Skip to content

enip: convert to rust#9844

Closed
catenacyber wants to merge 1 commit intoOISF:masterfrom
catenacyber:enip-rust-3958-v2
Closed

enip: convert to rust#9844
catenacyber wants to merge 1 commit intoOISF:masterfrom
catenacyber:enip-rust-3958-v2

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3958

Describe changes:

  • convert enip parser to rust

Alon the way, also

  • enip_command keyword accepts now string enumeration as values.
  • transactions are now bidirectional
  • there is a enip logger
  • gap support is improved with probing for resync
  • SEQUENCE_ADDR_ITEM value is fixed to 0x8002 instead of 0xB002

#9824 with review taken into account, CI should be greener, json schema completed...

Draft as is this is not complete :

  • need better response/request association for bidirectional transactions
  • get cip attributes by parsing deeper based on cip service, and reuse that for cip_service keyword
  • parse more, log more, add more keywords (enip.status)...
  • set event on parsing error
  • use frames ?
  • take a look into https://redmine.openinfosecfoundation.org/issues/6304

Provide values to any of the below to override the defaults.

SV_BRANCH=pr/1485

OISF/suricata-verify#1485

Ticket: 3958

- enip_command keyword accepts now string enumeration as values.
- transactions are now bidirectional
- there is a logger
- gap support is improved with probing for resync
- SEQUENCE_ADDR_ITEM value is fixed to 0x8002 instead of 0xB002
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 16649

@catenacyber catenacyber mentioned this pull request Nov 20, 2023
@catenacyber
Copy link
Contributor Author

Replaced by #9848

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants