/* packet-s7comm.c

 *

 * Author:      Thomas Wiens, 2014 (th.wiens@gmx.de)

 * Description: Wireshark dissector for S7-Communication

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/reassemble.h>

#include <stdlib.h>

#include <epan/tfs.h>

#include <wsutil/array.h>

#include <wsutil/strtoi.h>

#include <epan/expert.h>

#include "packet-s7comm.h"

#include "packet-s7comm_szl_ids.h"

#define PROTO_TAG_S7COMM                    "S7COMM"

/* Min. telegram length for heuristic check */

#define S7COMM_MIN_TELEGRAM_LENGTH          10

/* Protocol identifier */

#define S7COMM_PROT_ID                      0x32

/* Wireshark ID of the S7COMM protocol */

static int proto_s7comm;

/* Forward declarations */

void proto_reg_handoff_s7comm(void);

void proto_register_s7comm (void);

static uint32_t s7comm_decode_ud_tis_data(tvbuff_t *tvb, packet_info* pinfo, proto_tree *tree, uint8_t type, uint8_t subfunc, uint16_t td_size, uint32_t offset);

/**************************************************************************

 * PDU types

 */

#define S7COMM_ROSCTR_JOB                   0x01

#define S7COMM_ROSCTR_ACK                   0x02

#define S7COMM_ROSCTR_ACK_DATA              0x03

#define S7COMM_ROSCTR_USERDATA              0x07

static const value_string rosctr_names[] = {

    { S7COMM_ROSCTR_JOB,                    "Job" },        /* Request: job with acknowledgement */

    { S7COMM_ROSCTR_ACK,                    "Ack" },        /* acknowledgement without additional field */

    { S7COMM_ROSCTR_ACK_DATA,               "Ack_Data" },   /* Response: acknowledgement with additional field */

    { S7COMM_ROSCTR_USERDATA,               "Userdata" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Error classes in header

 */

#define S7COMM_ERRCLS_NONE                  0x00

#define S7COMM_ERRCLS_APPREL                0x81

#define S7COMM_ERRCLS_OBJDEF                0x82

#define S7COMM_ERRCLS_RESOURCE              0x83

#define S7COMM_ERRCLS_SERVICE               0x84

#define S7COMM_ERRCLS_SUPPLIES              0x85

#define S7COMM_ERRCLS_ACCESS                0x87

static const value_string errcls_names[] = {

    { S7COMM_ERRCLS_NONE,                   "No error" },

    { S7COMM_ERRCLS_APPREL,                 "Application relationship" },

    { S7COMM_ERRCLS_OBJDEF,                 "Object definition" },

    { S7COMM_ERRCLS_RESOURCE,               "No resources available" },

    { S7COMM_ERRCLS_SERVICE,                "Error on service processing" },

    { S7COMM_ERRCLS_SUPPLIES,               "Error on supplies" },

    { S7COMM_ERRCLS_ACCESS,                 "Access error" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Error code in parameter part

 */

static const value_string param_errcode_names[] = {

    { 0x0000,                               "No error" },

    { 0x0110,                               "Invalid block number" },

    { 0x0111,                               "Invalid request length" },

    { 0x0112,                               "Invalid parameter" },

    { 0x0113,                               "Invalid block type" },

    { 0x0114,                               "Block not found" },

    { 0x0115,                               "Block already exists" },

    { 0x0116,                               "Block is write-protected" },

    { 0x0117,                               "The block/operating system update is too large" },

    { 0x0118,                               "Invalid block number" },

    { 0x0119,                               "Incorrect password entered" },

    { 0x011A,                               "PG resource error" },

    { 0x011B,                               "PLC resource error" },

    { 0x011C,                               "Protocol error" },

    { 0x011D,                               "Too many blocks (module-related restriction)" },

    { 0x011E,                               "There is no longer a connection to the database, or S7DOS handle is invalid" },

    { 0x011F,                               "Result buffer too small" },

    { 0x0120,                               "End of block list" },

    { 0x0140,                               "Insufficient memory available" },

    { 0x0141,                               "Job cannot be processed because of a lack of resources" },

    { 0x8001,                               "The requested service cannot be performed while the block is in the current status" },

    { 0x8003,                               "S7 protocol error: Error occurred while transferring the block" },

    { 0x8100,                               "Application, general error: Service unknown to remote module" },

    { 0x8104,                               "This service is not implemented on the module or a frame error was reported" },

    { 0x8204,                               "The type specification for the object is inconsistent" },

    { 0x8205,                               "A copied block already exists and is not linked" },

    { 0x8301,                               "Insufficient memory space or work memory on the module, or specified storage medium not accessible" },

    { 0x8302,                               "Too few resources available or the processor resources are not available" },

    { 0x8304,                               "No further parallel upload possible. There is a resource bottleneck" },

    { 0x8305,                               "Function not available" },

    { 0x8306,                               "Insufficient work memory (for copying, linking, loading AWP)" },

    { 0x8307,                               "Not enough retentive work memory (for copying, linking, loading AWP)" },

    { 0x8401,                               "S7 protocol error: Invalid service sequence (for example, loading or uploading a block)" },

    { 0x8402,                               "Service cannot execute owing to status of the addressed object" },

    { 0x8404,                               "S7 protocol: The function cannot be performed" },

    { 0x8405,                               "Remote block is in DISABLE state (CFB). The function cannot be performed" },

    { 0x8500,                               "S7 protocol error: Wrong frames" },

    { 0x8503,                               "Alarm from the module: Service canceled prematurely" },

    { 0x8701,                               "Error addressing the object on the communications partner (for example, area length error)" },

    { 0x8702,                               "The requested service is not supported by the module" },

    { 0x8703,                               "Access to object refused" },

    { 0x8704,                               "Access error: Object damaged" },

    { 0xD001,                               "Protocol error: Illegal job number" },

    { 0xD002,                               "Parameter error: Illegal job variant" },

    { 0xD003,                               "Parameter error: Debugging function not supported by module" },

    { 0xD004,                               "Parameter error: Illegal job status" },

    { 0xD005,                               "Parameter error: Illegal job termination" },

    { 0xD006,                               "Parameter error: Illegal link disconnection ID" },

    { 0xD007,                               "Parameter error: Illegal number of buffer elements" },

    { 0xD008,                               "Parameter error: Illegal scan rate" },

    { 0xD009,                               "Parameter error: Illegal number of executions" },

    { 0xD00A,                               "Parameter error: Illegal trigger event" },

    { 0xD00B,                               "Parameter error: Illegal trigger condition" },

    { 0xD011,                               "Parameter error in path of the call environment: Block does not exist" },

    { 0xD012,                               "Parameter error: Wrong address in block" },

    { 0xD014,                               "Parameter error: Block being deleted/overwritten" },

    { 0xD015,                               "Parameter error: Illegal tag address" },

    { 0xD016,                               "Parameter error: Test jobs not possible, because of errors in user program" },

    { 0xD017,                               "Parameter error: Illegal trigger number" },

    { 0xD025,                               "Parameter error: Invalid path" },

    { 0xD026,                               "Parameter error: Illegal access type" },

    { 0xD027,                               "Parameter error: This number of data blocks is not permitted" },

    { 0xD031,                               "Internal protocol error" },

    { 0xD032,                               "Parameter error: Wrong result buffer length" },

    { 0xD033,                               "Protocol error: Wrong job length" },

    { 0xD03F,                               "Coding error: Error in parameter section (for example, reserve bytes not equal to 0)" },

    { 0xD041,                               "Data error: Illegal status list ID" },

    { 0xD042,                               "Data error: Illegal tag address" },

    { 0xD043,                               "Data error: Referenced job not found, check job data" },

    { 0xD044,                               "Data error: Illegal tag value, check job data" },

    { 0xD045,                               "Data error: Exiting the ODIS control is not allowed in HOLD" },

    { 0xD046,                               "Data error: Illegal measuring stage during run-time measurement" },

    { 0xD047,                               "Data error: Illegal hierarchy in 'Read job list'" },

    { 0xD048,                               "Data error: Illegal deletion ID in 'Delete job'" },

    { 0xD049,                               "Invalid substitute ID in 'Replace job'" },

    { 0xD04A,                               "Error executing 'program status'" },

    { 0xD05F,                               "Coding error: Error in data section (for example, reserve bytes not equal to 0, ...)" },

    { 0xD061,                               "Resource error: No memory space for job" },

    { 0xD062,                               "Resource error: Job list full" },

    { 0xD063,                               "Resource error: Trigger event occupied" },

    { 0xD064,                               "Resource error: Not enough memory space for one result buffer element" },

    { 0xD065,                               "Resource error: Not enough memory space for several  result buffer elements" },

    { 0xD066,                               "Resource error: The timer available for run-time measurement is occupied by another job" },

    { 0xD067,                               "Resource error: Too many 'modify tag' jobs active (in particular multi-processor operation)" },

    { 0xD081,                               "Function not permitted in current mode" },

    { 0xD082,                               "Mode error: Cannot exit HOLD mode" },

    { 0xD0A1,                               "Function not permitted in current protection level" },

    { 0xD0A2,                               "Function not possible at present, because a function is running that modifies memory" },

    { 0xD0A3,                               "Too many 'modify tag' jobs active on the I/O (in particular multi-processor operation)" },

    { 0xD0A4,                               "'Forcing' has already been established" },

    { 0xD0A5,                               "Referenced job not found" },

    { 0xD0A6,                               "Job cannot be disabled/enabled" },

    { 0xD0A7,                               "Job cannot be deleted, for example because it is currently being read" },

    { 0xD0A8,                               "Job cannot be replaced, for example because it is currently being read or deleted" },

    { 0xD0A9,                               "Job cannot be read, for example because it is currently being deleted" },

    { 0xD0AA,                               "Time limit exceeded in processing operation" },

    { 0xD0AB,                               "Invalid job parameters in process operation" },

    { 0xD0AC,                               "Invalid job data in process operation" },

    { 0xD0AD,                               "Operating mode already set" },

    { 0xD0AE,                               "The job was set up over a different connection and can only be handled over this connection" },

    { 0xD0C1,                               "At least one error has been detected while accessing the tag(s)" },

    { 0xD0C2,                               "Change to STOP/HOLD mode" },

    { 0xD0C3,                               "At least one error was detected while accessing the tag(s). Mode change to STOP/HOLD" },

    { 0xD0C4,                               "Timeout during run-time measurement" },

    { 0xD0C5,                               "Display of block stack inconsistent, because blocks were deleted/reloaded" },

    { 0xD0C6,                               "Job was automatically deleted as the jobs it referenced have been deleted" },

    { 0xD0C7,                               "The job was automatically deleted because STOP mode was exited" },

    { 0xD0C8,                               "'Block status' aborted because of inconsistencies between test job and running program" },

    { 0xD0C9,                               "Exit the status area by resetting OB90" },

    { 0xD0CA,                               "Exiting the status range by resetting OB90 and access error reading tags before exiting" },

    { 0xD0CB,                               "The output disable for the peripheral outputs has been activated again" },

    { 0xD0CC,                               "The amount of data for the debugging functions is restricted by the time limit" },

    { 0xD201,                               "Syntax error in block name" },

    { 0xD202,                               "Syntax error in function parameters" },

    { 0xD205,                               "Linked block already exists in RAM: Conditional copying is not possible" },

    { 0xD206,                               "Linked block already exists in EPROM: Conditional copying is not possible" },

    { 0xD208,                               "Maximum number of copied (not linked) blocks on module exceeded" },

    { 0xD209,                               "(At least) one of the given blocks not found on the module" },

    { 0xD20A,                               "The maximum number of blocks that can be linked with one job was exceeded" },

    { 0xD20B,                               "The maximum number of blocks that can be deleted with one job was exceeded" },

    { 0xD20C,                               "OB cannot be copied because the associated priority class does not exist" },

    { 0xD20D,                               "SDB cannot be interpreted (for example, unknown number)" },

    { 0xD20E,                               "No (further) block available" },

    { 0xD20F,                               "Module-specific maximum block size exceeded" },

    { 0xD210,                               "Invalid block number" },

    { 0xD212,                               "Incorrect header attribute (run-time relevant)" },

    { 0xD213,                               "Too many SDBs. Note the restrictions on the module being used" },

    { 0xD216,                               "Invalid user program - reset module" },

    { 0xD217,                               "Protection level specified in module properties not permitted" },

    { 0xD218,                               "Incorrect attribute (active/passive)" },

    { 0xD219,                               "Incorrect block lengths (for example, incorrect length of first section or of the whole block)" },

    { 0xD21A,                               "Incorrect local data length or write-protection code faulty" },

    { 0xD21B,                               "Module cannot compress or compression was interrupted early" },

    { 0xD21D,                               "The volume of dynamic project data transferred is illegal" },

    { 0xD21E,                               "Unable to assign parameters to a module (such as FM, CP). The system data could not be linked" },

    { 0xD220,                               "Invalid programming language. Note the restrictions on the module being used" },

    { 0xD221,                               "The system data for connections or routing are not valid" },

    { 0xD222,                               "The system data of the global data definition contain invalid parameters" },

    { 0xD223,                               "Error in instance data block for communication function block or maximum number of instance DBs exceeded" },

    { 0xD224,                               "The SCAN system data block contains invalid parameters" },

    { 0xD225,                               "The DP system data block contains invalid parameters" },

    { 0xD226,                               "A structural error occurred in a block" },

    { 0xD230,                               "A structural error occurred in a block" },

    { 0xD231,                               "At least one loaded OB cannot be copied because the associated priority class does not exist" },

    { 0xD232,                               "At least one block number of a loaded block is illegal" },

    { 0xD234,                               "Block exists twice in the specified memory medium or in the job" },

    { 0xD235,                               "The block contains an incorrect checksum" },

    { 0xD236,                               "The block does not contain a checksum" },

    { 0xD237,                               "You are about to load the block twice, i.e. a block with the same time stamp already exists on the CPU" },

    { 0xD238,                               "At least one of the blocks specified is not a DB" },

    { 0xD239,                               "At least one of the DBs specified is not available as a linked variant in the load memory" },

    { 0xD23A,                               "At least one of the specified DBs is considerably different from the copied and linked variant" },

    { 0xD240,                               "Coordination rules violated" },

    { 0xD241,                               "The function is not permitted in the current protection level" },

    { 0xD242,                               "Protection violation while processing F blocks" },

    { 0xD250,                               "Update and module ID or version do not match" },

    { 0xD251,                               "Incorrect sequence of operating system components" },

    { 0xD252,                               "Checksum error" },

    { 0xD253,                               "No executable loader available; update only possible using a memory card" },

    { 0xD254,                               "Storage error in operating system" },

    { 0xD280,                               "Error compiling block in S7-300 CPU" },

    { 0xD2A1,                               "Another block function or a trigger on a block is active" },

    { 0xD2A2,                               "A trigger is active on a block. Complete the debugging function first" },

    { 0xD2A3,                               "The block is not active (linked), the block is occupied or the block is currently marked for deletion" },

    { 0xD2A4,                               "The block is already being processed by another block function" },

    { 0xD2A6,                               "It is not possible to save and change the user program simultaneously" },

    { 0xD2A7,                               "The block has the attribute 'unlinked' or is not processed" },

    { 0xD2A8,                               "An active debugging function is preventing parameters from being assigned to the CPU" },

    { 0xD2A9,                               "New parameters are being assigned to the CPU" },

    { 0xD2AA,                               "New parameters are currently being assigned to the modules" },

    { 0xD2AB,                               "The dynamic configuration limits are currently being changed" },

    { 0xD2AC,                               "A running active or deactivate assignment (SFC 12) is temporarily preventing R-KiR process" },

    { 0xD2B0,                               "An error occurred while configuring in RUN (CiR)" },

    { 0xD2C0,                               "The maximum number of technological objects has been exceeded" },

    { 0xD2C1,                               "The same technology data block already exists on the module" },

    { 0xD2C2,                               "Downloading the user program or downloading the hardware configuration is not possible" },

    { 0xD401,                               "Information function unavailable" },

    { 0xD402,                               "Information function unavailable" },

    { 0xD403,                               "Service has already been logged on/off (Diagnostics/PMC)" },

    { 0xD404,                               "Maximum number of nodes reached. No more logons possible for diagnostics/PMC" },

    { 0xD405,                               "Service not supported or syntax error in function parameters" },

    { 0xD406,                               "Required information currently unavailable" },

    { 0xD407,                               "Diagnostics error occurred" },

    { 0xD408,                               "Update aborted" },

    { 0xD409,                               "Error on DP bus" },

    { 0xD601,                               "Syntax error in function parameter" },

    { 0xD602,                               "Incorrect password entered" },

    { 0xD603,                               "The connection has already been legitimized" },

    { 0xD604,                               "The connection has already been enabled" },

    { 0xD605,                               "Legitimization not possible because password does not exist" },

    { 0xD801,                               "At least one tag address is invalid" },

    { 0xD802,                               "Specified job does not exist" },

    { 0xD803,                               "Illegal job status" },

    { 0xD804,                               "Illegal cycle time (illegal time base or multiple)" },

    { 0xD805,                               "No more cyclic read jobs can be set up" },

    { 0xD806,                               "The referenced job is in a state in which the requested function cannot be performed" },

    { 0xD807,                               "Function aborted due to overload, meaning executing the read cycle takes longer than the set scan cycle time" },

    { 0xDC01,                               "Date and/or time invalid" },

    { 0xE201,                               "CPU is already the master" },

    { 0xE202,                               "Connect and update not possible due to different user program in flash module" },

    { 0xE203,                               "Connect and update not possible due to different firmware" },

    { 0xE204,                               "Connect and update not possible due to different memory configuration" },

    { 0xE205,                               "Connect/update aborted due to synchronization error" },

    { 0xE206,                               "Connect/update denied due to coordination violation" },

    { 0xEF01,                               "S7 protocol error: Error at ID2; only 00H permitted in job" },

    { 0xEF02,                               "S7 protocol error: Error at ID2; set of resources does not exist" },

    { 0,                                    NULL }

};

static value_string_ext param_errcode_names_ext = VALUE_STRING_EXT_INIT(param_errcode_names);

/**************************************************************************

 * Function codes in parameter part

 */

#define S7COMM_SERV_CPU                     0x00

#define S7COMM_SERV_MODETRANS               0x01

#define S7COMM_SERV_SETUPCOMM               0xF0

#define S7COMM_SERV_READVAR                 0x04

#define S7COMM_SERV_WRITEVAR                0x05

#define S7COMM_FUNCREQUESTDOWNLOAD          0x1A

#define S7COMM_FUNCDOWNLOADBLOCK            0x1B

#define S7COMM_FUNCDOWNLOADENDED            0x1C

#define S7COMM_FUNCSTARTUPLOAD              0x1D

#define S7COMM_FUNCUPLOAD                   0x1E

#define S7COMM_FUNCENDUPLOAD                0x1F

#define S7COMM_FUNCPISERVICE                0x28

#define S7COMM_FUNC_PLC_STOP                0x29

#define S7COMM_FUNC_INVALID                 0xFF

static const value_string param_functionnames[] = {

    { S7COMM_SERV_CPU,                      "CPU services" },

    { S7COMM_SERV_MODETRANS,                "Mode transition" },

    { S7COMM_SERV_SETUPCOMM,                "Setup communication" },

    { S7COMM_SERV_READVAR,                  "Read Var" },

    { S7COMM_SERV_WRITEVAR,                 "Write Var" },

    /* Block management services */

    { S7COMM_FUNCREQUESTDOWNLOAD,           "Request download" },

    { S7COMM_FUNCDOWNLOADBLOCK,             "Download block" },

    { S7COMM_FUNCDOWNLOADENDED,             "Download ended" },

    { S7COMM_FUNCSTARTUPLOAD,               "Start upload" },

    { S7COMM_FUNCUPLOAD,                    "Upload" },

    { S7COMM_FUNCENDUPLOAD,                 "End upload" },

    { S7COMM_FUNCPISERVICE,                 "PI-Service" },

    { S7COMM_FUNC_PLC_STOP,                 "PLC Stop" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Area names

 */

#define S7COMM_AREA_DATARECORD              0x01        /* Data record, used with RDREC or firmware updates on CP */

#define S7COMM_AREA_SYSINFO                 0x03        /* System info of 200 family */

#define S7COMM_AREA_SYSFLAGS                0x05        /* System flags of 200 family */

#define S7COMM_AREA_ANAIN                   0x06        /* analog inputs of 200 family */

#define S7COMM_AREA_ANAOUT                  0x07        /* analog outputs of 200 family */

#define S7COMM_AREA_P                       0x80        /* direct peripheral access */

#define S7COMM_AREA_INPUTS                  0x81

#define S7COMM_AREA_OUTPUTS                 0x82

#define S7COMM_AREA_FLAGS                   0x83

#define S7COMM_AREA_DB                      0x84        /* data blocks */

#define S7COMM_AREA_DI                      0x85        /* instance data blocks */

#define S7COMM_AREA_LOCAL                   0x86        /* local data (should not be accessible over network) */

#define S7COMM_AREA_V                       0x87        /* previous (Vorgaenger) local data (should not be accessible over network)  */

#define S7COMM_AREA_COUNTER                 28          /* S7 counters */

#define S7COMM_AREA_TIMER                   29          /* S7 timers */

#define S7COMM_AREA_COUNTER200              30          /* IEC counters (200 family) */

#define S7COMM_AREA_TIMER200                31          /* IEC timers (200 family) */

static const value_string item_areanames[] = {

    { S7COMM_AREA_DATARECORD,               "Data record" },

    { S7COMM_AREA_SYSINFO,                  "System info of 200 family" },

    { S7COMM_AREA_SYSFLAGS,                 "System flags of 200 family" },

    { S7COMM_AREA_ANAIN,                    "Analog inputs of 200 family" },

    { S7COMM_AREA_ANAOUT,                   "Analog outputs of 200 family" },

    { S7COMM_AREA_P,                        "Direct peripheral access (P)" },

    { S7COMM_AREA_INPUTS,                   "Inputs (I)" },

    { S7COMM_AREA_OUTPUTS,                  "Outputs (Q)" },

    { S7COMM_AREA_FLAGS,                    "Flags (M)" },

    { S7COMM_AREA_DB,                       "Data blocks (DB)" },

    { S7COMM_AREA_DI,                       "Instance data blocks (DI)" },

    { S7COMM_AREA_LOCAL,                    "Local data (L)" },

    { S7COMM_AREA_V,                        "Unknown yet (V)" },

    { S7COMM_AREA_COUNTER,                  "S7 counters (C)" },

    { S7COMM_AREA_TIMER,                    "S7 timers (T)" },

    { S7COMM_AREA_COUNTER200,               "IEC counters (200 family)" },

    { S7COMM_AREA_TIMER200,                 "IEC timers (200 family)" },

    { 0,                                    NULL }

};

static const value_string item_areanames_short[] = {

    { S7COMM_AREA_DATARECORD,               "RECORD" },

    { S7COMM_AREA_SYSINFO,                  "SI200" },

    { S7COMM_AREA_SYSFLAGS,                 "SF200" },

    { S7COMM_AREA_ANAIN,                    "AI200" },

    { S7COMM_AREA_ANAOUT,                   "AO" },

    { S7COMM_AREA_P,                        "P" },

    { S7COMM_AREA_INPUTS,                   "I" },

    { S7COMM_AREA_OUTPUTS,                  "Q" },

    { S7COMM_AREA_FLAGS,                    "M" },

    { S7COMM_AREA_DB,                       "DB" },

    { S7COMM_AREA_DI,                       "DI" },

    { S7COMM_AREA_LOCAL,                    "L" },

    { S7COMM_AREA_V,                        "V" },

    { S7COMM_AREA_COUNTER,                  "C" },

    { S7COMM_AREA_TIMER,                    "T" },

    { S7COMM_AREA_COUNTER200,               "C200" },

    { S7COMM_AREA_TIMER200,                 "T200" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Transport sizes in item data

 */

    /* types of 1 byte length */

#define S7COMM_TRANSPORT_SIZE_BIT           1

#define S7COMM_TRANSPORT_SIZE_BYTE          2

#define S7COMM_TRANSPORT_SIZE_CHAR          3

    /* types of 2 bytes length */

#define S7COMM_TRANSPORT_SIZE_WORD          4

#define S7COMM_TRANSPORT_SIZE_INT           5

    /* types of 4 bytes length */

#define S7COMM_TRANSPORT_SIZE_DWORD         6

#define S7COMM_TRANSPORT_SIZE_DINT          7

#define S7COMM_TRANSPORT_SIZE_REAL          8

    /* Special types */

#define S7COMM_TRANSPORT_SIZE_DATE          9

#define S7COMM_TRANSPORT_SIZE_TOD           10

#define S7COMM_TRANSPORT_SIZE_TIME          11

#define S7COMM_TRANSPORT_SIZE_S5TIME        12

#define S7COMM_TRANSPORT_SIZE_DT            15

    /* Timer or counter */

#define S7COMM_TRANSPORT_SIZE_COUNTER       28

#define S7COMM_TRANSPORT_SIZE_TIMER         29

#define S7COMM_TRANSPORT_SIZE_IEC_COUNTER   30

#define S7COMM_TRANSPORT_SIZE_IEC_TIMER     31

#define S7COMM_TRANSPORT_SIZE_HS_COUNTER    32

static const value_string item_transportsizenames[] = {

    { S7COMM_TRANSPORT_SIZE_BIT,            "BIT" },

    { S7COMM_TRANSPORT_SIZE_BYTE,           "BYTE" },

    { S7COMM_TRANSPORT_SIZE_CHAR,           "CHAR" },

    { S7COMM_TRANSPORT_SIZE_WORD,           "WORD" },

    { S7COMM_TRANSPORT_SIZE_INT,            "INT" },

    { S7COMM_TRANSPORT_SIZE_DWORD,          "DWORD" },

    { S7COMM_TRANSPORT_SIZE_DINT,           "DINT" },

    { S7COMM_TRANSPORT_SIZE_REAL,           "REAL" },

    { S7COMM_TRANSPORT_SIZE_TOD,            "TOD" },

    { S7COMM_TRANSPORT_SIZE_TIME,           "TIME" },

    { S7COMM_TRANSPORT_SIZE_S5TIME,         "S5TIME" },

    { S7COMM_TRANSPORT_SIZE_DT,             "DATE_AND_TIME" },

    { S7COMM_TRANSPORT_SIZE_COUNTER,        "COUNTER" },

    { S7COMM_TRANSPORT_SIZE_TIMER,          "TIMER" },

    { S7COMM_TRANSPORT_SIZE_IEC_COUNTER,    "IEC TIMER" },

    { S7COMM_TRANSPORT_SIZE_IEC_TIMER,      "IEC COUNTER" },

    { S7COMM_TRANSPORT_SIZE_HS_COUNTER,     "HS COUNTER" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Syntax Ids of variable specification

 */

#define S7COMM_SYNTAXID_S7ANY               0x10        /* Address data S7-Any pointer-like DB1.DBX10.2 */

#define S7COMM_SYNTAXID_SHORT               0x11

#define S7COMM_SYNTAXID_EXT                 0x12

#define S7COMM_SYNTAXID_PBC_ID              0x13        /* R_ID for PBC */

#define S7COMM_SYNTAXID_ALARM_LOCKFREESET   0x15        /* Alarm lock/free dataset */

#define S7COMM_SYNTAXID_ALARM_INDSET        0x16        /* Alarm indication dataset */

#define S7COMM_SYNTAXID_ALARM_ACKSET        0x19        /* Alarm acknowledge message dataset */

#define S7COMM_SYNTAXID_ALARM_QUERYREQSET   0x1a        /* Alarm query request dataset */

#define S7COMM_SYNTAXID_NOTIFY_INDSET       0x1c        /* Notify indication dataset */

#define S7COMM_SYNTAXID_NCK                 0x82        /* Sinumerik NCK HMI access (current units) */

#define S7COMM_SYNTAXID_NCK_METRIC          0x83        /* Sinumerik NCK HMI access metric units */

#define S7COMM_SYNTAXID_NCK_INCH            0x84        /* Sinumerik NCK HMI access inch */

#define S7COMM_SYNTAXID_DRIVEESANY          0xa2        /* seen on Drive ES Starter with routing over S7 */

#define S7COMM_SYNTAXID_1200SYM             0xb2        /* Symbolic address mode of S7-1200 */

#define S7COMM_SYNTAXID_DBREAD              0xb0        /* Kind of DB block read, seen only at an S7-400 */

static const value_string item_syntaxid_names[] = {

    { S7COMM_SYNTAXID_S7ANY,                "S7ANY" },

    { S7COMM_SYNTAXID_SHORT,                "ParameterShort" },

    { S7COMM_SYNTAXID_EXT,                  "ParameterExtended" },

    { S7COMM_SYNTAXID_PBC_ID,               "PBC-R_ID" },

    { S7COMM_SYNTAXID_ALARM_LOCKFREESET,    "ALARM_LOCKFREE" },

    { S7COMM_SYNTAXID_ALARM_INDSET,         "ALARM_IND" },

    { S7COMM_SYNTAXID_ALARM_ACKSET,         "ALARM_ACK" },

    { S7COMM_SYNTAXID_ALARM_QUERYREQSET,    "ALARM_QUERYREQ" },

    { S7COMM_SYNTAXID_NOTIFY_INDSET,        "NOTIFY_IND" },

    { S7COMM_SYNTAXID_NCK,                  "NCK" },

    { S7COMM_SYNTAXID_NCK_METRIC,           "NCK_M" },

    { S7COMM_SYNTAXID_NCK_INCH,             "NCK_I" },

    { S7COMM_SYNTAXID_DRIVEESANY,           "DRIVEESANY" },

    { S7COMM_SYNTAXID_1200SYM,              "1200SYM" },

    { S7COMM_SYNTAXID_DBREAD,               "DBREAD" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Transport sizes in data

 */

#define S7COMM_DATA_TRANSPORT_SIZE_NULL     0

#define S7COMM_DATA_TRANSPORT_SIZE_BBIT     3           /* bit access, len is in bits */

#define S7COMM_DATA_TRANSPORT_SIZE_BBYTE    4           /* byte/word/dword access, len is in bits */

#define S7COMM_DATA_TRANSPORT_SIZE_BINT     5           /* integer access, len is in bits */

#define S7COMM_DATA_TRANSPORT_SIZE_BDINT    6           /* integer access, len is in bytes */

#define S7COMM_DATA_TRANSPORT_SIZE_BREAL    7           /* real access, len is in bytes */

#define S7COMM_DATA_TRANSPORT_SIZE_BSTR     9           /* octet string, len is in bytes */

#define S7COMM_DATA_TRANSPORT_SIZE_NCKADDR1 17          /* NCK address description, fixed length */

#define S7COMM_DATA_TRANSPORT_SIZE_NCKADDR2 18          /* NCK address description, fixed length */

static const value_string data_transportsizenames[] = {

    { S7COMM_DATA_TRANSPORT_SIZE_NULL,      "NULL" },

    { S7COMM_DATA_TRANSPORT_SIZE_BBIT,      "BIT" },

    { S7COMM_DATA_TRANSPORT_SIZE_BBYTE,     "BYTE/WORD/DWORD" },

    { S7COMM_DATA_TRANSPORT_SIZE_BINT,      "INTEGER" },

    { S7COMM_DATA_TRANSPORT_SIZE_BDINT,     "DINTEGER" },

    { S7COMM_DATA_TRANSPORT_SIZE_BREAL,     "REAL" },

    { S7COMM_DATA_TRANSPORT_SIZE_BSTR,      "OCTET STRING" },

    { S7COMM_DATA_TRANSPORT_SIZE_NCKADDR1,  "NCK ADDRESS1" },

    { S7COMM_DATA_TRANSPORT_SIZE_NCKADDR2,  "NCK ADDRESS2" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Returnvalues of an item response

 */

const value_string s7comm_item_return_valuenames[] = {

    { S7COMM_ITEM_RETVAL_RESERVED,              "Reserved" },

    { S7COMM_ITEM_RETVAL_DATA_HW_FAULT,         "Hardware error" },

    { S7COMM_ITEM_RETVAL_DATA_ACCESS_FAULT,     "Accessing the object not allowed" },

    { S7COMM_ITEM_RETVAL_DATA_OUTOFRANGE,       "Invalid address" },

    { S7COMM_ITEM_RETVAL_DATA_NOT_SUP,          "Data type not supported" },

    { S7COMM_ITEM_RETVAL_DATA_SIZEMISMATCH,     "Data type inconsistent" },

    { S7COMM_ITEM_RETVAL_DATA_ERR,              "Object does not exist" },

    { S7COMM_ITEM_RETVAL_DATA_OK,               "Success" },

    { 0,                                        NULL }

};

/**************************************************************************

 * Block Types, used when blocktype is transferred as string

 */

#define S7COMM_BLOCKTYPE_OB                 0x3038      /* '08' */

#define S7COMM_BLOCKTYPE_CMOD               0x3039      /* '09' */

#define S7COMM_BLOCKTYPE_DB                 0x3041      /* '0A' */

#define S7COMM_BLOCKTYPE_SDB                0x3042      /* '0B' */

#define S7COMM_BLOCKTYPE_FC                 0x3043      /* '0C' */

#define S7COMM_BLOCKTYPE_SFC                0x3044      /* '0D' */

#define S7COMM_BLOCKTYPE_FB                 0x3045      /* '0E' */

#define S7COMM_BLOCKTYPE_SFB                0x3046      /* '0F' */

static const value_string blocktype_names[] = {

    { S7COMM_BLOCKTYPE_OB,                  "OB" },

    { S7COMM_BLOCKTYPE_CMOD,                "CMod" },

    { S7COMM_BLOCKTYPE_DB,                  "DB" },

    { S7COMM_BLOCKTYPE_SDB,                 "SDB" },

    { S7COMM_BLOCKTYPE_FC,                  "FC" },

    { S7COMM_BLOCKTYPE_SFC,                 "SFC" },

    { S7COMM_BLOCKTYPE_FB,                  "FB" },

    { S7COMM_BLOCKTYPE_SFB,                 "SFB" },

    { 0,                                    NULL }

};

static const value_string blocktype_attribute1_names[] = {

    { '_',                                  "Complete Module" },

    { '$',                                  "Module header for up-loading" },

    { 0,                                    NULL }

};

static const value_string blocktype_attribute2_names[] = {

    { 'P',                                  "Passive (copied, but not chained) module" },

    { 'A',                                  "Active embedded module" },

    { 'B',                                  "Active as well as passive module" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Subblk types

 */

#define S7COMM_SUBBLKTYPE_NONE              0x00

#define S7COMM_SUBBLKTYPE_OB                0x08

#define S7COMM_SUBBLKTYPE_DB                0x0a

#define S7COMM_SUBBLKTYPE_SDB               0x0b

#define S7COMM_SUBBLKTYPE_FC                0x0c

#define S7COMM_SUBBLKTYPE_SFC               0x0d

#define S7COMM_SUBBLKTYPE_FB                0x0e

#define S7COMM_SUBBLKTYPE_SFB               0x0f

static const value_string subblktype_names[] = {

    { S7COMM_SUBBLKTYPE_NONE,               "Not set" },

    { S7COMM_SUBBLKTYPE_OB,                 "OB" },

    { S7COMM_SUBBLKTYPE_DB,                 "DB" },

    { S7COMM_SUBBLKTYPE_SDB,                "SDB" },

    { S7COMM_SUBBLKTYPE_FC,                 "FC" },

    { S7COMM_SUBBLKTYPE_SFC,                "SFC" },

    { S7COMM_SUBBLKTYPE_FB,                 "FB" },

    { S7COMM_SUBBLKTYPE_SFB,                "SFB" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Block security

 */

#define S7COMM_BLOCKSECURITY_OFF            0

#define S7COMM_BLOCKSECURITY_KNOWHOWPROTECT 3

static const value_string blocksecurity_names[] = {

    { S7COMM_BLOCKSECURITY_OFF,             "None" },

    { S7COMM_BLOCKSECURITY_KNOWHOWPROTECT,  "Know How Protect" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Block Languages

 */

static const value_string blocklanguage_names[] = {

    { 0x00,                                 "Not defined" },

    { 0x01,                                 "AWL" },

    { 0x02,                                 "KOP" },

    { 0x03,                                 "FUP" },

    { 0x04,                                 "SCL" },

    { 0x05,                                 "DB" },

    { 0x06,                                 "GRAPH" },

    { 0x07,                                 "SDB" },

    { 0x08,                                 "CPU-DB" },                     /* DB was created from Plc programm (CREAT_DB) */

    { 0x11,                                 "SDB (after overall reset)" },  /* another SDB, don't know what it means, in SDB 1 and SDB 2, uncertain*/

    { 0x12,                                 "SDB (Routing)" },              /* another SDB, in SDB 999 and SDB 1000 (routing information), uncertain */

    { 0x29,                                 "ENCRYPT" },                    /* block is encrypted with S7-Block-Privacy */

    { 0,                                    NULL }

};

/**************************************************************************

 * Names of types in userdata parameter part

 */

static const value_string userdata_type_names[] = {

    { S7COMM_UD_TYPE_IND,                   "Indication" },

    { S7COMM_UD_TYPE_REQ,                   "Request" },

    { S7COMM_UD_TYPE_RES,                   "Response" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Subfunctions only used in Sinumerik NC file download

 */

#define S7COMM_NCPRG_FUNCREQUESTDOWNLOAD    1

#define S7COMM_NCPRG_FUNCDOWNLOADBLOCK      2

#define S7COMM_NCPRG_FUNCCONTDOWNLOAD       3

#define S7COMM_NCPRG_FUNCDOWNLOADENDED      4

#define S7COMM_NCPRG_FUNCSTARTUPLOAD        6

#define S7COMM_NCPRG_FUNCUPLOAD             7

#define S7COMM_NCPRG_FUNCCONTUPLOAD         8

static const value_string userdata_ncprg_subfunc_names[] = {

    { S7COMM_NCPRG_FUNCREQUESTDOWNLOAD,     "Request download" },

    { S7COMM_NCPRG_FUNCDOWNLOADBLOCK,       "Download block" },

    { S7COMM_NCPRG_FUNCCONTDOWNLOAD,        "Continue download" },

    { S7COMM_NCPRG_FUNCDOWNLOADENDED,       "Download ended" },

    { S7COMM_NCPRG_FUNCSTARTUPLOAD,         "Start upload" },

    { S7COMM_NCPRG_FUNCUPLOAD,              "Upload" },

    { S7COMM_NCPRG_FUNCCONTUPLOAD,          "Continue upload" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Subfunctions for Data Record Routing to Profibus

 */

#define S7COMM_DRR_FUNCINIT                 1

#define S7COMM_DRR_FUNCFINISH               2

#define S7COMM_DRR_FUNCDATA                 3

static const value_string userdata_drr_subfunc_names[] = {

    { S7COMM_DRR_FUNCINIT,                  "DRR Init" },

    { S7COMM_DRR_FUNCFINISH,                "DRR Finish" },

    { S7COMM_DRR_FUNCDATA,                  "DRR Data" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Userdata Parameter, last data unit

 */

#define S7COMM_UD_LASTDATAUNIT_YES          0x00

#define S7COMM_UD_LASTDATAUNIT_NO           0x01

static const value_string userdata_lastdataunit_names[] = {

    { S7COMM_UD_LASTDATAUNIT_YES,           "Yes" },

    { S7COMM_UD_LASTDATAUNIT_NO,            "No" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Names of Function groups in userdata parameter part

 */

#define S7COMM_UD_FUNCGROUP_TIS             0x01

#define S7COMM_UD_FUNCGROUP_CYCLIC          0x02

#define S7COMM_UD_FUNCGROUP_BLOCK           0x03

#define S7COMM_UD_FUNCGROUP_CPU             0x04

#define S7COMM_UD_FUNCGROUP_SEC             0x05                    /* Security functions e.g. plc password */

#define S7COMM_UD_FUNCGROUP_PBC_BSEND       0x06                    /* PBC = Programmable Block Communication (PBK in german) */

#define S7COMM_UD_FUNCGROUP_TIME            0x07

#define S7COMM_UD_FUNCGROUP_NCPRG           0x3f

#define S7COMM_UD_FUNCGROUP_DRR             0x20

static const value_string userdata_functiongroup_names[] = {

    { S7COMM_UD_FUNCGROUP_TIS,              "Programmer commands" },

    { S7COMM_UD_FUNCGROUP_CYCLIC,           "Cyclic services" },    /* to read data from plc without a request */

    { S7COMM_UD_FUNCGROUP_BLOCK,            "Block functions" },

    { S7COMM_UD_FUNCGROUP_CPU,              "CPU functions" },

    { S7COMM_UD_FUNCGROUP_SEC,              "Security" },

    { S7COMM_UD_FUNCGROUP_PBC_BSEND,        "PBC BSEND" },

    { S7COMM_UD_FUNCGROUP_TIME,             "Time functions" },

    { S7COMM_UD_FUNCGROUP_NCPRG,            "NC programming" },

    { S7COMM_UD_FUNCGROUP_DRR,              "DR Routing" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Variable status: Area of data request

 *

 * Low       Hi

 * 0=M       0=BOOL

 * 1=E       1=BYTE

 * 2=A       2=WORD

 * 3=PEx     3=DWORD

 * 7=DB

 * 54=TIMER

 * 64=COUNTER

 */

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MX      0x00

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MB      0x01

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MW      0x02

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MD      0x03

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EX      0x10

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EB      0x11

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EW      0x12

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_ED      0x13

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AX      0x20

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AB      0x21

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AW      0x22

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AD      0x23

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEB     0x31

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEW     0x32

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PED     0x33

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBX     0x70

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBB     0x71

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBW     0x72

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBD     0x73

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_T       0x54

#define S7COMM_UD_SUBF_TIS_VARSTAT_AREA_C       0x64

static const value_string userdata_tis_varstat_area_names[] = {

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MX,       "MX" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MB,       "MB" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MW,       "MW" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_MD,       "MD" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EB,       "IB" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EX,       "IX" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_EW,       "IW" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_ED,       "ID" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AX,       "QX" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AB,       "QB" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AW,       "QW" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_AD,       "QD" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEB,      "PIB" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PEW,      "PIW" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_PED,      "PID" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBX,      "DBX" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBB,      "DBB" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBW,      "DBW" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_DBD,      "DBD" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_T,        "TIMER" },

    { S7COMM_UD_SUBF_TIS_VARSTAT_AREA_C,        "COUNTER" },

    { 0,                                        NULL }

};

/**************************************************************************

 * Names of userdata subfunctions in group 1 (Programmer commands)

 * In szl dataset 0x0132/2 these are defined as "Test and installation functions TIS".

 * The methods supported by the CPU are listed in the funkt_n bits.

 */

#define S7COMM_UD_SUBF_TIS_BLOCKSTAT        0x01

#define S7COMM_UD_SUBF_TIS_VARSTAT          0x02

#define S7COMM_UD_SUBF_TIS_OUTISTACK        0x03

#define S7COMM_UD_SUBF_TIS_OUTBSTACK        0x04

#define S7COMM_UD_SUBF_TIS_OUTLSTACK        0x05

#define S7COMM_UD_SUBF_TIS_TIMEMEAS         0x06

#define S7COMM_UD_SUBF_TIS_FORCESEL         0x07

#define S7COMM_UD_SUBF_TIS_MODVAR           0x08

#define S7COMM_UD_SUBF_TIS_FORCE            0x09

#define S7COMM_UD_SUBF_TIS_BREAKPOINT       0x0a

#define S7COMM_UD_SUBF_TIS_EXITHOLD         0x0b

#define S7COMM_UD_SUBF_TIS_MEMORYRES        0x0c

#define S7COMM_UD_SUBF_TIS_DISABLEJOB       0x0d

#define S7COMM_UD_SUBF_TIS_ENABLEJOB        0x0e

#define S7COMM_UD_SUBF_TIS_DELETEJOB        0x0f

#define S7COMM_UD_SUBF_TIS_READJOBLIST      0x10

#define S7COMM_UD_SUBF_TIS_READJOB          0x11

#define S7COMM_UD_SUBF_TIS_REPLACEJOB       0x12

#define S7COMM_UD_SUBF_TIS_BLOCKSTAT2       0x13

#define S7COMM_UD_SUBF_TIS_FLASHLED         0x16

static const value_string userdata_tis_subfunc_names[] = {

    { S7COMM_UD_SUBF_TIS_BLOCKSTAT,         "Block status" },

    { S7COMM_UD_SUBF_TIS_VARSTAT,           "Variable status" },

    { S7COMM_UD_SUBF_TIS_OUTISTACK,         "Output ISTACK" },

    { S7COMM_UD_SUBF_TIS_OUTBSTACK,         "Output BSTACK" },

    { S7COMM_UD_SUBF_TIS_OUTLSTACK,         "Output LSTACK" },

    { S7COMM_UD_SUBF_TIS_TIMEMEAS,          "Time measurement from to" },       /* never seen yet */

    { S7COMM_UD_SUBF_TIS_FORCESEL,          "Force selection" },

    { S7COMM_UD_SUBF_TIS_MODVAR,            "Modify variable" },

    { S7COMM_UD_SUBF_TIS_FORCE,             "Force" },

    { S7COMM_UD_SUBF_TIS_BREAKPOINT,        "Breakpoint" },

    { S7COMM_UD_SUBF_TIS_EXITHOLD,          "Exit HOLD" },

    { S7COMM_UD_SUBF_TIS_MEMORYRES,         "Memory reset" },

    { S7COMM_UD_SUBF_TIS_DISABLEJOB,        "Disable job" },

    { S7COMM_UD_SUBF_TIS_ENABLEJOB,         "Enable job" },

    { S7COMM_UD_SUBF_TIS_DELETEJOB,         "Delete job" },

    { S7COMM_UD_SUBF_TIS_READJOBLIST,       "Read job list" },

    { S7COMM_UD_SUBF_TIS_READJOB,           "Read job" },

    { S7COMM_UD_SUBF_TIS_REPLACEJOB,        "Replace job" },

    { S7COMM_UD_SUBF_TIS_BLOCKSTAT2,        "Block status v2" },

    { S7COMM_UD_SUBF_TIS_FLASHLED,          "Flash LED" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Variable status: Trigger point

 */

static const value_string userdata_varstat_trgevent_names[] = {

    { 0x0000,                               "Immediately" },

    { 0x0100,                               "System Trigger" },

    { 0x0200,                               "System checkpoint main cycle start" },

    { 0x0300,                               "System checkpoint main cycle end" },

    { 0x0400,                               "Mode transition RUN-STOP" },

    { 0x0500,                               "After code address" },

    { 0x0600,                               "Code address area" },

    { 0x0601,                               "Code address area with call environment" },  /* Call conditions like opened DB/DI or called block */

    { 0x0700,                               "Data address" },

    { 0x0800,                               "Data address area" },

    { 0x0900,                               "Local data address" },

    { 0x0a00,                               "Local data address area" },

    { 0x0b00,                               "Range trigger" },

    { 0x0c00,                               "Before code address" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Names of userdata subfunctions in group 2 (cyclic data)

 */

#define S7COMM_UD_SUBF_CYCLIC_TRANSF        0x01

#define S7COMM_UD_SUBF_CYCLIC_UNSUBSCRIBE   0x04

#define S7COMM_UD_SUBF_CYCLIC_CHANGE        0x05

#define S7COMM_UD_SUBF_CYCLIC_CHANGE_MOD    0x07

#define S7COMM_UD_SUBF_CYCLIC_RDREC         0x08

static const value_string userdata_cyclic_subfunc_names[] = {

    { S7COMM_UD_SUBF_CYCLIC_TRANSF,         "Cyclic transfer" },

    { S7COMM_UD_SUBF_CYCLIC_UNSUBSCRIBE,    "Unsubscribe" },

    { S7COMM_UD_SUBF_CYCLIC_CHANGE,         "Change driven transfer" },

    { S7COMM_UD_SUBF_CYCLIC_CHANGE_MOD,     "Change driven transfer modify" },

    { S7COMM_UD_SUBF_CYCLIC_RDREC,          "RDREC" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Timebase for cyclic services

 */

static const value_string cycl_interval_timebase_names[] = {

    { 0,                                    "100 milliseconds" },

    { 1,                                    "1 second" },

    { 2,                                    "10 seconds" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Names of userdata subfunctions in group 3 (Block functions)

 */

#define S7COMM_UD_SUBF_BLOCK_LIST           0x01

#define S7COMM_UD_SUBF_BLOCK_LISTTYPE       0x02

#define S7COMM_UD_SUBF_BLOCK_BLOCKINFO      0x03

static const value_string userdata_block_subfunc_names[] = {

    { S7COMM_UD_SUBF_BLOCK_LIST,            "List blocks" },

    { S7COMM_UD_SUBF_BLOCK_LISTTYPE,        "List blocks of type" },

    { S7COMM_UD_SUBF_BLOCK_BLOCKINFO,       "Get block info" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Names of userdata subfunctions in group 4 (CPU functions)

 */

#define S7COMM_UD_SUBF_CPU_SCAN_IND         0x09

#define S7COMM_UD_SUBF_CPU_AR_SEND_IND      0x10

static const value_string userdata_cpu_subfunc_names[] = {

    { S7COMM_UD_SUBF_CPU_READSZL,           "Read SZL" },

    { S7COMM_UD_SUBF_CPU_MSGS,              "Message service" },                /* Header constant is also different here */

    { S7COMM_UD_SUBF_CPU_DIAGMSG,           "Diagnostic message" },             /* Diagnostic message from PLC */

    { S7COMM_UD_SUBF_CPU_ALARM8_IND,        "ALARM_8 indication" },             /* PLC is indicating an ALARM message, using ALARM_8 SFBs */

    { S7COMM_UD_SUBF_CPU_NOTIFY_IND,        "NOTIFY indication" },              /* PLC is indicating a NOTIFY message, using NOTIFY SFBs */

    { S7COMM_UD_SUBF_CPU_ALARM8LOCK,        "ALARM_8 lock" },                   /* Lock an ALARM message from HMI/SCADA */

    { S7COMM_UD_SUBF_CPU_ALARM8UNLOCK,      "ALARM_8 unlock" },                 /* Unlock an ALARM message from HMI/SCADA */

    { S7COMM_UD_SUBF_CPU_SCAN_IND,          "SCAN indication" },                /* PLC is indicating a SCAN message */

    { S7COMM_UD_SUBF_CPU_AR_SEND_IND,       "AR_SEND indication" },             /* PLC is indicating a AR_SEND message */

    { S7COMM_UD_SUBF_CPU_ALARMS_IND,        "ALARM_S indication" },             /* PLC is indicating an ALARM message, using ALARM_S/ALARM_D SFCs */

    { S7COMM_UD_SUBF_CPU_ALARMSQ_IND,       "ALARM_SQ indication" },            /* PLC is indicating an ALARM message, using ALARM_SQ/ALARM_DQ SFCs */

    { S7COMM_UD_SUBF_CPU_ALARMQUERY,        "ALARM query" },                    /* HMI/SCADA query of ALARMs */

    { S7COMM_UD_SUBF_CPU_ALARMACK,          "ALARM ack" },                      /* Alarm was acknowledged in HMI/SCADA */

    { S7COMM_UD_SUBF_CPU_ALARMACK_IND,      "ALARM ack indication" },           /* Alarm acknowledge indication from CPU to HMI */

    { S7COMM_UD_SUBF_CPU_ALARM8LOCK_IND,    "ALARM lock indication" },          /* Alarm lock indication from CPU to HMI */

    { S7COMM_UD_SUBF_CPU_ALARM8UNLOCK_IND,  "ALARM unlock indication" },        /* Alarm unlock indication from CPU to HMI */

    { S7COMM_UD_SUBF_CPU_NOTIFY8_IND,       "NOTIFY_8 indication" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Names of userdata subfunctions in group 5 (Security?)

 */

#define S7COMM_UD_SUBF_SEC_PASSWD           0x01

static const value_string userdata_sec_subfunc_names[] = {

    { S7COMM_UD_SUBF_SEC_PASSWD,            "PLC password" },

    { 0,                                    NULL }

};

/**************************************************************************

 * Names of userdata subfunctions in group 7 (Time functions)

 */

#define S7COMM_UD_SUBF_TIME_READ            0x01

#define S7COMM_UD_SUBF_TIME_SET             0x02

#define S7COMM_UD_SUBF_TIME_READF           0x03

#define S7COMM_UD_SUBF_TIME_SET2            0x04

static const value_string userdata_time_subfunc_names[] = {

    { S7COMM_UD_SUBF_TIME_READ,             "Read clock" },

    { S7COMM_UD_SUBF_TIME_SET,              "Set clock" },

    { S7COMM_UD_SUBF_TIME_READF,            "Read clock (following)" },

    { S7COMM_UD_SUBF_TIME_SET2,             "Set clock" },

    { 0,                                    NULL }

};

/*******************************************************************************************************

 * Weekday names in DATE_AND_TIME

 */

static const value_string weekdaynames[] = {

    { 0,                                    "Undefined" },

    { 1,                                    "Sunday" },

    { 2,                                    "Monday" },

    { 3,                                    "Tuesday" },

    { 4,                                    "Wednesday" },

    { 5,                                    "Thursday" },

    { 6,                                    "Friday" },

    { 7,                                    "Saturday" },

    { 0,                                    NULL }

};

/**************************************************************************

 **************************************************************************/

/**************************************************************************

 * Flags for LID access

 */

#define S7COMM_TIA1200_VAR_ENCAPS_LID       0x2

#define S7COMM_TIA1200_VAR_ENCAPS_IDX       0x3

#define S7COMM_TIA1200_VAR_OBTAIN_LID       0x4

#define S7COMM_TIA1200_VAR_OBTAIN_IDX       0x5

#define S7COMM_TIA1200_VAR_PART_START       0x6

#define S7COMM_TIA1200_VAR_PART_LEN         0x7

static const value_string tia1200_var_lid_flag_names[] = {

    { S7COMM_TIA1200_VAR_ENCAPS_LID,        "Encapsulated LID" },

    { S7COMM_TIA1200_VAR_ENCAPS_IDX,        "Encapsulated Index" },

    { S7COMM_TIA1200_VAR_OBTAIN_LID,        "Obtain by LID" },

    { S7COMM_TIA1200_VAR_OBTAIN_IDX,        "Obtain by Index" },

    { S7COMM_TIA1200_VAR_PART_START,        "Part Start Address" },

    { S7COMM_TIA1200_VAR_PART_LEN,          "Part Length" },

    { 0,                                    NULL }

};

/**************************************************************************

 * TIA 1200 Area Names for variable access

 */

#define S7COMM_TIA1200_VAR_ITEM_AREA1_DB    0x8a0e              /* Reading DB, 2 byte DB-Number following */

#define S7COMM_TIA1200_VAR_ITEM_AREA1_IQMCT 0x0000              /* Reading I/Q/M/C/T, 2 Byte detail area following */

static const value_string tia1200_var_item_area1_names[] = {

    { S7COMM_TIA1200_VAR_ITEM_AREA1_DB,     "DB" },

    { S7COMM_TIA1200_VAR_ITEM_AREA1_IQMCT,  "IQMCT" },

    { 0,                                    NULL }

};

#define S7COMM_TIA1200_VAR_ITEM_AREA2_I     0x50

#define S7COMM_TIA1200_VAR_ITEM_AREA2_Q     0x51

#define S7COMM_TIA1200_VAR_ITEM_AREA2_M     0x52

#define S7COMM_TIA1200_VAR_ITEM_AREA2_C     0x53

#define S7COMM_TIA1200_VAR_ITEM_AREA2_T     0x54

static const value_string tia1200_var_item_area2_names[] = {

    { S7COMM_TIA1200_VAR_ITEM_AREA2_I,      "Inputs (I)" },

    { S7COMM_TIA1200_VAR_ITEM_AREA2_Q,      "Outputs (Q)" },

    { S7COMM_TIA1200_VAR_ITEM_AREA2_M,      "Flags (M)" },

    { S7COMM_TIA1200_VAR_ITEM_AREA2_C,      "Counter (C)" },

    { S7COMM_TIA1200_VAR_ITEM_AREA2_T,      "Timer (T)" },

    { 0,                                    NULL }

};

/**************************************************************************

 * NCK areas

 */

#define S7COMM_NCK_AREA_N_NCK               0

#define S7COMM_NCK_AREA_B_MODEGROUP         1

#define S7COMM_NCK_AREA_C_CHANNEL           2

#define S7COMM_NCK_AREA_A_AXIS              3

#define S7COMM_NCK_AREA_T_TOOL              4

#define S7COMM_NCK_AREA_V_FEEDDRIVE         5

#define S7COMM_NCK_AREA_H_MAINDRIVE         6

#define S7COMM_NCK_AREA_M_MMC               7

static const value_string nck_area_names[] = {

    { S7COMM_NCK_AREA_N_NCK,                "N - NCK" },

    { S7COMM_NCK_AREA_B_MODEGROUP,          "B - Mode group" },

    { S7COMM_NCK_AREA_C_CHANNEL,            "C - Channel" },

    { S7COMM_NCK_AREA_A_AXIS,               "A - Axis" },

    { S7COMM_NCK_AREA_T_TOOL,               "T - Tool" },

    { S7COMM_NCK_AREA_V_FEEDDRIVE,          "V - Feed drive" },

    { S7COMM_NCK_AREA_H_MAINDRIVE,          "M - Main drive" },

    { S7COMM_NCK_AREA_M_MMC,                "M - MMC" },

    { 0,                                    NULL }

};

static const value_string nck_module_names[] = {

    { 0x10,                                 "Y - Global system data" },

    { 0x11,                                 "YNCFL - NCK instruction groups" },

    { 0x12,                                 "FU - NCU global settable frames" },

    { 0x13,                                 "FA - Active NCU global frames" },

    { 0x14,                                 "TO - Tool data" },

    { 0x15,                                 "RP - Arithmetic parameters" },

    { 0x16,                                 "SE - Setting data" },

    { 0x17,                                 "SGUD - SGUD-Block" },

    { 0x18,                                 "LUD - Local userdata" },

    { 0x19,                                 "TC - Toolholder parameters" },

    { 0x1a,                                 "M - Machine data" },

    { 0x1c,                                 "WAL - Working area limitation" },

    { 0x1e,                                 "DIAG - Internal diagnostic data" },

    { 0x1f,                                 "CC - Unknown" },

    { 0x20,                                 "FE - Channel-specific external frame" },

    { 0x21,                                 "TD - Tool data: General data" },

    { 0x22,                                 "TS - Tool edge data: Monitoring data" },

    { 0x23,                                 "TG - Tool data: Grinding-specific data" },

    { 0x24,                                 "TU - Tool data" },

    { 0x25,                                 "TUE - Tool edge data, userdefined data" },

    { 0x26,                                 "TV - Tool data, directory" },

    { 0x27,                                 "TM - Magazine data: General data" },

    { 0x28,                                 "TP - Magazine data: Location data" },

    { 0x29,                                 "TPM - Magazine data: Multiple assignment of location data" },

    { 0x2a,                                 "TT - Magazine data: Location typ" },

    { 0x2b,                                 "TMV - Magazine data: Directory" },

    { 0x2c,                                 "TMC - Magazine data: Configuration data" },

    { 0x2d,                                 "MGUD - MGUD-Block" },

    { 0x2e,                                 "UGUD - UGUD-Block" },

    { 0x2f,                                 "GUD4 - GUD4-Block" },

    { 0x30,                                 "GUD5 - GUD5-Block" },

    { 0x31,                                 "GUD6 - GUD6-Block" },

    { 0x32,                                 "GUD7 - GUD7-Block" },

    { 0x33,                                 "GUD8 - GUD8-Block" },

    { 0x34,                                 "GUD9 - GUD9-Block" },

    { 0x35,                                 "PA - Channel-specific protection zones" },

    { 0x36,                                 "GD1 - SGUD-Block GD1" },

    { 0x37,                                 "NIB - State data: Nibbling" },

    { 0x38,                                 "ETP - Types of events" },

    { 0x39,                                 "ETPD - Data lists for protocolling" },

    { 0x3a,                                 "SYNACT - Channel-specific synchronous actions" },

    { 0x3b,                                 "DIAGN - Diagnostic data" },

    { 0x3c,                                 "VSYN - Channel-specific user variables for synchronous actions" },

    { 0x3d,                                 "TUS - Tool data: user monitoring data" },

    { 0x3e,                                 "TUM - Tool data: user magazine data" },

    { 0x3f,                                 "TUP - Tool data: user magazine place data" },

    { 0x40,                                 "TF - Parameterizing, return parameters of _N_TMGETT, _N_TSEARC" },

    { 0x41,                                 "FB - Channel-specific base frames" },

    { 0x42,                                 "SSP2 - State data: Spindle" },

    { 0x43,                                 "PUD - programmglobale Benutzerdaten" },

    { 0x44,                                 "TOS - Edge-related location-dependent fine total offsets" },

    { 0x45,                                 "TOST - Edge-related location-dependent fine total offsets, transformed" },

    { 0x46,                                 "TOE - Edge-related coarse total offsets, setup offsets" },

    { 0x47,                                 "TOET - Edge-related coarse total offsets, transformed setup offsets" },

    { 0x48,                                 "AD - Adapter data" },

    { 0x49,                                 "TOT - Edge data: Transformed offset data" },

    { 0x4a,                                 "AEV - Working offsets: Directory" },

    { 0x4b,                                 "YFAFL - NCK instruction groups (Fanuc)" },

    { 0x4c,                                 "FS - System-Frame" },

    { 0x4d,                                 "SD - Servo data" },

    { 0x4e,                                 "TAD - Application-specific data" },

    { 0x4f,                                 "TAO - Application-specific cutting edge data" },

    { 0x50,                                 "TAS - Application-specific monitoring data" },

    { 0x51,                                 "TAM - Application-specific magazine data" },

    { 0x52,                                 "TAP - Application-specific magazine location data" },

    { 0x53,                                 "MEM - Unknown" },

    { 0x54,                                 "SALUC - Alarm actions: List in reverse chronological order" },

    { 0x55,                                 "AUXFU - Auxiliary functions" },

    { 0x56,                                 "TDC - Tool/Tools" },

    { 0x57,                                 "CP - Generic coupling" },

    { 0x6e,                                 "SDME - Unknown" },

    { 0x6f,                                 "SPARPI - Program pointer on interruption" },

    { 0x70,                                 "SEGA - State data: Geometry axes in tool offset memory (extended)" },

    { 0x71,                                 "SEMA - State data: Machine axes (extended)" },

    { 0x72,                                 "SSP - State data: Spindle" },

    { 0x73,                                 "SGA - State data: Geometry axes in tool offset memory" },

    { 0x74,                                 "SMA - State data: Machine axes" },

    { 0x75,                                 "SALAL - Alarms: List organized according to time" },

    { 0x76,                                 "SALAP - Alarms: List organized according to priority" },

    { 0x77,                                 "SALA - Alarms: List organized according to time" },

    { 0x78,                                 "SSYNAC - Synchronous actions" },

    { 0x79,                                 "SPARPF - Program pointers for block search and stop run" },

    { 0x7a,                                 "SPARPP - Program pointer in automatic operation" },

    { 0x7b,                                 "SNCF - Active G functions" },

    { 0x7d,                                 "SPARP - Part program information" },

    { 0x7e,                                 "SINF - Part-program-specific status data" },

    { 0x7f,                                 "S - State data" },

    { 0x80,                                 "0x80 - Unknown" },

    { 0x81,                                 "0x81 - Unknown" },

    { 0x82,                                 "0x82 - Unknown" },

    { 0x83,                                 "0x83 - Unknown" },

    { 0x84,                                 "0x84 - Unknown" },

    { 0x85,                                 "0x85 - Unknown" },

    { 0xfd,                                 "0 - Internal" },

    { 0,                                    NULL }

};

static value_string_ext nck_module_names_ext = VALUE_STRING_EXT_INIT(nck_module_names);

static int hf_s7comm_tia1200_item_reserved1;          /* 1 Byte Reserved (always 0xff?) */

static int hf_s7comm_tia1200_item_area1;              /* 2 Byte2 Root area (DB or IQMCT) */

static int hf_s7comm_tia1200_item_area2;              /* 2 Bytes detail area (I/Q/M/C/T) */

static int hf_s7comm_tia1200_item_area2unknown;       /* 2 Bytes detail area for possible unknown or not seen areas */

static int hf_s7comm_tia1200_item_dbnumber;           /* 2 Bytes DB number */

static int hf_s7comm_tia1200_item_crc;                /* 4 Bytes CRC */

static int hf_s7comm_tia1200_substructure_item;       /* Substructure */

static int hf_s7comm_tia1200_var_lid_flags;           /* LID Flags */

static int hf_s7comm_tia1200_item_value;