suricata
app-layer-dnp3.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #ifndef __APP_LAYER_DNP3_H__
19 #define __APP_LAYER_DNP3_H__
20 
21 #include "detect-engine-state.h"
22 #include "util-hashlist.h"
23 #include "util-byte.h"
24 
25 /**
26  * The maximum size of a DNP3 link PDU.
27  */
28 #define DNP3_MAX_LINK_PDU_LEN 292
29 
30 /* DNP3 application request function codes. */
31 #define DNP3_APP_FC_CONFIRM 0x00
32 #define DNP3_APP_FC_READ 0x01
33 #define DNP3_APP_FC_WRITE 0x02
34 #define DNP3_APP_FC_SELECT 0x03
35 #define DNP3_APP_FC_OPERATE 0x04
36 #define DNP3_APP_FC_DIR_OPERATE 0x05
37 #define DNP3_APP_FC_DIR_OPERATE_NR 0x06
38 #define DNP3_APP_FC_FREEZE 0x07
39 #define DNP3_APP_FC_FREEZE_NR 0x08
40 #define DNP3_APP_FC_FREEZE_CLEAR 0x09
41 #define DNP3_APP_FC_FREEZE_CLEAR_NR 0x0a
42 #define DNP3_APP_FC_FREEZE_AT_TIME 0x0b
43 #define DNP3_APP_FC_FREEZE_AT_TIME_NR 0x0c
44 #define DNP3_APP_FC_COLD_RESTART 0x0d
45 #define DNP3_APP_FC_WARM_RESTART 0x0e
46 #define DNP3_APP_FC_INITIALIZE_DATA 0x0f
47 #define DNP3_APP_FC_INITIALIZE_APPLICATION 0x10
48 #define DNP3_APP_FC_START_APPLICATION 0x11
49 #define DNP3_APP_FC_STOP_APPLICATION 0x12
50 #define DNP3_APP_FC_SAVE_CONFIGURATION 0x13
51 #define DNP3_APP_FC_ENABLE_UNSOLICITED 0x14
52 #define DNP3_APP_FC_DISABLE_UNSOLICTED 0x15
53 #define DNP3_APP_FC_ASSIGN_CLASS 0x16
54 #define DNP3_APP_FC_DELAY_MEASUREMENT 0x17
55 #define DNP3_APP_FC_RECORD_CURRENT_TIME 0x18
56 #define DNP3_APP_FC_OPEN_TIME 0x19
57 #define DNP3_APP_FC_CLOSE_FILE 0x1a
58 #define DNP3_APP_FC_DELETE_FILE 0x1b
59 #define DNP3_APP_FC_GET_FILE_INFO 0x1c
60 #define DNP3_APP_FC_AUTHENTICATE_FILE 0x1d
61 #define DNP3_APP_FC_ABORT_FILE 0x1e
62 #define DNP3_APP_FC_ACTIVATE_CONFIG 0x1f
63 #define DNP3_APP_FC_AUTH_REQ 0x20
64 #define DNP3_APP_FC_AUTH_REQ_NR 0x21
65 
66 /* DNP3 application response function codes. */
67 #define DNP3_APP_FC_RESPONSE 0x81
68 #define DNP3_APP_FC_UNSOLICITED_RESP 0x82
69 #define DNP3_APP_FC_AUTH_RESP 0x83
70 
71 /* Extract fields from the link control octet. */
72 #define DNP3_LINK_DIR(control) (control & 0x80)
73 #define DNP3_LINK_PRI(control) (control & 0x40)
74 #define DNP3_LINK_FCB(control) (control & 0x20)
75 #define DNP3_LINK_FCV(control) (control & 0x10)
76 #define DNP3_LINK_FC(control) (control & 0x0f)
77 
78 /* Extract fields from transport layer header octet. */
79 #define DNP3_TH_FIN(x) (x & 0x80)
80 #define DNP3_TH_FIR(x) (x & 0x40)
81 #define DNP3_TH_SEQ(x) (x & 0x3f)
82 
83 /* Extract fields from the application control octet. */
84 #define DNP3_APP_FIR(x) (x & 0x80)
85 #define DNP3_APP_FIN(x) (x & 0x40)
86 #define DNP3_APP_CON(x) (x & 0x20)
87 #define DNP3_APP_UNS(x) (x & 0x10)
88 #define DNP3_APP_SEQ(x) (x & 0x0f)
89 
90 /* DNP3 values are stored in little endian on the wire, so swapping will be
91  * needed on big endian architectures. */
92 #if __BYTE_ORDER == __BIG_ENDIAN
93 #define DNP3_SWAP16(x) SCByteSwap16(x)
94 #define DNP3_SWAP32(x) SCByteSwap32(x)
95 #define DNP3_SWAP64(x) SCByteSwap64(x)
96 #elif __BYTE_ORDER == __LITTLE_ENDIAN
97 #define DNP3_SWAP16(x) x
98 #define DNP3_SWAP32(x) x
99 #define DNP3_SWAP64(x) x
100 #endif
101 
102 /* DNP3 decoder events. */
103 enum {
110 };
111 
112 /**
113  * \brief DNP3 link header.
114  */
115 typedef struct DNP3LinkHeader_ {
116  uint8_t start_byte0; /**< First check byte. */
117  uint8_t start_byte1; /**< Second check byte. */
118  uint8_t len; /**< Length of PDU without CRCs. */
119  uint8_t control; /**< Control flags. */
120  uint16_t dst; /**< DNP3 destination address. */
121  uint16_t src; /**< DNP3 source address. */
122  uint16_t crc; /**< Link header CRC. */
123 } __attribute__((__packed__)) DNP3LinkHeader;
124 
125 /**
126  * \brief DNP3 transport header.
127  */
128 typedef uint8_t DNP3TransportHeader;
129 
130 /**
131  * \brief DNP3 application header.
132  */
133 typedef struct DNP3ApplicationHeader_ {
134  uint8_t control; /**< Control flags. */
135  uint8_t function_code; /**< Application function code. */
136 } __attribute__((__packed__)) DNP3ApplicationHeader;
137 
138 /**
139  * \brief DNP3 internal indicators.
140  *
141  * Part of the application header for responses only.
142  */
143 typedef struct DNP3InternalInd_ {
144  uint8_t iin1;
145  uint8_t iin2;
146 } __attribute__((__packed__)) DNP3InternalInd;
147 
148 /**
149  * \brief A struct used for buffering incoming data prior to reassembly.
150  */
151 typedef struct DNP3Buffer_ {
152  uint8_t *buffer;
153  size_t size;
154  int len;
155  int offset;
156 } DNP3Buffer;
157 
158 /**
159  * \brief DNP3 application object header.
160  */
161 typedef struct DNP3ObjHeader_ {
162  uint8_t group;
163  uint8_t variation;
164  uint8_t qualifier;
165 } __attribute__((packed)) DNP3ObjHeader;
166 
167 /**
168  * \brief DNP3 object point.
169  *
170  * Each DNP3 object can have 0 or more points representing the values
171  * of the object.
172  */
173 typedef struct DNP3Point_ {
174  uint32_t prefix; /**< Prefix value for point. */
175  uint32_t index; /**< Index of point. If the object is prefixed
176  * with an index then this will be that
177  * value. Otherwise this is the place the point
178  * was in the list of points (starting at 0). */
179  uint32_t size; /**< Size of point if the object prefix was a
180  * size. */
181  void *data; /**< Data for this point. */
183 } DNP3Point;
184 
185 typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList;
186 
187 /**
188  * \brief Struct to hold the list of decoded objects.
189  */
190 typedef struct DNP3Object_ {
191  uint8_t group;
192  uint8_t variation;
193  uint8_t qualifier;
194  uint8_t prefix_code;
195  uint8_t range_code;
196  uint32_t start;
197  uint32_t stop;
198  uint32_t count;
199  DNP3PointList *points; /**< List of points for this object. */
200 
202 } DNP3Object;
203 
204 typedef TAILQ_HEAD(DNP3ObjectList_, DNP3Object_) DNP3ObjectList;
205 
206 /**
207  * \brief DNP3 transaction.
208  */
209 typedef struct DNP3Transaction_ {
210  /** detection engine flags */
211  uint64_t detect_flags_ts;
212  uint64_t detect_flags_tc;
213 
214  uint64_t tx_num; /**< Internal transaction ID. */
215  uint32_t logged; /**< Flags indicating which loggers have logged this tx. */
216 
217  struct DNP3State_ *dnp3;
218 
219  uint8_t has_request;
220  uint8_t request_done;
221  DNP3LinkHeader request_lh;
223  DNP3ApplicationHeader request_ah;
224  uint8_t *request_buffer; /**< Reassembled request
225  * buffer. */
227  uint8_t request_complete; /**< Was the decode
228  * complete. It will not be
229  * complete if we hit objects
230  * we do not know. */
231  DNP3ObjectList request_objects;
232 
233  uint8_t has_response;
234  uint8_t response_done;
235  DNP3LinkHeader response_lh;
237  DNP3ApplicationHeader response_ah;
238  DNP3InternalInd response_iin;
239  uint8_t *response_buffer; /**< Reassembed response
240  * buffer. */
242  uint8_t response_complete; /**< Was the decode
243  * complete. It will not be
244  * complete if we hit objects
245  * we do not know. */
246  DNP3ObjectList response_objects;
247 
248  AppLayerDecoderEvents *decoder_events; /**< Per transcation
249  * decoder events. */
251 
254 
255 TAILQ_HEAD(TxListHead, DNP3Transaction_);
256 
257 /**
258  * \brief Per flow DNP3 state.
259  */
260 typedef struct DNP3State_ {
261  TAILQ_HEAD(, DNP3Transaction_) tx_list;
262  DNP3Transaction *curr; /**< Current transaction. */
263  uint64_t transaction_max;
264  uint16_t events;
265  uint32_t unreplied; /**< Number of unreplied requests. */
266  uint8_t flooded; /**< Flag indicating flood. */
267 
268  DNP3Buffer request_buffer; /**< Request buffer for buffering
269  * incomplete request PDUs received
270  * over TCP. */
271  DNP3Buffer response_buffer; /**< Response buffer for buffering
272  * incomplete response PDUs received
273  * over TCP. */
274 
275 } DNP3State;
276 
277 void RegisterDNP3Parsers(void);
278 void DNP3ParserRegisterTests(void);
279 int DNP3PrefixIsSize(uint8_t);
280 
281 #endif /* __APP_LAYER_DNP3_H__ */
DNP3Transaction_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Transaction_) next
util-byte.h
DNP3ParserRegisterTests
void DNP3ParserRegisterTests(void)
Definition: app-layer-dnp3.c:2646
DNP3Transaction_::response_lh
DNP3LinkHeader response_lh
Definition: app-layer-dnp3.h:235
DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
@ DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
Definition: app-layer-dnp3.h:107
DNP3Transaction_::response_done
uint8_t response_done
Definition: app-layer-dnp3.h:234
DNP3Transaction_::dnp3
struct DNP3State_ * dnp3
Definition: app-layer-dnp3.h:217
DNP3Buffer_::size
size_t size
Definition: app-layer-dnp3.h:153
util-hashlist.h
DetectEngineState_
Definition: detect-engine-state.h:92
DNP3State_::response_buffer
DNP3Buffer response_buffer
Definition: app-layer-dnp3.h:271
DNP3Transaction_::request_done
uint8_t request_done
Definition: app-layer-dnp3.h:220
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:2
DNP3LinkHeader_
DNP3 link header.
Definition: app-layer-dnp3.h:115
DNP3Transaction_::logged
uint32_t logged
Definition: app-layer-dnp3.h:215
DNP3Object_
Struct to hold the list of decoded objects.
Definition: app-layer-dnp3.h:190
DNP3Transaction_::has_request
uint8_t has_request
Definition: app-layer-dnp3.h:219
DNP3ObjHeader_::group
uint8_t group
Definition: app-layer-dnp3.h:162
DNP3Object
struct DNP3Object_ DNP3Object
Struct to hold the list of decoded objects.
DNP3State_::transaction_max
uint64_t transaction_max
Definition: app-layer-dnp3.h:263
DNP3State_::flooded
uint8_t flooded
Definition: app-layer-dnp3.h:266
DNP3Buffer_::offset
int offset
Definition: app-layer-dnp3.h:155
__attribute__
struct DNP3LinkHeader_ __attribute__((__packed__)) DNP3LinkHeader
DNP3 link header.
Definition: alert-unified2-alert.c:92
DNP3ApplicationHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:134
DNP3Object_::stop
uint32_t stop
Definition: app-layer-dnp3.h:197
DNP3Transaction_::response_buffer
uint8_t * response_buffer
Definition: app-layer-dnp3.h:239
DNP3LinkHeader_::len
uint8_t len
Definition: app-layer-dnp3.h:118
DNP3_DECODER_EVENT_BAD_LINK_CRC
@ DNP3_DECODER_EVENT_BAD_LINK_CRC
Definition: app-layer-dnp3.h:106
TAILQ_HEAD
typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList
DNP3ApplicationHeader_::function_code
uint8_t function_code
Definition: app-layer-dnp3.h:135
DNP3ObjHeader_::variation
uint8_t variation
Definition: app-layer-dnp3.h:163
RegisterDNP3Parsers
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
Definition: app-layer-dnp3.c:1599
DNP3State_::request_buffer
DNP3Buffer request_buffer
Definition: app-layer-dnp3.h:268
DNP3ApplicationHeader_
DNP3 application header.
Definition: app-layer-dnp3.h:133
DNP3Point_::data
void * data
Definition: app-layer-dnp3.h:181
DNP3Transaction_::response_complete
uint8_t response_complete
Definition: app-layer-dnp3.h:242
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
DNP3Transaction_::has_response
uint8_t has_response
Definition: app-layer-dnp3.h:233
DNP3_DECODER_EVENT_LEN_TOO_SMALL
@ DNP3_DECODER_EVENT_LEN_TOO_SMALL
Definition: app-layer-dnp3.h:105
DNP3Buffer_::len
int len
Definition: app-layer-dnp3.h:154
DNP3State_::events
uint16_t events
Definition: app-layer-dnp3.h:264
DNP3Object_::points
DNP3PointList * points
Definition: app-layer-dnp3.h:199
DNP3Transaction_::detect_flags_ts
uint64_t detect_flags_ts
Definition: app-layer-dnp3.h:211
DNP3LinkHeader_::dst
uint16_t dst
Definition: app-layer-dnp3.h:120
DNP3InternalInd_::iin1
uint8_t iin1
Definition: app-layer-dnp3.h:144
DNP3Object_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Object_) next
DNP3LinkHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:119
DNP3Transaction_::response_iin
DNP3InternalInd response_iin
Definition: app-layer-dnp3.h:238
DNP3Point_::size
uint32_t size
Definition: app-layer-dnp3.h:179
DNP3Transaction_::response_th
DNP3TransportHeader response_th
Definition: app-layer-dnp3.h:236
DNP3Transaction_::request_complete
uint8_t request_complete
Definition: app-layer-dnp3.h:227
DNP3InternalInd_
DNP3 internal indicators.
Definition: app-layer-dnp3.h:143
DNP3State
struct DNP3State_ DNP3State
Per flow DNP3 state.
DNP3Buffer_::buffer
uint8_t * buffer
Definition: app-layer-dnp3.h:152
DNP3_DECODER_EVENT_UNKNOWN_OBJECT
@ DNP3_DECODER_EVENT_UNKNOWN_OBJECT
Definition: app-layer-dnp3.h:109
DNP3State_::TAILQ_HEAD
TAILQ_HEAD(, DNP3Transaction_) tx_list
DNP3Object_::group
uint8_t group
Definition: app-layer-dnp3.h:191
DNP3Transaction_::request_buffer_len
uint32_t request_buffer_len
Definition: app-layer-dnp3.h:226
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
DNP3Object_::start
uint32_t start
Definition: app-layer-dnp3.h:196
DNP3Transaction_::request_ah
DNP3ApplicationHeader request_ah
Definition: app-layer-dnp3.h:223
DNP3Transaction_::response_ah
DNP3ApplicationHeader response_ah
Definition: app-layer-dnp3.h:237
DNP3Object_::count
uint32_t count
Definition: app-layer-dnp3.h:198
DNP3Transaction_::request_th
DNP3TransportHeader request_th
Definition: app-layer-dnp3.h:222
DNP3State_::curr
DNP3Transaction * curr
Definition: app-layer-dnp3.h:262
DNP3Object_::range_code
uint8_t range_code
Definition: app-layer-dnp3.h:195
DNP3Point
struct DNP3Point_ DNP3Point
DNP3 object point.
DNP3Object_::prefix_code
uint8_t prefix_code
Definition: app-layer-dnp3.h:194
DNP3Transaction_::request_lh
DNP3LinkHeader request_lh
Definition: app-layer-dnp3.h:221
DNP3Transaction
struct DNP3Transaction_ DNP3Transaction
DNP3 transaction.
DNP3Transaction_::tx_num
uint64_t tx_num
Definition: app-layer-dnp3.h:214
DNP3Transaction_::request_objects
DNP3ObjectList request_objects
Definition: app-layer-dnp3.h:231
DNP3Buffer
struct DNP3Buffer_ DNP3Buffer
A struct used for buffering incoming data prior to reassembly.
DNP3Transaction_::request_buffer
uint8_t * request_buffer
Definition: app-layer-dnp3.h:224
DNP3Object_::variation
uint8_t variation
Definition: app-layer-dnp3.h:192
DNP3Point_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Point_) next
DNP3Transaction_::detect_flags_tc
uint64_t detect_flags_tc
Definition: app-layer-dnp3.h:212
DNP3State_
Per flow DNP3 state.
Definition: app-layer-dnp3.h:260
DNP3Object_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:193
DNP3LinkHeader_::src
uint16_t src
Definition: app-layer-dnp3.h:121
DNP3Point_::index
uint32_t index
Definition: app-layer-dnp3.h:175
DNP3Transaction_::de_state
DetectEngineState * de_state
Definition: app-layer-dnp3.h:250
DNP3InternalInd_::iin2
uint8_t iin2
Definition: app-layer-dnp3.h:145
DNP3State_::unreplied
uint32_t unreplied
Definition: app-layer-dnp3.h:265
DNP3ObjHeader_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:164
DNP3TransportHeader
uint8_t DNP3TransportHeader
DNP3 transport header.
Definition: app-layer-dnp3.h:128
DNP3ObjHeader_
DNP3 application object header.
Definition: app-layer-dnp3.h:161
DNP3_DECODER_EVENT_MALFORMED
@ DNP3_DECODER_EVENT_MALFORMED
Definition: app-layer-dnp3.h:108
DNP3Point_::prefix
uint32_t prefix
Definition: app-layer-dnp3.h:174
DNP3LinkHeader_::crc
uint16_t crc
Definition: app-layer-dnp3.h:122
DNP3PrefixIsSize
int DNP3PrefixIsSize(uint8_t)
Check if the prefix code is a size prefix.
Definition: app-layer-dnp3.c:1562
DNP3LinkHeader_::start_byte1
uint8_t start_byte1
Definition: app-layer-dnp3.h:117
DNP3LinkHeader_::start_byte0
uint8_t start_byte0
Definition: app-layer-dnp3.h:116
DNP3Transaction_::response_buffer_len
uint32_t response_buffer_len
Definition: app-layer-dnp3.h:241
DNP3Transaction_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: app-layer-dnp3.h:248
DNP3Point_
DNP3 object point.
Definition: app-layer-dnp3.h:173
DNP3Transaction_
DNP3 transaction.
Definition: app-layer-dnp3.h:209
DNP3Transaction_::response_objects
DNP3ObjectList response_objects
Definition: app-layer-dnp3.h:246
DNP3_DECODER_EVENT_FLOODED
@ DNP3_DECODER_EVENT_FLOODED
Definition: app-layer-dnp3.h:104
DNP3Buffer_
A struct used for buffering incoming data prior to reassembly.
Definition: app-layer-dnp3.h:151