suricata
app-layer-dnp3.h File Reference
#include "detect-engine-state.h"
#include "util-hashlist.h"
#include "util-byte.h"
Include dependency graph for app-layer-dnp3.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  DNP3LinkHeader_
 DNP3 link header. More...
 
struct  DNP3ApplicationHeader_
 DNP3 application header. More...
 
struct  DNP3InternalInd_
 DNP3 internal indicators. More...
 
struct  DNP3Buffer_
 A struct used for buffering incoming data prior to reassembly. More...
 
struct  DNP3ObjHeader_
 DNP3 application object header. More...
 
struct  DNP3Point_
 DNP3 object point. More...
 
struct  DNP3Object_
 Struct to hold the list of decoded objects. More...
 
struct  DNP3Transaction_
 DNP3 transaction. More...
 
struct  DNP3State_
 Per flow DNP3 state. More...
 

Macros

#define DNP3_MAX_LINK_PDU_LEN   292
 
#define DNP3_APP_FC_CONFIRM   0x00
 
#define DNP3_APP_FC_READ   0x01
 
#define DNP3_APP_FC_WRITE   0x02
 
#define DNP3_APP_FC_SELECT   0x03
 
#define DNP3_APP_FC_OPERATE   0x04
 
#define DNP3_APP_FC_DIR_OPERATE   0x05
 
#define DNP3_APP_FC_DIR_OPERATE_NR   0x06
 
#define DNP3_APP_FC_FREEZE   0x07
 
#define DNP3_APP_FC_FREEZE_NR   0x08
 
#define DNP3_APP_FC_FREEZE_CLEAR   0x09
 
#define DNP3_APP_FC_FREEZE_CLEAR_NR   0x0a
 
#define DNP3_APP_FC_FREEZE_AT_TIME   0x0b
 
#define DNP3_APP_FC_FREEZE_AT_TIME_NR   0x0c
 
#define DNP3_APP_FC_COLD_RESTART   0x0d
 
#define DNP3_APP_FC_WARM_RESTART   0x0e
 
#define DNP3_APP_FC_INITIALIZE_DATA   0x0f
 
#define DNP3_APP_FC_INITIALIZE_APPLICATION   0x10
 
#define DNP3_APP_FC_START_APPLICATION   0x11
 
#define DNP3_APP_FC_STOP_APPLICATION   0x12
 
#define DNP3_APP_FC_SAVE_CONFIGURATION   0x13
 
#define DNP3_APP_FC_ENABLE_UNSOLICITED   0x14
 
#define DNP3_APP_FC_DISABLE_UNSOLICTED   0x15
 
#define DNP3_APP_FC_ASSIGN_CLASS   0x16
 
#define DNP3_APP_FC_DELAY_MEASUREMENT   0x17
 
#define DNP3_APP_FC_RECORD_CURRENT_TIME   0x18
 
#define DNP3_APP_FC_OPEN_TIME   0x19
 
#define DNP3_APP_FC_CLOSE_FILE   0x1a
 
#define DNP3_APP_FC_DELETE_FILE   0x1b
 
#define DNP3_APP_FC_GET_FILE_INFO   0x1c
 
#define DNP3_APP_FC_AUTHENTICATE_FILE   0x1d
 
#define DNP3_APP_FC_ABORT_FILE   0x1e
 
#define DNP3_APP_FC_ACTIVATE_CONFIG   0x1f
 
#define DNP3_APP_FC_AUTH_REQ   0x20
 
#define DNP3_APP_FC_AUTH_REQ_NR   0x21
 
#define DNP3_APP_FC_RESPONSE   0x81
 
#define DNP3_APP_FC_UNSOLICITED_RESP   0x82
 
#define DNP3_APP_FC_AUTH_RESP   0x83
 
#define DNP3_LINK_DIR(control)   (control & 0x80)
 
#define DNP3_LINK_PRI(control)   (control & 0x40)
 
#define DNP3_LINK_FCB(control)   (control & 0x20)
 
#define DNP3_LINK_FCV(control)   (control & 0x10)
 
#define DNP3_LINK_FC(control)   (control & 0x0f)
 
#define DNP3_TH_FIN(x)   (x & 0x80)
 
#define DNP3_TH_FIR(x)   (x & 0x40)
 
#define DNP3_TH_SEQ(x)   (x & 0x3f)
 
#define DNP3_APP_FIR(x)   (x & 0x80)
 
#define DNP3_APP_FIN(x)   (x & 0x40)
 
#define DNP3_APP_CON(x)   (x & 0x20)
 
#define DNP3_APP_UNS(x)   (x & 0x10)
 
#define DNP3_APP_SEQ(x)   (x & 0x0f)
 
#define DNP3_SWAP16(x)   SCByteSwap16(x)
 
#define DNP3_SWAP32(x)   SCByteSwap32(x)
 
#define DNP3_SWAP64(x)   SCByteSwap64(x)
 

Typedefs

typedef uint8_t DNP3TransportHeader
 DNP3 transport header. More...
 
typedef struct DNP3Buffer_ DNP3Buffer
 A struct used for buffering incoming data prior to reassembly. More...
 
typedef struct DNP3Point_ DNP3Point
 DNP3 object point. More...
 
typedef struct DNP3Object_ DNP3Object
 Struct to hold the list of decoded objects. More...
 
typedef struct DNP3Transaction_ DNP3Transaction
 DNP3 transaction. More...
 
typedef struct DNP3State_ DNP3State
 Per flow DNP3 state. More...
 

Enumerations

enum  {
  DNP3_DECODER_EVENT_FLOODED = 1, DNP3_DECODER_EVENT_LEN_TOO_SMALL, DNP3_DECODER_EVENT_BAD_LINK_CRC, DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC,
  DNP3_DECODER_EVENT_MALFORMED, DNP3_DECODER_EVENT_UNKNOWN_OBJECT
}
 

Functions

struct DNP3LinkHeader_ __attribute__ ((__packed__)) DNP3LinkHeader
 DNP3 link header. More...
 
struct DNP3ObjHeader_ __attribute__ ((packed)) DNP3ObjHeader
 DNP3 application object header. More...
 
typedef TAILQ_HEAD (DNP3PointList_, DNP3Point_) DNP3PointList
 
typedef TAILQ_HEAD (DNP3ObjectList_, DNP3Object_) DNP3ObjectList
 
 TAILQ_HEAD (TxListHead, DNP3Transaction_)
 
void RegisterDNP3Parsers (void)
 Register the DNP3 application protocol parser. More...
 
void DNP3ParserRegisterTests (void)
 
int DNP3PrefixIsSize (uint8_t)
 Check if the prefix code is a size prefix. More...
 

Variables

uint8_t start_byte0
 
uint8_t start_byte1
 
uint8_t len
 
uint8_t control
 
uint16_t dst
 
uint16_t src
 
uint16_t crc
 
uint8_t function_code
 
uint8_t iin1
 
uint8_t iin2
 
uint8_t group
 
uint8_t variation
 
uint8_t qualifier
 

Macro Definition Documentation

#define DNP3_APP_CON (   x)    (x & 0x20)

Definition at line 86 of file app-layer-dnp3.h.

#define DNP3_APP_FC_ABORT_FILE   0x1e

Definition at line 61 of file app-layer-dnp3.h.

#define DNP3_APP_FC_ACTIVATE_CONFIG   0x1f

Definition at line 62 of file app-layer-dnp3.h.

#define DNP3_APP_FC_ASSIGN_CLASS   0x16

Definition at line 53 of file app-layer-dnp3.h.

#define DNP3_APP_FC_AUTH_REQ   0x20

Definition at line 63 of file app-layer-dnp3.h.

#define DNP3_APP_FC_AUTH_REQ_NR   0x21

Definition at line 64 of file app-layer-dnp3.h.

#define DNP3_APP_FC_AUTH_RESP   0x83

Definition at line 69 of file app-layer-dnp3.h.

#define DNP3_APP_FC_AUTHENTICATE_FILE   0x1d

Definition at line 60 of file app-layer-dnp3.h.

#define DNP3_APP_FC_CLOSE_FILE   0x1a

Definition at line 57 of file app-layer-dnp3.h.

#define DNP3_APP_FC_COLD_RESTART   0x0d

Definition at line 44 of file app-layer-dnp3.h.

#define DNP3_APP_FC_CONFIRM   0x00

Definition at line 31 of file app-layer-dnp3.h.

#define DNP3_APP_FC_DELAY_MEASUREMENT   0x17

Definition at line 54 of file app-layer-dnp3.h.

#define DNP3_APP_FC_DELETE_FILE   0x1b

Definition at line 58 of file app-layer-dnp3.h.

#define DNP3_APP_FC_DIR_OPERATE   0x05

Definition at line 36 of file app-layer-dnp3.h.

Referenced by RegisterDNP3Parsers().

#define DNP3_APP_FC_DIR_OPERATE_NR   0x06

Definition at line 37 of file app-layer-dnp3.h.

#define DNP3_APP_FC_DISABLE_UNSOLICTED   0x15

Definition at line 52 of file app-layer-dnp3.h.

#define DNP3_APP_FC_ENABLE_UNSOLICITED   0x14

Definition at line 51 of file app-layer-dnp3.h.

#define DNP3_APP_FC_FREEZE   0x07

Definition at line 38 of file app-layer-dnp3.h.

#define DNP3_APP_FC_FREEZE_AT_TIME   0x0b

Definition at line 42 of file app-layer-dnp3.h.

#define DNP3_APP_FC_FREEZE_AT_TIME_NR   0x0c

Definition at line 43 of file app-layer-dnp3.h.

#define DNP3_APP_FC_FREEZE_CLEAR   0x09

Definition at line 40 of file app-layer-dnp3.h.

#define DNP3_APP_FC_FREEZE_CLEAR_NR   0x0a

Definition at line 41 of file app-layer-dnp3.h.

#define DNP3_APP_FC_FREEZE_NR   0x08

Definition at line 39 of file app-layer-dnp3.h.

#define DNP3_APP_FC_GET_FILE_INFO   0x1c

Definition at line 59 of file app-layer-dnp3.h.

#define DNP3_APP_FC_INITIALIZE_APPLICATION   0x10

Definition at line 47 of file app-layer-dnp3.h.

#define DNP3_APP_FC_INITIALIZE_DATA   0x0f

Definition at line 46 of file app-layer-dnp3.h.

#define DNP3_APP_FC_OPEN_TIME   0x19

Definition at line 56 of file app-layer-dnp3.h.

#define DNP3_APP_FC_OPERATE   0x04

Definition at line 35 of file app-layer-dnp3.h.

#define DNP3_APP_FC_READ   0x01

Definition at line 32 of file app-layer-dnp3.h.

#define DNP3_APP_FC_RECORD_CURRENT_TIME   0x18

Definition at line 55 of file app-layer-dnp3.h.

#define DNP3_APP_FC_RESPONSE   0x81

Definition at line 67 of file app-layer-dnp3.h.

#define DNP3_APP_FC_SAVE_CONFIGURATION   0x13

Definition at line 50 of file app-layer-dnp3.h.

#define DNP3_APP_FC_SELECT   0x03

Definition at line 34 of file app-layer-dnp3.h.

#define DNP3_APP_FC_START_APPLICATION   0x11

Definition at line 48 of file app-layer-dnp3.h.

#define DNP3_APP_FC_STOP_APPLICATION   0x12

Definition at line 49 of file app-layer-dnp3.h.

#define DNP3_APP_FC_UNSOLICITED_RESP   0x82

Definition at line 68 of file app-layer-dnp3.h.

Referenced by JsonDNP3LogResponse(), and RegisterDNP3Parsers().

#define DNP3_APP_FC_WARM_RESTART   0x0e

Definition at line 45 of file app-layer-dnp3.h.

#define DNP3_APP_FC_WRITE   0x02

Definition at line 33 of file app-layer-dnp3.h.

#define DNP3_APP_FIN (   x)    (x & 0x40)

Definition at line 85 of file app-layer-dnp3.h.

#define DNP3_APP_FIR (   x)    (x & 0x80)

Definition at line 84 of file app-layer-dnp3.h.

#define DNP3_APP_SEQ (   x)    (x & 0x0f)

Definition at line 88 of file app-layer-dnp3.h.

#define DNP3_APP_UNS (   x)    (x & 0x10)

Definition at line 87 of file app-layer-dnp3.h.

#define DNP3_LINK_DIR (   control)    (control & 0x80)

Definition at line 72 of file app-layer-dnp3.h.

#define DNP3_LINK_FC (   control)    (control & 0x0f)

Definition at line 76 of file app-layer-dnp3.h.

#define DNP3_LINK_FCB (   control)    (control & 0x20)

Definition at line 74 of file app-layer-dnp3.h.

#define DNP3_LINK_FCV (   control)    (control & 0x10)

Definition at line 75 of file app-layer-dnp3.h.

#define DNP3_LINK_PRI (   control)    (control & 0x40)

Definition at line 73 of file app-layer-dnp3.h.

#define DNP3_MAX_LINK_PDU_LEN   292

The maximum size of a DNP3 link PDU.

Definition at line 28 of file app-layer-dnp3.h.

#define DNP3_SWAP16 (   x)    SCByteSwap16(x)

Definition at line 93 of file app-layer-dnp3.h.

Referenced by DNP3FreeObjectPointList().

#define DNP3_SWAP32 (   x)    SCByteSwap32(x)

Definition at line 94 of file app-layer-dnp3.h.

Referenced by DNP3FreeObjectPointList().

#define DNP3_SWAP64 (   x)    SCByteSwap64(x)

Definition at line 95 of file app-layer-dnp3.h.

#define DNP3_TH_FIN (   x)    (x & 0x80)

Definition at line 79 of file app-layer-dnp3.h.

#define DNP3_TH_FIR (   x)    (x & 0x40)

Definition at line 80 of file app-layer-dnp3.h.

#define DNP3_TH_SEQ (   x)    (x & 0x3f)

Definition at line 81 of file app-layer-dnp3.h.

Typedef Documentation

typedef struct DNP3Buffer_ DNP3Buffer

A struct used for buffering incoming data prior to reassembly.

typedef struct DNP3Object_ DNP3Object

Struct to hold the list of decoded objects.

typedef struct DNP3Point_ DNP3Point

DNP3 object point.

Each DNP3 object can have 0 or more points representing the values of the object.

typedef struct DNP3State_ DNP3State

Per flow DNP3 state.

DNP3 transaction.

typedef uint8_t DNP3TransportHeader

DNP3 transport header.

Definition at line 128 of file app-layer-dnp3.h.

Enumeration Type Documentation

anonymous enum
Enumerator
DNP3_DECODER_EVENT_FLOODED 
DNP3_DECODER_EVENT_LEN_TOO_SMALL 
DNP3_DECODER_EVENT_BAD_LINK_CRC 
DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC 
DNP3_DECODER_EVENT_MALFORMED 
DNP3_DECODER_EVENT_UNKNOWN_OBJECT 

Definition at line 103 of file app-layer-dnp3.h.

Function Documentation

struct DNP3ObjHeader_ __attribute__ ( (packed)  )

DNP3 application object header.

Definition at line 53 of file source-erf-file.c.

struct DNP3LinkHeader_ __attribute__ ( (__packed__)  )

DNP3 link header.

DNP3 internal indicators.

DNP3 application header.

Part of the application header for responses only.

Unified2 Extra Data Header Unified2 Extra Data (currently used only for XFF)

Definition at line 92 of file alert-unified2-alert.c.

void DNP3ParserRegisterTests ( void  )

Definition at line 2646 of file app-layer-dnp3.c.

References UtRegisterTest().

Referenced by RegisterDNP3Parsers().

Here is the call graph for this function:

Here is the caller graph for this function:

int DNP3PrefixIsSize ( uint8_t  prefix_code)

Check if the prefix code is a size prefix.

Return values
1if the prefix_code specifies a size prefix, 0 if not.

Definition at line 1562 of file app-layer-dnp3.c.

References DNP3Transaction_::detect_flags_tc, DNP3Transaction_::detect_flags_ts, and STREAM_TOSERVER.

Referenced by DNP3FreeObjectPointList().

Here is the caller graph for this function:

void RegisterDNP3Parsers ( void  )

Register the DNP3 application protocol parser.

Definition at line 1599 of file app-layer-dnp3.c.

References Flow_::alproto, ALPROTO_DNP3, ALPROTO_FAILED, ALPROTO_UNKNOWN, Flow_::alstate, AppLayerParserConfParserEnabled(), AppLayerParserParse(), AppLayerParserRegisterDetectFlagsFuncs(), AppLayerParserRegisterDetectStateFuncs(), AppLayerParserRegisterGetEventInfo(), AppLayerParserRegisterGetEventInfoById(), AppLayerParserRegisterGetEventsFunc(), AppLayerParserRegisterGetStateProgressCompletionStatus(), AppLayerParserRegisterGetStateProgressFunc(), AppLayerParserRegisterGetTx(), AppLayerParserRegisterGetTxCnt(), AppLayerParserRegisterLoggerFuncs(), AppLayerParserRegisterParser(), AppLayerParserRegisterProtocolUnittests(), AppLayerParserRegisterStateFuncs(), AppLayerParserRegisterTxFreeFunc(), AppLayerParserThreadCtxAlloc(), AppLayerParserThreadCtxFree(), AppLayerProtoDetectConfProtoDetectionEnabled(), AppLayerProtoDetectPPParseConfPorts(), AppLayerProtoDetectPPRegister(), AppLayerProtoDetectRegisterProtocol(), DNP3Buffer_::buffer, DNP3Object_::count, crc, DNP3State_::curr, DNP3Point_::data, DNP3_APP_FC_DIR_OPERATE, DNP3_APP_FC_UNSOLICITED_RESP, DNP3_BLOCK_SIZE, DNP3_CRC_LEN, DNP3_DEFAULT_PORT, DNP3_DEFAULT_REQ_FLOOD_COUNT, DNP3ParserRegisterTests(), FAIL_IF, FAIL_IF_NOT, FAIL_IF_NULL, DNP3ObjectG70V3_::filename, DNP3State_::flooded, FLOW_DESTROY, DNP3Object_::group, DNP3Transaction_::has_request, DNP3Buffer_::len, len, Flow_::m, DNP3Buffer_::offset, PASS, DNP3Object_::points, DNP3Point_::prefix, DNP3Object_::prefix_code, Flow_::proto, Flow_::protoctx, DNP3Object_::range_code, DNP3Transaction_::request_ah, DNP3Transaction_::request_buffer, DNP3State_::request_buffer, DNP3Transaction_::request_buffer_len, DNP3Transaction_::request_objects, DNP3Transaction_::response_ah, DNP3Transaction_::response_buffer, DNP3State_::response_buffer, DNP3Transaction_::response_buffer_len, DNP3Transaction_::response_done, RunmodeIsUnittests(), SCEnter, SCFree, SCMutexLock, SCMutexUnlock, SCReturn, DNP3Point_::size, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpFreeConfig(), StreamTcpInitConfig(), TAILQ_EMPTY, TAILQ_FIRST, DNP3State_::transaction_max, TRUE, DNP3Transaction_::tx_num, and DNP3Object_::variation.

Referenced by AppLayerParserRegisterProtocolParsers(), and GetProgramVersion().

Here is the call graph for this function:

Here is the caller graph for this function:

typedef TAILQ_HEAD ( DNP3PointList_  ,
DNP3Point_   
)
typedef TAILQ_HEAD ( DNP3ObjectList_  ,
DNP3Object_   
)
TAILQ_HEAD ( TxListHead  ,
DNP3Transaction_   
)

Variable Documentation

uint8_t control

Control flags.

Definition at line 2650 of file app-layer-dnp3.h.

uint16_t crc

Link header CRC.

Definition at line 2653 of file app-layer-dnp3.h.

Referenced by RegisterDNP3Parsers().

uint8_t function_code

Application function code.

Definition at line 130 of file app-layer-dnp3.h.

uint8_t iin1

Definition at line 129 of file app-layer-dnp3.h.

uint8_t iin2

Definition at line 130 of file app-layer-dnp3.h.

uint8_t len

Length of PDU without CRCs.

Definition at line 2649 of file app-layer-dnp3.h.

Referenced by AFPGetLinkType(), AlertJsonHeader(), ByteExtractString(), ByteExtractStringSigned(), DatasetAddSerialized(), DatasetGetTypeFromString(), DatasetLookupwRep(), DatasetsSave(), DecodeENIPPDU(), DecodeIPV6FragHeader(), DefragTrackerFreeFrags(), DefragTrackerQueueLen(), DetectAsn1Register(), DetectByteExtractDoMatch(), DetectBytejumpDoMatch(), DetectBytetestDoMatch(), DetectClasstypeRegister(), DetectContentParse(), DetectCsumRegister(), DetectDceIfaceRegister(), DetectLoadCompleteSigPath(), DetectPcrePayloadMatch(), DetectPktvarRegister(), DetectReplaceFreeInternal(), DetectReplaceRegister(), DetectSignatureSetAppProto(), DetectTransformMd5Register(), DetectTransformSha1Register(), DetectTransformSha256Register(), DetectVarStoreMatch(), DetectVarStoreMatchKeyValue(), DNP3FreeObjectPointList(), FileCloseFilePtr(), FileGetSwfDecompressedLen(), FileTruncateAllOpenFiles(), FlowUpdateSpareFlows(), hashbig(), hexdump(), HostQueueLen(), HtpBodyAppendChunk(), HtpConfigRestoreBackup(), HTPParseContentRange(), IPPairQueueLen(), IPv4AddressStringIsValid(), IPv6AddressStringIsValid(), Ja3BufferFree(), JsonAddStringN(), JsonHttpLogJSONBodyPrintable(), JsonPacket(), MimeDecAddEntity(), PoolPrintSaturation(), PostRunDeinit(), ReceiveAFPLoop(), RegisterDNP3Parsers(), RunModeIdsNetmapRegister(), SCACTilePreparePatterns(), SCAsn1Decode(), SCClassConfClasstypeHashFunc(), SCCreateDirectoryTree(), SCHTPGenerateNormalizedUri(), SCPidfileCreate(), SCRConfReferenceHashFunc(), SCThresholdConfInitContext(), SigMatchList2DataArray(), SigMatchListSMBelongsTo(), SRepLoadCatFileFromFD(), SRepLoadFileFromFD(), StreamingBufferFree(), StreamingBufferSBBGetData(), StreamTcpCreateTestPacket(), StreamTcpUTAddSegmentWithByte(), StreamTcpUTAddSegmentWithPayload(), StringAsBase64(), strptime(), THashDataQueueNew(), TmModuleDecodeAFPRegister(), TmqDebugList(), TmThreadRemove(), TmThreadsSlotVarRun(), and UTHParseSignature().

uint8_t qualifier

Definition at line 131 of file app-layer-dnp3.h.

uint8_t start_byte0

First check byte.

Definition at line 2647 of file app-layer-dnp3.h.

uint8_t start_byte1

Second check byte.

Definition at line 2648 of file app-layer-dnp3.h.

uint8_t variation

Definition at line 130 of file app-layer-dnp3.h.