{"action":"created","comment":{"url":"https://api.github.com/repos/inliniac/suricata/pulls/comments/37772648","id":37772648,"diff_hunk":"@@ -0,0 +1,743 @@\n+/*\n+ * Copyright (C) 2014 ANSSI\n+ * All rights reserved.\n+ *\n+ * Redistribution and use in source and binary forms, with or without\n+ * modification, are permitted provided that the following conditions\n+ * are met:\n+ * 1. Redistributions of source code must retain the above copyright\n+ *    notice, this list of conditions and the following disclaimer.\n+ * 2. Redistributions in binary form must reproduce the above copyright\n+ *    notice, this list of conditions and the following disclaimer in the\n+ *    documentation and/or other materials provided with the distribution.\n+ * 3. The name of the author may not be used to endorse or promote products\n+ *    derived from this software without specific prior written permission.\n+ *\n+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,\n+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY\n+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL\n+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,\n+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,\n+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;\n+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR\n+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF\n+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n+ */\n+\n+/**\n+ * \\file\n+ *\n+ * \\author Kevin Wong <kwong@solananetworks.com>\n+ *\n+ * App-layer parser for ENIP protocol\n+ *\n+ */\n+\n+#include \"suricata-common.h\"\n+\n+#include \"util-debug.h\"\n+#include \"util-byte.h\"\n+#include \"util-enum.h\"\n+#include \"util-mem.h\"\n+#include \"util-misc.h\"\n+\n+#include \"stream.h\"\n+\n+#include \"app-layer-protos.h\"\n+#include \"app-layer-parser.h\"\n+#include \"app-layer-enip.h\"\n+#include \"app-layer-enip-common.h\"\n+\n+#include \"app-layer-detect-proto.h\"\n+\n+#include \"conf.h\"\n+#include \"decode.h\"\n+\n+\n+\n+void *ENIPGetTx(void *alstate, uint64_t tx_id)\n+{\n+    ENIPState *enip_state = (ENIPState *)alstate;\n+    ENIPTransaction *tx = NULL;\n+\n+    /* fast track: try the current tx */\n+    if (enip_state->curr && enip_state->curr->tx_num == tx_id + 1)\n+        return enip_state->curr;\n+\n+    /* fast track:\n+     * if the prev tx_id is equal to the stored tx ptr, we can\n+     * use this shortcut to get to the next. */\n+    if (enip_state->iter) {\n+        if (tx_id == enip_state->iter->tx_num) {\n+            tx = TAILQ_NEXT(enip_state->iter, next);\n+            if (tx && tx->tx_num == tx_id + 1) {\n+                enip_state->iter = tx;\n+                return tx;\n+            }\n+        }\n+    }\n+\n+    /* no luck with the fast tracks, do the full list walk */\n+    TAILQ_FOREACH(tx, &enip_state->tx_list, next) {\n+        SCLogDebug(\"tx->tx_num %u, tx_id %\"PRIu64, tx->tx_num, (tx_id+1));\n+        if ((tx_id+1) != tx->tx_num)\n+            continue;\n+\n+        SCLogDebug(\"returning tx %p\", tx);\n+        enip_state->iter = tx;\n+        return tx;\n+    }\n+\n+    return NULL;\n+}\n+\n+uint64_t ENIPGetTxCnt(void *alstate)\n+{\n+    ENIPState *enip_state = (ENIPState *)alstate;\n+    return (uint64_t)enip_state->transaction_max;\n+}\n+\n+\n+int ENIPGetAlstateProgress(void *tx, uint8_t direction)","path":"src/app-layer-enip.c","position":110,"original_position":102,"commit_id":"d9871ccb35e90b1429d90ffd810394c761efec1f","original_commit_id":"306e8d9dc0dbd37e682e3512fa06baeb0d19d142","user":{"login":"kwong-solana","id":13120762,"avatar_url":"https://avatars.githubusercontent.com/u/13120762?v=3","gravatar_id":"","url":"https://api.github.com/users/kwong-solana","html_url":"https://github.com/kwong-solana","followers_url":"https://api.github.com/users/kwong-solana/followers","following_url":"https://api.github.com/users/kwong-solana/following{/other_user}","gists_url":"https://api.github.com/users/kwong-solana/gists{/gist_id}","starred_url":"https://api.github.com/users/kwong-solana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwong-solana/subscriptions","organizations_url":"https://api.github.com/users/kwong-solana/orgs","repos_url":"https://api.github.com/users/kwong-solana/repos","events_url":"https://api.github.com/users/kwong-solana/events{/privacy}","received_events_url":"https://api.github.com/users/kwong-solana/received_events","type":"User","site_admin":false},"body":"Also threw some debug logs into the ENIPGetAlstateProgress and \nENIPGetAlstateProgressCompletionStatus and noticed that they don't get \ncalled even though I registered it.\n\nOn 21/08/2015 3:47 PM, Kevin Wong wrote:\n> I ran another test with a longer UDP pcap (172,000 Packets) and saw \n> that the Match function only got called first on the 991th \n> transaction.  Since my rule matched, it wasn't called anymore for that \n> rule just like for TCP.\n>\n> Could it be something in my RegisterParser which I'm not registering?\n>\n> On 21/08/2015 1:31 PM, Kevin Wong wrote:\n>> Hi Victor,\n>>\n>> That is the behaviour I want.  I want every packet to be considered \n>> it's own transaction and have the Match function called immediately \n>> afterwards\n>>\n>> On 21/08/2015 12:41 PM, Victor Julien wrote:\n>>>\n>>> In src/app-layer-enip.c \n>>> <https://github.com/inliniac/suricata/pull/1614#discussion_r37652561>:\n>>>\n>>> > +        SCLogDebug(\"returning tx %p\", tx);\n>>> > +        enip_state->iter = tx;\n>>> > +        return tx;\n>>> > +    }\n>>> > +\n>>> > +    return NULL;\n>>> > +}\n>>> > +\n>>> > +uint64_t ENIPGetTxCnt(void *alstate)\n>>> > +{\n>>> > +    ENIPState *enip_state = (ENIPState *)alstate;\n>>> > +    return (uint64_t)enip_state->transaction_max;\n>>> > +}\n>>> > +\n>>> > +\n>>> > +int ENIPGetAlstateProgress(void *tx, uint8_t direction)\n>>>\n>>> This function always returns 1, indicating the tx is complete (as 1 \n>>> is returned in ENIPGetAlstateProgressCompletionStatus). This means \n>>> that the tx is marked complete on just a request.\n>>>\n>>> There are several ways to handle this better. The http parser for \n>>> example, tracks the state of each direction of a tx separately. The \n>>> DNS parser has a simpler approach: for toserver to be done, use 1. \n>>> For toclient to be done, use 2. See c419f33 \n>>> <https://github.com/inliniac/suricata/commit/c419f33f441882ba5c080337667db5591df9eb2c>\n>>>\n>>> —\n>>> Reply to this email directly or view it on GitHub \n>>> <https://github.com/inliniac/suricata/pull/1614/files#r37652561>.\n>>>\n>>\n>> -- \n>> Kevin Wong\n>>\n>> Solana Networks Inc | 613.596.2557 x575 |kwong@solananetworks.com\n>>   \n>> http://www.solananetworks.com\n>>\n>> http://www.sparrowiq.com\n>\n> -- \n> Kevin Wong\n>\n> Solana Networks Inc | 613.596.2557 x575 |kwong@solananetworks.com\n>   \n> http://www.solananetworks.com\n>\n> http://www.sparrowiq.com\n\n-- \nKevin Wong\n\nSolana Networks Inc | 613.596.2557 x575 | kwong@solananetworks.com\n  \nhttp://www.solananetworks.com\n\nhttp://www.sparrowiq.com\n\n","created_at":"2015-08-24T16:45:34Z","updated_at":"2015-08-24T16:45:34Z","html_url":"https://github.com/inliniac/suricata/pull/1614#discussion_r37772648","pull_request_url":"https://api.github.com/repos/inliniac/suricata/pulls/1614","_links":{"self":{"href":"https://api.github.com/repos/inliniac/suricata/pulls/comments/37772648"},"html":{"href":"https://github.com/inliniac/suricata/pull/1614#discussion_r37772648"},"pull_request":{"href":"https://api.github.com/repos/inliniac/suricata/pulls/1614"}}},"pull_request":{"url":"https://api.github.com/repos/inliniac/suricata/pulls/1614","id":43054290,"html_url":"https://github.com/inliniac/suricata/pull/1614","diff_url":"https://github.com/inliniac/suricata/pull/1614.diff","patch_url":"https://github.com/inliniac/suricata/pull/1614.patch","issue_url":"https://api.github.com/repos/inliniac/suricata/issues/1614","number":1614,"state":"open","locked":false,"title":"Enip feature 1495 v3","user":{"login":"kwong-solana","id":13120762,"avatar_url":"https://avatars.githubusercontent.com/u/13120762?v=3","gravatar_id":"","url":"https://api.github.com/users/kwong-solana","html_url":"https://github.com/kwong-solana","followers_url":"https://api.github.com/users/kwong-solana/followers","following_url":"https://api.github.com/users/kwong-solana/following{/other_user}","gists_url":"https://api.github.com/users/kwong-solana/gists{/gist_id}","starred_url":"https://api.github.com/users/kwong-solana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwong-solana/subscriptions","organizations_url":"https://api.github.com/users/kwong-solana/orgs","repos_url":"https://api.github.com/users/kwong-solana/repos","events_url":"https://api.github.com/users/kwong-solana/events{/privacy}","received_events_url":"https://api.github.com/users/kwong-solana/received_events","type":"User","site_admin":false},"body":"app layer implementation, merge from master","created_at":"2015-08-21T16:10:23Z","updated_at":"2015-08-24T16:45:34Z","closed_at":null,"merged_at":null,"merge_commit_sha":"befa38844b6b9689c0193a0d31653262023c820d","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/inliniac/suricata/pulls/1614/commits","review_comments_url":"https://api.github.com/repos/inliniac/suricata/pulls/1614/comments","review_comment_url":"https://api.github.com/repos/inliniac/suricata/pulls/comments{/number}","comments_url":"https://api.github.com/repos/inliniac/suricata/issues/1614/comments","statuses_url":"https://api.github.com/repos/inliniac/suricata/statuses/d9871ccb35e90b1429d90ffd810394c761efec1f","head":{"label":"kwong-solana:enip-feature-1495-v3","ref":"enip-feature-1495-v3","sha":"d9871ccb35e90b1429d90ffd810394c761efec1f","user":{"login":"kwong-solana","id":13120762,"avatar_url":"https://avatars.githubusercontent.com/u/13120762?v=3","gravatar_id":"","url":"https://api.github.com/users/kwong-solana","html_url":"https://github.com/kwong-solana","followers_url":"https://api.github.com/users/kwong-solana/followers","following_url":"https://api.github.com/users/kwong-solana/following{/other_user}","gists_url":"https://api.github.com/users/kwong-solana/gists{/gist_id}","starred_url":"https://api.github.com/users/kwong-solana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwong-solana/subscriptions","organizations_url":"https://api.github.com/users/kwong-solana/orgs","repos_url":"https://api.github.com/users/kwong-solana/repos","events_url":"https://api.github.com/users/kwong-solana/events{/privacy}","received_events_url":"https://api.github.com/users/kwong-solana/received_events","type":"User","site_admin":false},"repo":{"id":38316388,"name":"suricata","full_name":"kwong-solana/suricata","owner":{"login":"kwong-solana","id":13120762,"avatar_url":"https://avatars.githubusercontent.com/u/13120762?v=3","gravatar_id":"","url":"https://api.github.com/users/kwong-solana","html_url":"https://github.com/kwong-solana","followers_url":"https://api.github.com/users/kwong-solana/followers","following_url":"https://api.github.com/users/kwong-solana/following{/other_user}","gists_url":"https://api.github.com/users/kwong-solana/gists{/gist_id}","starred_url":"https://api.github.com/users/kwong-solana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwong-solana/subscriptions","organizations_url":"https://api.github.com/users/kwong-solana/orgs","repos_url":"https://api.github.com/users/kwong-solana/repos","events_url":"https://api.github.com/users/kwong-solana/events{/privacy}","received_events_url":"https://api.github.com/users/kwong-solana/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kwong-solana/suricata","description":"Mirror of the official OISF Suricata git repository","fork":true,"url":"https://api.github.com/repos/kwong-solana/suricata","forks_url":"https://api.github.com/repos/kwong-solana/suricata/forks","keys_url":"https://api.github.com/repos/kwong-solana/suricata/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kwong-solana/suricata/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kwong-solana/suricata/teams","hooks_url":"https://api.github.com/repos/kwong-solana/suricata/hooks","issue_events_url":"https://api.github.com/repos/kwong-solana/suricata/issues/events{/number}","events_url":"https://api.github.com/repos/kwong-solana/suricata/events","assignees_url":"https://api.github.com/repos/kwong-solana/suricata/assignees{/user}","branches_url":"https://api.github.com/repos/kwong-solana/suricata/branches{/branch}","tags_url":"https://api.github.com/repos/kwong-solana/suricata/tags","blobs_url":"https://api.github.com/repos/kwong-solana/suricata/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kwong-solana/suricata/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kwong-solana/suricata/git/refs{/sha}","trees_url":"https://api.github.com/repos/kwong-solana/suricata/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kwong-solana/suricata/statuses/{sha}","languages_url":"https://api.github.com/repos/kwong-solana/suricata/languages","stargazers_url":"https://api.github.com/repos/kwong-solana/suricata/stargazers","contributors_url":"https://api.github.com/repos/kwong-solana/suricata/contributors","subscribers_url":"https://api.github.com/repos/kwong-solana/suricata/subscribers","subscription_url":"https://api.github.com/repos/kwong-solana/suricata/subscription","commits_url":"https://api.github.com/repos/kwong-solana/suricata/commits{/sha}","git_commits_url":"https://api.github.com/repos/kwong-solana/suricata/git/commits{/sha}","comments_url":"https://api.github.com/repos/kwong-solana/suricata/comments{/number}","issue_comment_url":"https://api.github.com/repos/kwong-solana/suricata/issues/comments{/number}","contents_url":"https://api.github.com/repos/kwong-solana/suricata/contents/{+path}","compare_url":"https://api.github.com/repos/kwong-solana/suricata/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kwong-solana/suricata/merges","archive_url":"https://api.github.com/repos/kwong-solana/suricata/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kwong-solana/suricata/downloads","issues_url":"https://api.github.com/repos/kwong-solana/suricata/issues{/number}","pulls_url":"https://api.github.com/repos/kwong-solana/suricata/pulls{/number}","milestones_url":"https://api.github.com/repos/kwong-solana/suricata/milestones{/number}","notifications_url":"https://api.github.com/repos/kwong-solana/suricata/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kwong-solana/suricata/labels{/name}","releases_url":"https://api.github.com/repos/kwong-solana/suricata/releases{/id}","created_at":"2015-06-30T15:12:33Z","updated_at":"2015-06-30T15:12:38Z","pushed_at":"2015-08-21T20:27:34Z","git_url":"git://github.com/kwong-solana/suricata.git","ssh_url":"git@github.com:kwong-solana/suricata.git","clone_url":"https://github.com/kwong-solana/suricata.git","svn_url":"https://github.com/kwong-solana/suricata","homepage":"http://suricata-ids.org/","size":40613,"stargazers_count":0,"watchers_count":0,"language":"C","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"inliniac:master","ref":"master","sha":"63a47967d70c39179cf7cad67ffc1eb0c912adb2","user":{"login":"inliniac","id":719366,"avatar_url":"https://avatars.githubusercontent.com/u/719366?v=3","gravatar_id":"","url":"https://api.github.com/users/inliniac","html_url":"https://github.com/inliniac","followers_url":"https://api.github.com/users/inliniac/followers","following_url":"https://api.github.com/users/inliniac/following{/other_user}","gists_url":"https://api.github.com/users/inliniac/gists{/gist_id}","starred_url":"https://api.github.com/users/inliniac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inliniac/subscriptions","organizations_url":"https://api.github.com/users/inliniac/orgs","repos_url":"https://api.github.com/users/inliniac/repos","events_url":"https://api.github.com/users/inliniac/events{/privacy}","received_events_url":"https://api.github.com/users/inliniac/received_events","type":"User","site_admin":false},"repo":{"id":5410234,"name":"suricata","full_name":"inliniac/suricata","owner":{"login":"inliniac","id":719366,"avatar_url":"https://avatars.githubusercontent.com/u/719366?v=3","gravatar_id":"","url":"https://api.github.com/users/inliniac","html_url":"https://github.com/inliniac","followers_url":"https://api.github.com/users/inliniac/followers","following_url":"https://api.github.com/users/inliniac/following{/other_user}","gists_url":"https://api.github.com/users/inliniac/gists{/gist_id}","starred_url":"https://api.github.com/users/inliniac/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/inliniac/subscriptions","organizations_url":"https://api.github.com/users/inliniac/orgs","repos_url":"https://api.github.com/users/inliniac/repos","events_url":"https://api.github.com/users/inliniac/events{/privacy}","received_events_url":"https://api.github.com/users/inliniac/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/inliniac/suricata","description":"Mirror of the official OISF Suricata git repository","fork":false,"url":"https://api.github.com/repos/inliniac/suricata","forks_url":"https://api.github.com/repos/inliniac/suricata/forks","keys_url":"https://api.github.com/repos/inliniac/suricata/keys{/key_id}","collaborators_url":"https://api.github.com/repos/inliniac/suricata/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/inliniac/suricata/teams","hooks_url":"https://api.github.com/repos/inliniac/suricata/hooks","issue_events_url":"https://api.github.com/repos/inliniac/suricata/issues/events{/number}","events_url":"https://api.github.com/repos/inliniac/suricata/events","assignees_url":"https://api.github.com/repos/inliniac/suricata/assignees{/user}","branches_url":"https://api.github.com/repos/inliniac/suricata/branches{/branch}","tags_url":"https://api.github.com/repos/inliniac/suricata/tags","blobs_url":"https://api.github.com/repos/inliniac/suricata/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/inliniac/suricata/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/inliniac/suricata/git/refs{/sha}","trees_url":"https://api.github.com/repos/inliniac/suricata/git/trees{/sha}","statuses_url":"https://api.github.com/repos/inliniac/suricata/statuses/{sha}","languages_url":"https://api.github.com/repos/inliniac/suricata/languages","stargazers_url":"https://api.github.com/repos/inliniac/suricata/stargazers","contributors_url":"https://api.github.com/repos/inliniac/suricata/contributors","subscribers_url":"https://api.github.com/repos/inliniac/suricata/subscribers","subscription_url":"https://api.github.com/repos/inliniac/suricata/subscription","commits_url":"https://api.github.com/repos/inliniac/suricata/commits{/sha}","git_commits_url":"https://api.github.com/repos/inliniac/suricata/git/commits{/sha}","comments_url":"https://api.github.com/repos/inliniac/suricata/comments{/number}","issue_comment_url":"https://api.github.com/repos/inliniac/suricata/issues/comments{/number}","contents_url":"https://api.github.com/repos/inliniac/suricata/contents/{+path}","compare_url":"https://api.github.com/repos/inliniac/suricata/compare/{base}...{head}","merges_url":"https://api.github.com/repos/inliniac/suricata/merges","archive_url":"https://api.github.com/repos/inliniac/suricata/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/inliniac/suricata/downloads","issues_url":"https://api.github.com/repos/inliniac/suricata/issues{/number}","pulls_url":"https://api.github.com/repos/inliniac/suricata/pulls{/number}","milestones_url":"https://api.github.com/repos/inliniac/suricata/milestones{/number}","notifications_url":"https://api.github.com/repos/inliniac/suricata/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/inliniac/suricata/labels{/name}","releases_url":"https://api.github.com/repos/inliniac/suricata/releases{/id}","created_at":"2012-08-14T08:30:06Z","updated_at":"2015-08-20T07:49:56Z","pushed_at":"2015-08-21T20:27:35Z","git_url":"git://github.com/inliniac/suricata.git","ssh_url":"git@github.com:inliniac/suricata.git","clone_url":"https://github.com/inliniac/suricata.git","svn_url":"https://github.com/inliniac/suricata","homepage":"http://suricata-ids.org/","size":62278,"stargazers_count":192,"watchers_count":192,"language":"C","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":181,"mirror_url":null,"open_issues_count":23,"forks":181,"open_issues":23,"watchers":192,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/inliniac/suricata/pulls/1614"},"html":{"href":"https://github.com/inliniac/suricata/pull/1614"},"issue":{"href":"https://api.github.com/repos/inliniac/suricata/issues/1614"},"comments":{"href":"https://api.github.com/repos/inliniac/suricata/issues/1614/comments"},"review_comments":{"href":"https://api.github.com/repos/inliniac/suricata/pulls/1614/comments"},"review_comment":{"href":"https://api.github.com/repos/inliniac/suricata/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/inliniac/suricata/pulls/1614/commits"},"statuses":{"href":"https://api.github.com/repos/inliniac/suricata/statuses/d9871ccb35e90b1429d90ffd810394c761efec1f"}}}}