epan/dissectors/packet-kingfisher.c

   1 /* packet-kingfisher.c
   2  * Routines for kingfisher packet dissection
   3  * By Rob Casey 2007
   4  *
   5  * Wireshark - Network traffic analyzer
   6  * By Gerald Combs <gerald@wireshark.org>
   7  * Copyright 1998 Gerald Combs
   8  *
   9  * Copied from packet-pop.c
  10  *
  11  * SPDX-License-Identifier: GPL-2.0-or-later
  12  */
  13
  14 #include "config.h"
  15
  16 #include <epan/packet.h>
  17 #include <epan/conversation.h>
  18 #include <epan/expert.h>
  19
  20 void proto_register_kingfisher(void);
  21 void proto_reg_handoff_kingfisher(void);
  22
  23 static dissector_handle_t kingfisher_handle;
  24
  25 #define SUPPORT_KINGFISHER_SERIES_2
  26
  27 #ifdef SUPPORT_KINGFISHER_SERIES_2
  28 #define TCP_PORT_KINGFISHER_RANGE   "473,4058" /* 473 not IANA registered */
  29 #define UDP_PORT_KINGFISHER_RANGE   "473,4058" /* 473 not IANA registered */
  30 #else
  31 #define TCP_PORT_KINGFISHER_RANGE   "4058"
  32 #define UDP_PORT_KINGFISHER_RANGE   "4058"
  33 #endif
  34
  35 static int proto_kingfisher;
  36 static int hf_kingfisher_version;
  37 static int hf_kingfisher_system;
  38 static int hf_kingfisher_length;
  39 static int hf_kingfisher_from;
  40 static int hf_kingfisher_target;
  41 static int hf_kingfisher_via;
  42 static int hf_kingfisher_message;
  43 static int hf_kingfisher_function;
  44 static int hf_kingfisher_checksum;
  45 static int hf_kingfisher_checksum_status;
  46 static int hf_kingfisher_message_data;
  47
  48 static expert_field ei_kingfisher_checksum;
  49
  50 static dissector_handle_t kingfisher_conv_handle;
  51
  52
  53 typedef struct _kingfisher_packet_t
  54 {
  55     uint8_t     version;
  56     uint8_t     system_id;
  57     uint16_t    from;
  58     uint16_t    target;
  59     uint16_t    via;
  60     uint8_t     length;
  61     uint8_t     message;
  62     uint8_t     function;
  63     uint16_t    checksum;
  64 } kingfisher_packet_t;
  65
  66 static int ett_kingfisher;
  67
  68 static const value_string function_code_vals[] =
  69 {
  70     { 0x00, "Acknowledgement" },
  71     { 0x01, "Negative Acknowledgement" },
  72     { 0x02, "No Access" },
  73     { 0x03, "Message Buffer Full" },
  74     { 0x0a, "Get Data Frame" },
  75     { 0x0b, "Send Data Frame" },
  76     { 0x0c, "Get Data Blocks" },
  77     { 0x0d, "Send Data Blocks" },
  78     { 0x0e, "Check RTU Update" },
  79     { 0x0f, "Send RTU Update" },
  80     { 0x10, "Get Multiple Data" },
  81     { 0x11, "Send Multiple Data" },
  82     { 0x12, "Get Multiple Network Data" },
  83     { 0x13, "Send Multiple Network Data" },
  84     { 0x14, "Set Multiple Data" },
  85     { 0x15, "Get Multiple Data to Local Registers" },
  86     { 0x16, "Set Data Block" },
  87     { 0x17, "QSet Multiple Data" },
  88     { 0x18, "Set Digital Data" },
  89     { 0x1a, "Request RTU update" },
  90     { 0x1b, "QSet Digital Data" },
  91     { 0x1e, "Cold Start" },
  92     { 0x1f, "Warm Start" },
  93     { 0x21, "Program Control" },
  94     { 0x22, "Get RTU Status" },
  95     { 0x23, "Send RTU Status" },
  96     { 0x24, "Set RTC" },
  97     { 0x25, "Swap Master CPU" },
  98     { 0x26, "Send I/O Module Message" },
  99     { 0x28, "Get Diagnostic Information" },
 100     { 0x29, "Send Diagnostic Information" },
 101     { 0x2b, "Send Pager Information" },
 102     { 0x2c, "Get Pager Information" },
 103     { 0x2d, "Send Port Data Information" },
 104     { 0x2e, "Get Port Data Information" },
 105     { 0x2f, "Send RTU Data Information" },
 106     { 0x30, "Get RTU Data Information" },
 107     { 0x31, "Unlock Port" },
 108     { 0x33, "Carrier Test" },
 109     { 0x34, "Program Flash RAM" },
 110     { 0x35, "Get I/O Values" },
 111     { 0x36, "Send I/O Values" },
 112     { 0x37, "Synchronise Clock" },
 113     { 0x38, "Send Communications Module Message" },
 114     { 0x39, "Get Communications Module Message" },
 115     { 0x3a, "Get Driver Information" },
 116     { 0x3b, "Send Driver Information" },
 117     { 0x3c, "Communications Analyser" },
 118     { 0x41, "Dial Site" },
 119     { 0x42, "Hang-up Site" },
 120     { 0x46, "Send File" },
 121     { 0x47, "Get File" },
 122     { 0x50, "Get Event Logging" },
 123     { 0x51, "Send Event Logging" },
 124     { 0x80, "Acknowledgement" },
 125     { 0x81, "Negative Acknowledgement" },
 126     { 0x84, "Get Named Variable" },
 127     { 0x85, "Send Named Variable" },
 128     { 0x87, "Get Module Information" },
 129     { 0x88, "Send Module Information" },
 130     { 0x89, "Get I/O Values" },
 131     { 0x8a, "Send I/O Values" },
 132     { 0x9e, "Cold Start" },
 133     { 0x9f, "Warm Start" },
 134     { 0xa2, "Get RTU Status" },
 135     { 0xa3, "Send RTU Status" },
 136     { 0xa4, "Set RTC" },
 137     { 0xa8, "Get Diagnostic Information" },
 138     { 0xa9, "Send Diagnostic Information" },
 139     { 0xd1, "Set Event Log" },
 140     { 0xd2, "Clear Event Log" },
 141     { 0xd3, "Get Number of Events" },
 142     { 0xd4, "Send Number of Events" },
 143     { 0xd5, "Get Event Log" },
 144     { 0xd6, "Continue Event Log" },
 145     { 0xd7, "Send Event Log" },
 146     { 0xe0, "Send File Start" },
 147     { 0xe1, "Send File Start Acknowledgement" },
 148     { 0xe2, "Send File Data" },
 149     { 0xe3, "Send File Data Acknowledgement" },
 150     {0, NULL}
 151 };
 152
 153
 154 static unsigned short
 155 kingfisher_checksum(tvbuff_t *tvb, int offset)
 156 {
 157     int c, i, j, len;
 158     unsigned short crc;
 159
 160     crc = 0;
 161     len = tvb_reported_length_remaining(tvb, offset) - 2;
 162     for( i = 1; i < len; i++ )
 163     {
 164         c = ( ( unsigned char ) tvb_get_uint8( tvb, i ) ) & 0xff;
 165         for( j = 0; j < 8; ++j )
 166         {
 167             if( crc & 0x8000 )
 168             {
 169                 crc <<= 1;
 170                 crc += ( ( ( c <<= 1 ) & 0x100 ) != 0 );
 171                 crc ^= 0x1021;
 172             }
 173             else
 174             {
 175                 crc <<= 1;
 176                 crc += ( ( ( c <<= 1 ) & 0x100 ) != 0 );
 177             }
 178         }
 179     }
 180     return crc;
 181 }
 182
 183
 184 static gboolean
 185 dissect_kingfisher(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, gboolean is_conv_dissector)
 186 {
 187     kingfisher_packet_t kfp;
 188     proto_tree *kingfisher_tree;
 189     proto_item *item=NULL;
 190     const char *func_string = NULL;
 191     unsigned short checksum;
 192     int message;
 193
 194
 195     /* There can be one byte reply packets. we only test for these when we
 196        are called from the conversation dissector since that is the only time
 197        we can be certain this is kingfisher
 198      */
 199     if(is_conv_dissector && (tvb_reported_length(tvb)==1)){
 200         /*
 201           Perform a check to see if the message is a single byte acknowledgement
 202           message - Note that in this instance there is no information in the packet
 203           with regard to source or destination RTU address which can be used in the
 204           population of dissector fields.
 205          */
 206         switch(tvb_get_uint8(tvb, 0)){
 207         case 0x00:
 208         case 0x01:
 209         case 0x80:
 210         case 0x81:
 211             col_set_str(pinfo->cinfo, COL_PROTOCOL, "Kingfisher");
 212             func_string = val_to_str_const(tvb_get_uint8(tvb, 0), function_code_vals, "Unknown function");
 213             col_add_fstr(pinfo->cinfo, COL_INFO, "(%s)", func_string);
 214             proto_tree_add_protocol_format(tree, proto_kingfisher, tvb, 0, -1, "Kingfisher Protocol, %s", func_string);
 215             return TRUE;
 216         }
 217         /* otherwise it is way too short to be kingfisher */
 218         return FALSE;
 219     }
 220
 221
 222     /* Verify that it looks like kingfisher */
 223     /* the packet must be at least 9 bytes */
 224     if(tvb_reported_length(tvb)<9){
 225         return FALSE;
 226     }
 227
 228     /* the function code must be known */
 229     kfp.function = tvb_get_uint8( tvb, 6 );
 230     if (try_val_to_str(kfp.function, function_code_vals) == NULL) {
 231         /* This appears not to be a kingfisher packet */
 232         return FALSE;
 233     }
 234
 235     /* verify the length */
 236     kfp.length = tvb_get_uint8(tvb, 2);
 237     if((kfp.length+1) != (uint8_t)tvb_captured_length(tvb)){
 238         return FALSE;
 239     }
 240
 241     /* verify the checksum */
 242     kfp.checksum = tvb_get_ntohs(tvb, kfp.length - 1);
 243     checksum = kingfisher_checksum(tvb, 0);
 244     if(kfp.checksum!=checksum){
 245         return FALSE;
 246     }
 247
 248
 249     kfp.version = (kfp.function & 0x80)?3:2;
 250     kfp.system_id = tvb_get_uint8( tvb, 0 );
 251     kfp.message = tvb_get_uint8( tvb, 5 );
 252
 253     kfp.target = tvb_get_uint8( tvb, 1 );
 254     kfp.from = tvb_get_uint8( tvb, 3 );
 255     kfp.via = tvb_get_uint8( tvb, 4 );
 256
 257     if( kfp.version == 3 )
 258     {
 259         kfp.target |= ( tvb_get_uint8( tvb, 7 ) << 8 );
 260         kfp.from   |= ( tvb_get_uint8( tvb, 8 ) << 8 );
 261         kfp.via    |= ( tvb_get_uint8( tvb, 9 ) << 8 );
 262     }
 263
 264
 265     /* Ok  this does look like Kingfisher, so lets dissect it */
 266     func_string = val_to_str_const(kfp.function, function_code_vals, "Unknown function");
 267
 268     col_set_str(pinfo->cinfo, COL_PROTOCOL, "Kingfisher");
 269     col_add_fstr(pinfo->cinfo, COL_INFO, "%u > %u (%s)", kfp.from, kfp.target, func_string);
 270
 271
 272     message = (kfp.message & 0x0f) | ((kfp.message & 0xf0) >> 4);
 273
 274     item = proto_tree_add_protocol_format(tree, proto_kingfisher, tvb, 0, -1, "Kingfisher Protocol, From RTU: %d, Target RTU: %d", kfp.from, kfp.target );
 275     kingfisher_tree = proto_item_add_subtree( item, ett_kingfisher );
 276
 277     /* version */
 278     proto_tree_add_uint(kingfisher_tree, hf_kingfisher_version, tvb, 6, 1, kfp.version);
 279
 280     /* system id */
 281     proto_tree_add_uint(kingfisher_tree, hf_kingfisher_system, tvb, 0, 1, kfp.system_id);
 282
 283     /* target rtu */
 284     proto_tree_add_uint(kingfisher_tree, hf_kingfisher_target, tvb, 1, 1, kfp.target);
 285
 286     /* length */
 287     proto_tree_add_uint(kingfisher_tree, hf_kingfisher_length, tvb, 2, 1, kfp.length);
 288
 289     /* from rtu */
 290     proto_tree_add_uint(kingfisher_tree, hf_kingfisher_from, tvb, 3, 1, kfp.from);
 291
 292     /* via rtu */
 293     proto_tree_add_uint(kingfisher_tree, hf_kingfisher_via, tvb, 4, 1, kfp.via);
 294
 295     /* message number */
 296     proto_tree_add_uint_format_value(kingfisher_tree, hf_kingfisher_message, tvb, 5, 1, kfp.message, "%u (0x%02X, %s)", message, kfp.message, ((kfp.message & 0xf0)?"Response":"Request"));
 297
 298     /* message function code */
 299     proto_tree_add_uint_format_value(kingfisher_tree, hf_kingfisher_function, tvb, 6, 1, kfp.function, "%u (0x%02X, %s)", kfp.function, kfp.function, func_string);
 300
 301     /* message data */
 302     if(kfp.length > ((kfp.version==3)?11:8)){
 303         proto_tree_add_item(kingfisher_tree, hf_kingfisher_message_data, tvb, ((kfp.version==3)?10:7), kfp.length - ((kfp.version==3)?11:8), ENC_NA);
 304     }
 305
 306     /* checksum */
 307     proto_tree_add_checksum(kingfisher_tree, tvb, kfp.length-1, hf_kingfisher_checksum, hf_kingfisher_checksum_status, &ei_kingfisher_checksum,
 308                             pinfo, checksum, ENC_BIG_ENDIAN, PROTO_CHECKSUM_VERIFY);
 309
 310     return TRUE;
 311 }
 312
 313
 314 static gboolean
 315 dissect_kingfisher_heur(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 316 {
 317     gboolean was_kingfisher;
 318
 319
 320     was_kingfisher=dissect_kingfisher(tvb, pinfo, tree, FALSE);
 321
 322     if(was_kingfisher){
 323         conversation_t *conversation;
 324
 325         /* Ok this was a genuine kingfisher packet. Now create a conversation
 326            dissector for this tcp/udp socket and attach a conversation
 327            dissector to it.
 328          */
 329         conversation = find_or_create_conversation(pinfo);
 330
 331         conversation_set_dissector(conversation, kingfisher_conv_handle);
 332     }
 333
 334     return was_kingfisher;
 335 }
 336
 337 static gboolean
 338 dissect_kingfisher_conv(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
 339 {
 340     return dissect_kingfisher(tvb, pinfo, tree, TRUE);
 341 }
 342
 343 void
 344 proto_register_kingfisher( void )
 345 {
 346     static hf_register_info hf[] =
 347     {
 348             { &hf_kingfisher_version,       { "Version", "kingfisher.version", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 349             { &hf_kingfisher_system,        { "System Identifier", "kingfisher.system", FT_UINT8, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL } },
 350             { &hf_kingfisher_length,        { "Length", "kingfisher.length", FT_UINT8, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL } },
 351             { &hf_kingfisher_from,          { "From RTU", "kingfisher.from", FT_UINT16, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL } },
 352             { &hf_kingfisher_target,        { "Target RTU", "kingfisher.target", FT_UINT16, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL } },
 353             { &hf_kingfisher_via,           { "Via RTU", "kingfisher.via", FT_UINT16, BASE_DEC_HEX, NULL, 0x0, NULL, HFILL } },
 354             { &hf_kingfisher_message,       { "Message Number", "kingfisher.message", FT_UINT8, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 355             { &hf_kingfisher_function,      { "Message Function Code", "kingfisher.function", FT_UINT8, BASE_DEC, VALS( function_code_vals ), 0x0, NULL, HFILL } },
 356             { &hf_kingfisher_checksum,      { "Checksum", "kingfisher.checksum", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } },
 357             { &hf_kingfisher_checksum_status, { "Checksum Status", "kingfisher.checksum.status", FT_UINT8, BASE_NONE, VALS(proto_checksum_vals), 0x0, NULL, HFILL } },
 358             { &hf_kingfisher_message_data,  { "Message Data", "kingfisher.message_data", FT_BYTES, BASE_NONE, NULL, 0x0, NULL, HFILL } },
 359     };
 360
 361     static int *ett[] = {
 362         &ett_kingfisher
 363     };
 364
 365     static ei_register_info ei[] = {
 366         { &ei_kingfisher_checksum, { "kingfisher.bad_checksum", PI_CHECKSUM, PI_ERROR, "Bad checksum", EXPFILL }},
 367     };
 368
 369     expert_module_t* expert_kingfisher;
 370
 371     proto_kingfisher = proto_register_protocol( "Kingfisher", "Kingfisher", "kf" );
 372     proto_register_field_array( proto_kingfisher, hf, array_length( hf ) );
 373     proto_register_subtree_array( ett, array_length( ett ) );
 374     expert_kingfisher = expert_register_protocol(proto_kingfisher);
 375     expert_register_field_array(expert_kingfisher, ei, array_length(ei));
 376
 377     kingfisher_handle = register_dissector("kf", dissect_kingfisher_heur, proto_kingfisher);
 378 }
 379
 380
 381 void
 382 proto_reg_handoff_kingfisher( void )
 383 {
 384     dissector_add_uint_range_with_preference("tcp.port", TCP_PORT_KINGFISHER_RANGE, kingfisher_handle);
 385     dissector_add_uint_range_with_preference("udp.port", UDP_PORT_KINGFISHER_RANGE, kingfisher_handle);
 386
 387     kingfisher_conv_handle = create_dissector_handle(dissect_kingfisher_conv, proto_kingfisher);
 388 }
 389
 390 /*
 391  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 392  *
 393  * Local variables:
 394  * c-basic-offset: 4
 395  * tab-width: 8
 396  * indent-tabs-mode: nil
 397  * End:
 398  *
 399  * vi: set shiftwidth=4 tabstop=8 expandtab:
 400  * :indentSize=4:tabSize=8:noTabs=true:
 401  */