Bug #9399
openenip: cip_service does not match CIP requests with a symbolic path or inside an Unconnected Send
Description
cip_service only matches CIP requests whose path is made of logical segments. With Suricata 8.0.7 (and main at 4badfd1), these well-formed requests (one RegisterSession and one SendRRData or SendUnitData each) give:
| CIP request | rule on the request's service | eve enip |
|---|---|---|
| Set_Attribute_Single, logical path (class 4, instance 150, attribute 3) | cip_service:16 matches |
service, path |
Write Tag (0x4D), symbolic path Pump_Start |
cip_service:77 does not match |
send_r_r_data with no cip |
| Unconnected Send (0x52 to the Connection Manager, route to backplane port 1, slot 0) carrying Set_Attribute_Single | cip_service:16 does not match; only 82 |
the 0x52, named "Read Data Fragmented" |
| Unconnected Send carrying Write Tag | cip_service:77 does not match; only 82 |
same |
| SendUnitData (connected), Set_Attribute_Single, logical path | cip_service:16 matches |
service, path |
| SendUnitData (connected), Write Tag, symbolic path | cip_service:77 does not match |
send_unit_data with no cip |
Wireshark decodes all six, including the tag name.
Cause: in rust/src/enip/parser.rs, parse_cip_path_segment accepts only logical segments ("we only handle logical segment"), so an ANSI extended symbolic segment (0x91) makes the whole request fail to parse. The request embedded in an Unconnected Send is not decoded either. The documentation of cip_service does not mention this.
Effect: a rule meant to alert on, or drop, writes to tags of a Logix-style controller by cip_service misses writes addressed by tag name, and writes routed through a communication module. cip_service:82 matches every routed message, reads included.
Possible approach: parse symbolic segments (0x91) in parse_cip_path_segment (and log the tag name in eve), and decode the embedded request of an Unconnected Send (service 0x52 to class 6, instance 1). I can share the six pcaps, and work on a PR with suricata-verify tests if this is wanted.
I used Claude Code (Claude Opus 5.5) to help find this and write the report, and checked it myself.
No data to display