Fix DNP3 detection: duplicate transport kwarg breaks every DNP3 packet#1
Open
fatihpurtas wants to merge 1 commit into
Open
Fix DNP3 detection: duplicate transport kwarg breaks every DNP3 packet#1fatihpurtas wants to merge 1 commit into
fatihpurtas wants to merge 1 commit into
Conversation
DNP3Analyzer.analyze() passed `transport` both explicitly and via **details to _make_detection(), raising TypeError on every DNP3 packet. core.py swallows the exception, so DNP3 was never detected and devices fell back to the generic "OT-GEN-003 Protocol Unidentified" finding. Dropping the redundant transport=proto argument restores DNP3 detection and the DNP3-specific vulnerability rules (RTU-DNP3-*).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
DNP3 is never detected. On any DNP3 capture, devices on port 20000 are
reported with the generic finding "OT-GEN-003 Device on OT Ports,
Protocol Unidentified" instead of DNP3, and none of the DNP3-specific
vulnerability rules (RTU-DNP3-*) fire.
Root cause
In ot_scanner/scanner/protocols/dnp3.py, analyze() builds a
detailsdict that already contains "transport": proto (line 158), then calls
_make_detection() passing transport=proto explicitly (line 171) plus
**details (line 172). Python raises:
TypeError: _make_detection() got multiple values for keyword argument 'transport'
on every DNP3 packet. The call is wrapped in a try/except in core.py, so
the error is silently swallowed and DNP3 detection produces nothing.
Fix
Remove the redundant explicit transport=proto argument; the value is
already carried in **details.
Verification
Tested against a normal DNP3 capture (opendnp3 full exchange).
Before: protocol_summary is empty, device only carries OT-GEN-003.
After:
protocol_summary = {"DNP3": 1}
device protocols = ["DNP3"]
vulnerability rule RTU-DNP3-001 fires as expected