Skip to content

Comments

Enip rust 3958 v12#10183

Closed
catenacyber wants to merge 9 commits intoOISF:masterfrom
catenacyber:enip-rust-3958-v12
Closed

Enip rust 3958 v12#10183
catenacyber wants to merge 9 commits intoOISF:masterfrom
catenacyber:enip-rust-3958-v12

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3958

Describe changes:

  • convert enip parser to rust
  • integer keywords now support hexadecimal notation

Alon the way, also

  • transactions are now bidirectional
  • there is a enip logger
  • gap support is improved with probing for resync
  • frames
  • events
  • enip_command keyword accepts now string enumeration as values.
  • more keywords

#10178 with clippy fixes + rebase on #10179 + SV test rebased

SV_BRANCH=pr/1582

OISF/suricata-verify#1582

catenacyber and others added 9 commits January 16, 2024 15:42
So that we can write enip.revision: 0x203

Ticket: 6645
Ticket: 6647

Allows keywords using integers to use strings in signature
parsing based on a rust enumeration with a derive.
Ticket: 6648

Like &0x40=0x40 to test for a specific bit set
Ticket: 6628

Document the generic detection capabilities for integer keywords.
and make every integer keyword pointing to this section.
Ticket: 3958

- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- frames support
- app-layer events
- enip_command keyword accepts now string enumeration as values.
- add enip.status keyword
- add keywords :
    enip.product_name, enip.protocol_version, enip.revision,
    enip.identity_status, enip.state, enip.serial, enip.product_code,
    enip.device_type, enip.vendor_id, enip.capabilities,
    enip.cip_attribute, enip.cip_class, enip.cip_instance,
    enip.cip_status, enip.cip_extendedstatus
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 17551

@catenacyber catenacyber mentioned this pull request Jan 17, 2024
@catenacyber
Copy link
Contributor Author

Replaced by #10186

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants