a k#dcQ@sdZddlTddlTddlTddlmZddlmZddlm Z m Z ddl m Z m Z mZmZmZmZmZmZmZddlmZddlmZmZmZd ZdZeZd ZeZed ed iZ dZ!d Z"d Z#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/dZ0dZ1dZ2dZ3dZ4dZ5d Z6d!Z7d"Z8d#Z9d$Z:d%Z;d&Zd)Z?d*Z@d+ZAd,ZBd-ZCd.ZDd/ZEd0ZFd1ZGd2ZHd3ZId4ZJd5ZKd6ZLd7ZMd8ZNd9ZOd:ZPd;ZQdZTd?ZUd@ZVdAZWdBZXdCZYdDZZdEZ[dFZ\dGZ]dHZ^dIZ_dJZ`e!dKe"dLe#dMe$dNe%dOe&dPe'dQe(dRe)dSe*dTe+dUe,dVe-dWe.dXe/dYe0dZe1d[e2d\e3d]e4d^e5d_e6d`e7dae8dbe9dce:dde;deedhe?die@djeAdkeBdleCdmeDdneEdoeFdpeGdqeHdreIdseJdteKdueLdveMdweNdxeOdyePdzeQd{eRd|eSd}eTd~eUdeVdeWdeXdeYdeZde[de\de]de^de_de`di@ZadZbd Zcd ZddZedZfddZgGdddeZhGdddehZiGdddehZjddZkddZlGdddeZmGddde ZnGdddehZoGdddeoZpGdddeoZqebejrecepedeqeeejefeiiZsddZtddZuddZvddZwddZxeeehedeeeheddS)a> IEC 60870-5-104 ~~~~~~~~~~~~~~~ :description: This module provides the IEC 60870-5-104 (common short name: iec104) layer, the information objects and related information element definitions. normative references: - IEC 60870-5-4:1994 (atomic base types / data format) - IEC 60870-5-101:2003 (information elements (sec. 7.2.6) and ASDU definition (sec. 7.3)) - IEC 60870-5-104:2006 (information element TSC (sec. 8.8, p. 44)) :TODO: - add allowed direction to IO attributes (but this could be derived from the name easily <--> ) - information elements / objects need more testing (e.g. on live traffic w comparison against tshark) :NOTES: - bit and octet numbering is used as in the related standards (they usually start with index one instead of zero) - some of the information objects are only valid for IEC 60870-5-101 - so usually they should never appear on the network as iec101 uses serial connections. I added them if decoding of those messages is needed cause one goes to implement a iec101<-->iec104 gateway or hits such a gateway that acts not standard conform (e.g. by forwarding 101 messages to a 104 network) )*)orb)conf)warningScapy_Exception) ByteFieldBitField ByteEnumFieldPacketListField BitEnumField XByteField FieldLenField LEShortFieldBitFieldLenField)TCP)RawPacket bind_layersid z"monitor direction (sub -> central)z"control direction (central -> sub)  !"#$%&'()*+,-./0123456789:;<=>? undefinedzcyclic (per/cyc)zbackground (back)zspontaneous (spont)zinitialized (init)z request (req)zactivation (act)zactivation confirmed (actcon)zactivation canceled (deact)z,activation cancellation confirmed (deactcon)zactivation finished (actterm)z*feedback caused by remote command (retrem)z)feedback caused by local command (retloc)zfile transfer (file)Z reserved_14Z reserved_15Z reserved_16Z reserved_17Z reserved_18Z reserved_19zqueried by station (inrogen)z#queried by query to group 1 (inro1)z#queried by query to group 2 (inro2)z#queried by query to group 3 (inro3)z#queried by query to group 4 (inro4)z#queried by query to group 5 (inro5)z#queried by query to group 6 (inro6)z#queried by query to group 7 (inro7)z#queried by query to group 8 (inro8)z#queried by query to group 9 (inro9)z%queried by query to group 10 (inro10)z%queried by query to group 11 (inro11)z%queried by query to group 12 (inro12)z%queried by query to group 13 (inro13)z%queried by query to group 14 (inro14)z%queried by query to group 15 (inro15)z%queried by query to group 16 (inro16)z3queried by counter general interrogation (reqcogen)z,queried by query to counter group 1 (reqco1)z,queried by query to counter group 2 (reqco2)z,queried by query to counter group 3 (reqco3)z,queried by query to counter group 4 (reqco4)Z reserved_42Z reserved_43zunknown type codezunknown transmit reasonzunknown common address of ASDUz%unknown address of information objectZ private_48Z private_49Z private_50Z private_51Z private_52Z private_53Z private_54Z private_55Z private_56Z private_57Z private_58Z private_59Z private_60Z private_61Z private_62Z private_63cCst|d}t|d}t|d@}t|d@}t|d@}|dur||dur|t|dkr\tSt|dd@dk}|rxtStS|r|dur|durtS|r|r|durtStS)aI the type of the message is encoded in octet 1..4 oct 1, bit 1 2 oct 3, bit 1 I Message 0 1|0 0 S Message 1 0 0 U Message 1 1 0 see EN 60870-5-104:2006, sec. 5 (p. 13, fig. 6,7,8) rrrFrr)rboollenIEC104_APDU_TYPE_UNKNOWNIEC104_APDU_TYPE_I_SEQ_IOAIEC104_APDU_TYPE_I_SINGLE_IOAIEC104_APDU_TYPE_SIEC104_APDU_TYPE_U)dataZoct_1Zoct_3Z oct_1_bit_1Z oct_1_bit_2Z oct_3_bit_1Z is_seq_ioar]Z/var/www/html/gsl.tools/lib/python3.9/site-packages/scapy/contrib/scada/iec104/__init__.py_iec104_apci_type_from_packets"      r_c@s&eZdZdZddZedddZdS) IEC104_APDUzP basic Application Protocol Data Unit definition used by S/U/I messages cCst|}|dkr||St|ddkr4||dt|d}||krftd||||St|}t|||S)Nrrhrrz4invalid len of APDU. given len: {} available len: {})rVZdefault_payload_classrrformatr_IEC104_APDU_CLASSESget)selfpayloadZ payload_len apdu_lengthZ apdu_typer]r]r^guess_payload_classs"   zIEC104_APDU.guess_payload_classNcOs4t|r tSt|rtSt|r$tSt|r0tStS)z detect type of the message by checking packet data :param _pkt: raw bytes of the packet layer data to be checked :param args: unused :param kargs: unused :return: class of the detected message type ) _iec104_is_i_apdu_seq_ioaIEC104_I_Message_SeqIOA_iec104_is_i_apdu_single_ioaIEC104_I_Message_SingleIOA_iec104_is_u_apduIEC104_U_Message_iec104_is_s_apduIEC104_S_Messager)cls_pktargsZkargsr]r]r^ dispatch_hooks zIEC104_APDU.dispatch_hook)N)__name__ __module__ __qualname____doc__rh classmethodrtr]r]r]r^r`sr`c@s@eZdZdZdZeddeddedded d ed d gZd S) rpz5 message used for ack of received I-messages zIEC-104 S APDUstartrargrZoctet_1roctet_2r rx_seq_numN) rurvrwrxnamer rIEC104SequenceNumber fields_descr]r]r]r^rp2srpc@seZdZdZdZeddeddeddd ed dd ed dd ed dd ed dd eddd edddeddeddeddg ZdS)rnzT message used for connection tx control (start/stop) and monitoring (test) zIEC-104 U APDUrzrargrZ testfr_conrrZ testfr_actZ stopdt_conZ stopdt_actZ startdt_conZ startdt_actZ octet_1_1_2rrr{Zoctet_3Zoctet_4N) rurvrwrxr}r rrrr]r]r]r^rnCs       rncCst|jtj}||S)z? get the type id and return the matching ASDU instance )ZIEC104_IO_CLASSESrdtype_idr raw_layerpktZnext_layer_dataZnext_layer_class_typer]r]r^_i_msg_io_dispatcher_sequence\srcCst|jtj}||S)z get the type id and return the matching ASDU instance (information object address + regular ASDU information object fields) )ZIEC104_IO_WITH_IOA_CLASSESrdrrrrr]r]r^_i_msg_io_dispatcher_singleesrc@seZdZdZddZdS)IEC104ASDUPacketListFieldzC used to add a list of information objects to an I-message cCs |||S)z add calling layer instance to the cls()-signature :param pkt: calling layer instance :param m: raw data forming the next layer :return: instance of the class representing the next layer )rq)rermr]r]r^m2itszIEC104ASDUPacketListField.m2iN)rurvrwrxrr]r]r]r^rpsrc@seZdZdZdS)#IEC104_I_Message_StructureExceptionzG Exception raised if payload is not of type Information Object N)rurvrwrxr]r]r]r^r~srcsreZdZdZdZdZdZdZedediZdZ dZ e de d iZ dZ dZ e d e d iZgZdfdd ZddZZS)IEC104_I_Messagea2 message used for transmitting data (APDU - Application Protocol Data Unit) APDU: MAGIC + APCI + ASDU MAGIC: 0x68 APCI : Control Information (rx/tx seq/ack numbers) ASDU : Application Service Data Unit - information object related data see EN 60870-5-104:2006, sec. 5 (p. 12) zIEC-104 I APDUrarrsinglesequencedisabledenabledZpositivenegativeNc sBtt|jf||||d|d|vr>|dr>||ddS)N)rrpost_transform _internal _underlayerio)superr__init___information_object_update)rerrrrrfields __class__r]r^rszIEC104_I_Message.__init__cCsnt|ts|g}|d}|j}t|ts0td||_|ddD]"}|j|krFtd|j |j qFdS)z set the type_id in the ASDU header based on the given information object (io) and check for valid structure :param io_instances: information object rzAinformation object payload must be a subclass of IEC104_IO_PacketrNzeeach information object within the ASDU must be of the same class type (first io: {}, current io: {})) isinstancelistr issubclassZIEC104_IO_PacketrZiec104_io_type_idrrb_name)reZ io_instancesZfirst_ioZfirst_io_classZio_instr]r]r^rs"    z+IEC104_I_Message._information_object_update)rNrN)rurvrwrxr} IEC_104_MAGICSQ_FLAG_SINGLESQ_FLAG_SEQUENCESQ_FLAGSZ TEST_DISABLEDZ TEST_ENABLED TEST_FLAGSZ ACK_POSITIVEZ ACK_NEGATIVE ACK_FLAGSrrr __classcell__r]r]rr^rs.  rc@seZdZdZdZedejedddddd d e d d e d d e dd e e dej dejeddddde dd deje dd deje dd deedd edd edd edeedd dgZddZdS)rjz all information objects share a base information object address field sq = 1, see EN 60870-5-101:2003, sec. 7.2.2.1 (p. 33) zIEC-104 I APDU (Seq IOA)rzrgN!BrcCs|dSNr r]rxr]r]r^rz IEC104_I_Message_SeqIOA.fmtZ length_ofadjust tx_seq_numrr|rsqrnum_iorZcount_oftestackcotrorigin_addresscommon_asdu_addressZinformation_object_addresscCs |jdSrrgrr]r]r^rrZ length_fromcCs$|jtkr t|dtg|j|S)Nr)rZIEC104_IO_ID_C_RD_NA_1setattrZIEC104_IO_C_RD_NA_1r)resr]r]r^ post_dissects z$IEC104_I_Message_SeqIOA.post_dissect)rurvrwrxr}r rrr r~r IEC104_IO_NAMESr rrrrrCAUSE_OF_TRANSMISSIONSrrZLEThreeBytesFieldrrrrrrr]r]r]r^rjs4      rjc@seZdZdZdZedejedddddd d e d d e d d e dd e e dej dejeddddde dd deje dd deje dd deedd edd edeedd dg ZdS)rlz every information object contains an individual information object address field sq = 0, see EN 60870-5-101:2003, sec. 7.2.2.1 (p. 33) zIEC-104 I APDU (single IOA)rzrgNrrcCs|dSNrr]rr]r]r^rrz#IEC104_I_Message_SingleIOA.rrrr|rrrrrrrrrrrrcCs |jdSrrrr]r]r^r0rr)rurvrwrxr}r rrr r~r rr rrrrrrrrrrrrrr]r]r]r^rl s0     rlcCsPt|}|dkrdSt|ddks@t|dd|ks@|dkrDdStt|kSNrFrrarrr)rVrrXr_rfZ len_payloadr]r]r^ri=sricCsPt|}|dkrdSt|ddks@t|dd|ks@|dkrDdStt|kSr)rVrrYr_rr]r]r^rkIsrkcCs@t|dkrdSt|ddks0t|ddkr4dStt|kSNrFrrarr)rVrr[r_rfr]r]r^rmVs   rmcCs@t|dkrdSt|ddks0t|ddkr4dStt|kSr)rVrrZr_rr]r]r^ro`s   rocCsNt|rt|St|r t|St|r0t|St|r@t|St |SdS)z can be used to dissect payload of a TCP connection :param payload: the application layer data (IEC104-APDU(s)) :return: iec104 (I/U/S) message instance, conf.raw_layer() if unknown N) rirjrkrlrorprmrnrrrr]r]r^ iec104_decodejsr)Zsport)dportN)yrxZ(scapy.contrib.scada.iec104.iec104_fieldsZ6scapy.contrib.scada.iec104.iec104_information_elementsZ5scapy.contrib.scada.iec104.iec104_information_objectsZ scapy.compatrZ scapy.configrZ scapy.errorrrZ scapy.fieldsrrr r r r r rrZscapy.layers.inetrZ scapy.packetrrrZIEC_104_IANA_PORTZIEC104_CONTROL_DIRECTIONZIEC104_CENTRAL_2_SUB_DIRZIEC104_MONITOR_DIRECTIONZIEC104_SUB_2_CENTRAL_DIRZIEC104_DIRECTIONSZIEC104_COT_UNDEFINEDZIEC104_COT_CYCZIEC104_COT_BACKZIEC104_COT_SPONTZIEC104_COT_INITZIEC104_COT_REQZIEC104_COT_ACTZIEC104_COT_ACTCONZIEC104_COT_DEACTZIEC104_COT_DEACTCONZIEC104_COT_ACTTERMZIEC104_COT_RETREMZIEC104_COT_RETLOCZIEC104_COT_FILEZIEC104_COT_RESERVED_14ZIEC104_COT_RESERVED_15ZIEC104_COT_RESERVED_16ZIEC104_COT_RESERVED_17ZIEC104_COT_RESERVED_18ZIEC104_COT_RESERVED_19ZIEC104_COT_INROGENZIEC104_COT_INRO1ZIEC104_COT_INRO2ZIEC104_COT_INRO3ZIEC104_COT_INRO4ZIEC104_COT_INRO5ZIEC104_COT_INRO6ZIEC104_COT_INRO7ZIEC104_COT_INRO8ZIEC104_COT_INRO9ZIEC104_COT_INRO10ZIEC104_COT_INRO11ZIEC104_COT_INRO12ZIEC104_COT_INRO13ZIEC104_COT_INRO14ZIEC104_COT_INRO15ZIEC104_COT_INRO16ZIEC104_COT_REQCOGENZIEC104_COT_REQCO1ZIEC104_COT_REQCO2ZIEC104_COT_REQCO3ZIEC104_COT_REQCO4ZIEC104_COT_RESERVED_42ZIEC104_COT_RESERVED_43ZIEC104_COT_UNKNOWN_TYPE_CODEZ"IEC104_COT_UNKNOWN_TRANSMIT_REASONZ)IEC104_COT_UNKNOWN_COMMON_ADDRESS_OF_ASDUZ0IEC104_COT_UNKNOWN_ADDRESS_OF_INFORMATION_OBJECTZIEC104_COT_PRIVATE_48ZIEC104_COT_PRIVATE_49ZIEC104_COT_PRIVATE_50ZIEC104_COT_PRIVATE_51ZIEC104_COT_PRIVATE_52ZIEC104_COT_PRIVATE_53ZIEC104_COT_PRIVATE_54ZIEC104_COT_PRIVATE_55ZIEC104_COT_PRIVATE_56ZIEC104_COT_PRIVATE_57ZIEC104_COT_PRIVATE_58ZIEC104_COT_PRIVATE_59ZIEC104_COT_PRIVATE_60ZIEC104_COT_PRIVATE_61ZIEC104_COT_PRIVATE_62ZIEC104_COT_PRIVATE_63rrWrXrYr[rZr_r`rprnrrrrrrjrlrrcrirkrmrorr]r]r]r^ sb!  , E(7  S4)