Overall Code Additions and Modifications for scapy-cip-enip

[m4tthew-d]

A description of changes is provided below. The test packets generated in both the enip_tcp.py and enip_udp.py files from your code have remained the same. However I did notice that when looking at the enip_tcp.py test packet in Wireshark, the packet was supposedly malformed. I wanted to make sure you were aware of this.

Added Files:
enip.py

• Conglomeration of EtherNet/IP dissection classes from enip_tcp and enip_udp files
• Dictionary of device profile IDs for EtherNet/IP devices

Modified Files:
cip.py

• Added CIP_PortSegment class
• Added CIP_LogicalSegment class
• Added CIP_PathPadded class
• More scapy_all.bind_layers() statements
• Corrected issue in CIP_ConnectionParam class method do_build that caused malformed packet creation
• Changed field types for some fields in CIP_ReqForwardOpen

enip_cpf.py

• Changed CPF_Address_Item class into CPF_Item
• Expanded Item ID numbers

enip_tcp.py

• Added import from new file, enip.py
• Moved most classes to enip.py
• Updated appropriate code references to reflect relocation of classes to enip.py

enip_udp.py

• Added import from enip_tcp.py
• Moved most classes to enip.py
• Updated appropriate code references to reflect relocation of classes to enip.py
• Added more scapy_all.bind_layers() statements

plc.py

• Updated references in code to reflect enip_tcp and enip_udp class relocations to enip.py

utils.py

• Added field types: XLEInt and XLEShort
• Added function to merge dictionaries: from http://stackoverflow.com/a/26853961

[noleti]

Hi Matthew, thanks for the contribution. Let me check for compatibility issues with our existing private projects using this library. I will then pull this afterwards.

[francozappa]

Hi @m4tthew-d, first of all thank you for your contributions 👍

I'll review your list of commits and give you some feedback soon.

[francozappa]

Hi @m4tthew-d ,

I've tried to split the PR in several parts and this are my feedback:

Part 1: enip.py file

You placed all the enip dissection logic taken from enip_tcp and
enip_udp in a new enip.py file, changing ENIP_TCP into ENIP_PACKET and
he added also some dicts to it. I would ask you to revert back the changes
(eg: move back dissection logic to relevant files and rename back top
level classes such as ENIP_PACKET to ENIP_TCP)
because I think is better to keep the file structure as it was eg:
enip_tcp,py contains both the dissection logic and the test cases.

Furthermore, please check and add the relevant test cases to
the relevant enip_* file in case you added or changed any dissection
class value. Finally, please move what is left in enip.py to utils.py
or maybe in a new file and then import them where needed.

Part 2: cip.py

I saw that you added and modified several cip dissection classes but
I did not check if you added also the corresponding unit-test cases, indeed
please point us to the relevant tests if any or add them

Part 3: plc.py

Please rearrange the import statement according to Part 1 and 2

Thank you again !

[rajatkmehta]

Hi @m4tthew-d, @noleti @francozappa
I am using scapy-cip-enip to communicate from our EIP enabled device. For explicit(Unconnected), i am getting proper response for almost all the objects.
But when i try for Implicit(Connected) messaging by sending forward_open request as function already defined.
Getting error as...
[ERROR] Failed to Forward Open CIP connection: <CIP_ResponseStatus status=Not enough data>

Please guide me on the actual 'CIP_REqForwardOpen parameters and path'which should be send as a request to get proper response. Thanks in advance.

def forward_close(self):
    """Send a forward close request"""
    cippkt = CIP(service=0x4e, path=CIP_Path(wordsize=2, path=b'\x20\x06\x24\x01'))
    cippkt /= CIP_ReqForwardClose(path_wordsize=3, path=b"\x01\x00\x20\x02\x24\x01")
    self.send_rr_cip(cippkt)
    if self.sock is None:
        return
    resppkt = self.recv_enippkt()
    cippkt = resppkt[CIP]
    if cippkt.status[0].status != 0:
        logger.error("Failed to Forward Close CIP connection: %r", cippkt.status[0])
        return False
    return True