Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/scapy/layers/zigbee.py: 64%

1# SPDX-License-Identifier: GPL-2.0-only 

2# This file is part of Scapy 

3# See https://scapy.net/ for more information 

4# Copyright (C) Ryan Speers <ryan@rmspeers.com> 2011-2012 

5# Copyright (C) Roger Meyer <roger.meyer@csus.edu>: 2012-03-10 Added frames 

6# Copyright (C) Gabriel Potter <gabriel[]potter[]fr>: 2018 

7# Copyright (C) 2020-2021 Dimitrios-Georgios Akestoridis <akestoridis@cmu.edu> 

8 

9""" 

10ZigBee bindings for IEEE 802.15.4. 

11""" 

12 

13import struct 

14 

15from scapy.compat import orb 

16from scapy.packet import bind_layers, bind_bottom_up, Packet 

17from scapy.fields import BitField, ByteField, XLEIntField, ConditionalField, \ 

18 ByteEnumField, EnumField, BitEnumField, FieldListField, FlagsField, \ 

19 IntField, PacketListField, ShortField, StrField, StrFixedLenField, \ 

20 StrLenField, XLEShortField, XStrField 

21 

22from scapy.layers.dot15d4 import dot15d4AddressField, Dot15d4Beacon, Dot15d4, \ 

23 Dot15d4FCS 

24from scapy.layers.inet import UDP 

25from scapy.layers.ntp import TimeStampField 

26 

27 

28# APS Profile Identifiers 

29_aps_profile_identifiers = { 

30 0x0000: "Zigbee_Device_Profile", 

31 0x0101: "IPM_Industrial_Plant_Monitoring", 

32 0x0104: "HA_Home_Automation", 

33 0x0105: "CBA_Commercial_Building_Automation", 

34 0x0107: "TA_Telecom_Applications", 

35 0x0108: "HC_Health_Care", 

36 0x0109: "SE_Smart_Energy_Profile", 

37} 

38 

39# ZigBee Cluster Library Identifiers, Table 2.2 ZCL 

40_zcl_cluster_identifier = { 

41 # Functional Domain: General 

42 0x0000: "basic", 

43 0x0001: "power_configuration", 

44 0x0002: "device_temperature_configuration", 

45 0x0003: "identify", 

46 0x0004: "groups", 

47 0x0005: "scenes", 

48 0x0006: "on_off", 

49 0x0007: "on_off_switch_configuration", 

50 0x0008: "level_control", 

51 0x0009: "alarms", 

52 0x000a: "time", 

53 0x000b: "rssi_location", 

54 0x000c: "analog_input", 

55 0x000d: "analog_output", 

56 0x000e: "analog_value", 

57 0x000f: "binary_input", 

58 0x0010: "binary_output", 

59 0x0011: "binary_value", 

60 0x0012: "multistate_input", 

61 0x0013: "multistate_output", 

62 0x0014: "multistate_value", 

63 0x0015: "commissioning", 

64 # 0x0016 - 0x00ff reserved 

65 # Functional Domain: Closures 

66 0x0100: "shade_configuration", 

67 # 0x0101 - 0x01ff reserved 

68 # Functional Domain: HVAC 

69 0x0200: "pump_configuration_and_control", 

70 0x0201: "thermostat", 

71 0x0202: "fan_control", 

72 0x0203: "dehumidification_control", 

73 0x0204: "thermostat_user_interface_configuration", 

74 # 0x0205 - 0x02ff reserved 

75 # Functional Domain: Lighting 

76 0x0300: "color_control", 

77 0x0301: "ballast_configuration", 

78 # Functional Domain: Measurement and sensing 

79 0x0400: "illuminance_measurement", 

80 0x0401: "illuminance_level_sensing", 

81 0x0402: "temperature_measurement", 

82 0x0403: "pressure_measurement", 

83 0x0404: "flow_measurement", 

84 0x0405: "relative_humidity_measurement", 

85 0x0406: "occupancy_sensing", 

86 # Functional Domain: Security and safethy 

87 0x0500: "ias_zone", 

88 0x0501: "ias_ace", 

89 0x0502: "ias_wd", 

90 # Functional Domain: Protocol Interfaces 

91 0x0600: "generic_tunnel", 

92 0x0601: "bacnet_protocol_tunnel", 

93 0x0602: "analog_input_regular", 

94 0x0603: "analog_input_extended", 

95 0x0604: "analog_output_regular", 

96 0x0605: "analog_output_extended", 

97 0x0606: "analog_value_regular", 

98 0x0607: "analog_value_extended", 

99 0x0608: "binary_input_regular", 

100 0x0609: "binary_input_extended", 

101 0x060a: "binary_output_regular", 

102 0x060b: "binary_output_extended", 

103 0x060c: "binary_value_regular", 

104 0x060d: "binary_value_extended", 

105 0x060e: "multistate_input_regular", 

106 0x060f: "multistate_input_extended", 

107 0x0610: "multistate_output_regular", 

108 0x0611: "multistate_output_extended", 

109 0x0612: "multistate_value_regular", 

110 0x0613: "multistate_value", 

111 # Smart Energy Profile Clusters 

112 0x0700: "price", 

113 0x0701: "demand_response_and_load_control", 

114 0x0702: "metering", 

115 0x0703: "messaging", 

116 0x0704: "smart_energy_tunneling", 

117 0x0705: "prepayment", 

118 # Functional Domain: General 

119 # Key Establishment 

120 0x0800: "key_establishment", 

121} 

122 

123# ZigBee Cluster Library, Table 2.8 ZCL Command Frames 

124_zcl_command_frames = { 

125 0x00: "read_attributes", 

126 0x01: "read_attributes_response", 

127 0x02: "write_attributes", 

128 0x03: "write_attributes_undivided", 

129 0x04: "write_attributes_response", 

130 0x05: "write_attributes_no_response", 

131 0x06: "configure_reporting", 

132 0x07: "configure_reporting_response", 

133 0x08: "read_reporting_configuration", 

134 0x09: "read_reporting_configuration_response", 

135 0x0a: "report_attributes", 

136 0x0b: "default_response", 

137 0x0c: "discover_attributes", 

138 0x0d: "discover_attributes_response", 

139 0x0e: "read_attributes_structured", 

140 0x0f: "write_attributes_structured", 

141 0x10: "write_attributes_structured_response", 

142 0x11: "discover_commands_received", 

143 0x12: "discover_commands_received_response", 

144 0x13: "discover_commands_generated", 

145 0x14: "discover_commands_generated_response", 

146 0x15: "discover_attributes_extended", 

147 0x16: "discover_attributes_extended_response", 

148 # 0x17 - 0xff Reserved 

149} 

150 

151# ZigBee Cluster Library, Table 2.16 Enumerated Status Values 

152_zcl_enumerated_status_values = { 

153 0x00: "SUCCESS", 

154 0x01: "FAILURE", 

155 # 0x02 - 0x7d Reserved 

156 0x7e: "NOT_AUTHORIZED", 

157 0x7f: "RESERVED_FIELD_NOT_ZERO", 

158 0x80: "MALFORMED_COMMAND", 

159 0x81: "UNSUP_CLUSTER_COMMAND", 

160 0x82: "UNSUP_GENERAL_COMMAND", 

161 0x83: "UNSUP_MANUF_CLUSTER_COMMAND", 

162 0x84: "UNSUP_MANUF_GENERAL_COMMAND", 

163 0x85: "INVALID_FIELD", 

164 0x86: "UNSUPPORTED_ATTRIBUTE", 

165 0x87: "INVALID_VALUE", 

166 0x88: "READ_ONLY", 

167 0x89: "INSUFFICIENT_SPACE", 

168 0x8a: "DUPLICATE_EXISTS", 

169 0x8b: "NOT_FOUND", 

170 0x8c: "UNREPORTABLE_ATTRIBUTE", 

171 0x8d: "INVALID_DATA_TYPE", 

172 0x8e: "INVALID_SELECTOR", 

173 0x8f: "WRITE_ONLY", 

174 0x90: "INCONSISTENT_STARTUP_STATE", 

175 0x91: "DEFINED_OUT_OF_BAND", 

176 0x92: "INCONSISTENT", 

177 0x93: "ACTION_DENIED", 

178 0x94: "TIMEOUT", 

179 0x95: "ABORT", 

180 0x96: "INVALID_IMAGE", 

181 0x97: "WAIT_FOR_DATA", 

182 0x98: "NO_IMAGE_AVAILABLE", 

183 0x99: "REQUIRE_MORE_IMAGE", 

184 0x9a: "NOTIFICATION_PENDING", 

185 # 0x9b - 0xbf Reserved 

186 0xc0: "HARDWARE_FAILURE", 

187 0xc1: "SOFTWARE_FAILURE", 

188 0xc2: "CALIBRATION_ERROR", 

189 0xc3: "UNSUPPORTED_CLUSTER", 

190 # 0xc4 - 0xff Reserved 

191} 

192 

193# ZigBee Cluster Library, Table 2.15 Data Types 

194_zcl_attribute_data_types = { 

195 0x00: "no_data", 

196 # General data 

197 0x08: "8-bit_data", 

198 0x09: "16-bit_data", 

199 0x0a: "24-bit_data", 

200 0x0b: "32-bit_data", 

201 0x0c: "40-bit_data", 

202 0x0d: "48-bit_data", 

203 0x0e: "56-bit_data", 

204 0x0f: "64-bit_data", 

205 # Logical 

206 0x10: "boolean", 

207 # Bitmap 

208 0x18: "8-bit_bitmap", 

209 0x19: "16-bit_bitmap", 

210 0x1a: "24-bit_bitmap", 

211 0x1b: "32-bit_bitmap", 

212 0x1c: "40-bit_bitmap", 

213 0x1d: "48-bit_bitmap", 

214 0x1e: "56-bit_bitmap", 

215 0x1f: "64-bit_bitmap", 

216 # Unsigned integer 

217 0x20: "Unsigned_8-bit_integer", 

218 0x21: "Unsigned_16-bit_integer", 

219 0x22: "Unsigned_24-bit_integer", 

220 0x23: "Unsigned_32-bit_integer", 

221 0x24: "Unsigned_40-bit_integer", 

222 0x25: "Unsigned_48-bit_integer", 

223 0x26: "Unsigned_56-bit_integer", 

224 0x27: "Unsigned_64-bit_integer", 

225 # Signed integer 

226 0x28: "Signed_8-bit_integer", 

227 0x29: "Signed_16-bit_integer", 

228 0x2a: "Signed_24-bit_integer", 

229 0x2b: "Signed_32-bit_integer", 

230 0x2c: "Signed_40-bit_integer", 

231 0x2d: "Signed_48-bit_integer", 

232 0x2e: "Signed_56-bit_integer", 

233 0x2f: "Signed_64-bit_integer", 

234 # Enumeration 

235 0x30: "8-bit_enumeration", 

236 0x31: "16-bit_enumeration", 

237 # Floating point 

238 0x38: "semi_precision", 

239 0x39: "single_precision", 

240 0x3a: "double_precision", 

241 # String 

242 0x41: "octet-string", 

243 0x42: "character_string", 

244 0x43: "long_octet_string", 

245 0x44: "long_character_string", 

246 # Ordered sequence 

247 0x48: "array", 

248 0x4c: "structure", 

249 # Collection 

250 0x50: "set", 

251 0x51: "bag", 

252 # Time 

253 0xe0: "time_of_day", 

254 0xe1: "date", 

255 0xe2: "utc_time", 

256 # Identifier 

257 0xe8: "cluster_id", 

258 0xe9: "attribute_id", 

259 0xea: "bacnet_oid", 

260 # Miscellaneous 

261 0xf0: "ieee_address", 

262 0xf1: "128-bit_security_key", 

263 # Unknown 

264 0xff: "unknown", 

265} 

266 

267# Zigbee Cluster Library, IAS Zone, Enroll Response Codes 

268_zcl_ias_zone_enroll_response_codes = { 

269 0x00: "Success", 

270 0x01: "Not supported", 

271 0x02: "No enroll permit", 

272 0x03: "Too many zones", 

273} 

274 

275# Zigbee Cluster Library, IAS Zone, Zone Types 

276_zcl_ias_zone_zone_types = { 

277 0x0000: "Standard CIE", 

278 0x000d: "Motion sensor", 

279 0x0015: "Contact switch", 

280 0x0028: "Fire sensor", 

281 0x002a: "Water sensor", 

282 0x002b: "Carbon Monoxide (CO) sensor", 

283 0x002c: "Personal emergency device", 

284 0x002d: "Vibration/Movement sensor", 

285 0x010f: "Remote Control", 

286 0x0115: "Key fob", 

287 0x021d: "Keypad", 

288 0x0225: "Standard Warning Device", 

289 0x0226: "Glass break sensor", 

290 0x0229: "Security repeater", 

291 # 0x8000 - 0xfffe Manufacturer-specific types 

292 0xffff: "Invalid Zone Type", 

293} 

294 

295 

296# ZigBee # 

297 

298class ZigbeeNWK(Packet): 

299 name = "Zigbee Network Layer" 

300 fields_desc = [ 

301 BitField("discover_route", 0, 2), 

302 BitField("proto_version", 2, 4), 

303 BitEnumField("frametype", 0, 2, 

304 {0: 'data', 1: 'command', 3: 'Inter-PAN'}), 

305 FlagsField("flags", 0, 8, ['multicast', 'security', 'source_route', 'extended_dst', 'extended_src', 'reserved1', 'reserved2', 'reserved3']), # noqa: E501 

306 XLEShortField("destination", 0), 

307 XLEShortField("source", 0), 

308 ByteField("radius", 0), 

309 ByteField("seqnum", 1), 

310 

311 # ConditionalField(XLongField("ext_dst", 0), lambda pkt:pkt.flags & 8), 

312 

313 ConditionalField(dot15d4AddressField("ext_dst", 0, adjust=lambda pkt, x: 8), lambda pkt:pkt.flags & 8), # noqa: E501 

314 ConditionalField(dot15d4AddressField("ext_src", 0, adjust=lambda pkt, x: 8), lambda pkt:pkt.flags & 16), # noqa: E501 

315 

316 ConditionalField(ByteField("relay_count", 1), lambda pkt:pkt.flags & 0x04), # noqa: E501 

317 ConditionalField(ByteField("relay_index", 0), lambda pkt:pkt.flags & 0x04), # noqa: E501 

318 ConditionalField(FieldListField("relays", [], XLEShortField("", 0x0000), count_from=lambda pkt:pkt.relay_count), lambda pkt:pkt.flags & 0x04), # noqa: E501 

319 ] 

320 

321 @classmethod 

322 def dispatch_hook(cls, _pkt=None, *args, **kargs): 

323 if _pkt and len(_pkt) >= 2: 

324 frametype = ord(_pkt[:1]) & 3 

325 if frametype == 3: 

326 return ZigbeeNWKStub 

327 return cls 

328 

329 def guess_payload_class(self, payload): 

330 if self.flags.security: 

331 return ZigbeeSecurityHeader 

332 elif self.frametype == 0: 

333 return ZigbeeAppDataPayload 

334 elif self.frametype == 1: 

335 return ZigbeeNWKCommandPayload 

336 else: 

337 return Packet.guess_payload_class(self, payload) 

338 

339 

340class LinkStatusEntry(Packet): 

341 name = "ZigBee Link Status Entry" 

342 

343 fields_desc = [ 

344 # Neighbor network address (2 octets) 

345 XLEShortField("neighbor_network_address", 0x0000), 

346 # Link status (1 octet) 

347 BitField("reserved1", 0, 1), 

348 BitField("outgoing_cost", 0, 3), 

349 BitField("reserved2", 0, 1), 

350 BitField("incoming_cost", 0, 3), 

351 ] 

352 

353 def extract_padding(self, p): 

354 return b"", p 

355 

356 

357class ZigbeeNWKCommandPayload(Packet): 

358 name = "Zigbee Network Layer Command Payload" 

359 fields_desc = [ 

360 ByteEnumField("cmd_identifier", 1, { 

361 1: "route request", 

362 2: "route reply", 

363 3: "network status", 

364 4: "leave", 

365 5: "route record", 

366 6: "rejoin request", 

367 7: "rejoin response", 

368 8: "link status", 

369 9: "network report", 

370 10: "network update", 

371 11: "end device timeout request", 

372 12: "end device timeout response" 

373 # 0x0d - 0xff reserved 

374 }), 

375 

376 # - Route Request Command - # 

377 # Command options (1 octet) 

378 ConditionalField(BitField("res1", 0, 1), 

379 lambda pkt: pkt.cmd_identifier in [1, 2]), 

380 ConditionalField(BitField("multicast", 0, 1), 

381 lambda pkt: pkt.cmd_identifier in [1, 2]), 

382 ConditionalField(BitField("dest_addr_bit", 0, 1), lambda pkt: pkt.cmd_identifier == 1), # noqa: E501 

383 ConditionalField( 

384 BitEnumField("many_to_one", 0, 2, { 

385 0: "not_m2one", 1: "m2one_support_rrt", 2: "m2one_no_support_rrt", 3: "reserved"} # noqa: E501 

386 ), lambda pkt: pkt.cmd_identifier == 1), 

387 ConditionalField(BitField("res2", 0, 3), lambda pkt: pkt.cmd_identifier == 1), # noqa: E501 

388 

389 # - Route Reply Command - # 

390 # Command options (1 octet) 

391 ConditionalField(BitField("responder_addr_bit", 0, 1), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

392 ConditionalField(BitField("originator_addr_bit", 0, 1), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

393 ConditionalField(BitField("res3", 0, 4), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

394 # Route request identifier (1 octet) 

395 ConditionalField(ByteField("route_request_identifier", 0), 

396 lambda pkt: pkt.cmd_identifier in [1, 2]), # noqa: E501 

397 # Originator address (2 octets) 

398 ConditionalField(XLEShortField("originator_address", 0x0000), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

399 # Responder address (2 octets) 

400 ConditionalField(XLEShortField("responder_address", 0x0000), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

401 

402 # - Network Status Command - # 

403 # Status code (1 octet) 

404 ConditionalField(ByteEnumField("status_code", 0, { 

405 0x00: "No route available", 

406 0x01: "Tree link failure", 

407 0x02: "Non-tree link failure", 

408 0x03: "Low battery level", 

409 0x04: "No routing capacity", 

410 0x05: "No indirect capacity", 

411 0x06: "Indirect transaction expiry", 

412 0x07: "Target device unavailable", 

413 0x08: "Target address unallocated", 

414 0x09: "Parent link failure", 

415 0x0a: "Validate route", 

416 0x0b: "Source route failure", 

417 0x0c: "Many-to-one route failure", 

418 0x0d: "Address conflict", 

419 0x0e: "Verify addresses", 

420 0x0f: "PAN identifier update", 

421 0x10: "Network address update", 

422 0x11: "Bad frame counter", 

423 0x12: "Bad key sequence number", 

424 # 0x13 - 0xff Reserved 

425 }), lambda pkt: pkt.cmd_identifier == 3), 

426 # Destination address (2 octets) 

427 ConditionalField(XLEShortField("destination_address", 0x0000), 

428 lambda pkt: pkt.cmd_identifier in [1, 3]), 

429 # Path cost (1 octet) 

430 ConditionalField(ByteField("path_cost", 0), 

431 lambda pkt: pkt.cmd_identifier in [1, 2]), # noqa: E501 

432 # Destination IEEE Address (0/8 octets), only present when dest_addr_bit has a value of 1 # noqa: E501 

433 ConditionalField(dot15d4AddressField("ext_dst", 0, adjust=lambda pkt, x: 8), # noqa: E501 

434 lambda pkt: (pkt.cmd_identifier == 1 and pkt.dest_addr_bit == 1)), # noqa: E501 

435 # Originator IEEE address (0/8 octets) 

436 ConditionalField(dot15d4AddressField("originator_addr", 0, adjust=lambda pkt, x: 8), # noqa: E501 

437 lambda pkt: (pkt.cmd_identifier == 2 and pkt.originator_addr_bit == 1)), # noqa: E501 

438 # Responder IEEE address (0/8 octets) 

439 ConditionalField(dot15d4AddressField("responder_addr", 0, adjust=lambda pkt, x: 8), # noqa: E501 

440 lambda pkt: (pkt.cmd_identifier == 2 and pkt.responder_addr_bit == 1)), # noqa: E501 

441 

442 # - Leave Command - # 

443 # Command options (1 octet) 

444 # Bit 7: Remove children 

445 ConditionalField(BitField("remove_children", 0, 1), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

446 # Bit 6: Request 

447 ConditionalField(BitField("request", 0, 1), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

448 # Bit 5: Rejoin 

449 ConditionalField(BitField("rejoin", 0, 1), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

450 # Bit 0 - 4: Reserved 

451 ConditionalField(BitField("res4", 0, 5), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

452 

453 # - Route Record Command - # 

454 # Relay count (1 octet) 

455 ConditionalField(ByteField("rr_relay_count", 0), lambda pkt: pkt.cmd_identifier == 5), # noqa: E501 

456 # Relay list (variable in length) 

457 ConditionalField( 

458 FieldListField("rr_relay_list", [], XLEShortField("", 0x0000), count_from=lambda pkt:pkt.rr_relay_count), # noqa: E501 

459 lambda pkt:pkt.cmd_identifier == 5), 

460 

461 # - Rejoin Request Command - # 

462 # Capability Information (1 octet) 

463 ConditionalField(BitField("allocate_address", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Allocate Address # noqa: E501 

464 ConditionalField(BitField("security_capability", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Security Capability # noqa: E501 

465 ConditionalField(BitField("reserved2", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # bit 5 is reserved # noqa: E501 

466 ConditionalField(BitField("reserved1", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # bit 4 is reserved # noqa: E501 

467 ConditionalField(BitField("receiver_on_when_idle", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Receiver On When Idle # noqa: E501 

468 ConditionalField(BitField("power_source", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Power Source # noqa: E501 

469 ConditionalField(BitField("device_type", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Device Type # noqa: E501 

470 ConditionalField(BitField("alternate_pan_coordinator", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Alternate PAN Coordinator # noqa: E501 

471 

472 # - Rejoin Response Command - # 

473 # Network address (2 octets) 

474 ConditionalField(XLEShortField("network_address", 0xFFFF), lambda pkt:pkt.cmd_identifier == 7), # noqa: E501 

475 # Rejoin status (1 octet) 

476 ConditionalField(ByteField("rejoin_status", 0), lambda pkt:pkt.cmd_identifier == 7), # noqa: E501 

477 

478 # - Link Status Command - # 

479 # Command options (1 octet) 

480 ConditionalField(BitField("res5", 0, 1), lambda pkt:pkt.cmd_identifier == 8), # Reserved # noqa: E501 

481 ConditionalField(BitField("last_frame", 0, 1), lambda pkt:pkt.cmd_identifier == 8), # Last frame # noqa: E501 

482 ConditionalField(BitField("first_frame", 0, 1), lambda pkt:pkt.cmd_identifier == 8), # First frame # noqa: E501 

483 ConditionalField(BitField("entry_count", 0, 5), lambda pkt:pkt.cmd_identifier == 8), # Entry count # noqa: E501 

484 # Link status list (variable size) 

485 ConditionalField( 

486 PacketListField("link_status_list", [], LinkStatusEntry, count_from=lambda pkt:pkt.entry_count), # noqa: E501 

487 lambda pkt:pkt.cmd_identifier == 8), 

488 

489 # - Network Report Command - # 

490 # Command options (1 octet) 

491 ConditionalField( 

492 BitEnumField("report_command_identifier", 0, 3, {0: "PAN identifier conflict"}), # 0x01 - 0x07 Reserved # noqa: E501 

493 lambda pkt: pkt.cmd_identifier == 9), 

494 ConditionalField(BitField("report_information_count", 0, 5), lambda pkt: pkt.cmd_identifier == 9), # noqa: E501 

495 

496 # - Network Update Command - # 

497 # Command options (1 octet) 

498 ConditionalField( 

499 BitEnumField("update_command_identifier", 0, 3, {0: "PAN Identifier Update"}), # 0x01 - 0x07 Reserved # noqa: E501 

500 lambda pkt: pkt.cmd_identifier == 10), 

501 ConditionalField(BitField("update_information_count", 0, 5), lambda pkt: pkt.cmd_identifier == 10), # noqa: E501 

502 # EPID: Extended PAN ID (8 octets) 

503 ConditionalField( 

504 dot15d4AddressField("epid", 0, adjust=lambda pkt, x: 8), 

505 lambda pkt: pkt.cmd_identifier in [9, 10] 

506 ), 

507 # Report information (variable length) 

508 # Only present if we have a PAN Identifier Conflict Report 

509 ConditionalField( 

510 FieldListField("PAN_ID_conflict_report", [], XLEShortField("", 0x0000), # noqa: E501 

511 count_from=lambda pkt:pkt.report_information_count), 

512 lambda pkt:(pkt.cmd_identifier == 9 and pkt.report_command_identifier == 0) # noqa: E501 

513 ), 

514 # Update Id (1 octet) 

515 ConditionalField(ByteField("update_id", 0), lambda pkt: pkt.cmd_identifier == 10), # noqa: E501 

516 # Update Information (Variable) 

517 # Only present if we have a PAN Identifier Update 

518 # New PAN ID (2 octets) 

519 ConditionalField(XLEShortField("new_PAN_ID", 0x0000), 

520 lambda pkt: (pkt.cmd_identifier == 10 and pkt.update_command_identifier == 0)), # noqa: E501 

521 

522 # - End Device Timeout Request Command - # 

523 # Requested Timeout (1 octet) 

524 ConditionalField( 

525 ByteEnumField("req_timeout", 3, { 

526 0: "10 seconds", 

527 1: "2 minutes", 

528 2: "4 minutes", 

529 3: "8 minutes", 

530 4: "16 minutes", 

531 5: "32 minutes", 

532 6: "64 minutes", 

533 7: "128 minutes", 

534 8: "256 minutes", 

535 9: "512 minutes", 

536 10: "1024 minutes", 

537 11: "2048 minutes", 

538 12: "4096 minutes", 

539 13: "8192 minutes", 

540 14: "16384 minutes" 

541 }), 

542 lambda pkt: pkt.cmd_identifier == 11), 

543 # End Device Configuration (1 octet) 

544 ConditionalField( 

545 ByteField("ed_conf", 0), 

546 lambda pkt: pkt.cmd_identifier == 11), 

547 

548 # - End Device Timeout Response Command - # 

549 # Status (1 octet) 

550 ConditionalField( 

551 ByteEnumField("status", 0, { 

552 0: "Success", 

553 1: "Incorrect Value" 

554 }), 

555 lambda pkt: pkt.cmd_identifier == 12), 

556 # Parent Information (1 octet) 

557 ConditionalField( 

558 BitField("res6", 0, 6), 

559 lambda pkt: pkt.cmd_identifier == 12), 

560 ConditionalField( 

561 BitField("ed_timeout_req_keepalive", 0, 1), 

562 lambda pkt: pkt.cmd_identifier == 12), 

563 ConditionalField( 

564 BitField("mac_data_poll_keepalive", 0, 1), 

565 lambda pkt: pkt.cmd_identifier == 12) 

566 

567 # StrField("data", ""), 

568 ] 

569 

570 

571def util_mic_len(pkt): 

572 ''' Calculate the length of the attribute value field ''' 

573 if (pkt.nwk_seclevel == 0): # no encryption, no mic 

574 return 0 

575 elif (pkt.nwk_seclevel == 1): # MIC-32 

576 return 4 

577 elif (pkt.nwk_seclevel == 2): # MIC-64 

578 return 8 

579 elif (pkt.nwk_seclevel == 3): # MIC-128 

580 return 16 

581 elif (pkt.nwk_seclevel == 4): # ENC 

582 return 0 

583 elif (pkt.nwk_seclevel == 5): # ENC-MIC-32 

584 return 4 

585 elif (pkt.nwk_seclevel == 6): # ENC-MIC-64 

586 return 8 

587 elif (pkt.nwk_seclevel == 7): # ENC-MIC-128 

588 return 16 

589 else: 

590 return 0 

591 

592 

593class ZigbeeSecurityHeader(Packet): 

594 name = "Zigbee Security Header" 

595 fields_desc = [ 

596 # Security control (1 octet) 

597 FlagsField("reserved1", 0, 2, ['reserved1', 'reserved2']), 

598 BitField("extended_nonce", 1, 1), # set to 1 if the sender address field is present (source) # noqa: E501 

599 # Key identifier 

600 BitEnumField("key_type", 1, 2, { 

601 0: 'data_key', 

602 1: 'network_key', 

603 2: 'key_transport_key', 

604 3: 'key_load_key' 

605 }), 

606 # Security level (3 bits) 

607 BitEnumField("nwk_seclevel", 0, 3, { 

608 0: "None", 

609 1: "MIC-32", 

610 2: "MIC-64", 

611 3: "MIC-128", 

612 4: "ENC", 

613 5: "ENC-MIC-32", 

614 6: "ENC-MIC-64", 

615 7: "ENC-MIC-128" 

616 }), 

617 # Frame counter (4 octets) 

618 XLEIntField("fc", 0), # provide frame freshness and prevent duplicate frames # noqa: E501 

619 # Source address (0/8 octets) 

620 ConditionalField(dot15d4AddressField("source", 0, adjust=lambda pkt, x: 8), lambda pkt: pkt.extended_nonce), # noqa: E501 

621 # Key sequence number (0/1 octet): only present when key identifier is 1 (network key) # noqa: E501 

622 ConditionalField(ByteField("key_seqnum", 0), lambda pkt: pkt.getfieldval("key_type") == 1), # noqa: E501 

623 # Payload 

624 # the length of the encrypted data is the payload length minus the MIC 

625 StrField("data", ""), # noqa: E501 

626 # Message Integrity Code (0/variable in size), length depends on nwk_seclevel # noqa: E501 

627 XStrField("mic", ""), 

628 ] 

629 

630 def post_dissect(self, s): 

631 # Get the mic dissected correctly 

632 mic_length = util_mic_len(self) 

633 if mic_length > 0: # Slice "data" into "data + mic" 

634 _data, _mic = self.data[:-mic_length], self.data[-mic_length:] 

635 self.data, self.mic = _data, _mic 

636 return s 

637 

638 

639class ZigbeeAppDataPayload(Packet): 

640 name = "Zigbee Application Layer Data Payload (General APS Frame Format)" 

641 fields_desc = [ 

642 # Frame control (1 octet) 

643 FlagsField("frame_control", 2, 4, 

644 ['ack_format', 'security', 'ack_req', 'extended_hdr']), 

645 BitEnumField("delivery_mode", 0, 2, 

646 {0: 'unicast', 1: 'indirect', 

647 2: 'broadcast', 3: 'group_addressing'}), 

648 BitEnumField("aps_frametype", 0, 2, 

649 {0: 'data', 1: 'command', 2: 'ack'}), 

650 # Destination endpoint (0/1 octet) 

651 ConditionalField( 

652 ByteField("dst_endpoint", 10), 

653 lambda pkt: ((pkt.aps_frametype == 0 and 

654 pkt.delivery_mode in [0, 2]) or 

655 (pkt.aps_frametype == 2 and not 

656 pkt.frame_control.ack_format)) 

657 ), 

658 # Group address (0/2 octets) 

659 ConditionalField( 

660 XLEShortField("group_addr", 0x0000), 

661 lambda pkt: (pkt.aps_frametype == 0 and pkt.delivery_mode == 3) 

662 ), 

663 # Cluster identifier (0/2 octets) 

664 ConditionalField( 

665 # unsigned short (little-endian) 

666 XLEShortField("cluster", 0x0000), 

667 lambda pkt: ((pkt.aps_frametype == 0) or 

668 (pkt.aps_frametype == 2 and not 

669 pkt.frame_control.ack_format)) 

670 ), 

671 # Profile identifier (0/2 octets) 

672 ConditionalField( 

673 EnumField("profile", 0, _aps_profile_identifiers, fmt="<H"), 

674 lambda pkt: ((pkt.aps_frametype == 0) or 

675 (pkt.aps_frametype == 2 and not 

676 pkt.frame_control.ack_format)) 

677 ), 

678 # Source endpoint (0/1 octets) 

679 ConditionalField( 

680 ByteField("src_endpoint", 10), 

681 lambda pkt: ((pkt.aps_frametype == 0) or 

682 (pkt.aps_frametype == 2 and not 

683 pkt.frame_control.ack_format)) 

684 ), 

685 # APS counter (1 octet) 

686 ByteField("counter", 0), 

687 # Extended header (0/1/2 octets) 

688 # cribbed from https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-zbee-aps.c # noqa: E501 

689 ConditionalField( 

690 ByteEnumField( 

691 "fragmentation", 0, 

692 {0: "none", 1: "first_block", 2: "middle_block"}), 

693 lambda pkt: (pkt.aps_frametype in [0, 2] and 

694 pkt.frame_control.extended_hdr) 

695 ), 

696 ConditionalField( 

697 ByteField("block_number", 0), 

698 lambda pkt: (pkt.aps_frametype in [0, 2] and 

699 pkt.fragmentation in [1, 2]) 

700 ), 

701 ConditionalField( 

702 ByteField("ack_bitfield", 0), 

703 lambda pkt: (pkt.aps_frametype == 2 and 

704 pkt.fragmentation in [1, 2]) 

705 ), 

706 # variable length frame payload: 

707 # 3 frame types: data, APS command, and acknowledgement 

708 # ConditionalField(StrField("data", ""), lambda pkt:pkt.aps_frametype == 0), # noqa: E501 

709 ] 

710 

711 def guess_payload_class(self, payload): 

712 if self.frame_control & 0x02: # we have a security header 

713 return ZigbeeSecurityHeader 

714 elif self.aps_frametype == 0: # data 

715 if self.profile == 0x0000: 

716 return ZigbeeDeviceProfile 

717 else: 

718 return ZigbeeClusterLibrary 

719 elif self.aps_frametype == 1: # command 

720 return ZigbeeAppCommandPayload 

721 else: 

722 return Packet.guess_payload_class(self, payload) 

723 

724 

725_TransportKeyKeyTypes = { 

726 0x00: "Trust Center Master Key", 

727 0x01: "Standard Network Key", 

728 0x02: "Application Master Key", 

729 0x03: "Application Link Key", 

730 0x04: "Trust Center Link Key", 

731 0x05: "High-Security Network Key", 

732} 

733 

734 

735_RequestKeyKeyTypes = { 

736 0x02: "Application Link Key", 

737 0x04: "Trust Center Link Key", 

738} 

739 

740 

741_ApsStatusValues = { 

742 0x00: "SUCCESS", 

743 0xa0: "ASDU_TOO_LONG", 

744 0xa1: "DEFRAG_DEFERRED", 

745 0xa2: "DEFRAG_UNSUPPORTED", 

746 0xa3: "ILLEGAL_REQUEST", 

747 0xa4: "INVALID_BINDING", 

748 0xa5: "INVALID_GROUP", 

749 0xa6: "INVALID_PARAMETER", 

750 0xa7: "NO_ACK", 

751 0xa8: "NO_BOUND_DEVICE", 

752 0xa9: "NO_SHORT_ADDRESS", 

753 0xaa: "NOT_SUPPORTED", 

754 0xab: "SECURED_LINK_KEY", 

755 0xac: "SECURED_NWK_KEY", 

756 0xad: "SECURITY_FAIL", 

757 0xae: "TABLE_FULL", 

758 0xaf: "UNSECURED", 

759 0xb0: "UNSUPPORTED_ATTRIBUTE" 

760} 

761 

762 

763class ZigbeeAppCommandPayload(Packet): 

764 name = "Zigbee Application Layer Command Payload" 

765 fields_desc = [ 

766 ByteEnumField("cmd_identifier", 1, { 

767 1: "APS_CMD_SKKE_1", 

768 2: "APS_CMD_SKKE_2", 

769 3: "APS_CMD_SKKE_3", 

770 4: "APS_CMD_SKKE_4", 

771 5: "APS_CMD_TRANSPORT_KEY", 

772 6: "APS_CMD_UPDATE_DEVICE", 

773 7: "APS_CMD_REMOVE_DEVICE", 

774 8: "APS_CMD_REQUEST_KEY", 

775 9: "APS_CMD_SWITCH_KEY", 

776 # TODO: implement 10 to 13 

777 10: "APS_CMD_EA_INIT_CHLNG", 

778 11: "APS_CMD_EA_RSP_CHLNG", 

779 12: "APS_CMD_EA_INIT_MAC_DATA", 

780 13: "APS_CMD_EA_RSP_MAC_DATA", 

781 14: "APS_CMD_TUNNEL", 

782 15: "APS_CMD_VERIFY_KEY", 

783 16: "APS_CMD_CONFIRM_KEY" 

784 }), 

785 # SKKE Commands 

786 ConditionalField(dot15d4AddressField("initiator", 0, 

787 adjust=lambda pkt, x: 8), 

788 lambda pkt: pkt.cmd_identifier in [1, 2, 3, 4]), 

789 ConditionalField(dot15d4AddressField("responder", 0, 

790 adjust=lambda pkt, x: 8), 

791 lambda pkt: pkt.cmd_identifier in [1, 2, 3, 4]), 

792 ConditionalField(StrFixedLenField("data", 0, length=16),