/* packet-iec104.c

 * Routines for IEC-60870-5-101 & 104 Protocol disassembly

 *

 * Copyright (c) 2008 by Joan Ramio <joan@ramio.cat>

 * Joan is a masculine catalan name. Search the Internet for Joan Pujol (alias Garbo).

 *

 * Copyright (c) 2009 by Kjell Hultman <kjell.hultman@gmail.com>

 * Added dissection of signal (ASDU) information.

 * Kjell is also a masculine name, but a Scandinavian one.

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1999 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <math.h> /* floor */

#include <epan/packet.h>

#include <epan/prefs.h>

#include <epan/expert.h>

#include <epan/reassemble.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <wsutil/str_util.h>

#include "packet-tcp.h"

void proto_register_iec60870_104(void);

void proto_reg_handoff_iec60870_104(void);

void proto_register_iec60870_101(void);

void proto_reg_handoff_iec60870_101(void);

void proto_register_iec60870_5_103(void);

void proto_reg_handoff_iec60870_5_103(void);

void proto_register_iec60870_asdu(void);

static int dissect_iec60870_asdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data);

static dissector_handle_t iec60870_asdu_handle;

static dissector_handle_t iec60870_104_handle;

static dissector_handle_t iec60870_101_handle;

static dissector_handle_t iec60870_5_103_handle;

static reassembly_table iec60870_reassemble_table;

/* the asdu header structure */

struct asduheader {

  uint32_t Addr;

  uint8_t OA;

  uint8_t TypeId;

  uint8_t TNCause;

  uint32_t IOA;

  uint8_t NumIx;

  uint8_t SQ;

  uint8_t DataLength;

};

struct asdu_parms {

  unsigned cot_len;

  unsigned asdu_addr_len;

  unsigned ioa_len;

};

#define IEC104_PORT     2404

/* Define the iec101/103/104 protos */

static int proto_iec60870_101;

static int proto_iec60870_5_103;

static int proto_iec60870_104;

static int proto_iec60870_asdu;

/* Protocol constants */

#define APCI_START  0x68

#define APCI_LEN  6

#define APCI_START_LEN  2

#define APCI_DATA_LEN (APCI_LEN - APCI_START_LEN)

#define APDU_MIN_LEN  4

#define APDU_MAX_LEN  253

/* ASDU_HEAD_LEN: Includes Asdu head and first IOA */

#define ASDU_HEAD_LEN 9

#define F_TEST  0x80

#define F_NEGA  0x40

#define F_CAUSE 0x3F

#define F_SQ    0x80

/* APCI types */

/* Type I is only lowest bit set to 0 */

#define I_TYPE    0

#define S_TYPE    1

#define U_TYPE    3

#define APCI_TYPE_UNKNOWN 4

static const value_string apci_types [] = {

  { I_TYPE,   "I" },

  { S_TYPE,   "S" },

  { U_TYPE,   "U" },

  { 0, NULL }

};

/* Constants relative to the field, independent of the field position in the byte */

/* U (Unnumbered) constants */

#define U_STARTDT_ACT     0x01

#define U_STARTDT_CON   0x02

#define U_STOPDT_ACT    0x04

#define U_STOPDT_CON    0x08

#define U_TESTFR_ACT    0x10

#define U_TESTFR_CON    0x20

static const value_string u_types[] = {

  { U_STARTDT_ACT,    "STARTDT act" },

  { U_STARTDT_CON,    "STARTDT con" },

  { U_STOPDT_ACT,     "STOPDT act" },

  { U_STOPDT_CON,     "STOPDT con" },

  { U_TESTFR_ACT,     "TESTFR act" },

  { U_TESTFR_CON,     "TESTFR con" },

  { 0, NULL }

};

/* ASDU types (TypeId) */

#define M_SP_NA_1  1    /* single-point information                 */

#define M_SP_TA_1  2    /* single-point information with time tag             */

#define M_DP_NA_1  3    /* double-point information                 */

#define M_DP_TA_1  4    /* double-point information with time tag             */

#define M_ST_NA_1  5    /* step position information                */

#define M_ST_TA_1  6    /* step position information with time tag            */

#define M_BO_NA_1  7    /* bitstring of 32 bits                 */

#define M_BO_TA_1  8    /* bitstring of 32 bits with time tag               */

#define M_ME_NA_1  9    /* measured value, normalized value               */

#define M_ME_TA_1  10    /* measured value, normalized value with time tag           */

#define M_ME_NB_1  11    /* measured value, scaled value               */

#define M_ME_TB_1  12    /* measured value, scaled value with time tag             */

#define M_ME_NC_1  13    /* measured value, short floating point number          */

#define M_ME_TC_1  14    /* measured value, short floating point number with time tag        */

#define M_IT_NA_1  15    /* integrated totals                  */

#define M_IT_TA_1  16    /* integrated totals with time tag              */

#define M_EP_TA_1  17    /* event of protection equipment with time tag          */

#define M_EP_TB_1  18    /* packed start events of protection equipment with time tag        */

#define M_EP_TC_1  19    /* packed output circuit information of protection equipment with time tag    */

#define M_PS_NA_1  20    /* packed single-point information with status change detection       */

#define M_ME_ND_1  21    /* measured value, normalized value without quality descriptor      */

#define M_SP_TB_1  30    /* single-point information with time tag CP56Time2a          */

#define M_DP_TB_1  31    /* double-point information with time tag CP56Time2a          */

#define M_ST_TB_1  32    /* step position information with time tag CP56Time2a           */

#define M_BO_TB_1  33    /* bitstring of 32 bit with time tag CP56Time2a           */

#define M_ME_TD_1  34    /* measured value, normalized value with time tag CP56Time2a        */

#define M_ME_TE_1  35    /* measured value, scaled value with time tag CP56Time2a        */

#define M_ME_TF_1  36    /* measured value, short floating point number with time tag CP56Time2a     */

#define M_IT_TB_1  37    /* integrated totals with time tag CP56Time2a             */

#define M_EP_TD_1  38    /* event of protection equipment with time tag CP56Time2a         */

#define M_EP_TE_1  39    /* packed start events of protection equipment with time tag CP56Time2a     */

#define M_EP_TF_1  40    /* packed output circuit information of protection equipment with time tag CP56Time2a   */

#define S_IT_TC_1  41    /* integrated totals containing time tagged security statistics     */

#define C_SC_NA_1  45    /* single command                   */

#define C_DC_NA_1  46    /* double command                   */

#define C_RC_NA_1  47    /* regulating step command                */

#define C_SE_NA_1  48    /* set point command, normalized value            */

#define C_SE_NB_1  49    /* set point command, scaled value              */

#define C_SE_NC_1  50    /* set point command, short floating point number           */

#define C_BO_NA_1  51    /* bitstring of 32 bits                 */

#define C_SC_TA_1  58    /* single command with time tag CP56Time2a            */

#define C_DC_TA_1  59    /* double command with time tag CP56Time2a            */

#define C_RC_TA_1  60    /* regulating step command with time tag CP56Time2a           */

#define C_SE_TA_1  61    /* set point command, normalized value with time tag CP56Time2a       */

#define C_SE_TB_1  62    /* set point command, scaled value with time tag CP56Time2a         */

#define C_SE_TC_1  63    /* set point command, short floating-point number with time tag CP56Time2a    */

#define C_BO_TA_1  64    /* bitstring of 32 bits with time tag CP56Time2a          */

#define M_EI_NA_1  70    /* end of initialization                */

#define S_CH_NA_1  81    /* authentication challenge               */

#define S_RP_NA_1  82    /* authentication reply               */

#define S_AR_NA_1  83    /* aggressive mode authentication request session key status request      */

#define S_KR_NA_1  84    /* session key status request               */

#define S_KS_NA_1  85    /* session key status                 */

#define S_KC_NA_1  86    /* session key change                 */

#define S_ER_NA_1  87    /* authentication error               */

#define S_US_NA_1  90    /* user status change                  */

#define S_UQ_NA_1  91    /* update key change request               */

#define S_UR_NA_1  92    /* update key change reply               */

#define S_UK_NA_1  93    /* update key change symmetric               */

#define S_UA_NA_1  94    /* update key change asymmetric              */

#define S_UC_NA_1  95    /* update key change confirmation             */

#define C_IC_NA_1  100    /* interrogation command                */

#define C_CI_NA_1  101    /* counter interrogation command              */

#define C_RD_NA_1  102    /* read command                   */

#define C_CS_NA_1  103    /* clock synchronization command              */

#define C_TS_NA_1  104    /* test command                                                                       */

#define C_RP_NA_1  105    /* reset process command                */

#define C_CD_NA_1  106    /* delay acquisition command                */

#define C_TS_TA_1  107    /* test command with time tag CP56Time2a            */

#define P_ME_NA_1  110    /* parameter of measured value, normalized value          */

#define P_ME_NB_1  111    /* parameter of measured value, scaled value            */

#define P_ME_NC_1  112    /* parameter of measured value, short floating-point number         */

#define P_AC_NA_1  113    /* parameter activation                 */

#define F_FR_NA_1  120    /* file ready                   */

#define F_SR_NA_1  121    /* section ready                  */

#define F_SC_NA_1  122    /* call directory, select file, call file, call section         */

#define F_LS_NA_1  123    /* last section, last segment               */

#define F_AF_NA_1  124    /* ack file, ack section                */

#define F_SG_NA_1  125    /* segment                    */

#define F_DR_TA_1  126    /* directory                    */

#define F_SC_NB_1  127    /* Query Log - Request archive file               */

static const value_string asdu_types [] = {

  {  M_SP_NA_1,   "M_SP_NA_1" },

  {  M_SP_TA_1,   "M_SP_TA_1" },

  {  M_DP_NA_1,   "M_DP_NA_1" },

  {  M_DP_TA_1,   "M_DP_TA_1" },

  {  M_ST_NA_1,   "M_ST_NA_1" },

  {  M_ST_TA_1,   "M_ST_TA_1" },

  {  M_BO_NA_1,   "M_BO_NA_1" },

  {  M_BO_TA_1,   "M_BO_TA_1" },

  {  M_ME_NA_1,   "M_ME_NA_1" },

  {  M_ME_TA_1,   "M_ME_TA_1" },

  {  M_ME_NB_1,   "M_ME_NB_1" },

  {  M_ME_TB_1,   "M_ME_TB_1" },

  {  M_ME_NC_1,   "M_ME_NC_1" },

  {  M_ME_TC_1,   "M_ME_TC_1" },

  {  M_IT_NA_1,   "M_IT_NA_1" },

  {  M_IT_TA_1,   "M_IT_TA_1" },

  {  M_EP_TA_1,   "M_EP_TA_1" },

  {  M_EP_TB_1,   "M_EP_TB_1" },

  {  M_EP_TC_1,   "M_EP_TC_1" },

  {  M_PS_NA_1,   "M_PS_NA_1" },

  {  M_ME_ND_1,   "M_ME_ND_1" },

  {  M_SP_TB_1,   "M_SP_TB_1" },

  {  M_DP_TB_1,   "M_DP_TB_1" },

  {  M_ST_TB_1,   "M_ST_TB_1" },

  {  M_BO_TB_1,   "M_BO_TB_1" },

  {  M_ME_TD_1,   "M_ME_TD_1" },

  {  M_ME_TE_1,   "M_ME_TE_1" },

  {  M_ME_TF_1,   "M_ME_TF_1" },

  {  M_IT_TB_1,   "M_IT_TB_1" },

  {  M_EP_TD_1,   "M_EP_TD_1" },

  {  M_EP_TE_1,   "M_EP_TE_1" },

  {  M_EP_TF_1,   "M_EP_TF_1" },

  {  S_IT_TC_1,   "S_IT_TC_1" },

  {  C_SC_NA_1,   "C_SC_NA_1" },

  {  C_DC_NA_1,   "C_DC_NA_1" },

  {  C_RC_NA_1,   "C_RC_NA_1" },

  {  C_SE_NA_1,   "C_SE_NA_1" },

  {  C_SE_NB_1,   "C_SE_NB_1" },

  {  C_SE_NC_1,   "C_SE_NC_1" },

  {  C_BO_NA_1,   "C_BO_NA_1" },

  {  C_SC_TA_1,   "C_SC_TA_1" },

  {  C_DC_TA_1,   "C_DC_TA_1" },

  {  C_RC_TA_1,   "C_RC_TA_1" },

  {  C_SE_TA_1,   "C_SE_TA_1" },

  {  C_SE_TB_1,   "C_SE_TB_1" },

  {  C_SE_TC_1,   "C_SE_TC_1" },

  {  C_BO_TA_1,   "C_BO_TA_1" },

  {  M_EI_NA_1,   "M_EI_NA_1" },

  {  S_CH_NA_1,   "S_CH_NA_1" },

  {  S_RP_NA_1,   "S_RP_NA_1" },

  {  S_AR_NA_1,   "S_AR_NA_1" },

  {  S_KR_NA_1,   "S_KR_NA_1" },

  {  S_KS_NA_1,   "S_KS_NA_1" },

  {  S_KC_NA_1,   "S_KC_NA_1" },

  {  S_ER_NA_1,   "S_ER_NA_1" },

  {  S_US_NA_1,   "S_US_NA_1" },

  {  S_UQ_NA_1,   "S_UQ_NA_1" },

  {  S_UR_NA_1,   "S_UR_NA_1" },

  {  S_UK_NA_1,   "S_UK_NA_1" },

  {  S_UA_NA_1,   "S_UA_NA_1" },

  {  S_UC_NA_1,   "S_UC_NA_1" },

  {  C_IC_NA_1,   "C_IC_NA_1" },

  {  C_CI_NA_1,   "C_CI_NA_1" },

  {  C_RD_NA_1,   "C_RD_NA_1" },

  {  C_CS_NA_1,   "C_CS_NA_1" },

  {  C_TS_NA_1,   "C_TS_NA_1" },

  {  C_RP_NA_1,   "C_RP_NA_1" },

  {  C_CD_NA_1,   "C_CD_NA_1" },

  {  C_TS_TA_1,   "C_TS_TA_1" },

  {  P_ME_NA_1,   "P_ME_NA_1" },

  {  P_ME_NB_1,   "P_ME_NB_1" },

  {  P_ME_NC_1,   "P_ME_NC_1" },

  {  P_AC_NA_1,   "P_AC_NA_1" },

  {  F_FR_NA_1,   "F_FR_NA_1" },

  {  F_SR_NA_1,   "F_SR_NA_1" },

  {  F_SC_NA_1,   "F_SC_NA_1" },

  {  F_LS_NA_1,   "F_LS_NA_1" },

  {  F_AF_NA_1,   "F_AF_NA_1" },

  {  F_SG_NA_1,   "F_SG_NA_1" },

  {  F_DR_TA_1,   "F_DR_TA_1" },

  {  F_SC_NB_1,   "F_SC_NB_1" },

  { 0, NULL }

};

static const value_string asdu_lngtypes [] = {

  {  M_SP_NA_1,   "single-point information" },

  {  M_SP_TA_1,   "single-point information with time tag" },

  {  M_DP_NA_1,   "double-point information" },

  {  M_DP_TA_1,   "double-point information with time tag" },

  {  M_ST_NA_1,   "step position information" },

  {  M_ST_TA_1,   "step position information with time tag" },

  {  M_BO_NA_1,   "bitstring of 32 bits" },

  {  M_BO_TA_1,   "bitstring of 32 bits with time tag" },

  {  M_ME_NA_1,   "measured value, normalized value" },

  {  M_ME_TA_1,   "measured value, normalized value with time tag" },

  {  M_ME_NB_1,   "measured value, scaled value" },

  {  M_ME_TB_1,   "measured value, scaled value with time tag" },

  {  M_ME_NC_1,   "measured value, short floating point number" },

  {  M_ME_TC_1,   "measured value, short floating point number with time tag" },

  {  M_IT_NA_1,   "integrated totals" },

  {  M_IT_TA_1,   "integrated totals with time tag" },

  {  M_EP_TA_1,   "event of protection equipment with time tag" },

  {  M_EP_TB_1,   "packed start events of protection equipment with time tag" },

  {  M_EP_TC_1,   "packed output circuit information of protection equipment with time tag" },

  {  M_PS_NA_1,   "packed single-point information with status change detection" },

  {  M_ME_ND_1,   "measured value, normalized value without quality descriptor" },

  {  M_SP_TB_1,   "single-point information with time tag CP56Time2a" },

  {  M_DP_TB_1,   "double-point information with time tag CP56Time2a" },

  {  M_ST_TB_1,   "step position information with time tag CP56Time2a" },

  {  M_BO_TB_1,   "bitstring of 32 bit with time tag CP56Time2a" },

  {  M_ME_TD_1,   "measured value, normalized value with time tag CP56Time2a" },

  {  M_ME_TE_1,   "measured value, scaled value with time tag CP56Time2a" },

  {  M_ME_TF_1,   "measured value, short floating point number with time tag CP56Time2a" },

  {  M_IT_TB_1,   "integrated totals with time tag CP56Time2a" },

  {  M_EP_TD_1,   "event of protection equipment with time tag CP56Time2a" },

  {  M_EP_TE_1,   "packed start events of protection equipment with time tag CP56Time2a" },

  {  M_EP_TF_1,   "packed output circuit information of protection equipment with time tag CP56Time2a" },

  {  S_IT_TC_1,   "integrated totals containing time tagged security statistics" },

  {  C_SC_NA_1,   "single command" },

  {  C_DC_NA_1,   "double command" },

  {  C_RC_NA_1,   "regulating step command" },

  {  C_SE_NA_1,   "set point command, normalized value" },

  {  C_SE_NB_1,   "set point command, scaled value" },

  {  C_SE_NC_1,   "set point command, short floating point number" },

  {  C_BO_NA_1,   "bitstring of 32 bits" },

  {  C_SC_TA_1,   "single command with time tag CP56Time2a" },

  {  C_DC_TA_1,   "double command with time tag CP56Time2a" },

  {  C_RC_TA_1,   "regulating step command with time tag CP56Time2a" },

  {  C_SE_TA_1,   "set point command, normalized value with time tag CP56Time2a" },

  {  C_SE_TB_1,   "set point command, scaled value with time tag CP56Time2a" },

  {  C_SE_TC_1,   "set point command, short floating-point number with time tag CP56Time2a" },

  {  C_BO_TA_1,   "bitstring of 32 bits with time tag CP56Time2a" },

  {  M_EI_NA_1,   "end of initialization" },

  {  S_CH_NA_1,   "authentication challenge" },

  {  S_RP_NA_1,   "authentication reply" },

  {  S_AR_NA_1,   "aggressive mode authentication request session key status request" },

  {  S_KR_NA_1,   "session key status request" },

  {  S_KS_NA_1,   "session key status" },

  {  S_KC_NA_1,   "session key change" },

  {  S_ER_NA_1,   "authentication error" },

  {  S_US_NA_1,   "user status change" },

  {  S_UQ_NA_1,   "update key change request" },

  {  S_UR_NA_1,   "update key change reply" },

  {  S_UK_NA_1,   "update key change symmetric" },

  {  S_UA_NA_1,   "update key change asymmetric" },

  {  S_UC_NA_1,   "update key change confirmation" },

  {  C_IC_NA_1,   "interrogation command" },

  {  C_CI_NA_1,   "counter interrogation command" },

  {  C_RD_NA_1,   "read command" },

  {  C_CS_NA_1,   "clock synchronization command" },

  {  C_TS_NA_1,   "test command" },

  {  C_RP_NA_1,   "reset process command" },

  {  C_CD_NA_1,   "delay acquisition command" },

  {  C_TS_TA_1,   "test command with time tag CP56Time2a" },

  {  P_ME_NA_1,   "parameter of measured value, normalized value" },

  {  P_ME_NB_1,   "parameter of measured value, scaled value" },

  {  P_ME_NC_1,   "parameter of measured value, short floating-point number" },

  {  P_AC_NA_1,   "parameter activation" },

  {  F_FR_NA_1,   "file ready" },

  {  F_SR_NA_1,   "section ready" },

  {  F_SC_NA_1,   "call directory, select file, call file, call section" },

  {  F_LS_NA_1,   "last section, last segment" },

  {  F_AF_NA_1,   "ack file, ack section" },

  {  F_SG_NA_1,   "segment" },

  {  F_DR_TA_1,   "directory" },

  {  F_SC_NB_1,   "Query Log - Request archive file" },

  { 0, NULL }

};

typedef struct {

  uint8_t value;

  uint8_t length;

} td_asdu_length;

static const td_asdu_length asdu_length [] = {

  {  M_SP_NA_1,  1 },

  {  M_SP_TA_1,  4 },

  {  M_DP_NA_1,  1 },

  {  M_DP_TA_1,  4 },

  {  M_ST_NA_1,  2 },

  {  M_ST_TA_1,  5 },

  {  M_BO_NA_1,  5 },

  {  M_BO_TA_1,  8 },

  {  M_ME_NA_1,  3 },

  {  M_ME_TA_1,  6 },

  {  M_ME_NB_1,  3 },

  {  M_ME_TB_1,  6 },

  {  M_ME_NC_1,  5 },

  {  M_ME_TC_1,  8 },

  {  M_IT_NA_1,  5 },

  {  M_IT_TA_1,  8 },

  {  M_EP_TA_1,  6 },

  {  M_EP_TB_1,  7 },

  {  M_EP_TC_1,  7 },

  {  M_PS_NA_1,  5 },

  {  M_ME_ND_1,  2 },

  {  M_SP_TB_1,  8 },

  {  M_DP_TB_1,  8 },

  {  M_ST_TB_1,  9 },

  {  M_BO_TB_1, 12 },

  {  M_ME_TD_1, 10 },

  {  M_ME_TE_1, 10 },

  {  M_ME_TF_1, 12 },

  {  M_IT_TB_1, 12 },

  {  M_EP_TD_1, 10 },

  {  M_EP_TE_1, 11 },

  {  M_EP_TF_1, 11 },

  {  S_IT_TC_1,   14 },

  {  C_SC_NA_1,  1 },

  {  C_DC_NA_1,  1 },

  {  C_RC_NA_1,  1 },

  {  C_SE_NA_1,  3 },

  {  C_SE_NB_1,  3 },

  {  C_SE_NC_1,  5 },

  {  C_BO_NA_1,  4 },

  {  C_SC_TA_1,  8 },

  {  C_DC_TA_1,  8 },

  {  C_RC_TA_1,  8 },

  {  C_SE_TA_1, 10 },

  {  C_SE_TB_1, 10 },

  {  C_SE_TC_1, 12 },

  {  C_BO_TA_1, 11 },

  {  M_EI_NA_1,  1 },

  {  S_CH_NA_1,    0 },

  {  S_RP_NA_1,    0 },

  {  S_AR_NA_1,    0 },

  {  S_KR_NA_1,    0 },

  {  S_KS_NA_1,    0 },

  {  S_KC_NA_1,    0 },

  {  S_ER_NA_1,    0 },

  {  S_US_NA_1,    0 },

  {  S_UQ_NA_1,    0 },

  {  S_UR_NA_1,    0 },

  {  S_UK_NA_1,    0 },

  {  S_UA_NA_1,    0 },

  {  S_UC_NA_1,    0 },

  {  C_IC_NA_1,  1 },

  {  C_CI_NA_1,  1 },

  {  C_RD_NA_1,  0 },

  {  C_CS_NA_1,  7 },

  {  C_TS_NA_1,  2 },

  {  C_RP_NA_1,  1 },

  {  C_CD_NA_1,  2 },

  {  C_TS_TA_1,  9 },

  {  P_ME_NA_1,  3 },

  {  P_ME_NB_1,  3 },

  {  P_ME_NC_1,  5 },

  {  P_AC_NA_1,  1 },

  {  F_FR_NA_1,  6 },

  {  F_SR_NA_1,  7 },

  {  F_SC_NA_1,  4 },

  {  F_LS_NA_1,  5 },

  {  F_AF_NA_1,  4 },

  {  F_SG_NA_1,  4 },

  {  F_DR_TA_1, 13 },

  {  F_SC_NB_1, 16 },

  { 0, 0 }

};

/* Cause of Transmission (CauseTx) */

#define Per_Cyc         1

#define Back            2

#define Spont           3

#define Init            4

#define Req             5

#define Act             6

#define ActCon          7

#define Deact           8

#define DeactCon        9

#define ActTerm         10

#define Retrem          11

#define Retloc          12

#define File            13

#define Auth            14

#define Seskey          15

#define Usrkey          16

#define Inrogen         20

#define Inro1           21

#define Inro2           22

#define Inro3           23

#define Inro4           24

#define Inro5           25

#define Inro6           26

#define Inro7           27

#define Inro8           28

#define Inro9           29

#define Inro10          30

#define Inro11          31

#define Inro12          32

#define Inro13          33

#define Inro14          34

#define Inro15          35

#define Inro16          36

#define Reqcogen        37

#define Reqco1          38

#define Reqco2          39

#define Reqco3          40

#define Reqco4          41

#define UkTypeId        44

#define UkCauseTx       45

#define UkComAdrASDU    46

#define UkIOA           47

static const value_string causetx_types [] = {

  { Per_Cyc         ,"Per/Cyc" },

  { Back            ,"Back" },

  { Spont           ,"Spont" },

  { Init            ,"Init" },

  { Req             ,"Req" },

  { Act             ,"Act" },

  { ActCon          ,"ActCon" },

  { Deact           ,"Deact" },

  { DeactCon        ,"DeactCon" },

  { ActTerm         ,"ActTerm" },

  { Retrem          ,"Retrem" },

  { Retloc          ,"Retloc" },

  { File            ,"File" },

  { Auth            ,"Auth" },

  { Seskey          ,"Seskey" },

  { Usrkey          ,"Usrkey" },

  { Inrogen         ,"Inrogen" },

  { Inro1           ,"Inro1" },

  { Inro2           ,"Inro2" },

  { Inro3           ,"Inro3" },

  { Inro4           ,"Inro4" },

  { Inro5           ,"Inro5" },

  { Inro6           ,"Inro6" },

  { Inro7           ,"Inro7" },

  { Inro8           ,"Inro8" },

  { Inro9           ,"Inro9" },

  { Inro10          ,"Inro10" },

  { Inro11          ,"Inro11" },

  { Inro12          ,"Inro12" },

  { Inro13          ,"Inro13" },

  { Inro14          ,"Inro14" },

  { Inro15          ,"Inro15" },

  { Inro16          ,"Inro16" },

  { Reqcogen        ,"Reqcogen" },

  { Reqco1          ,"Reqco1" },

  { Reqco2          ,"Reqco2" },

  { Reqco3          ,"Reqco3" },

  { Reqco4          ,"Reqco4" },

  { UkTypeId        ,"UkTypeId" },

  { UkCauseTx       ,"UkCauseTx" },

  { UkComAdrASDU    ,"UkComAdrASDU" },

  { UkIOA           ,"UkIOA" },

  { 0, NULL }

};

static const value_string diq_types[] = {

  { 0,    "Indeterminate or Intermediate" },

  { 1,    "OFF" },

  { 2,    "ON" },

  { 3,    "Indeterminate" },

  { 0, NULL }

};

static const value_string qos_qu_types[] = {

  { 0,    "No pulse defined" },

  { 1,    "Short Pulse" },

  { 2,    "Long Pulse" },

  { 3,    "Persistent Output" },

  { 0, NULL }

};

static const value_string dco_on_types[] = {

  { 0,    "(None)" },

  { 1,    "OFF" },

  { 2,    "ON" },

  { 3,    "Error: On/Off not defined" },

  { 0, NULL }

};

static const value_string rco_up_types[] = {

  { 0,    "(None)" },

  { 1,    "DOWN" },

  { 2,    "UP" },

  { 3,    "Error: Up/Down not defined" },

  { 0, NULL }

};

static const value_string qpm_kpa_types[] = {

  { 0,    "Not used" },

  { 1,    "Threshold value" },

  { 2,    "Smoothing factor (filter time constant)" },

  { 0, NULL }

};

static const value_string qpm_lpc_types[] = {

  { 0,    "No change" },

  { 1,    "Change" },

  { 0, NULL }

};

static const value_string qpm_pop_types[] = {

  { 0,    "Operation" },

  { 1,    "Not in operation" },

  { 0, NULL }

};

static const value_string coi_r_types[] = {

  { 0,    "Local power switch on" },

  { 1,    "Local manual reset" },

  { 2,    "Remote reset" },

  { 0, NULL }

};

static const value_string qoi_r_types[] = {

  { 0,    "Not specified" },

  { 20,   "Station interrogation (global)" },

  { 21,   "Group 1 interrogation" },

  { 22,   "Group 2 interrogation" },

  { 23,   "Group 3 interrogation" },

  { 24,   "Group 4 interrogation" },

  { 25,   "Group 5 interrogation" },

  { 26,   "Group 6 interrogation" },

  { 27,   "Group 7 interrogation" },

  { 28,   "Group 8 interrogation" },

  { 29,   "Group 9 interrogation" },

  { 30,   "Group 10 interrogation" },

  { 31,   "Group 11 interrogation" },

  { 32,   "Group 12 interrogation" },

  { 33,   "Group 13 interrogation" },

  { 34,   "Group 14 interrogation" },

  { 35,   "Group 15 interrogation" },

  { 36,   "Group 16 interrogation" },

  { 0, NULL }

};

static const value_string rqt_r_types[] = {

  { 0,    "Not specified" },

  { 1,    "Group 1 counter interrogation" },

  { 2,    "Group 2 counter interrogation" },

  { 3,    "Group 3 counter interrogation" },

  { 4,    "Group 4 counter interrogation" },

  { 5,    "General counter interrogation" },

  { 0, NULL }

};

static const value_string frz_r_types[] = {

  { 0,    "Read only (no freeze or reset)" },

  { 1,    "Counter freeze without reset (value frozen represents integrated total)" },

  { 2,    "Counter freeze with reset (value frozen represents incremental information)" },

  { 3,    "Counter reset" },

  { 0, NULL }

};

static const value_string qrp_r_types[] = {

  { 0,    "Not used" },

  { 1,    "General reset of process" },

  { 2,    "Reset of pending information with time tag of the event buffer" },

  { 0, NULL }

};

static const value_string frq_qualifier[] = {

  { 0,    "Default" },

  { 0, NULL }

};

static const value_string srq_qualifier[] = {

  { 0,    "Default" },

  { 0, NULL }

};

static const value_string scq_select[] = {

  { 0,    "Default" },

  { 1,    "Select file" },

  { 2,    "Request file" },

  { 3,    "Deactivate file" },

  { 4,    "Delete file" },

  { 5,    "Select section" },

  { 6,    "Request section" },

  { 7,    "deactivate section" },

  { 0, NULL }

};

static const value_string scq_qualifier[] = {

  { 0,    "Default" },

  { 1,    "Requested memory space not available" },

  { 2,    "Checksum failed" },

  { 3,    "Unexpected communication service" },

  { 4,    "Unexpected name of file" },

  { 5,    "Unexpected name of section" },

  { 0, NULL }

};

static const value_string lsq_qualifier[] = {

  { 0,    "Not used" },

  { 1,    "File transfer without deactivation" },

  { 2,    "File transfer with deactivation" },

  { 3,    "Section transfer without deactivation" },

  { 4,    "Section transfer with deactivation" },

  { 0, NULL }

};

static const value_string afq_ack[] = {

  { 0,    "Not used" },

  { 1,    "Positive acknowledge of file transfer" },

  { 2,    "Negative acknowledge of file transfer" },

  { 3,    "Positive acknowledge of section transfer" },

  { 4,    "Negative acknowledge of section transfer" },

  { 0, NULL }

};

static const value_string afq_qualifier[] = {

  { 0,    "Default" },

  { 1,    "Requested memory space not available" },

  { 2,    "Checksum failed" },

  { 3,    "Unexpected communication service" },

  { 4,    "Unexpected name of file" },

  { 5,    "Unexpected name of section" },

  { 0, NULL }

};

static const value_string sof_status[] = {

  { 0,    "Default" },

  { 0, NULL }

};

static const value_string sep_types[] = {

  { 0,    "Indeterminate" },

  { 1,    "OFF" },

  { 2,    "ON" },

  { 3,    "Indeterminate" },

  { 0, NULL }

};

static const value_string qpa_types[] = {

  { 0,    "Not used" },

  { 1,    "Act/deact of the previously loaded parameters (object address = 0)" },

  { 2,    "Act/deact of the parameter of the addressed object" },

  { 3,    "Act/deact of persistent cyclic or periodic transmission of the addressed object" },

  { 0, NULL }

};

static const range_string usr_types[] = {

  { 0,  0,  "(Unknown)" },

  { 1,  1,  "Default" },

  { 2,  65535,  "Chosen by the controlling station" },

  { 0, 0, NULL }

};

static const range_string mal_types[] = {

  { 0,  0,  "(not used)" },

  { 1,  1,  "HMAC SHA-1 truncated to 4 octets (serial)" },

  { 2,  2,  "HMAC SHA-1 truncated to 10 octets (networked)" },

  { 3,  3,  "HMAC-SHA-256 truncated to 8 octets (serial)" },

  { 4,  4,  "HMAC-SHA-256 truncated to 16 octets (networked)" },

  { 128,  255,  "(vendor-specific choice)" },

  { 0, 0, NULL }

};

static const value_string rsc_types[] = {

  { 0,    "(not used)" },

  { 1,    "CRITICAL" },

  { 0, NULL }

};

static const range_string kwa_types[] = {

  { 0,  0,  "(not used)" },

  { 1,  1,  "AES-128 Key Wrap Algorithm" },

  { 2,  2,  "AES-256 Key Wrap Algorithm" },

  { 128,  255,  "(vendor-specific choice)" },

  { 0, 0, NULL }

};

static const value_string kst_types[] = {

  { 0,    "(not used)" },

  { 1,    "OK" },

  { 2,    "NOT INIT" },

  { 3,    "COMM FAIL" },

  { 4,    "AUTH FAIL" },

  { 0, NULL }

};

static const range_string hal_types[] = {

  { 0,  0,  "No MAC value in this message" },

  { 1,  1,  "HMAC SHA-1 truncated to 4 octets (serial)" },

  { 2,  2,  "HMAC SHA-1 truncated to 10 octets (networked)" },

  { 3,  3,  "HMAC-SHA-256 truncated to 8 octets (serial)" },

  { 4,  4,  "HMAC-SHA-256 truncated to 16 octets (networked)" },

  { 128,  255,  "(vendor-specific choice)" },

  { 0, 0, NULL }

};

static const range_string error_codes[] = {

  { 0,  0,  "(not used)" },

  { 1,  1,  "Authentication failed" },

  { 2,  2,  "Unexpected reply" },

  { 3,  3,  "No reply" },

  { 4,  4,  "Aggressive Mode not permitted" },

  { 5,  5,  "MAC algorithm not permitted" },

  { 6,  6,  "Key Wrap algorithm not permitted" },

  { 7,  7,  "Authorization failed" },

  { 8,  8,  "Update Key Change Method not permitted" },

  { 9,  9,  "Invalid Signature" },

  { 10, 10, "Invalid Certification Data" },

  { 11, 11, "Unknown User" },

  { 128, 255, "(vendor-specific choice)"},

  { 0, 0, NULL }

};

static const true_false_string tfs_blocked_not_blocked = { "Blocked", "Not blocked" };

static const true_false_string tfs_substituted_not_substituted = { "Substituted", "Not Substituted" };

static const true_false_string tfs_not_topical_topical = { "Not Topical", "Topical" };

static const true_false_string tfs_transient_not_transient = { "Transient", "Not Transient" };

static const true_false_string tfs_overflow_no_overflow = { "Overflow", "No overflow" };

static const true_false_string tfs_select_execute = { "Select", "Execute" };

static const true_false_string tfs_summer_standard_time = { "Summer time", "Standard time" };

static const true_false_string tfs_coi_i = { "Initialisation after change of local parameters", "Initialisation with unchanged local parameters" };

static const true_false_string tfs_adjusted_not_adjusted = { "Adjusted", "Not Adjusted" };

static const true_false_string tfs_negative_positive = { "Negative", "Positive" };

static const true_false_string tfs_not_ready_ready = { "Not ready", "Ready" };

static const true_false_string tfs_last_file_additional_follows = { "Last file", "Additional file follows" };

static const true_false_string tfs_subdir_file = { "Subdirectory", "File" };

static const true_false_string tfs_active_waits = { "Transfer active", "Waits for transfer" };

static const true_false_string tfs_elapsed_invalid_valid = { "Elapsed time invalid", "Elapsed time valid" };

static const true_false_string tfs_general_start_no_general_start = { "General start", "No general start" };

static const true_false_string tfs_general_command_no_general_command = { "General command", "No general command" };

static const true_false_string tfs_start_no_start = { "Start", "No start" };

static const true_false_string tfs_start_reverse_no_start_revers = { "Start in reverse direction", "No start in reverse direction" };

static const true_false_string tfs_command_no_command = { "Command", "No command" };

static int global_iec60870_link_addr_len = 1;

static int global_iec60870_cot_len = 1;

static int global_iec60870_asdu_addr_len = 1;

static int global_iec60870_ioa_len = 2;

/* Protocol fields to be filtered */

static int hf_apdulen;

static int hf_apcitype_i;

static int hf_apcitype_s_u;

static int hf_apciutype;

static int hf_apcitx;

static int hf_apcirx;

static int hf_apcidata;

static int hf_addr;

static int hf_oa;

static int hf_typeid;

static int hf_causetx;

static int hf_nega;

static int hf_test;

static int hf_ioa;

static int hf_numix;

static int hf_sq;

static int hf_cp16time;

static int hf_cp24time;

static int hf_cp24time_ms;

static int hf_cp24time_min;

static int hf_cp24time_iv;

static int hf_cp56time;

static int hf_cp56time_ms;

static int hf_cp56time_min;

static int hf_cp56time_gen;

static int hf_cp56time_iv;

static int hf_cp56time_hour;

static int hf_cp56time_su;

static int hf_cp56time_day;

static int hf_cp56time_dow;

static int hf_cp56time_month;

static int hf_cp56time_year;

static int hf_range_start_cp56time;

static int hf_range_stop_cp56time;

static int hf_siq;

static int hf_siq_spi;

static int hf_siq_bl;

static int hf_siq_sb;

static int hf_siq_nt;

static int hf_siq_iv;

static int hf_diq;

static int hf_diq_dpi;

static int hf_diq_bl;

static int hf_diq_sb;

static int hf_diq_nt;

static int hf_diq_iv;

static int hf_qds;

static int hf_qds_ov;

static int hf_qds_bl;

static int hf_qds_sb;

static int hf_qds_nt;

static int hf_qds_iv;

static int hf_vti;

static int hf_vti_v;

static int hf_vti_t;

static int hf_qos;

static int hf_qos_ql;

static int hf_qos_se;

static int hf_sco;

static int hf_sco_on;

static int hf_sco_qu;

static int hf_sco_se;

static int hf_dco;

static int hf_dco_on;

static int hf_dco_qu;

static int hf_dco_se;

static int hf_rco;

static int hf_rco_up;

static int hf_rco_qu;

static int hf_rco_se;

static int hf_qpm;

static int hf_qpm_kpa;

static int hf_qpm_lpc;

static int hf_qpm_pop;

static int hf_nof;

static int hf_lof;

static int hf_frq;

static int hf_frq_qualifier;

static int hf_frq_confirm;

static int hf_nos;

static int hf_srq;

static int hf_srq_qualifier;

static int hf_srq_ready;

static int hf_scq;

static int hf_scq_select;

static int hf_scq_qualifier;

static int hf_lsq;

static int hf_chs;

static int hf_afq;

static int hf_afq_ack;

static int hf_afq_qualifier;

static int hf_los;

static int hf_segment_data;

static int hf_sof;

static int hf_sof_status;

static int hf_sof_lfd;

static int hf_sof_for;

static int hf_sof_fa;

static int hf_sep;

static int hf_sep_es;

static int hf_sep_ei;

static int hf_sep_bl;

static int hf_sep_sb;

static int hf_sep_nt;

static int hf_sep_iv;

static int hf_spe;

static int hf_spe_gs;

static int hf_spe_sl1;

static int hf_spe_sl2;

static int hf_spe_sl3;

static int hf_spe_sie;

static int hf_spe_srd;

static int hf_qdp;

static int hf_qdp_ei;

static int hf_qdp_bl;

static int hf_qdp_sb;

static int hf_qdp_nt;

static int hf_qdp_iv;

static int hf_oci;

static int hf_oci_gc;

static int hf_oci_cl1;

static int hf_oci_cl2;

static int hf_oci_cl3;

static int hf_qpa;

static int hf_fbp;

static int hf_scd;

static int hf_scd_st;

static int hf_scd_cd;

static int hf_asn;

static int hf_usr;

static int hf_iec60870_segment_data;

static int hf_mal;

static int hf_rsc;

static int hf_asn_fin;

static int hf_asn_fir;

static int hf_csq;

static int hf_ksq;

static int hf_kwa;

static int hf_kst;

static int hf_hln;

static int hf_hal;

static int hf_cln;

static int hf_wkl;

static int hf_prcd_raw_data;

static int hf_hmac_raw_data;

static int hf_wkd_raw_data;

static int hf_aid;

static int hf_err;

static int hf_etm;

static int hf_etm_ms;

static int hf_etm_min;

static int hf_etm_iv;

static int hf_etm_hour;

static int hf_etm_su;

static int hf_etm_day;

static int hf_etm_dow;

static int hf_etm_month;

static int hf_etm_year;

static int hf_eln;

static int hf_error_text;

static int hf_coi;

static int hf_coi_r;

static int hf_coi_i;

static int hf_qoi;

static int hf_qcc;

static int hf_qcc_rqt;

static int hf_qcc_frz;

static int hf_qrp;

static int hf_bcr;

static int hf_bcr_count;

static int hf_bcr_sq;

static int hf_bcr_cy;

static int hf_bcr_ca;

static int hf_bcr_iv;

static int hf_start;

static int hf_asdu_bitstring;

static int hf_asdu_float;

static int hf_asdu_normval;

static int hf_asdu_scalval;

static int hf_asdu_tsc;

static int hf_asdu_raw_data;

static int ett_apci;

static int ett_asdu;

static int ett_asdu_objects;

static int ett_siq;

static int ett_diq;

static int ett_vti;

static int ett_qds;

static int ett_qos;

static int ett_sco;

static int ett_sep;

static int ett_spe;

static int ett_qdp;

static int ett_oci;

static int ett_scd;

static int ett_dco;

static int ett_rco;

static int ett_qpm;

static int ett_frq;

static int ett_srq;

static int ett_scq;

static int ett_afq;

static int ett_sof;

static int ett_coi;

static int ett_qcc;

static int ett_cp24time;

static int ett_cp56time;

static int ett_etm;

static int ett_iec60870_segment;

static int ett_iec60870_segments;

static expert_field ei_iec104_short_asdu;

static expert_field ei_iec104_apdu_min_len;

static expert_field ei_iec104_apdu_invalid_len;

/* IEC 101 stuff */

/* Initialize the protocol and registered fields */

static int hf_iec60870_101_frame;

static int hf_iec60870_101_length;

static int hf_iec60870_101_num_user_octets;

static int hf_iec60870_101_ctrlfield;

static int hf_iec60870_101_ctrl_prm;

static int hf_iec60870_101_ctrl_fcb;

static int hf_iec60870_101_ctrl_fcv;

static int hf_iec60870_101_ctrl_dfc;

static int hf_iec60870_101_ctrl_func_pri_to_sec;

static int hf_iec60870_101_ctrl_func_sec_to_pri;

static int hf_iec60870_101_linkaddr;

static int hf_iec60870_101_checksum;

static int hf_iec60870_101_stopchar;

static int hf_iec60870_segments;

static int hf_iec60870_segment;

static int hf_iec60870_segment_overlap;

static int hf_iec60870_segment_overlap_conflict;

static int hf_iec60870_segment_multiple_tails;

static int hf_iec60870_segment_too_long_segment;

static int hf_iec60870_segment_error;

static int hf_iec60870_segment_count;

static int hf_iec60870_reassembled_in;

static int hf_iec60870_reassembled_length;

static const fragment_items iec60870_frag_items = {

  &ett_iec60870_segment,

  &ett_iec60870_segments,

  &hf_iec60870_segments,

  &hf_iec60870_segment,

  &hf_iec60870_segment_overlap,

  &hf_iec60870_segment_overlap_conflict,

  &hf_iec60870_segment_multiple_tails,

  &hf_iec60870_segment_too_long_segment,

  &hf_iec60870_segment_error,

  &hf_iec60870_segment_count,

  &hf_iec60870_reassembled_in,

  &hf_iec60870_reassembled_length,

  /* Reassembled data field */

  NULL,

  "segments"

};

/* Initialize the subtree pointers */

static int ett_iec60870_101;

static int ett_iec60870_101_ctrlfield;

static expert_field ei_iec101_frame_mismatch;

static expert_field ei_iec101_length_mismatch;

static expert_field ei_iec101_stopchar_invalid;

/* Frame Format */

#define IEC101_VAR_LEN        0x68

#define IEC101_FIXED_LEN      0x10

#define IEC101_SINGLE_CHAR    0xE5

#define IEC101_STOP_CHAR      0x16

static const value_string iec60870_101_frame_vals[] = {

  { IEC101_VAR_LEN,         "Variable Length" },

  { IEC101_FIXED_LEN,       "Fixed Length" },

  { IEC101_SINGLE_CHAR,     "Single Character" },

  { 0,                         NULL }

};

static const value_string iec60870_101_ctrl_prm_values[] = {

  { 0,      "Message from Secondary (Responding) Station" },

  { 1,      "Message from Primary (Initiating) Station" },

  { 0,      NULL }

};