suricata
app-layer-dnp3.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #ifndef __APP_LAYER_DNP3_H__
19 #define __APP_LAYER_DNP3_H__
20 
21 #include "detect-engine-state.h"
22 #include "util-hashlist.h"
23 #include "util-byte.h"
24 #include "rust.h"
25 
26 /**
27  * The maximum size of a DNP3 link PDU.
28  */
29 #define DNP3_MAX_LINK_PDU_LEN 292
30 
31 /* DNP3 application request function codes. */
32 #define DNP3_APP_FC_CONFIRM 0x00
33 #define DNP3_APP_FC_READ 0x01
34 #define DNP3_APP_FC_WRITE 0x02
35 #define DNP3_APP_FC_SELECT 0x03
36 #define DNP3_APP_FC_OPERATE 0x04
37 #define DNP3_APP_FC_DIR_OPERATE 0x05
38 #define DNP3_APP_FC_DIR_OPERATE_NR 0x06
39 #define DNP3_APP_FC_FREEZE 0x07
40 #define DNP3_APP_FC_FREEZE_NR 0x08
41 #define DNP3_APP_FC_FREEZE_CLEAR 0x09
42 #define DNP3_APP_FC_FREEZE_CLEAR_NR 0x0a
43 #define DNP3_APP_FC_FREEZE_AT_TIME 0x0b
44 #define DNP3_APP_FC_FREEZE_AT_TIME_NR 0x0c
45 #define DNP3_APP_FC_COLD_RESTART 0x0d
46 #define DNP3_APP_FC_WARM_RESTART 0x0e
47 #define DNP3_APP_FC_INITIALIZE_DATA 0x0f
48 #define DNP3_APP_FC_INITIALIZE_APPLICATION 0x10
49 #define DNP3_APP_FC_START_APPLICATION 0x11
50 #define DNP3_APP_FC_STOP_APPLICATION 0x12
51 #define DNP3_APP_FC_SAVE_CONFIGURATION 0x13
52 #define DNP3_APP_FC_ENABLE_UNSOLICITED 0x14
53 #define DNP3_APP_FC_DISABLE_UNSOLICTED 0x15
54 #define DNP3_APP_FC_ASSIGN_CLASS 0x16
55 #define DNP3_APP_FC_DELAY_MEASUREMENT 0x17
56 #define DNP3_APP_FC_RECORD_CURRENT_TIME 0x18
57 #define DNP3_APP_FC_OPEN_TIME 0x19
58 #define DNP3_APP_FC_CLOSE_FILE 0x1a
59 #define DNP3_APP_FC_DELETE_FILE 0x1b
60 #define DNP3_APP_FC_GET_FILE_INFO 0x1c
61 #define DNP3_APP_FC_AUTHENTICATE_FILE 0x1d
62 #define DNP3_APP_FC_ABORT_FILE 0x1e
63 #define DNP3_APP_FC_ACTIVATE_CONFIG 0x1f
64 #define DNP3_APP_FC_AUTH_REQ 0x20
65 #define DNP3_APP_FC_AUTH_REQ_NR 0x21
66 
67 /* DNP3 application response function codes. */
68 #define DNP3_APP_FC_RESPONSE 0x81
69 #define DNP3_APP_FC_UNSOLICITED_RESP 0x82
70 #define DNP3_APP_FC_AUTH_RESP 0x83
71 
72 /* Extract fields from the link control octet. */
73 #define DNP3_LINK_DIR(control) (control & 0x80)
74 #define DNP3_LINK_PRI(control) (control & 0x40)
75 #define DNP3_LINK_FCB(control) (control & 0x20)
76 #define DNP3_LINK_FCV(control) (control & 0x10)
77 #define DNP3_LINK_FC(control) (control & 0x0f)
78 
79 /* Extract fields from transport layer header octet. */
80 #define DNP3_TH_FIN(x) (x & 0x80)
81 #define DNP3_TH_FIR(x) (x & 0x40)
82 #define DNP3_TH_SEQ(x) (x & 0x3f)
83 
84 /* Extract fields from the application control octet. */
85 #define DNP3_APP_FIR(x) (x & 0x80)
86 #define DNP3_APP_FIN(x) (x & 0x40)
87 #define DNP3_APP_CON(x) (x & 0x20)
88 #define DNP3_APP_UNS(x) (x & 0x10)
89 #define DNP3_APP_SEQ(x) (x & 0x0f)
90 
91 /* DNP3 values are stored in little endian on the wire, so swapping will be
92  * needed on big endian architectures. */
93 #if __BYTE_ORDER == __BIG_ENDIAN
94 #define DNP3_SWAP16(x) SCByteSwap16(x)
95 #define DNP3_SWAP32(x) SCByteSwap32(x)
96 #define DNP3_SWAP64(x) SCByteSwap64(x)
97 #elif __BYTE_ORDER == __LITTLE_ENDIAN
98 #define DNP3_SWAP16(x) x
99 #define DNP3_SWAP32(x) x
100 #define DNP3_SWAP64(x) x
101 #endif
102 
103 /* DNP3 decoder events. */
104 enum {
111 };
112 
113 /**
114  * \brief DNP3 link header.
115  */
116 typedef struct DNP3LinkHeader_ {
117  uint8_t start_byte0; /**< First check byte. */
118  uint8_t start_byte1; /**< Second check byte. */
119  uint8_t len; /**< Length of PDU without CRCs. */
120  uint8_t control; /**< Control flags. */
121  uint16_t dst; /**< DNP3 destination address. */
122  uint16_t src; /**< DNP3 source address. */
123  uint16_t crc; /**< Link header CRC. */
124 } __attribute__((__packed__)) DNP3LinkHeader;
125 
126 /**
127  * \brief DNP3 transport header.
128  */
129 typedef uint8_t DNP3TransportHeader;
130 
131 /**
132  * \brief DNP3 application header.
133  */
134 typedef struct DNP3ApplicationHeader_ {
135  uint8_t control; /**< Control flags. */
136  uint8_t function_code; /**< Application function code. */
137 } __attribute__((__packed__)) DNP3ApplicationHeader;
138 
139 /**
140  * \brief DNP3 internal indicators.
141  *
142  * Part of the application header for responses only.
143  */
144 typedef struct DNP3InternalInd_ {
145  uint8_t iin1;
146  uint8_t iin2;
147 } __attribute__((__packed__)) DNP3InternalInd;
148 
149 /**
150  * \brief A struct used for buffering incoming data prior to reassembly.
151  */
152 typedef struct DNP3Buffer_ {
153  uint8_t *buffer;
154  size_t size;
155  int len;
156  int offset;
158 
159 /**
160  * \brief DNP3 application object header.
161  */
162 typedef struct DNP3ObjHeader_ {
163  uint8_t group;
164  uint8_t variation;
165  uint8_t qualifier;
166 } __attribute__((packed)) DNP3ObjHeader;
167 
168 /**
169  * \brief DNP3 object point.
170  *
171  * Each DNP3 object can have 0 or more points representing the values
172  * of the object.
173  */
174 typedef struct DNP3Point_ {
175  uint32_t prefix; /**< Prefix value for point. */
176  uint32_t index; /**< Index of point. If the object is prefixed
177  * with an index then this will be that
178  * value. Otherwise this is the place the point
179  * was in the list of points (starting at 0). */
180  uint32_t size; /**< Size of point if the object prefix was a
181  * size. */
182  void *data; /**< Data for this point. */
185 
186 typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList;
187 
188 /**
189  * \brief Struct to hold the list of decoded objects.
190  */
191 typedef struct DNP3Object_ {
192  uint8_t group;
193  uint8_t variation;
194  uint8_t qualifier;
195  uint8_t prefix_code;
196  uint8_t range_code;
197  uint32_t start;
198  uint32_t stop;
199  uint32_t count;
200  DNP3PointList *points; /**< List of points for this object. */
201 
204 
205 typedef TAILQ_HEAD(DNP3ObjectList_, DNP3Object_) DNP3ObjectList;
206 
207 /**
208  * \brief DNP3 transaction.
209  */
210 typedef struct DNP3Transaction_ {
211  AppLayerTxData tx_data;
212 
213  uint64_t tx_num; /**< Internal transaction ID. */
214 
215  struct DNP3State_ *dnp3;
216 
217  uint8_t has_request;
218  uint8_t request_done;
219  DNP3LinkHeader request_lh;
221  DNP3ApplicationHeader request_ah;
222  uint8_t *request_buffer; /**< Reassembled request
223  * buffer. */
225  uint8_t request_complete; /**< Was the decode
226  * complete. It will not be
227  * complete if we hit objects
228  * we do not know. */
229  DNP3ObjectList request_objects;
230 
231  uint8_t has_response;
232  uint8_t response_done;
233  DNP3LinkHeader response_lh;
235  DNP3ApplicationHeader response_ah;
236  DNP3InternalInd response_iin;
237  uint8_t *response_buffer; /**< Reassembed response
238  * buffer. */
240  uint8_t response_complete; /**< Was the decode
241  * complete. It will not be
242  * complete if we hit objects
243  * we do not know. */
244  DNP3ObjectList response_objects;
245 
246  AppLayerDecoderEvents *decoder_events; /**< Per transcation
247  * decoder events. */
249 
252 
254 
255 /**
256  * \brief Per flow DNP3 state.
257  */
258 typedef struct DNP3State_ {
260  DNP3Transaction *curr; /**< Current transaction. */
261  uint64_t transaction_max;
262  uint16_t events;
263  uint32_t unreplied; /**< Number of unreplied requests. */
264  uint8_t flooded; /**< Flag indicating flood. */
265 
266  DNP3Buffer request_buffer; /**< Request buffer for buffering
267  * incomplete request PDUs received
268  * over TCP. */
269  DNP3Buffer response_buffer; /**< Response buffer for buffering
270  * incomplete response PDUs received
271  * over TCP. */
272 
274 
275 void RegisterDNP3Parsers(void);
276 void DNP3ParserRegisterTests(void);
277 int DNP3PrefixIsSize(uint8_t);
278 
279 #endif /* __APP_LAYER_DNP3_H__ */
DNP3Transaction_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Transaction_) next
util-byte.h
DNP3ParserRegisterTests
void DNP3ParserRegisterTests(void)
Definition: app-layer-dnp3.c:2674
DNP3Transaction_::response_lh
DNP3LinkHeader response_lh
Definition: app-layer-dnp3.h:233
DNP3Transaction_::response_done
uint8_t response_done
Definition: app-layer-dnp3.h:232
DNP3Transaction_::dnp3
struct DNP3State_ * dnp3
Definition: app-layer-dnp3.h:215
DNP3Buffer_::size
size_t size
Definition: app-layer-dnp3.h:154
DNP3_DECODER_EVENT_MALFORMED
@ DNP3_DECODER_EVENT_MALFORMED
Definition: app-layer-dnp3.h:109
util-hashlist.h
DetectEngineState_
Definition: detect-engine-state.h:92
DNP3State_::response_buffer
DNP3Buffer response_buffer
Definition: app-layer-dnp3.h:269
DNP3Transaction_::request_done
uint8_t request_done
Definition: app-layer-dnp3.h:218
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DNP3_DECODER_EVENT_FLOODED
@ DNP3_DECODER_EVENT_FLOODED
Definition: app-layer-dnp3.h:105
DNP3LinkHeader_
DNP3 link header.
Definition: app-layer-dnp3.h:116
DNP3Object_
Struct to hold the list of decoded objects.
Definition: app-layer-dnp3.h:191
DNP3Transaction_::has_request
uint8_t has_request
Definition: app-layer-dnp3.h:217
DNP3ObjHeader_::group
uint8_t group
Definition: app-layer-dnp3.h:163
DNP3Object
struct DNP3Object_ DNP3Object
Struct to hold the list of decoded objects.
DNP3State_::transaction_max
uint64_t transaction_max
Definition: app-layer-dnp3.h:261
DNP3State_::flooded
uint8_t flooded
Definition: app-layer-dnp3.h:264
DNP3Buffer_::offset
int offset
Definition: app-layer-dnp3.h:156
__attribute__
struct DNP3LinkHeader_ __attribute__((__packed__)) DNP3LinkHeader
DNP3 link header.
Definition: decode-vlan.c:113
DNP3ApplicationHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:135
DNP3Object_::stop
uint32_t stop
Definition: app-layer-dnp3.h:198
DNP3Transaction_::response_buffer
uint8_t * response_buffer
Definition: app-layer-dnp3.h:237
rust.h
DNP3LinkHeader_::len
uint8_t len
Definition: app-layer-dnp3.h:119
TAILQ_HEAD
typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList
DNP3ApplicationHeader_::function_code
uint8_t function_code
Definition: app-layer-dnp3.h:136
DNP3ObjHeader_::variation
uint8_t variation
Definition: app-layer-dnp3.h:164
RegisterDNP3Parsers
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
Definition: app-layer-dnp3.c:1592
DNP3State_::request_buffer
DNP3Buffer request_buffer
Definition: app-layer-dnp3.h:266
DNP3ApplicationHeader_
DNP3 application header.
Definition: app-layer-dnp3.h:134
DNP3Point_::data
void * data
Definition: app-layer-dnp3.h:182
DNP3Transaction_::response_complete
uint8_t response_complete
Definition: app-layer-dnp3.h:240
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
DNP3Transaction_::has_response
uint8_t has_response
Definition: app-layer-dnp3.h:231
DNP3Buffer_::len
int len
Definition: app-layer-dnp3.h:155
DNP3State_::events
uint16_t events
Definition: app-layer-dnp3.h:262
DNP3Object_::points
DNP3PointList * points
Definition: app-layer-dnp3.h:200
DNP3_DECODER_EVENT_UNKNOWN_OBJECT
@ DNP3_DECODER_EVENT_UNKNOWN_OBJECT
Definition: app-layer-dnp3.h:110
DNP3LinkHeader_::dst
uint16_t dst
Definition: app-layer-dnp3.h:121
DNP3InternalInd_::iin1
uint8_t iin1
Definition: app-layer-dnp3.h:145
DNP3Object_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Object_) next
DNP3LinkHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:120
DNP3Transaction_::response_iin
DNP3InternalInd response_iin
Definition: app-layer-dnp3.h:236
DNP3Point_::size
uint32_t size
Definition: app-layer-dnp3.h:180
DNP3Transaction_::response_th
DNP3TransportHeader response_th
Definition: app-layer-dnp3.h:234
DNP3Transaction_::request_complete
uint8_t request_complete
Definition: app-layer-dnp3.h:225
DNP3InternalInd_
DNP3 internal indicators.
Definition: app-layer-dnp3.h:144
DNP3State
struct DNP3State_ DNP3State
Per flow DNP3 state.
DNP3Buffer_::buffer
uint8_t * buffer
Definition: app-layer-dnp3.h:153
DNP3State_::TAILQ_HEAD
TAILQ_HEAD(, DNP3Transaction_) tx_list
DNP3Object_::group
uint8_t group
Definition: app-layer-dnp3.h:192
DNP3Transaction_::request_buffer_len
uint32_t request_buffer_len
Definition: app-layer-dnp3.h:224
detect-engine-state.h
Data structures and function prototypes for keeping state for the detection engine.
DNP3Object_::start
uint32_t start
Definition: app-layer-dnp3.h:197
DNP3Transaction_::request_ah
DNP3ApplicationHeader request_ah
Definition: app-layer-dnp3.h:221
DNP3Transaction_::response_ah
DNP3ApplicationHeader response_ah
Definition: app-layer-dnp3.h:235
DNP3Object_::count
uint32_t count
Definition: app-layer-dnp3.h:199
DNP3Transaction_::request_th
DNP3TransportHeader request_th
Definition: app-layer-dnp3.h:220
DNP3State_::curr
DNP3Transaction * curr
Definition: app-layer-dnp3.h:260
DNP3_DECODER_EVENT_BAD_LINK_CRC
@ DNP3_DECODER_EVENT_BAD_LINK_CRC
Definition: app-layer-dnp3.h:107
DNP3Object_::range_code
uint8_t range_code
Definition: app-layer-dnp3.h:196
DNP3Point
struct DNP3Point_ DNP3Point
DNP3 object point.
DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
@ DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
Definition: app-layer-dnp3.h:108
DNP3Object_::prefix_code
uint8_t prefix_code
Definition: app-layer-dnp3.h:195
DNP3Transaction_::request_lh
DNP3LinkHeader request_lh
Definition: app-layer-dnp3.h:219
DNP3Transaction
struct DNP3Transaction_ DNP3Transaction
DNP3 transaction.
DNP3Transaction_::tx_num
uint64_t tx_num
Definition: app-layer-dnp3.h:213
DNP3Transaction_::request_objects
DNP3ObjectList request_objects
Definition: app-layer-dnp3.h:229
DNP3Buffer
struct DNP3Buffer_ DNP3Buffer
A struct used for buffering incoming data prior to reassembly.
DNP3Transaction_::request_buffer
uint8_t * request_buffer
Definition: app-layer-dnp3.h:222
DNP3Object_::variation
uint8_t variation
Definition: app-layer-dnp3.h:193
DNP3Point_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Point_) next
DNP3State_
Per flow DNP3 state.
Definition: app-layer-dnp3.h:258
DNP3Object_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:194
DNP3LinkHeader_::src
uint16_t src
Definition: app-layer-dnp3.h:122
DNP3Point_::index
uint32_t index
Definition: app-layer-dnp3.h:176
DNP3Transaction_::de_state
DetectEngineState * de_state
Definition: app-layer-dnp3.h:248
DNP3InternalInd_::iin2
uint8_t iin2
Definition: app-layer-dnp3.h:146
DNP3State_::unreplied
uint32_t unreplied
Definition: app-layer-dnp3.h:263
DNP3ObjHeader_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:165
DNP3TransportHeader
uint8_t DNP3TransportHeader
DNP3 transport header.
Definition: app-layer-dnp3.h:129
DNP3ObjHeader_
DNP3 application object header.
Definition: app-layer-dnp3.h:162
DNP3Point_::prefix
uint32_t prefix
Definition: app-layer-dnp3.h:175
DNP3Transaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-dnp3.h:211
DNP3LinkHeader_::crc
uint16_t crc
Definition: app-layer-dnp3.h:123
DNP3PrefixIsSize
int DNP3PrefixIsSize(uint8_t)
Check if the prefix code is a size prefix.
Definition: app-layer-dnp3.c:1576
DNP3LinkHeader_::start_byte1
uint8_t start_byte1
Definition: app-layer-dnp3.h:118
DNP3LinkHeader_::start_byte0
uint8_t start_byte0
Definition: app-layer-dnp3.h:117
DNP3Transaction_::response_buffer_len
uint32_t response_buffer_len
Definition: app-layer-dnp3.h:239
DNP3Transaction_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: app-layer-dnp3.h:246
DNP3Point_
DNP3 object point.
Definition: app-layer-dnp3.h:174
DNP3Transaction_
DNP3 transaction.
Definition: app-layer-dnp3.h:210
DNP3Transaction_::response_objects
DNP3ObjectList response_objects
Definition: app-layer-dnp3.h:244
DNP3Buffer_
A struct used for buffering incoming data prior to reassembly.
Definition: app-layer-dnp3.h:152
DNP3_DECODER_EVENT_LEN_TOO_SMALL
@ DNP3_DECODER_EVENT_LEN_TOO_SMALL
Definition: app-layer-dnp3.h:106