Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Log s7comm device information #18

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
+407 −41
Open

Log s7comm device information #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
36c8d18
Initial commit
Oct 6, 2024
9c528ee
Fix cleaning of strings
Oct 7, 2024
35621ca
Add testcases and comments
Jan 2, 2025
fe5f763
Add baseline for identification pcap
Jan 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
92 changes: 83 additions & 9 deletions scripts/icsnpp/s7comm/main.zeek
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,11 @@
module S7COMM;

export{
redef enum Log::ID += { LOG_COTP,
LOG_S7COMM,
LOG_S7COMM_READ_SZL,
LOG_S7COMM_UPLOAD_DOWNLOAD,
redef enum Log::ID += { LOG_COTP,
LOG_S7COMM,
LOG_S7COMM_READ_SZL,
LOG_S7COMM_UPLOAD_DOWNLOAD,
LOG_S7COMM_KNOWN_DEVICES,
LOG_S7COMM_PLUS };

###############################################################################################
Expand Down Expand Up @@ -130,11 +131,35 @@ export{
global log_s7comm_plus: event(rec: S7COMM_PLUS);
global log_policy_s7comm_plus: Log::PolicyHook;

###############################################################################################
################### S7COMM_KNOWN_DEVICES -> s7comm_known_devices.log ########################
###############################################################################################
type S7COMM_KNOWN_DEVICES: record {
ts : time &log; # Timestamp of Event
uid : string &log; # Zeek Unique ID for Connection
id : conn_id &log; # Zeek Connection Struct (addresses and ports)
is_orig : bool &log; # the message came from the originator/client or the responder/server
source_h : addr &log; # Source IP Address
source_p : port &log; # Source Port
destination_h : addr &log; # Destination IP Address
destination_p : port &log; # Destination Port
automation_system_name : string &log;
module_name : string &log;
plant_name : string &log;
module_serial : string &log;
};
global log_s7comm_known_devices: event(rec: S7COMM_KNOWN_DEVICES);
global log_policy_s7comm_known_devices: Log::PolicyHook;

redef record connection += {
filename : string &optional;
filename : string &optional;
};
}

redef record connection += {
s7comm_device_info : S7COMM_KNOWN_DEVICES &optional;
};

# All these protocols operate on TCP port 102
const ports = {
102/tcp,
Expand Down Expand Up @@ -165,6 +190,11 @@ event zeek_init() &priority=5 {
$path="s7comm_upload_download",
$policy=log_policy_s7comm_upload_download]);

Log::create_stream(S7COMM::LOG_S7COMM_KNOWN_DEVICES, [$columns=S7COMM_KNOWN_DEVICES,
$ev=log_s7comm_known_devices,
$path="s7comm_known_devices",
$policy=log_policy_s7comm_known_devices]);

Log::create_stream(S7COMM::LOG_S7COMM_PLUS, [$columns=S7COMM_PLUS,
$ev=log_s7comm_plus,
$path="s7comm_plus",
Expand Down Expand Up @@ -249,7 +279,7 @@ event s7comm_header(c: connection,
if ( function_code != UINT8_MAX )
{
# Formatting for function is different for User-Data functions
if ( rosctr == 0x07 )
if ( rosctr == 0x07 )
{
s7comm_item$function_code = fmt("0x%02x", function_code);
if ( (function_code & 0xf0) == 0x40)
Expand All @@ -267,7 +297,7 @@ event s7comm_header(c: connection,
s7comm_item$function_name = s7comm_functions[function_code];
}
}

if ( subfunction != UINT8_MAX )
{
s7comm_item$subfunction_code = fmt("0x%02x", subfunction);
Expand Down Expand Up @@ -415,7 +445,7 @@ event s7comm_upload_download(c: connection,
s7comm_upload_download_item$rosctr = rosctr_types[rosctr];
s7comm_upload_download_item$pdu_reference = pdu_reference;
s7comm_upload_download_item$function_name = s7comm_functions[function_code];

if ( function_status != UINT8_MAX )
s7comm_upload_download_item$function_status = fmt("0x%02x", function_status);

Expand Down Expand Up @@ -452,7 +482,7 @@ event s7comm_plus_header(c: connection,
s7comm_plus_item$ts = network_time();
s7comm_plus_item$uid = c$uid;
s7comm_plus_item$id = c$id;

s7comm_plus_item$is_orig = is_orig;

if(is_orig)
Expand Down Expand Up @@ -481,3 +511,47 @@ event s7comm_plus_header(c: connection,

Log::write(LOG_S7COMM_PLUS, s7comm_plus_item);
}

#####################################################################################################################
################# Defines logging of s7comm_device_identifcation event -> s7comm_known_devices.log ################
#####################################################################################################################

event s7comm_device_identification(c:connection, opcode: count, name: string)
{
if (! c?$s7comm_device_info)
{
local s: S7COMM_KNOWN_DEVICES;
c$s7comm_device_info = s;
}

name = rstrip(name,"\x00");

if (opcode == 0x0001 )
{
c$s7comm_device_info$automation_system_name = name;
}
if (opcode == 0x0002)
{
c$s7comm_device_info$module_name = name;
}
if (opcode == 0x0003)
{
c$s7comm_device_info$plant_name = name;
}
if (opcode == 0x0005)
{
c$s7comm_device_info$module_serial = name;
}
}

event connection_state_remove(c:connection)
{
if (c?$s7comm_device_info)
{
c$s7comm_device_info$ts = network_time();
c$s7comm_device_info$uid = c$uid;
c$s7comm_device_info$id = c$id;

Log::write(S7COMM::LOG_S7COMM_KNOWN_DEVICES, c$s7comm_device_info);
}
}
25 changes: 20 additions & 5 deletions src/events.bif
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ event s7comm_header%(c: connection,

## ---------------------------------------s7comm_read-szl------------------------------------------
## Event Description:
## Event is generated for all s7comm User-Data CPU Functions with Read SZL subfunction and
## Event is generated for all s7comm User-Data CPU Functions with Read SZL subfunction and
## contains relevant Read SZL data
## Event Data:
## - pdu_reference: count -> Reference ID Used to Link Requests to Responses
Expand Down Expand Up @@ -118,6 +118,21 @@ event s7comm_plus_header%(c: connection,
opcode: count,
function_code: count%);

## ---------------------------------------s7comm_device_identification---------------------------------------
## Event Description:
## Event is generated for all succesfully parsed device identification strings
## Event Data:
## - c: connection -> Zeek Connection Struct
## - opcode: count -> The opcode specifying the part of the identification
## - value: string -> The name of the part that is being identified
## Default Output:
## Writes to log file s7comm-known-devices.log
## ------------------------------------------------------------------------------------------------
event s7comm_device_identification%(c:connection,
opcode: count,
value: string%);


###################################################################################################
################################### END OF LOGGED BY DEFAULT ####################################
###################################################################################################
Expand All @@ -127,16 +142,16 @@ event s7comm_plus_header%(c: connection,
##################################### NOT LOGGED BY DEFAULT #####################################
###################################################################################################

event tpkt%(c: connection,
event tpkt%(c: connection,
is_orig: bool,
version: count,
reserved: count,
version: count,
reserved: count,
length: count%);

event cotp_data%(c: connection,
is_orig: bool,
tpdu_sequence_num: count,
eot: count,
eot: count,
variable_data: string%);

event cotp_connection_request%(c: connection,
Expand Down
28 changes: 28 additions & 0 deletions src/s7comm-analyzer.pac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,34 @@ refine flow S7COMM_Flow += {
return true;
%}

function process_szl_data_record_xy1c(data: SZL_DataRecord_xy1c): bool
%{
uint16 index = ${data.index};
string name;

switch (index) {
case 0x0001:
name = std_str(${data.name_of_automation_system.name});
break;
case 0x0002:
name = std_str(${data.name_of_module.name});
break;
case 0x0003:
name = std_str(${data.plant_identification.name});
break;
case 0x0005:
name = std_str(${data.serial_of_module.name});
break;
}
if ( name.size() )
zeek::BifEvent::enqueue_s7comm_device_identification(connection()->zeek_analyzer(),
connection()->zeek_analyzer()->Conn(),
index,
zeek::make_intrusive<zeek::StringVal>(name));

return true;
%}

###############################################################################################
##################### Process data for rosctr_ack -> s7comm_header event #####################
###############################################################################################
Expand Down
Loading