suricata
app-layer-dnp3.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * DNP3 application layer protocol header file
22  */
23 
24 #ifndef SURICATA_APP_LAYER_DNP3_H
25 #define SURICATA_APP_LAYER_DNP3_H
26 
27 #include "rust.h"
28 #if __BYTE_ORDER == __BIG_ENDIAN
29 #include "util-byte.h"
30 #endif
31 
32 /* DNP3 application request function codes. */
33 #define DNP3_APP_FC_CONFIRM 0x00
34 #define DNP3_APP_FC_READ 0x01
35 #define DNP3_APP_FC_WRITE 0x02
36 #define DNP3_APP_FC_SELECT 0x03
37 #define DNP3_APP_FC_OPERATE 0x04
38 #define DNP3_APP_FC_DIR_OPERATE 0x05
39 #define DNP3_APP_FC_DIR_OPERATE_NR 0x06
40 #define DNP3_APP_FC_FREEZE 0x07
41 #define DNP3_APP_FC_FREEZE_NR 0x08
42 #define DNP3_APP_FC_FREEZE_CLEAR 0x09
43 #define DNP3_APP_FC_FREEZE_CLEAR_NR 0x0a
44 #define DNP3_APP_FC_FREEZE_AT_TIME 0x0b
45 #define DNP3_APP_FC_FREEZE_AT_TIME_NR 0x0c
46 #define DNP3_APP_FC_COLD_RESTART 0x0d
47 #define DNP3_APP_FC_WARM_RESTART 0x0e
48 #define DNP3_APP_FC_INITIALIZE_DATA 0x0f
49 #define DNP3_APP_FC_INITIALIZE_APPLICATION 0x10
50 #define DNP3_APP_FC_START_APPLICATION 0x11
51 #define DNP3_APP_FC_STOP_APPLICATION 0x12
52 #define DNP3_APP_FC_SAVE_CONFIGURATION 0x13
53 #define DNP3_APP_FC_ENABLE_UNSOLICITED 0x14
54 #define DNP3_APP_FC_DISABLE_UNSOLICITED 0x15
55 #define DNP3_APP_FC_ASSIGN_CLASS 0x16
56 #define DNP3_APP_FC_DELAY_MEASUREMENT 0x17
57 #define DNP3_APP_FC_RECORD_CURRENT_TIME 0x18
58 #define DNP3_APP_FC_OPEN_TIME 0x19
59 #define DNP3_APP_FC_CLOSE_FILE 0x1a
60 #define DNP3_APP_FC_DELETE_FILE 0x1b
61 #define DNP3_APP_FC_GET_FILE_INFO 0x1c
62 #define DNP3_APP_FC_AUTHENTICATE_FILE 0x1d
63 #define DNP3_APP_FC_ABORT_FILE 0x1e
64 #define DNP3_APP_FC_ACTIVATE_CONFIG 0x1f
65 #define DNP3_APP_FC_AUTH_REQ 0x20
66 #define DNP3_APP_FC_AUTH_REQ_NR 0x21
67 
68 /* DNP3 application response function codes. */
69 #define DNP3_APP_FC_RESPONSE 0x81
70 #define DNP3_APP_FC_UNSOLICITED_RESP 0x82
71 #define DNP3_APP_FC_AUTH_RESP 0x83
72 
73 /* Extract fields from the link control octet. */
74 #define DNP3_LINK_DIR(control) (control & 0x80)
75 #define DNP3_LINK_PRI(control) (control & 0x40)
76 #define DNP3_LINK_FCB(control) (control & 0x20)
77 #define DNP3_LINK_FCV(control) (control & 0x10)
78 #define DNP3_LINK_FC(control) (control & 0x0f)
79 
80 /* Extract fields from transport layer header octet. */
81 #define DNP3_TH_FIN(x) (x & 0x80)
82 #define DNP3_TH_FIR(x) (x & 0x40)
83 #define DNP3_TH_SEQ(x) (x & 0x3f)
84 
85 /* Extract fields from the application control octet. */
86 #define DNP3_APP_FIR(x) (x & 0x80)
87 #define DNP3_APP_FIN(x) (x & 0x40)
88 #define DNP3_APP_CON(x) (x & 0x20)
89 #define DNP3_APP_UNS(x) (x & 0x10)
90 #define DNP3_APP_SEQ(x) (x & 0x0f)
91 
92 /* DNP3 values are stored in little endian on the wire, so swapping will be
93  * needed on big endian architectures. */
94 #if __BYTE_ORDER == __BIG_ENDIAN
95 #define DNP3_SWAP16(x) SCByteSwap16(x)
96 #define DNP3_SWAP32(x) SCByteSwap32(x)
97 #define DNP3_SWAP64(x) SCByteSwap64(x)
98 #elif __BYTE_ORDER == __LITTLE_ENDIAN
99 #define DNP3_SWAP16(x) x
100 #define DNP3_SWAP32(x) x
101 #define DNP3_SWAP64(x) x
102 #endif
103 
104 /* DNP3 decoder events. */
105 enum {
112 };
113 
114 /**
115  * \brief DNP3 link header.
116  */
117 typedef struct DNP3LinkHeader_ {
118  uint8_t start_byte0; /**< First check byte. */
119  uint8_t start_byte1; /**< Second check byte. */
120  uint8_t len; /**< Length of PDU without CRCs. */
121  uint8_t control; /**< Control flags. */
122  uint16_t dst; /**< DNP3 destination address. */
123  uint16_t src; /**< DNP3 source address. */
124  uint16_t crc; /**< Link header CRC. */
125 } __attribute__((__packed__)) DNP3LinkHeader;
126 
127 /**
128  * \brief DNP3 transport header.
129  */
130 typedef uint8_t DNP3TransportHeader;
131 
132 /**
133  * \brief DNP3 application header.
134  */
135 typedef struct DNP3ApplicationHeader_ {
136  uint8_t control; /**< Control flags. */
137  uint8_t function_code; /**< Application function code. */
138 } __attribute__((__packed__)) DNP3ApplicationHeader;
139 
140 /**
141  * \brief DNP3 internal indicators.
142  *
143  * Part of the application header for responses only.
144  */
145 typedef struct DNP3InternalInd_ {
146  uint8_t iin1;
147  uint8_t iin2;
148 } __attribute__((__packed__)) DNP3InternalInd;
149 
150 /**
151  * \brief A struct used for buffering incoming data prior to reassembly.
152  */
153 typedef struct DNP3Buffer_ {
154  uint8_t *buffer;
155  size_t size;
156  int len;
157  int offset;
159 
160 /**
161  * \brief DNP3 application object header.
162  */
163 typedef struct DNP3ObjHeader_ {
164  uint8_t group;
165  uint8_t variation;
166  uint8_t qualifier;
167 } __attribute__((packed)) DNP3ObjHeader;
168 
169 /**
170  * \brief DNP3 object point.
171  *
172  * Each DNP3 object can have 0 or more points representing the values
173  * of the object.
174  */
175 typedef struct DNP3Point_ {
176  uint32_t prefix; /**< Prefix value for point. */
177  uint32_t index; /**< Index of point. If the object is prefixed
178  * with an index then this will be that
179  * value. Otherwise this is the place the point
180  * was in the list of points (starting at 0). */
181  uint32_t size; /**< Size of point if the object prefix was a
182  * size. */
183  void *data; /**< Data for this point. */
186 
187 typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList;
188 
189 /**
190  * \brief Struct to hold the list of decoded objects.
191  */
192 typedef struct DNP3Object_ {
193  uint8_t group;
194  uint8_t variation;
195  uint8_t qualifier;
196  uint8_t prefix_code;
197  uint8_t range_code;
198  uint32_t start;
199  uint32_t stop;
200  uint32_t count;
201  DNP3PointList *points; /**< List of points for this object. */
202 
205 
206 typedef TAILQ_HEAD(DNP3ObjectList_, DNP3Object_) DNP3ObjectList;
207 
208 /**
209  * \brief DNP3 transaction.
210  */
211 typedef struct DNP3Transaction_ {
213 
214  uint64_t tx_num; /**< Internal transaction ID. */
215  bool is_request; /**< Is this tx a request? */
216 
217  struct DNP3State_ *dnp3;
218 
219  uint8_t *buffer; /**< Reassembled request buffer. */
220  uint32_t buffer_len;
221  DNP3ObjectList objects;
222  DNP3LinkHeader lh;
224  DNP3ApplicationHeader ah;
225  DNP3InternalInd iin;
226  uint8_t done;
227  uint8_t complete; /**< Was the decode complete. It will not be
228  complete if we hit objects we do not know. */
229 
232 
234 
235 /**
236  * \brief Per flow DNP3 state.
237  */
238 typedef struct DNP3State_ {
239  AppLayerStateData state_data;
241  DNP3Transaction *curr; /**< Current transaction. */
242  uint64_t transaction_max;
243  uint16_t events;
244  uint32_t unreplied; /**< Number of unreplied requests. */
245  uint8_t flooded; /**< Flag indicating flood. */
246 
247  DNP3Buffer request_buffer; /**< Request buffer for buffering
248  * incomplete request PDUs received
249  * over TCP. */
250  DNP3Buffer response_buffer; /**< Response buffer for buffering
251  * incomplete response PDUs received
252  * over TCP. */
253 
255 
256 void RegisterDNP3Parsers(void);
257 void DNP3ParserRegisterTests(void);
258 int DNP3PrefixIsSize(uint8_t);
259 
260 #endif /* SURICATA_APP_LAYER_DNP3_H */
DNP3Transaction_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Transaction_) next
util-byte.h
DNP3ParserRegisterTests
void DNP3ParserRegisterTests(void)
Definition: app-layer-dnp3.c:2629
DNP3Transaction_::complete
uint8_t complete
Definition: app-layer-dnp3.h:227
DNP3Transaction_::dnp3
struct DNP3State_ * dnp3
Definition: app-layer-dnp3.h:217
DNP3Buffer_::size
size_t size
Definition: app-layer-dnp3.h:155
DNP3_DECODER_EVENT_MALFORMED
@ DNP3_DECODER_EVENT_MALFORMED
Definition: app-layer-dnp3.h:110
DNP3State_::response_buffer
DNP3Buffer response_buffer
Definition: app-layer-dnp3.h:250
DNP3Transaction_::done
uint8_t done
Definition: app-layer-dnp3.h:226
DNP3Transaction_::th
DNP3TransportHeader th
Definition: app-layer-dnp3.h:223
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DNP3_DECODER_EVENT_FLOODED
@ DNP3_DECODER_EVENT_FLOODED
Definition: app-layer-dnp3.h:106
DNP3LinkHeader_
DNP3 link header.
Definition: app-layer-dnp3.h:117
DNP3Object_
Struct to hold the list of decoded objects.
Definition: app-layer-dnp3.h:192
DNP3ObjHeader_::group
uint8_t group
Definition: app-layer-dnp3.h:164
DNP3Object
struct DNP3Object_ DNP3Object
Struct to hold the list of decoded objects.
DNP3State_::transaction_max
uint64_t transaction_max
Definition: app-layer-dnp3.h:242
DNP3State_::flooded
uint8_t flooded
Definition: app-layer-dnp3.h:245
DNP3Buffer_::offset
int offset
Definition: app-layer-dnp3.h:157
__attribute__
struct DNP3LinkHeader_ __attribute__((__packed__)) DNP3LinkHeader
DNP3 link header.
Definition: decode-vlan.c:103
DNP3ApplicationHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:136
DNP3Object_::stop
uint32_t stop
Definition: app-layer-dnp3.h:199
DNP3Transaction_::objects
DNP3ObjectList objects
Definition: app-layer-dnp3.h:221
rust.h
DNP3LinkHeader_::len
uint8_t len
Definition: app-layer-dnp3.h:120
TAILQ_HEAD
typedef TAILQ_HEAD(DNP3PointList_, DNP3Point_) DNP3PointList
DNP3ApplicationHeader_::function_code
uint8_t function_code
Definition: app-layer-dnp3.h:137
DNP3ObjHeader_::variation
uint8_t variation
Definition: app-layer-dnp3.h:165
RegisterDNP3Parsers
void RegisterDNP3Parsers(void)
Register the DNP3 application protocol parser.
Definition: app-layer-dnp3.c:1548
DNP3State_::request_buffer
DNP3Buffer request_buffer
Definition: app-layer-dnp3.h:247
DNP3ApplicationHeader_
DNP3 application header.
Definition: app-layer-dnp3.h:135
DNP3Transaction_::buffer_len
uint32_t buffer_len
Definition: app-layer-dnp3.h:220
DNP3Point_::data
void * data
Definition: app-layer-dnp3.h:183
DNP3Buffer_::len
int len
Definition: app-layer-dnp3.h:156
DNP3State_::events
uint16_t events
Definition: app-layer-dnp3.h:243
DNP3Object_::points
DNP3PointList * points
Definition: app-layer-dnp3.h:201
DNP3_DECODER_EVENT_UNKNOWN_OBJECT
@ DNP3_DECODER_EVENT_UNKNOWN_OBJECT
Definition: app-layer-dnp3.h:111
DNP3LinkHeader_::dst
uint16_t dst
Definition: app-layer-dnp3.h:122
DNP3InternalInd_::iin1
uint8_t iin1
Definition: app-layer-dnp3.h:146
DNP3Object_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Object_) next
DNP3LinkHeader_::control
uint8_t control
Definition: app-layer-dnp3.h:121
DNP3Transaction_::ah
DNP3ApplicationHeader ah
Definition: app-layer-dnp3.h:224
DNP3Point_::size
uint32_t size
Definition: app-layer-dnp3.h:181
DNP3Transaction_::iin
DNP3InternalInd iin
Definition: app-layer-dnp3.h:225
DNP3InternalInd_
DNP3 internal indicators.
Definition: app-layer-dnp3.h:145
DNP3State
struct DNP3State_ DNP3State
Per flow DNP3 state.
DNP3Buffer_::buffer
uint8_t * buffer
Definition: app-layer-dnp3.h:154
DNP3State_::TAILQ_HEAD
TAILQ_HEAD(, DNP3Transaction_) tx_list
DNP3Object_::group
uint8_t group
Definition: app-layer-dnp3.h:193
DNP3Object_::start
uint32_t start
Definition: app-layer-dnp3.h:198
DNP3Transaction_::is_request
bool is_request
Definition: app-layer-dnp3.h:215
DNP3Object_::count
uint32_t count
Definition: app-layer-dnp3.h:200
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1355
DNP3State_::curr
DNP3Transaction * curr
Definition: app-layer-dnp3.h:241
DNP3_DECODER_EVENT_BAD_LINK_CRC
@ DNP3_DECODER_EVENT_BAD_LINK_CRC
Definition: app-layer-dnp3.h:108
DNP3Object_::range_code
uint8_t range_code
Definition: app-layer-dnp3.h:197
DNP3Point
struct DNP3Point_ DNP3Point
DNP3 object point.
DNP3State_::state_data
AppLayerStateData state_data
Definition: app-layer-dnp3.h:239
DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
@ DNP3_DECODER_EVENT_BAD_TRANSPORT_CRC
Definition: app-layer-dnp3.h:109
DNP3Object_::prefix_code
uint8_t prefix_code
Definition: app-layer-dnp3.h:196
DNP3Transaction
struct DNP3Transaction_ DNP3Transaction
DNP3 transaction.
DNP3Transaction_::tx_num
uint64_t tx_num
Definition: app-layer-dnp3.h:214
DNP3Buffer
struct DNP3Buffer_ DNP3Buffer
A struct used for buffering incoming data prior to reassembly.
DNP3Object_::variation
uint8_t variation
Definition: app-layer-dnp3.h:194
DNP3Point_::TAILQ_ENTRY
TAILQ_ENTRY(DNP3Point_) next
DNP3State_
Per flow DNP3 state.
Definition: app-layer-dnp3.h:238
DNP3Object_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:195
DNP3LinkHeader_::src
uint16_t src
Definition: app-layer-dnp3.h:123
DNP3Point_::index
uint32_t index
Definition: app-layer-dnp3.h:177
DNP3InternalInd_::iin2
uint8_t iin2
Definition: app-layer-dnp3.h:147
DNP3State_::unreplied
uint32_t unreplied
Definition: app-layer-dnp3.h:244
DNP3ObjHeader_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:166
DNP3TransportHeader
uint8_t DNP3TransportHeader
DNP3 transport header.
Definition: app-layer-dnp3.h:130
DNP3ObjHeader_
DNP3 application object header.
Definition: app-layer-dnp3.h:163
DNP3Point_::prefix
uint32_t prefix
Definition: app-layer-dnp3.h:176
DNP3Transaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-dnp3.h:212
DNP3LinkHeader_::crc
uint16_t crc
Definition: app-layer-dnp3.h:124
DNP3PrefixIsSize
int DNP3PrefixIsSize(uint8_t)
Check if the prefix code is a size prefix.
Definition: app-layer-dnp3.c:1498
DNP3Transaction_::lh
DNP3LinkHeader lh
Definition: app-layer-dnp3.h:222
DNP3LinkHeader_::start_byte1
uint8_t start_byte1
Definition: app-layer-dnp3.h:119
DNP3LinkHeader_::start_byte0
uint8_t start_byte0
Definition: app-layer-dnp3.h:118
DNP3Point_
DNP3 object point.
Definition: app-layer-dnp3.h:175
DNP3Transaction_
DNP3 transaction.
Definition: app-layer-dnp3.h:211
DNP3Buffer_
A struct used for buffering incoming data prior to reassembly.
Definition: app-layer-dnp3.h:153
DNP3Transaction_::buffer
uint8_t * buffer
Definition: app-layer-dnp3.h:219
DNP3_DECODER_EVENT_LEN_TOO_SMALL
@ DNP3_DECODER_EVENT_LEN_TOO_SMALL
Definition: app-layer-dnp3.h:107