Adding SCADA EtherNet/IP and CIP protocol support #2311
Conversation
1. The enip-feature-1495-v15 branch contains support for the ENIP/CIP Industrial protocol 2. This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords 3. Rebased master to clean out commits done on master and then merged to latest code 4. Addresses failed PR's OISF#1810 and OISF#1819 and OISF#1827 and OISF#2009 and OISF#2011 and OISF#2012 and OISF#2019 and OISF#2030 and OISF#2068 and OISF#2107 and OISF#2305 5. As requested, added AFL entry points
| */ | ||
| typedef struct ENIPEncapHdr_ | ||
| { | ||
| u_int64_t context; |
There was a problem hiding this comment.
All these u_int* should be converted to uint*. The u_int* ones are not portable.
(update formatting)
| } response; | ||
| }; | ||
|
|
||
| TAILQ_HEAD(, SegmentEntry_) segment_list; /**< list for CIP segment */ |
| { | ||
| uint16_t attribute; //segment class | ||
|
|
||
| TAILQ_ENTRY(AttributeEntry_) next; |
There was a problem hiding this comment.
would you like me to create a new branch for these fixes?
|
I think we also need a suricata.yaml.in update to add these protocols (disabled by default I think). Then we'd need a doc update, which is new. This would need update https://github.com/inliniac/suricata/blob/master/doc/userguide/configuration/suricata-yaml.rst and here we'd need a new file: https://github.com/inliniac/suricata/tree/master/doc/userguide/rules |
updated suricata.yaml from commit OISF#2311
|
Can you fix these commit messages? I have no idea why they start with "1. ..." |
|
Sure, would you like me to make a new branch for the changes? I put a
On 29/09/2016 12:09 PM, Victor Julien wrote:
Kevin Wong Solana Networks Inc | 613.596.2557 x575 | kwong@solananetworks.com |
1. The enip-feature-1495-v16 branch contains support for the ENIP/CIP Industrial protocol 2. This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords 3. Rebased master to clean out commits done on master and then merged to latest code 4. Addresses failed PR's OISF#1810 and OISF#1819 and OISF#1827 and OISF#2009 and OISF#2011 and OISF#2012 and OISF#2019 and OISF#2030 and OISF#2068 and OISF#2107 and OISF#2305 and OISF#2311 5. As requested, added AFL entry points
Industrial protocol
and "cip_service" and "enip_command" keywords
merged to latest code
Enip feature 1495 v3 #1810 and
Enip feature 1495 v4 #1819 and
1. The enip-feature-1495-v4 branch contains support for the ENIP/CIP #1827 and
1. The enip-feature-1495-v6 branch contains support for the ENIP/CIP #2009 and
Enip feature 1495 v7 #2011 and
Adding SCADA EtherNet/IP and CIP protocol support #2012 and
Adding SCADA EtherNet/IP and CIP protocol support #2019 and
Adding SCADA EtherNet/IP and CIP protocol support #2030 and
Adding SCADA EtherNet/IP and CIP protocol support #2068 and
Adding SCADA EtherNet/IP and CIP protocol support #2107 and
Adding SCADA EtherNet/IP and CIP protocol support #2305