Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/scapy/layers/zigbee.py: 64%

1# SPDX-License-Identifier: GPL-2.0-only 

2# This file is part of Scapy 

3# See https://scapy.net/ for more information 

4# Copyright (C) Ryan Speers <ryan@rmspeers.com> 2011-2012 

5# Copyright (C) Roger Meyer <roger.meyer@csus.edu>: 2012-03-10 Added frames 

6# Copyright (C) Gabriel Potter <gabriel[]potter[]fr>: 2018 

7# Copyright (C) 2020-2021 Dimitrios-Georgios Akestoridis <akestoridis@cmu.edu> 

8 

9""" 

10ZigBee bindings for IEEE 802.15.4. 

11""" 

12 

13import struct 

14 

15from scapy.packet import bind_layers, bind_bottom_up, Packet 

16from scapy.fields import BitField, ByteField, XLEIntField, ConditionalField, \ 

17 ByteEnumField, EnumField, BitEnumField, FieldListField, FlagsField, \ 

18 IntField, PacketListField, ShortField, StrField, StrFixedLenField, \ 

19 StrLenField, XLEShortField, XStrField 

20 

21from scapy.layers.dot15d4 import dot15d4AddressField, Dot15d4Beacon, Dot15d4, \ 

22 Dot15d4FCS 

23from scapy.layers.inet import UDP 

24from scapy.layers.ntp import TimeStampField 

25 

26 

27# APS Profile Identifiers 

28_aps_profile_identifiers = { 

29 0x0000: "Zigbee_Device_Profile", 

30 0x0101: "IPM_Industrial_Plant_Monitoring", 

31 0x0104: "HA_Home_Automation", 

32 0x0105: "CBA_Commercial_Building_Automation", 

33 0x0107: "TA_Telecom_Applications", 

34 0x0108: "HC_Health_Care", 

35 0x0109: "SE_Smart_Energy_Profile", 

36} 

37 

38# ZigBee Cluster Library Identifiers, Table 2.2 ZCL 

39_zcl_cluster_identifier = { 

40 # Functional Domain: General 

41 0x0000: "basic", 

42 0x0001: "power_configuration", 

43 0x0002: "device_temperature_configuration", 

44 0x0003: "identify", 

45 0x0004: "groups", 

46 0x0005: "scenes", 

47 0x0006: "on_off", 

48 0x0007: "on_off_switch_configuration", 

49 0x0008: "level_control", 

50 0x0009: "alarms", 

51 0x000a: "time", 

52 0x000b: "rssi_location", 

53 0x000c: "analog_input", 

54 0x000d: "analog_output", 

55 0x000e: "analog_value", 

56 0x000f: "binary_input", 

57 0x0010: "binary_output", 

58 0x0011: "binary_value", 

59 0x0012: "multistate_input", 

60 0x0013: "multistate_output", 

61 0x0014: "multistate_value", 

62 0x0015: "commissioning", 

63 # 0x0016 - 0x00ff reserved 

64 # Functional Domain: Closures 

65 0x0100: "shade_configuration", 

66 # 0x0101 - 0x01ff reserved 

67 # Functional Domain: HVAC 

68 0x0200: "pump_configuration_and_control", 

69 0x0201: "thermostat", 

70 0x0202: "fan_control", 

71 0x0203: "dehumidification_control", 

72 0x0204: "thermostat_user_interface_configuration", 

73 # 0x0205 - 0x02ff reserved 

74 # Functional Domain: Lighting 

75 0x0300: "color_control", 

76 0x0301: "ballast_configuration", 

77 # Functional Domain: Measurement and sensing 

78 0x0400: "illuminance_measurement", 

79 0x0401: "illuminance_level_sensing", 

80 0x0402: "temperature_measurement", 

81 0x0403: "pressure_measurement", 

82 0x0404: "flow_measurement", 

83 0x0405: "relative_humidity_measurement", 

84 0x0406: "occupancy_sensing", 

85 # Functional Domain: Security and safethy 

86 0x0500: "ias_zone", 

87 0x0501: "ias_ace", 

88 0x0502: "ias_wd", 

89 # Functional Domain: Protocol Interfaces 

90 0x0600: "generic_tunnel", 

91 0x0601: "bacnet_protocol_tunnel", 

92 0x0602: "analog_input_regular", 

93 0x0603: "analog_input_extended", 

94 0x0604: "analog_output_regular", 

95 0x0605: "analog_output_extended", 

96 0x0606: "analog_value_regular", 

97 0x0607: "analog_value_extended", 

98 0x0608: "binary_input_regular", 

99 0x0609: "binary_input_extended", 

100 0x060a: "binary_output_regular", 

101 0x060b: "binary_output_extended", 

102 0x060c: "binary_value_regular", 

103 0x060d: "binary_value_extended", 

104 0x060e: "multistate_input_regular", 

105 0x060f: "multistate_input_extended", 

106 0x0610: "multistate_output_regular", 

107 0x0611: "multistate_output_extended", 

108 0x0612: "multistate_value_regular", 

109 0x0613: "multistate_value", 

110 # Smart Energy Profile Clusters 

111 0x0700: "price", 

112 0x0701: "demand_response_and_load_control", 

113 0x0702: "metering", 

114 0x0703: "messaging", 

115 0x0704: "smart_energy_tunneling", 

116 0x0705: "prepayment", 

117 # Functional Domain: General 

118 # Key Establishment 

119 0x0800: "key_establishment", 

120} 

121 

122# ZigBee Cluster Library, Table 2.8 ZCL Command Frames 

123_zcl_command_frames = { 

124 0x00: "read_attributes", 

125 0x01: "read_attributes_response", 

126 0x02: "write_attributes", 

127 0x03: "write_attributes_undivided", 

128 0x04: "write_attributes_response", 

129 0x05: "write_attributes_no_response", 

130 0x06: "configure_reporting", 

131 0x07: "configure_reporting_response", 

132 0x08: "read_reporting_configuration", 

133 0x09: "read_reporting_configuration_response", 

134 0x0a: "report_attributes", 

135 0x0b: "default_response", 

136 0x0c: "discover_attributes", 

137 0x0d: "discover_attributes_response", 

138 0x0e: "read_attributes_structured", 

139 0x0f: "write_attributes_structured", 

140 0x10: "write_attributes_structured_response", 

141 0x11: "discover_commands_received", 

142 0x12: "discover_commands_received_response", 

143 0x13: "discover_commands_generated", 

144 0x14: "discover_commands_generated_response", 

145 0x15: "discover_attributes_extended", 

146 0x16: "discover_attributes_extended_response", 

147 # 0x17 - 0xff Reserved 

148} 

149 

150# ZigBee Cluster Library, Table 2.16 Enumerated Status Values 

151_zcl_enumerated_status_values = { 

152 0x00: "SUCCESS", 

153 0x01: "FAILURE", 

154 # 0x02 - 0x7d Reserved 

155 0x7e: "NOT_AUTHORIZED", 

156 0x7f: "RESERVED_FIELD_NOT_ZERO", 

157 0x80: "MALFORMED_COMMAND", 

158 0x81: "UNSUP_CLUSTER_COMMAND", 

159 0x82: "UNSUP_GENERAL_COMMAND", 

160 0x83: "UNSUP_MANUF_CLUSTER_COMMAND", 

161 0x84: "UNSUP_MANUF_GENERAL_COMMAND", 

162 0x85: "INVALID_FIELD", 

163 0x86: "UNSUPPORTED_ATTRIBUTE", 

164 0x87: "INVALID_VALUE", 

165 0x88: "READ_ONLY", 

166 0x89: "INSUFFICIENT_SPACE", 

167 0x8a: "DUPLICATE_EXISTS", 

168 0x8b: "NOT_FOUND", 

169 0x8c: "UNREPORTABLE_ATTRIBUTE", 

170 0x8d: "INVALID_DATA_TYPE", 

171 0x8e: "INVALID_SELECTOR", 

172 0x8f: "WRITE_ONLY", 

173 0x90: "INCONSISTENT_STARTUP_STATE", 

174 0x91: "DEFINED_OUT_OF_BAND", 

175 0x92: "INCONSISTENT", 

176 0x93: "ACTION_DENIED", 

177 0x94: "TIMEOUT", 

178 0x95: "ABORT", 

179 0x96: "INVALID_IMAGE", 

180 0x97: "WAIT_FOR_DATA", 

181 0x98: "NO_IMAGE_AVAILABLE", 

182 0x99: "REQUIRE_MORE_IMAGE", 

183 0x9a: "NOTIFICATION_PENDING", 

184 # 0x9b - 0xbf Reserved 

185 0xc0: "HARDWARE_FAILURE", 

186 0xc1: "SOFTWARE_FAILURE", 

187 0xc2: "CALIBRATION_ERROR", 

188 0xc3: "UNSUPPORTED_CLUSTER", 

189 # 0xc4 - 0xff Reserved 

190} 

191 

192# ZigBee Cluster Library, Table 2.15 Data Types 

193_zcl_attribute_data_types = { 

194 0x00: "no_data", 

195 # General data 

196 0x08: "8-bit_data", 

197 0x09: "16-bit_data", 

198 0x0a: "24-bit_data", 

199 0x0b: "32-bit_data", 

200 0x0c: "40-bit_data", 

201 0x0d: "48-bit_data", 

202 0x0e: "56-bit_data", 

203 0x0f: "64-bit_data", 

204 # Logical 

205 0x10: "boolean", 

206 # Bitmap 

207 0x18: "8-bit_bitmap", 

208 0x19: "16-bit_bitmap", 

209 0x1a: "24-bit_bitmap", 

210 0x1b: "32-bit_bitmap", 

211 0x1c: "40-bit_bitmap", 

212 0x1d: "48-bit_bitmap", 

213 0x1e: "56-bit_bitmap", 

214 0x1f: "64-bit_bitmap", 

215 # Unsigned integer 

216 0x20: "Unsigned_8-bit_integer", 

217 0x21: "Unsigned_16-bit_integer", 

218 0x22: "Unsigned_24-bit_integer", 

219 0x23: "Unsigned_32-bit_integer", 

220 0x24: "Unsigned_40-bit_integer", 

221 0x25: "Unsigned_48-bit_integer", 

222 0x26: "Unsigned_56-bit_integer", 

223 0x27: "Unsigned_64-bit_integer", 

224 # Signed integer 

225 0x28: "Signed_8-bit_integer", 

226 0x29: "Signed_16-bit_integer", 

227 0x2a: "Signed_24-bit_integer", 

228 0x2b: "Signed_32-bit_integer", 

229 0x2c: "Signed_40-bit_integer", 

230 0x2d: "Signed_48-bit_integer", 

231 0x2e: "Signed_56-bit_integer", 

232 0x2f: "Signed_64-bit_integer", 

233 # Enumeration 

234 0x30: "8-bit_enumeration", 

235 0x31: "16-bit_enumeration", 

236 # Floating point 

237 0x38: "semi_precision", 

238 0x39: "single_precision", 

239 0x3a: "double_precision", 

240 # String 

241 0x41: "octet-string", 

242 0x42: "character_string", 

243 0x43: "long_octet_string", 

244 0x44: "long_character_string", 

245 # Ordered sequence 

246 0x48: "array", 

247 0x4c: "structure", 

248 # Collection 

249 0x50: "set", 

250 0x51: "bag", 

251 # Time 

252 0xe0: "time_of_day", 

253 0xe1: "date", 

254 0xe2: "utc_time", 

255 # Identifier 

256 0xe8: "cluster_id", 

257 0xe9: "attribute_id", 

258 0xea: "bacnet_oid", 

259 # Miscellaneous 

260 0xf0: "ieee_address", 

261 0xf1: "128-bit_security_key", 

262 # Unknown 

263 0xff: "unknown", 

264} 

265 

266# Zigbee Cluster Library, IAS Zone, Enroll Response Codes 

267_zcl_ias_zone_enroll_response_codes = { 

268 0x00: "Success", 

269 0x01: "Not supported", 

270 0x02: "No enroll permit", 

271 0x03: "Too many zones", 

272} 

273 

274# Zigbee Cluster Library, IAS Zone, Zone Types 

275_zcl_ias_zone_zone_types = { 

276 0x0000: "Standard CIE", 

277 0x000d: "Motion sensor", 

278 0x0015: "Contact switch", 

279 0x0028: "Fire sensor", 

280 0x002a: "Water sensor", 

281 0x002b: "Carbon Monoxide (CO) sensor", 

282 0x002c: "Personal emergency device", 

283 0x002d: "Vibration/Movement sensor", 

284 0x010f: "Remote Control", 

285 0x0115: "Key fob", 

286 0x021d: "Keypad", 

287 0x0225: "Standard Warning Device", 

288 0x0226: "Glass break sensor", 

289 0x0229: "Security repeater", 

290 # 0x8000 - 0xfffe Manufacturer-specific types 

291 0xffff: "Invalid Zone Type", 

292} 

293 

294 

295# ZigBee # 

296 

297class ZigbeeNWK(Packet): 

298 name = "Zigbee Network Layer" 

299 fields_desc = [ 

300 BitField("discover_route", 0, 2), 

301 BitField("proto_version", 2, 4), 

302 BitEnumField("frametype", 0, 2, 

303 {0: 'data', 1: 'command', 3: 'Inter-PAN'}), 

304 FlagsField("flags", 0, 8, ['multicast', 'security', 'source_route', 'extended_dst', 'extended_src', 'reserved1', 'reserved2', 'reserved3']), # noqa: E501 

305 XLEShortField("destination", 0), 

306 XLEShortField("source", 0), 

307 ByteField("radius", 0), 

308 ByteField("seqnum", 1), 

309 

310 # ConditionalField(XLongField("ext_dst", 0), lambda pkt:pkt.flags & 8), 

311 

312 ConditionalField(dot15d4AddressField("ext_dst", 0, adjust=lambda pkt, x: 8), lambda pkt:pkt.flags & 8), # noqa: E501 

313 ConditionalField(dot15d4AddressField("ext_src", 0, adjust=lambda pkt, x: 8), lambda pkt:pkt.flags & 16), # noqa: E501 

314 

315 ConditionalField(ByteField("relay_count", 1), lambda pkt:pkt.flags & 0x04), # noqa: E501 

316 ConditionalField(ByteField("relay_index", 0), lambda pkt:pkt.flags & 0x04), # noqa: E501 

317 ConditionalField(FieldListField("relays", [], XLEShortField("", 0x0000), count_from=lambda pkt:pkt.relay_count), lambda pkt:pkt.flags & 0x04), # noqa: E501 

318 ] 

319 

320 @classmethod 

321 def dispatch_hook(cls, _pkt=None, *args, **kargs): 

322 if _pkt and len(_pkt) >= 2: 

323 frametype = ord(_pkt[:1]) & 3 

324 if frametype == 3: 

325 return ZigbeeNWKStub 

326 return cls 

327 

328 def guess_payload_class(self, payload): 

329 if self.flags.security: 

330 return ZigbeeSecurityHeader 

331 elif self.frametype == 0: 

332 return ZigbeeAppDataPayload 

333 elif self.frametype == 1: 

334 return ZigbeeNWKCommandPayload 

335 else: 

336 return Packet.guess_payload_class(self, payload) 

337 

338 

339class LinkStatusEntry(Packet): 

340 name = "ZigBee Link Status Entry" 

341 

342 fields_desc = [ 

343 # Neighbor network address (2 octets) 

344 XLEShortField("neighbor_network_address", 0x0000), 

345 # Link status (1 octet) 

346 BitField("reserved1", 0, 1), 

347 BitField("outgoing_cost", 0, 3), 

348 BitField("reserved2", 0, 1), 

349 BitField("incoming_cost", 0, 3), 

350 ] 

351 

352 def extract_padding(self, p): 

353 return b"", p 

354 

355 

356class ZigbeeNWKCommandPayload(Packet): 

357 name = "Zigbee Network Layer Command Payload" 

358 fields_desc = [ 

359 ByteEnumField("cmd_identifier", 1, { 

360 1: "route request", 

361 2: "route reply", 

362 3: "network status", 

363 4: "leave", 

364 5: "route record", 

365 6: "rejoin request", 

366 7: "rejoin response", 

367 8: "link status", 

368 9: "network report", 

369 10: "network update", 

370 11: "end device timeout request", 

371 12: "end device timeout response" 

372 # 0x0d - 0xff reserved 

373 }), 

374 

375 # - Route Request Command - # 

376 # Command options (1 octet) 

377 ConditionalField(BitField("res1", 0, 1), 

378 lambda pkt: pkt.cmd_identifier in [1, 2]), 

379 ConditionalField(BitField("multicast", 0, 1), 

380 lambda pkt: pkt.cmd_identifier in [1, 2]), 

381 ConditionalField(BitField("dest_addr_bit", 0, 1), lambda pkt: pkt.cmd_identifier == 1), # noqa: E501 

382 ConditionalField( 

383 BitEnumField("many_to_one", 0, 2, { 

384 0: "not_m2one", 1: "m2one_support_rrt", 2: "m2one_no_support_rrt", 3: "reserved"} # noqa: E501 

385 ), lambda pkt: pkt.cmd_identifier == 1), 

386 ConditionalField(BitField("res2", 0, 3), lambda pkt: pkt.cmd_identifier == 1), # noqa: E501 

387 

388 # - Route Reply Command - # 

389 # Command options (1 octet) 

390 ConditionalField(BitField("responder_addr_bit", 0, 1), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

391 ConditionalField(BitField("originator_addr_bit", 0, 1), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

392 ConditionalField(BitField("res3", 0, 4), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

393 # Route request identifier (1 octet) 

394 ConditionalField(ByteField("route_request_identifier", 0), 

395 lambda pkt: pkt.cmd_identifier in [1, 2]), # noqa: E501 

396 # Originator address (2 octets) 

397 ConditionalField(XLEShortField("originator_address", 0x0000), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

398 # Responder address (2 octets) 

399 ConditionalField(XLEShortField("responder_address", 0x0000), lambda pkt: pkt.cmd_identifier == 2), # noqa: E501 

400 

401 # - Network Status Command - # 

402 # Status code (1 octet) 

403 ConditionalField(ByteEnumField("status_code", 0, { 

404 0x00: "No route available", 

405 0x01: "Tree link failure", 

406 0x02: "Non-tree link failure", 

407 0x03: "Low battery level", 

408 0x04: "No routing capacity", 

409 0x05: "No indirect capacity", 

410 0x06: "Indirect transaction expiry", 

411 0x07: "Target device unavailable", 

412 0x08: "Target address unallocated", 

413 0x09: "Parent link failure", 

414 0x0a: "Validate route", 

415 0x0b: "Source route failure", 

416 0x0c: "Many-to-one route failure", 

417 0x0d: "Address conflict", 

418 0x0e: "Verify addresses", 

419 0x0f: "PAN identifier update", 

420 0x10: "Network address update", 

421 0x11: "Bad frame counter", 

422 0x12: "Bad key sequence number", 

423 # 0x13 - 0xff Reserved 

424 }), lambda pkt: pkt.cmd_identifier == 3), 

425 # Destination address (2 octets) 

426 ConditionalField(XLEShortField("destination_address", 0x0000), 

427 lambda pkt: pkt.cmd_identifier in [1, 3]), 

428 # Path cost (1 octet) 

429 ConditionalField(ByteField("path_cost", 0), 

430 lambda pkt: pkt.cmd_identifier in [1, 2]), # noqa: E501 

431 # Destination IEEE Address (0/8 octets), only present when dest_addr_bit has a value of 1 # noqa: E501 

432 ConditionalField(dot15d4AddressField("ext_dst", 0, adjust=lambda pkt, x: 8), # noqa: E501 

433 lambda pkt: (pkt.cmd_identifier == 1 and pkt.dest_addr_bit == 1)), # noqa: E501 

434 # Originator IEEE address (0/8 octets) 

435 ConditionalField(dot15d4AddressField("originator_addr", 0, adjust=lambda pkt, x: 8), # noqa: E501 

436 lambda pkt: (pkt.cmd_identifier == 2 and pkt.originator_addr_bit == 1)), # noqa: E501 

437 # Responder IEEE address (0/8 octets) 

438 ConditionalField(dot15d4AddressField("responder_addr", 0, adjust=lambda pkt, x: 8), # noqa: E501 

439 lambda pkt: (pkt.cmd_identifier == 2 and pkt.responder_addr_bit == 1)), # noqa: E501 

440 

441 # - Leave Command - # 

442 # Command options (1 octet) 

443 # Bit 7: Remove children 

444 ConditionalField(BitField("remove_children", 0, 1), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

445 # Bit 6: Request 

446 ConditionalField(BitField("request", 0, 1), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

447 # Bit 5: Rejoin 

448 ConditionalField(BitField("rejoin", 0, 1), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

449 # Bit 0 - 4: Reserved 

450 ConditionalField(BitField("res4", 0, 5), lambda pkt: pkt.cmd_identifier == 4), # noqa: E501 

451 

452 # - Route Record Command - # 

453 # Relay count (1 octet) 

454 ConditionalField(ByteField("rr_relay_count", 0), lambda pkt: pkt.cmd_identifier == 5), # noqa: E501 

455 # Relay list (variable in length) 

456 ConditionalField( 

457 FieldListField("rr_relay_list", [], XLEShortField("", 0x0000), count_from=lambda pkt:pkt.rr_relay_count), # noqa: E501 

458 lambda pkt:pkt.cmd_identifier == 5), 

459 

460 # - Rejoin Request Command - # 

461 # Capability Information (1 octet) 

462 ConditionalField(BitField("allocate_address", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Allocate Address # noqa: E501 

463 ConditionalField(BitField("security_capability", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Security Capability # noqa: E501 

464 ConditionalField(BitField("reserved2", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # bit 5 is reserved # noqa: E501 

465 ConditionalField(BitField("reserved1", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # bit 4 is reserved # noqa: E501 

466 ConditionalField(BitField("receiver_on_when_idle", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Receiver On When Idle # noqa: E501 

467 ConditionalField(BitField("power_source", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Power Source # noqa: E501 

468 ConditionalField(BitField("device_type", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Device Type # noqa: E501 

469 ConditionalField(BitField("alternate_pan_coordinator", 0, 1), lambda pkt:pkt.cmd_identifier == 6), # Alternate PAN Coordinator # noqa: E501 

470 

471 # - Rejoin Response Command - # 

472 # Network address (2 octets) 

473 ConditionalField(XLEShortField("network_address", 0xFFFF), lambda pkt:pkt.cmd_identifier == 7), # noqa: E501 

474 # Rejoin status (1 octet) 

475 ConditionalField(ByteField("rejoin_status", 0), lambda pkt:pkt.cmd_identifier == 7), # noqa: E501 

476 

477 # - Link Status Command - # 

478 # Command options (1 octet) 

479 ConditionalField(BitField("res5", 0, 1), lambda pkt:pkt.cmd_identifier == 8), # Reserved # noqa: E501 

480 ConditionalField(BitField("last_frame", 0, 1), lambda pkt:pkt.cmd_identifier == 8), # Last frame # noqa: E501 

481 ConditionalField(BitField("first_frame", 0, 1), lambda pkt:pkt.cmd_identifier == 8), # First frame # noqa: E501 

482 ConditionalField(BitField("entry_count", 0, 5), lambda pkt:pkt.cmd_identifier == 8), # Entry count # noqa: E501 

483 # Link status list (variable size) 

484 ConditionalField( 

485 PacketListField("link_status_list", [], LinkStatusEntry, count_from=lambda pkt:pkt.entry_count), # noqa: E501 

486 lambda pkt:pkt.cmd_identifier == 8), 

487 

488 # - Network Report Command - # 

489 # Command options (1 octet) 

490 ConditionalField( 

491 BitEnumField("report_command_identifier", 0, 3, {0: "PAN identifier conflict"}), # 0x01 - 0x07 Reserved # noqa: E501 

492 lambda pkt: pkt.cmd_identifier == 9), 

493 ConditionalField(BitField("report_information_count", 0, 5), lambda pkt: pkt.cmd_identifier == 9), # noqa: E501 

494 

495 # - Network Update Command - # 

496 # Command options (1 octet) 

497 ConditionalField( 

498 BitEnumField("update_command_identifier", 0, 3, {0: "PAN Identifier Update"}), # 0x01 - 0x07 Reserved # noqa: E501 

499 lambda pkt: pkt.cmd_identifier == 10), 

500 ConditionalField(BitField("update_information_count", 0, 5), lambda pkt: pkt.cmd_identifier == 10), # noqa: E501 

501 # EPID: Extended PAN ID (8 octets) 

502 ConditionalField( 

503 dot15d4AddressField("epid", 0, adjust=lambda pkt, x: 8), 

504 lambda pkt: pkt.cmd_identifier in [9, 10] 

505 ), 

506 # Report information (variable length) 

507 # Only present if we have a PAN Identifier Conflict Report 

508 ConditionalField( 

509 FieldListField("PAN_ID_conflict_report", [], XLEShortField("", 0x0000), # noqa: E501 

510 count_from=lambda pkt:pkt.report_information_count), 

511 lambda pkt:(pkt.cmd_identifier == 9 and pkt.report_command_identifier == 0) # noqa: E501 

512 ), 

513 # Update Id (1 octet) 

514 ConditionalField(ByteField("update_id", 0), lambda pkt: pkt.cmd_identifier == 10), # noqa: E501 

515 # Update Information (Variable) 

516 # Only present if we have a PAN Identifier Update 

517 # New PAN ID (2 octets) 

518 ConditionalField(XLEShortField("new_PAN_ID", 0x0000), 

519 lambda pkt: (pkt.cmd_identifier == 10 and pkt.update_command_identifier == 0)), # noqa: E501 

520 

521 # - End Device Timeout Request Command - # 

522 # Requested Timeout (1 octet) 

523 ConditionalField( 

524 ByteEnumField("req_timeout", 3, { 

525 0: "10 seconds", 

526 1: "2 minutes", 

527 2: "4 minutes", 

528 3: "8 minutes", 

529 4: "16 minutes", 

530 5: "32 minutes", 

531 6: "64 minutes", 

532 7: "128 minutes", 

533 8: "256 minutes", 

534 9: "512 minutes", 

535 10: "1024 minutes", 

536 11: "2048 minutes", 

537 12: "4096 minutes", 

538 13: "8192 minutes", 

539 14: "16384 minutes" 

540 }), 

541 lambda pkt: pkt.cmd_identifier == 11), 

542 # End Device Configuration (1 octet) 

543 ConditionalField( 

544 ByteField("ed_conf", 0), 

545 lambda pkt: pkt.cmd_identifier == 11), 

546 

547 # - End Device Timeout Response Command - # 

548 # Status (1 octet) 

549 ConditionalField( 

550 ByteEnumField("status", 0, { 

551 0: "Success", 

552 1: "Incorrect Value" 

553 }), 

554 lambda pkt: pkt.cmd_identifier == 12), 

555 # Parent Information (1 octet) 

556 ConditionalField( 

557 BitField("res6", 0, 6), 

558 lambda pkt: pkt.cmd_identifier == 12), 

559 ConditionalField( 

560 BitField("ed_timeout_req_keepalive", 0, 1), 

561 lambda pkt: pkt.cmd_identifier == 12), 

562 ConditionalField( 

563 BitField("mac_data_poll_keepalive", 0, 1), 

564 lambda pkt: pkt.cmd_identifier == 12) 

565 

566 # StrField("data", ""), 

567 ] 

568 

569 

570def util_mic_len(pkt): 

571 ''' Calculate the length of the attribute value field ''' 

572 if (pkt.nwk_seclevel == 0): # no encryption, no mic 

573 return 0 

574 elif (pkt.nwk_seclevel == 1): # MIC-32 

575 return 4 

576 elif (pkt.nwk_seclevel == 2): # MIC-64 

577 return 8 

578 elif (pkt.nwk_seclevel == 3): # MIC-128 

579 return 16 

580 elif (pkt.nwk_seclevel == 4): # ENC 

581 return 0 

582 elif (pkt.nwk_seclevel == 5): # ENC-MIC-32 

583 return 4 

584 elif (pkt.nwk_seclevel == 6): # ENC-MIC-64 

585 return 8 

586 elif (pkt.nwk_seclevel == 7): # ENC-MIC-128 

587 return 16 

588 else: 

589 return 0 

590 

591 

592class ZigbeeSecurityHeader(Packet): 

593 name = "Zigbee Security Header" 

594 fields_desc = [ 

595 # Security control (1 octet) 

596 FlagsField("reserved1", 0, 2, ['reserved1', 'reserved2']), 

597 BitField("extended_nonce", 1, 1), # set to 1 if the sender address field is present (source) # noqa: E501 

598 # Key identifier 

599 BitEnumField("key_type", 1, 2, { 

600 0: 'data_key', 

601 1: 'network_key', 

602 2: 'key_transport_key', 

603 3: 'key_load_key' 

604 }), 

605 # Security level (3 bits) 

606 BitEnumField("nwk_seclevel", 0, 3, { 

607 0: "None", 

608 1: "MIC-32", 

609 2: "MIC-64", 

610 3: "MIC-128", 

611 4: "ENC", 

612 5: "ENC-MIC-32", 

613 6: "ENC-MIC-64", 

614 7: "ENC-MIC-128" 

615 }), 

616 # Frame counter (4 octets) 

617 XLEIntField("fc", 0), # provide frame freshness and prevent duplicate frames # noqa: E501 

618 # Source address (0/8 octets) 

619 ConditionalField(dot15d4AddressField("source", 0, adjust=lambda pkt, x: 8), lambda pkt: pkt.extended_nonce), # noqa: E501 

620 # Key sequence number (0/1 octet): only present when key identifier is 1 (network key) # noqa: E501 

621 ConditionalField(ByteField("key_seqnum", 0), lambda pkt: pkt.getfieldval("key_type") == 1), # noqa: E501 

622 # Payload 

623 # the length of the encrypted data is the payload length minus the MIC 

624 StrField("data", ""), # noqa: E501 

625 # Message Integrity Code (0/variable in size), length depends on nwk_seclevel # noqa: E501 

626 XStrField("mic", ""), 

627 ] 

628 

629 def post_dissect(self, s): 

630 # Get the mic dissected correctly 

631 mic_length = util_mic_len(self) 

632 if mic_length > 0: # Slice "data" into "data + mic" 

633 _data, _mic = self.data[:-mic_length], self.data[-mic_length:] 

634 self.data, self.mic = _data, _mic 

635 return s 

636 

637 

638class ZigbeeAppDataPayload(Packet): 

639 name = "Zigbee Application Layer Data Payload (General APS Frame Format)" 

640 fields_desc = [ 

641 # Frame control (1 octet) 

642 FlagsField("frame_control", 2, 4, 

643 ['ack_format', 'security', 'ack_req', 'extended_hdr']), 

644 BitEnumField("delivery_mode", 0, 2, 

645 {0: 'unicast', 1: 'indirect', 

646 2: 'broadcast', 3: 'group_addressing'}), 

647 BitEnumField("aps_frametype", 0, 2, 

648 {0: 'data', 1: 'command', 2: 'ack'}), 

649 # Destination endpoint (0/1 octet) 

650 ConditionalField( 

651 ByteField("dst_endpoint", 10), 

652 lambda pkt: ((pkt.aps_frametype == 0 and 

653 pkt.delivery_mode in [0, 2]) or 

654 (pkt.aps_frametype == 2 and not 

655 pkt.frame_control.ack_format)) 

656 ), 

657 # Group address (0/2 octets) 

658 ConditionalField( 

659 XLEShortField("group_addr", 0x0000), 

660 lambda pkt: (pkt.aps_frametype == 0 and pkt.delivery_mode == 3) 

661 ), 

662 # Cluster identifier (0/2 octets) 

663 ConditionalField( 

664 # unsigned short (little-endian) 

665 XLEShortField("cluster", 0x0000), 

666 lambda pkt: ((pkt.aps_frametype == 0) or 

667 (pkt.aps_frametype == 2 and not 

668 pkt.frame_control.ack_format)) 

669 ), 

670 # Profile identifier (0/2 octets) 

671 ConditionalField( 

672 EnumField("profile", 0, _aps_profile_identifiers, fmt="<H"), 

673 lambda pkt: ((pkt.aps_frametype == 0) or 

674 (pkt.aps_frametype == 2 and not 

675 pkt.frame_control.ack_format)) 

676 ), 

677 # Source endpoint (0/1 octets) 

678 ConditionalField( 

679 ByteField("src_endpoint", 10), 

680 lambda pkt: ((pkt.aps_frametype == 0) or 

681 (pkt.aps_frametype == 2 and not 

682 pkt.frame_control.ack_format)) 

683 ), 

684 # APS counter (1 octet) 

685 ByteField("counter", 0), 

686 # Extended header (0/1/2 octets) 

687 # cribbed from https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-zbee-aps.c # noqa: E501 

688 ConditionalField( 

689 ByteEnumField( 

690 "fragmentation", 0, 

691 {0: "none", 1: "first_block", 2: "middle_block"}), 

692 lambda pkt: (pkt.aps_frametype in [0, 2] and 

693 pkt.frame_control.extended_hdr) 

694 ), 

695 ConditionalField( 

696 ByteField("block_number", 0), 

697 lambda pkt: (pkt.aps_frametype in [0, 2] and 

698 pkt.fragmentation in [1, 2]) 

699 ), 

700 ConditionalField( 

701 ByteField("ack_bitfield", 0), 

702 lambda pkt: (pkt.aps_frametype == 2 and 

703 pkt.fragmentation in [1, 2]) 

704 ), 

705 # variable length frame payload: 

706 # 3 frame types: data, APS command, and acknowledgement 

707 # ConditionalField(StrField("data", ""), lambda pkt:pkt.aps_frametype == 0), # noqa: E501 

708 ] 

709 

710 def guess_payload_class(self, payload): 

711 if self.frame_control & 0x02: # we have a security header 

712 return ZigbeeSecurityHeader 

713 elif self.aps_frametype == 0: # data 

714 if self.profile == 0x0000: 

715 return ZigbeeDeviceProfile 

716 else: 

717 return ZigbeeClusterLibrary 

718 elif self.aps_frametype == 1: # command 

719 return ZigbeeAppCommandPayload 

720 else: 

721 return Packet.guess_payload_class(self, payload) 

722 

723 

724_TransportKeyKeyTypes = { 

725 0x00: "Trust Center Master Key", 

726 0x01: "Standard Network Key", 

727 0x02: "Application Master Key", 

728 0x03: "Application Link Key", 

729 0x04: "Trust Center Link Key", 

730 0x05: "High-Security Network Key", 

731} 

732 

733 

734_RequestKeyKeyTypes = { 

735 0x02: "Application Link Key", 

736 0x04: "Trust Center Link Key", 

737} 

738 

739 

740_ApsStatusValues = { 

741 0x00: "SUCCESS", 

742 0xa0: "ASDU_TOO_LONG", 

743 0xa1: "DEFRAG_DEFERRED", 

744 0xa2: "DEFRAG_UNSUPPORTED", 

745 0xa3: "ILLEGAL_REQUEST", 

746 0xa4: "INVALID_BINDING", 

747 0xa5: "INVALID_GROUP", 

748 0xa6: "INVALID_PARAMETER", 

749 0xa7: "NO_ACK", 

750 0xa8: "NO_BOUND_DEVICE", 

751 0xa9: "NO_SHORT_ADDRESS", 

752 0xaa: "NOT_SUPPORTED", 

753 0xab: "SECURED_LINK_KEY", 

754 0xac: "SECURED_NWK_KEY", 

755 0xad: "SECURITY_FAIL", 

756 0xae: "TABLE_FULL", 

757 0xaf: "UNSECURED", 

758 0xb0: "UNSUPPORTED_ATTRIBUTE" 

759} 

760 

761 

762class ZigbeeAppCommandPayload(Packet): 

763 name = "Zigbee Application Layer Command Payload" 

764 fields_desc = [ 

765 ByteEnumField("cmd_identifier", 1, { 

766 1: "APS_CMD_SKKE_1", 

767 2: "APS_CMD_SKKE_2", 

768 3: "APS_CMD_SKKE_3", 

769 4: "APS_CMD_SKKE_4", 

770 5: "APS_CMD_TRANSPORT_KEY", 

771 6: "APS_CMD_UPDATE_DEVICE", 

772 7: "APS_CMD_REMOVE_DEVICE", 

773 8: "APS_CMD_REQUEST_KEY", 

774 9: "APS_CMD_SWITCH_KEY", 

775 # TODO: implement 10 to 13 

776 10: "APS_CMD_EA_INIT_CHLNG", 

777 11: "APS_CMD_EA_RSP_CHLNG", 

778 12: "APS_CMD_EA_INIT_MAC_DATA", 

779 13: "APS_CMD_EA_RSP_MAC_DATA", 

780 14: "APS_CMD_TUNNEL", 

781 15: "APS_CMD_VERIFY_KEY", 

782 16: "APS_CMD_CONFIRM_KEY" 

783 }), 

784 # SKKE Commands 

785 ConditionalField(dot15d4AddressField("initiator", 0, 

786 adjust=lambda pkt, x: 8), 

787 lambda pkt: pkt.cmd_identifier in [1, 2, 3, 4]), 

788 ConditionalField(dot15d4AddressField("responder", 0, 

789 adjust=lambda pkt, x: 8), 

790 lambda pkt: pkt.cmd_identifier in [1, 2, 3, 4]), 

791 ConditionalField(StrFixedLenField("data", 0, length=16),