suricata
app-layer-dnp3.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #ifndef __APP_LAYER_DNP3_H__
19 #define __APP_LAYER_DNP3_H__
20 
21 #include "rust.h"
22 
23 /**
24  * The maximum size of a DNP3 link PDU.
25  */
26 #define DNP3_MAX_LINK_PDU_LEN 292
27 
28 /* DNP3 application request function codes. */
29 #define DNP3_APP_FC_CONFIRM 0x00
30 #define DNP3_APP_FC_READ 0x01
31 #define DNP3_APP_FC_WRITE 0x02
32 #define DNP3_APP_FC_SELECT 0x03
33 #define DNP3_APP_FC_OPERATE 0x04
34 #define DNP3_APP_FC_DIR_OPERATE 0x05
35 #define DNP3_APP_FC_DIR_OPERATE_NR 0x06
36 #define DNP3_APP_FC_FREEZE 0x07
37 #define DNP3_APP_FC_FREEZE_NR 0x08
38 #define DNP3_APP_FC_FREEZE_CLEAR 0x09
39 #define DNP3_APP_FC_FREEZE_CLEAR_NR 0x0a
40 #define DNP3_APP_FC_FREEZE_AT_TIME 0x0b
41 #define DNP3_APP_FC_FREEZE_AT_TIME_NR 0x0c
42 #define DNP3_APP_FC_COLD_RESTART 0x0d
43 #define DNP3_APP_FC_WARM_RESTART 0x0e
44 #define DNP3_APP_FC_INITIALIZE_DATA 0x0f
45 #define DNP3_APP_FC_INITIALIZE_APPLICATION 0x10
46 #define DNP3_APP_FC_START_APPLICATION 0x11
47 #define DNP3_APP_FC_STOP_APPLICATION 0x12
48 #define DNP3_APP_FC_SAVE_CONFIGURATION 0x13
49 #define DNP3_APP_FC_ENABLE_UNSOLICITED 0x14
50 #define DNP3_APP_FC_DISABLE_UNSOLICTED 0x15
51 #define DNP3_APP_FC_ASSIGN_CLASS 0x16
52 #define DNP3_APP_FC_DELAY_MEASUREMENT 0x17
53 #define DNP3_APP_FC_RECORD_CURRENT_TIME 0x18
54 #define DNP3_APP_FC_OPEN_TIME 0x19
55 #define DNP3_APP_FC_CLOSE_FILE 0x1a
56 #define DNP3_APP_FC_DELETE_FILE 0x1b
57 #define DNP3_APP_FC_GET_FILE_INFO 0x1c
58 #define DNP3_APP_FC_AUTHENTICATE_FILE 0x1d
59 #define DNP3_APP_FC_ABORT_FILE 0x1e
60 #define DNP3_APP_FC_ACTIVATE_CONFIG 0x1f
61 #define DNP3_APP_FC_AUTH_REQ 0x20
62 #define DNP3_APP_FC_AUTH_REQ_NR 0x21
63 
64 /* DNP3 application response function codes. */
65 #define DNP3_APP_FC_RESPONSE 0x81
66 #define DNP3_APP_FC_UNSOLICITED_RESP 0x82
67 #define DNP3_APP_FC_AUTH_RESP 0x83
68 
69 /* Extract fields from the link control octet. */
70 #define DNP3_LINK_DIR(control) (control & 0x80)
71 #define DNP3_LINK_PRI(control) (control & 0x40)
72 #define DNP3_LINK_FCB(control) (control & 0x20)
73 #define DNP3_LINK_FCV(control) (control & 0x10)
74 #define DNP3_LINK_FC(control) (control & 0x0f)
75 
76 /* Extract fields from transport layer header octet. */
77 #define DNP3_TH_FIN(x) (x & 0x80)
78 #define DNP3_TH_FIR(x) (x & 0x40)
79 #define DNP3_TH_SEQ(x) (x & 0x3f)
80 
81 /* Extract fields from the application control octet. */
82 #define DNP3_APP_FIR(x) (x & 0x80)
83 #define DNP3_APP_FIN(x) (x & 0x40)
84 #define DNP3_APP_CON(x) (x & 0x20)
85 #define DNP3_APP_UNS(x) (x & 0x10)
86 #define DNP3_APP_SEQ(x) (x & 0x0f)
87 
88 /* DNP3 values are stored in little endian on the wire, so swapping will be
89  * needed on big endian architectures. */
90 #if __BYTE_ORDER == __BIG_ENDIAN
91 #define DNP3_SWAP16(x) SCByteSwap16(x)
92 #define DNP3_SWAP32(x) SCByteSwap32(x)
93 #define DNP3_SWAP64(x) SCByteSwap64(x)
94 #elif __BYTE_ORDER == __LITTLE_ENDIAN
95 #define DNP3_SWAP16(x) x
96 #define DNP3_SWAP32(x) x
97 #define DNP3_SWAP64(x) x
98 #endif
99 
100 /* DNP3 decoder events. */
101 enum {
108 };
109 
110 /**
111  * \brief DNP3 link header.
112  */
113 typedef struct DNP3LinkHeader_ {
114  uint8_t start_byte0; /**< First check byte. */
115  uint8_t start_byte1; /**< Second check byte. */
116  uint8_t len; /**< Length of PDU without CRCs. */
117  uint8_t control; /**< Control flags. */
118  uint16_t dst; /**< DNP3 destination address. */
119  uint16_t src; /**< DNP3 source address. */
120  uint16_t crc; /**< Link header CRC. */
121 } __attribute__((__packed__)) DNP3LinkHeader;
122 
123 /**
124  * \brief DNP3 transport header.
125  */
126 typedef uint8_t DNP3TransportHeader;
127 
128 /**
129  * \brief DNP3 application header.
130  */
131 typedef struct DNP3ApplicationHeader_ {
132  uint8_t control; /**< Control flags. */
133  uint8_t function_code; /**< Application function code. */
134 } __attribute__((__packed__)) DNP3ApplicationHeader;
135 
136 /**
137  * \brief DNP3 internal indicators.
138  *
139  * Part of the application header for responses only.
140  */
141 typedef struct DNP3InternalInd_ {
142  uint8_t iin1;
143  uint8_t iin2;
144 } __attribute__((__packed__)) DNP3InternalInd;
145 
146 /**
147  * \brief A struct used for buffering incoming data prior to reassembly.
148  */
149 typedef struct DNP3Buffer_ {
150  uint8_t *buffer;
151  size_t size;
152  int len;
153  int offset;
155 
156 /**
157  * \brief DNP3 application object header.
158  */
159 typedef struct DNP3ObjHeader_ {
160  uint8_t group;
161  uint8_t variation;
162  uint8_t qualifier;
163 } __attribute__((packed)) DNP3ObjHeader;
164 
165 /**
166  * \brief DNP3 object point.
167  *
168  * Each DNP3 object can have 0 or more points representing the values
169  * of the object.
170  */
171 typedef struct DNP3Point_ {
172  uint32_t prefix; /**< Prefix value for point. */
173  uint32_t index; /**< Index of point. If the object is prefixed
174  * with an index then this will be that
175  * value. Otherwise this is the place the point
176  * was in the list of points (starting at 0). */
177  uint32_t size; /**< Size of point if the object prefix was a
178  * size. */
179  void *data; /**< Data for this point. */
182 
183 typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList;
184 
185 /**
186  * \brief Struct to hold the list of decoded objects.
187  */
188 typedef struct DNP3Object_ {
189  uint8_t group;
190  uint8_t variation;
191  uint8_t qualifier;
192  uint8_t prefix_code;
193  uint8_t range_code;
194  uint32_t start;
195  uint32_t stop;
196  uint32_t count;
197  DNP3PointList *points; /**< List of points for this object. */
198 
201 
202 typedef TAILQ_HEAD(DNP3ObjectList_, DNP3Object_) DNP3ObjectList;
203 
204 /**
205  * \brief DNP3 transaction.
206  */
207 typedef struct DNP3Transaction_ {
209 
210  uint64_t tx_num; /**< Internal transaction ID. */
211  bool is_request; /**< Is this tx a request? */
212 
213  struct DNP3State_ *dnp3;
214 
215  uint8_t *buffer; /**< Reassembled request buffer. */
216  uint32_t buffer_len;
217  DNP3ObjectList objects;
218  DNP3LinkHeader lh;
220  DNP3ApplicationHeader ah;
221  DNP3InternalInd iin;
222  uint8_t done;
223  uint8_t complete; /**< Was the decode complete. It will not be
224  complete if we hit objects we do not know. */
225 
228 
230 
231 /**
232  * \brief Per flow DNP3 state.
233  */
234 typedef struct DNP3State_ {
235  AppLayerStateData state_data;
237  DNP3Transaction *curr; /**< Current transaction. */
238  uint64_t transaction_max;
239  uint16_t events;
240  uint32_t unreplied; /**< Number of unreplied requests. */
241  uint8_t flooded; /**< Flag indicating flood. */
242 
243  DNP3Buffer request_buffer; /**< Request buffer for buffering
244  * incomplete request PDUs received
245  * over TCP. */
246  DNP3Buffer response_buffer; /**< Response buffer for buffering
247  * incomplete response PDUs received
248  * over TCP. */
249 
251 
252 void RegisterDNP3Parsers(void);
253 void DNP3ParserRegisterTests(void);
254 int DNP3PrefixIsSize(uint8_t);
255 
256 #endif /* __APP_LAYER_DNP3_H__ */
DNP3Transaction_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Transaction_) next
DNP3ParserRegisterTests
void DNP3ParserRegisterTests(void)
Definition: app-layer-dnp3.c:2618
DNP3Transaction_::complete
uint8_t complete
Definition: app-layer-dnp3.h:223
DNP3Transaction_::dnp3
struct DNP3State_ * dnp3
Definition: app-layer-dnp3.h:213
DNP3Buffer_::size
size_t size
Definition: app-layer-dnp3.h:151
DNP3_DECODER_EVENT_MALFORMED
@ DNP3_DECODER_EVENT_MALFORMED
Definition: app-layer-dnp3.h:106
DNP3State_::response_buffer
DNP3Buffer response_buffer
Definition: app-layer-dnp3.h:246
DNP3Transaction_::done
uint8_t done
Definition: app-layer-dnp3.h:222
DNP3Transaction_::th
DNP3TransportHeader th
Definition: app-layer-dnp3.h:219
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DNP3_DECODER_EVENT_FLOODED
@ DNP3_DECODER_EVENT_FLOODED
Definition: app-layer-dnp3.h:102
DNP3LinkHeader_
DNP3 link header.
Definition: app-layer-dnp3.h:113
DNP3Object_
Struct to hold the list of decoded objects.
Definition: app-layer-dnp3.h:188
DNP3ObjHeader_::group
uint8_t group
Definition: app-layer-dnp3.h:160
DNP3Object
struct DNP3Object_ DNP3Object
Struct to hold the list of decoded objects.
DNP3State_::transaction_max
uint64_t transaction_max
Definition: app-layer-dnp3.h:238
DNP3State_::flooded
uint8_t flooded
Definition: app-layer-dnp3.h:241
DNP3Buffer_::offset
int offset
Definition: app-layer-dnp3.h:153
__attribute__
struct DNP3LinkHeader_ __attribute__((__packed__)) DNP3LinkHeader
DNP3 link header.
Definition: decode-vlan.c:111
DNP3ApplicationHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:132
DNP3Object_::stop
uint32_t stop
Definition: app-layer-dnp3.h:195
DNP3Transaction_::objects
DNP3ObjectList objects
Definition: app-layer-dnp3.h:217
rust.h
DNP3LinkHeader_::len
uint8_t len
Definition: app-layer-dnp3.h:116
TAILQ_HEAD
typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList
DNP3ApplicationHeader_::function_code
uint8_t function_code
Definition: app-layer-dnp3.h:133
DNP3ObjHeader_::variation
uint8_t variation
Definition: app-layer-dnp3.h:161
RegisterDNP3Parsers
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
Definition: app-layer-dnp3.c:1532
DNP3State_::request_buffer
DNP3Buffer request_buffer
Definition: app-layer-dnp3.h:243
DNP3ApplicationHeader_
DNP3 application header.
Definition: app-layer-dnp3.h:131
DNP3Transaction_::buffer_len
uint32_t buffer_len
Definition: app-layer-dnp3.h:216
DNP3Point_::data
void * data
Definition: app-layer-dnp3.h:179
DNP3Buffer_::len
int len
Definition: app-layer-dnp3.h:152
DNP3State_::events
uint16_t events
Definition: app-layer-dnp3.h:239
DNP3Object_::points
DNP3PointList * points
Definition: app-layer-dnp3.h:197
DNP3_DECODER_EVENT_UNKNOWN_OBJECT
@ DNP3_DECODER_EVENT_UNKNOWN_OBJECT
Definition: app-layer-dnp3.h:107
DNP3LinkHeader_::dst
uint16_t dst
Definition: app-layer-dnp3.h:118
DNP3InternalInd_::iin1
uint8_t iin1
Definition: app-layer-dnp3.h:142
DNP3Object_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Object_) next
DNP3LinkHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:117
DNP3Transaction_::ah
DNP3ApplicationHeader ah
Definition: app-layer-dnp3.h:220
DNP3Point_::size
uint32_t size
Definition: app-layer-dnp3.h:177
DNP3Transaction_::iin
DNP3InternalInd iin
Definition: app-layer-dnp3.h:221
DNP3InternalInd_
DNP3 internal indicators.
Definition: app-layer-dnp3.h:141
DNP3State
struct DNP3State_ DNP3State
Per flow DNP3 state.
DNP3Buffer_::buffer
uint8_t * buffer
Definition: app-layer-dnp3.h:150
DNP3State_::TAILQ_HEAD
TAILQ_HEAD(, DNP3Transaction_) tx_list
DNP3Object_::group
uint8_t group
Definition: app-layer-dnp3.h:189
DNP3Object_::start
uint32_t start
Definition: app-layer-dnp3.h:194
DNP3Transaction_::is_request
bool is_request
Definition: app-layer-dnp3.h:211
DNP3Object_::count
uint32_t count
Definition: app-layer-dnp3.h:196
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1300
DNP3State_::curr
DNP3Transaction * curr
Definition: app-layer-dnp3.h:237
DNP3_DECODER_EVENT_BAD_LINK_CRC
@ DNP3_DECODER_EVENT_BAD_LINK_CRC
Definition: app-layer-dnp3.h:104
DNP3Object_::range_code
uint8_t range_code
Definition: app-layer-dnp3.h:193
DNP3Point
struct DNP3Point_ DNP3Point
DNP3 object point.
DNP3State_::state_data
AppLayerStateData state_data
Definition: app-layer-dnp3.h:235
DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
@ DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
Definition: app-layer-dnp3.h:105
DNP3Object_::prefix_code
uint8_t prefix_code
Definition: app-layer-dnp3.h:192
DNP3Transaction
struct DNP3Transaction_ DNP3Transaction
DNP3 transaction.
DNP3Transaction_::tx_num
uint64_t tx_num
Definition: app-layer-dnp3.h:210
DNP3Buffer
struct DNP3Buffer_ DNP3Buffer
A struct used for buffering incoming data prior to reassembly.
DNP3Object_::variation
uint8_t variation
Definition: app-layer-dnp3.h:190
DNP3Point_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Point_) next
DNP3State_
Per flow DNP3 state.
Definition: app-layer-dnp3.h:234
DNP3Object_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:191
DNP3LinkHeader_::src
uint16_t src
Definition: app-layer-dnp3.h:119
DNP3Point_::index
uint32_t index
Definition: app-layer-dnp3.h:173
DNP3InternalInd_::iin2
uint8_t iin2
Definition: app-layer-dnp3.h:143
DNP3State_::unreplied
uint32_t unreplied
Definition: app-layer-dnp3.h:240
DNP3ObjHeader_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:162
DNP3TransportHeader
uint8_t DNP3TransportHeader
DNP3 transport header.
Definition: app-layer-dnp3.h:126
DNP3ObjHeader_
DNP3 application object header.
Definition: app-layer-dnp3.h:159
DNP3Point_::prefix
uint32_t prefix
Definition: app-layer-dnp3.h:172
DNP3Transaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-dnp3.h:208
DNP3LinkHeader_::crc
uint16_t crc
Definition: app-layer-dnp3.h:120
DNP3PrefixIsSize
int DNP3PrefixIsSize(uint8_t)
Check if the prefix code is a size prefix.
Definition: app-layer-dnp3.c:1516
DNP3Transaction_::lh
DNP3LinkHeader lh
Definition: app-layer-dnp3.h:218
DNP3LinkHeader_::start_byte1
uint8_t start_byte1
Definition: app-layer-dnp3.h:115
DNP3LinkHeader_::start_byte0
uint8_t start_byte0
Definition: app-layer-dnp3.h:114
DNP3Point_
DNP3 object point.
Definition: app-layer-dnp3.h:171
DNP3Transaction_
DNP3 transaction.
Definition: app-layer-dnp3.h:207
DNP3Buffer_
A struct used for buffering incoming data prior to reassembly.
Definition: app-layer-dnp3.h:149
DNP3Transaction_::buffer
uint8_t * buffer
Definition: app-layer-dnp3.h:215
DNP3_DECODER_EVENT_LEN_TOO_SMALL
@ DNP3_DECODER_EVENT_LEN_TOO_SMALL
Definition: app-layer-dnp3.h:103