Enhancement of dnp3 parser

Hi, Below are few requirements for dnp3 parser enhancement which we already discussed in the zeek community.

1. dnp3-objects.pac: dnp3_attribute_common() is implemented for group 0(device attribute g0), there are many attributes which are not implemented as of now. for eg. device information (VAR: 203, 204, 205, 242-252), max transmit fragment size (240,241) Those fields can be added in the switch case in dnp3-objects.pac. Pl refer below link (page 15) for these attributes. DNP3 AN2013-004b Validation of Incoming DNP3 Data.pdf

The requirement is to extend this function and expose an event API which will return value of the attributes under g0.

1. There is similar requirement under g34, which is to extract deadband values, defined as ai_dead_16, ai_dead_32. So, we need to expose new event APIs for these.

• There is another event in events.bif in dnp3 called dnp3_response_data_object() with argument "data_value" which states “the value for those objects that carry their information here directly”. Firstly the meaning is not clear to me and secondly how to print/dump such data_value in zeek scripts is not clear. Is it a vector of values or just a value ? As it’s type is count… why I am interested because I think deadband values may be extracted (ai_dead, ai_dead_16 of dnp3-objects.pac). Please help in this area and provide one example to print data_value.

1. Another similar requirement to extract from dnp3 application pdu such as time value in g50.

2. For few group codes like g70, g86, g85 etc, few important attributes such as data/pdu length, data type code, op code etc can be extracted. So the requirement is to add event APIs for these group code from where we can fetch length and code.

3. Requirement to get control code for application layer header ( FIR, FIN, SEQ etc), trasnport layer control codes ( FIR, FIN, SEQ etc)

As of now I have identified these requirements which can be added to the existing DNP3 parser which will make it more useful for daily usage in ICS domain. More requirements may come in future, but it will be great if Zeek team can take up this activity as discussed with @awelzel . Thanks Biswa

Reference to community.zeek.org conversation: https://community.zeek.org/t/need-help-to-print-data-value-in-zeek/6966/6