[Bro-Dev] [Bro-Commits] [git/bro] topic/jsiwek/modbus-fixes: Remove byte count parameter from modbus events carrying register arrays (fd5eb23)
Vlad Grigorescu
vladg at cmu.edu
Tue Nov 13 11:11:50 PST 2012
Thanks for looking into this, Jon.
I'm still seeing crashes with this commit (trace included below). Should I open a new ticket for this? I don't want to latch onto the merge request at #917 unnecessarily. Thanks,
--Vlad
[New LWP 3282]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/local/bro/bin/bro -i eth4 -U .status -p broctl -p broctl-live -p local -p'.
Program terminated with signal 6, Aborted.
#0 0x00007f46f893f425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
Thread 1 (Thread 0x7f46fac7e780 (LWP 3282)):
#0 0x00007f46f893f425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007f46f8942b8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007f46f89380ee in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007f46f8938192 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x000000000068cd9f in ClearPreviousData (this=<optimized out>) at /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:213
#5 binpac::FlowBuffer::ClearPreviousData (this=<optimized out>) at /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:208
#6 0x000000000068d246 in binpac::FlowBuffer::NewData (this=0xb1b08c0, begin=0xbfcf7a0 "\300\205", end=0xbfcf7ad "") at /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:176
#7 0x0000000000503ce0 in binpac::ModbusTCP::ModbusTCP_Flow::NewData (this=0x46c1f90, t_begin_of_data=<optimized out>, t_end_of_data=<optimized out>) at /home/bro/src/bro/build/src/modbus_pac.cc:2867
#8 0x000000000052169d in Analyzer::NextStream (this=0xb1a3640, len=<optimized out>, data=<optimized out>, is_orig=<optimized out>) at /home/bro/src/bro/src/Analyzer.cc:369
#9 0x00000000005222b6 in Analyzer::ForwardStream (this=0xb19b240, len=13, data=0xbfcf7a0 "\300\205", is_orig=false) at /home/bro/src/bro/src/Analyzer.cc:456
#10 0x0000000000646e80 in TCP_Reassembler::DeliverBlock (this=0x5fdf8c0, seq=15, len=13, data=0xbfcf7a0 "\300\205") at /home/bro/src/bro/src/TCP_Reassembler.cc:618
#11 0x00000000006471aa in BlockInserted (start_block=<optimized out>, this=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:359
#12 TCP_Reassembler::BlockInserted (this=0x5fdf8c0, start_block=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:334
#13 0x0000000000646d28 in TCP_Reassembler::DataSent (this=0x5fdf8c0, t=<optimized out>, seq=<optimized out>, len=<optimized out>, data=<optimized out>, replaying=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:458
#14 0x0000000000645cc6 in TCP_Endpoint::DataSent (this=0xb1a8790, t=<optimized out>, seq=15, len=13, caplen=13, data=0x7f46e2eefffe <Address 0x7f46e2eefffe out of bounds>, ip=<optimized out>, tp=0x7f46e2eeffea) at /home/bro/src/bro/src/TCP_Endpoint.cc:183
#15 0x00000000006446f8 in TCP_Analyzer::DeliverPacket (this=0xb19b240, len=13, data=0x7f46e2eefffe <Address 0x7f46e2eefffe out of bounds>, is_orig=false, seq=<optimized out>, ip=0x7fff69511bf0, caplen=13) at /home/bro/src/bro/src/TCP.cc:1039
#16 0x0000000000521571 in Analyzer::NextPacket (this=0xb19b240, len=<optimized out>, data=<optimized out>, is_orig=<optimized out>, seq=<optimized out>, ip=<optimized out>, caplen=33) at /home/bro/src/bro/src/Analyzer.cc:341
#17 0x000000000053aa70 in Connection::NextPacket (this=<optimized out>, t=<optimized out>, is_orig=<optimized out>, ip=<optimized out>, len=<optimized out>, caplen=<optimized out>, data=<optimized out>, record_packet=@0x7fff69511868: 1, record_content=@0x7fff6951186c: 1, hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14) at /home/bro/src/bro/src/Conn.cc:259
#18 0x000000000062e2f0 in NetSessions::DoNextPacket (this=0x2bd0c00, t=1352833032.1424849, hdr=0x1abd040, ip_hdr=0x7fff69511bf0, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14, encapsulation=0x0) at /home/bro/src/bro/src/Sessions.cc:700
#19 0x000000000062f8c5 in NetSessions::NextPacket (this=0x2bd0c00, t=1352833032.1424849, hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14, pkt_elem=<optimized out>) at /home/bro/src/bro/src/Sessions.cc:238
#20 0x00000000005ec14b in net_packet_dispatch (t=1352833032.1424849, hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14, src_ps=0x1abd000, pkt_elem=0x0) at /home/bro/src/bro/src/Net.cc:353
#21 0x00000000005fb0cf in Process (this=0x1abd000) at /home/bro/src/bro/src/PktSrc.cc:303
#22 PktSrc::Process (this=0x1abd000) at /home/bro/src/bro/src/PktSrc.cc:175
#23 0x00000000005ec547 in net_run () at /home/bro/src/bro/src/Net.cc:446
#24 0x00000000004c06ea in main (argc=<optimized out>, argv=<optimized out>) at /home/bro/src/bro/src/main.cc:1073
==== No reporter.log
==== stderr.log
listening on eth4, capture length 8192 bytes
bro: /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:213: void binpac::FlowBuffer::ClearPreviousData(): Assertion `buffer_n_ == 0' failed.
/usr/local/bro/share/broctl/scripts/run-bro: line 60: 3282 Aborted (core dumped) nohup $mybro $@
On Nov 13, 2012, at 1:12 PM, Jonathan Siwek <jsiwek at ncsa.illinois.edu> wrote:
> Repository : ssh://git@bro-ids.icir.org/bro
>
> On branch : topic/jsiwek/modbus-fixes
> Link : http://tracker.bro-ids.org/bro/changeset/fd5eb23fa6ac654471d71645eb37dacc6d45896b/bro
>
>> ---------------------------------------------------------------
>
> commit fd5eb23fa6ac654471d71645eb37dacc6d45896b
> Author: Jon Siwek <jsiwek at ncsa.illinois.edu>
> Date: Tue Nov 13 12:09:14 2012 -0600
>
> Remove byte count parameter from modbus events carrying register arrays
>
> Instead of these events being generated for invalid byte count values
> (they should always be even, not odd), a protocol_violation is raised.
>
> modbus_read_holding_registers_response
> modbus_read_input_registers_response
> modbus_write_multiple_registers_request
> modbus_read_write_multiple_registers_request
> modbus_read_write_multiple_registers_response
> modbus_read_fifo_queue_respons
>
>
>> ---------------------------------------------------------------
>
> fd5eb23fa6ac654471d71645eb37dacc6d45896b
> scripts/policy/protocols/modbus/track-memmap.bro | 2 +-
> src/event.bif | 24 ++-------
> src/modbus-analyzer.pac | 50 +++++++++++++++++--
> .../output | 5 +-
> .../btest/scripts/base/protocols/modbus/events.bro | 12 ++--
> .../base/protocols/modbus/register_parsing.bro | 9 ++--
> 6 files changed, 64 insertions(+), 38 deletions(-)
>
> diff --git a/scripts/policy/protocols/modbus/track-memmap.bro b/scripts/policy/protocols/modbus/track-memmap.bro
> index cc02ce9..fc02d9b 100644
> --- a/scripts/policy/protocols/modbus/track-memmap.bro
> +++ b/scripts/policy/protocols/modbus/track-memmap.bro
> @@ -60,7 +60,7 @@ event modbus_read_holding_registers_request(c: connection, headers: ModbusHeader
> c$modbus$track_address = start_address+1;
> }
>
> -event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
> {
> local slave = c$id$resp_h;
>
> diff --git a/src/event.bif b/src/event.bif
> index cc8acb1..b965c26 100644
> --- a/src/event.bif
> +++ b/src/event.bif
> @@ -6623,10 +6623,8 @@ event modbus_read_holding_registers_request%(c: connection, headers: ModbusHeade
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register values.
> -##
> ## registers: The register values returned from the device.
> -event modbus_read_holding_registers_response%(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters%);
> +event modbus_read_holding_registers_response%(c: connection, headers: ModbusHeaders, registers: ModbusRegisters%);
>
> ## Generated for a Modbus read input registers request.
> ##
> @@ -6645,10 +6643,8 @@ event modbus_read_input_registers_request%(c: connection, headers: ModbusHeaders
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register values.
> -##
> ## registers: The register values returned from the device.
> -event modbus_read_input_registers_response%(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters%);
> +event modbus_read_input_registers_response%(c: connection, headers: ModbusHeaders, registers: ModbusRegisters%);
>
> ## Generated for a Modbus write single coil request.
> ##
> @@ -6724,10 +6720,8 @@ event modbus_write_multiple_coils_response%(c: connection, headers: ModbusHeader
> ##
> ## start_address: The memory address of the first register to be written.
> ##
> -## byte_count: The number of bytes in the message that comprise register values.
> -##
> ## registers: The values to be written to the registers.
> -event modbus_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, start_address: count, byte_count: count, registers: ModbusRegisters%);
> +event modbus_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, start_address: count, registers: ModbusRegisters%);
>
> ## Generated for a Modbus write multiple registers response.
> ##
> @@ -6818,10 +6812,8 @@ event modbus_mask_write_register_response%(c: connection, headers: ModbusHeaders
> ##
> ## write_start_address: The memory address of the first register to be written.
> ##
> -## write_byte_count: Number of bytes in message that comprise register values.
> -##
> ## write_registers: The values to be written to the registers.
> -event modbus_read_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_byte_count: count, write_registers: ModbusRegisters%);
> +event modbus_read_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_registers: ModbusRegisters%);
>
> ## Generated for a Modbus read/write multiple registers response.
> ##
> @@ -6829,10 +6821,8 @@ event modbus_read_write_multiple_registers_request%(c: connection, headers: Modb
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register values.
> -##
> ## written_registers: The register values read from the registers specified in the request.
> -event modbus_read_write_multiple_registers_response%(c: connection, headers: ModbusHeaders, byte_count: count, written_registers: ModbusRegisters%);
> +event modbus_read_write_multiple_registers_response%(c: connection, headers: ModbusHeaders, written_registers: ModbusRegisters%);
>
> ## Generated for a Modbus read FIFO queue request.
> ##
> @@ -6849,10 +6839,8 @@ event modbus_read_fifo_queue_request%(c: connection, headers: ModbusHeaders, sta
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register values.
> -##
> ## fifos: The register values read from the FIFO queue on the device.
> -event modbus_read_fifo_queue_response%(c: connection, headers: ModbusHeaders, byte_count: count, fifos: ModbusRegisters%);
> +event modbus_read_fifo_queue_response%(c: connection, headers: ModbusHeaders, fifos: ModbusRegisters%);
>
> ## Raised for informational messages reported via Bro's reporter framework. Such
> ## messages may be generated internally by the event engine and also by other
> diff --git a/src/modbus-analyzer.pac b/src/modbus-analyzer.pac
> index 155da96..b03df9d 100644
> --- a/src/modbus-analyzer.pac
> +++ b/src/modbus-analyzer.pac
> @@ -135,8 +135,16 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=3
> function deliver_ReadHoldingRegistersResponse(header: ModbusTCP_TransportHeader, message: ReadHoldingRegistersResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read holding register response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_holding_registers_response )
> {
> +
> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
> for ( unsigned int i=0; i < ${message.registers}->size(); ++i )
> {
> @@ -147,7 +155,6 @@ refine flow ModbusTCP_Flow += {
> BifEvent::generate_modbus_read_holding_registers_response(connection()->bro_analyzer(),
> connection()->bro_analyzer()->Conn(),
> HeaderToBro(header),
> - ${message.byte_count},
> t);
> }
>
> @@ -172,6 +179,13 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=4
> function deliver_ReadInputRegistersResponse(header: ModbusTCP_TransportHeader, message: ReadInputRegistersResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read input register response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_input_registers_response )
> {
> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
> @@ -184,7 +198,6 @@ refine flow ModbusTCP_Flow += {
> BifEvent::generate_modbus_read_input_registers_response(connection()->bro_analyzer(),
> connection()->bro_analyzer()->Conn(),
> HeaderToBro(header),
> - ${message.byte_count},
> t);
> }
>
> @@ -309,6 +322,13 @@ refine flow ModbusTCP_Flow += {
> # REQUEST FC=16
> function deliver_WriteMultipleRegistersRequest(header: ModbusTCP_TransportHeader, message: WriteMultipleRegistersRequest): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus write multiple registers request byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_write_multiple_registers_request )
> {
> VectorVal * t = new VectorVal(BifType::Vector::ModbusRegisters);
> @@ -321,7 +341,7 @@ refine flow ModbusTCP_Flow += {
> BifEvent::generate_modbus_write_multiple_registers_request(connection()->bro_analyzer(),
> connection()->bro_analyzer()->Conn(),
> HeaderToBro(header),
> - ${message.start_address}, ${message.byte_count}, t);
> + ${message.start_address}, t);
> }
>
> return true;
> @@ -486,6 +506,13 @@ refine flow ModbusTCP_Flow += {
> # REQUEST FC=23
> function deliver_ReadWriteMultipleRegistersRequest(header: ModbusTCP_TransportHeader, message: ReadWriteMultipleRegistersRequest): bool
> %{
> + if ( ${message.write_byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read write multiple registers request write byte count %d", ${message.write_byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_write_multiple_registers_request )
> {
> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
> @@ -501,7 +528,6 @@ refine flow ModbusTCP_Flow += {
> ${message.read_start_address},
> ${message.read_quantity},
> ${message.write_start_address},
> - ${message.write_byte_count},
> t);
> }
>
> @@ -511,6 +537,13 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=23
> function deliver_ReadWriteMultipleRegistersResponse(header: ModbusTCP_TransportHeader, message: ReadWriteMultipleRegistersResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read write multiple registers response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_write_multiple_registers_response )
> {
> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
> @@ -523,7 +556,6 @@ refine flow ModbusTCP_Flow += {
> BifEvent::generate_modbus_read_write_multiple_registers_response(connection()->bro_analyzer(),
> connection()->bro_analyzer()->Conn(),
> HeaderToBro(header),
> - ${message.byte_count},
> t);
> }
>
> @@ -548,6 +580,13 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=24
> function deliver_ReadFIFOQueueResponse(header: ModbusTCP_TransportHeader, message: ReadFIFOQueueResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read FIFO queue response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_fifo_queue_response )
> {
> VectorVal* t = new VectorVal(new VectorType(base_type(TYPE_COUNT)));
> @@ -560,7 +599,6 @@ refine flow ModbusTCP_Flow += {
> BifEvent::generate_modbus_read_fifo_queue_response(connection()->bro_analyzer(),
> connection()->bro_analyzer()->Conn(),
> HeaderToBro(header),
> - ${message.byte_count},
> t);
> }
>
> diff --git a/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output b/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
> index 353f85d..5bb5f1b 100644
> --- a/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
> +++ b/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
> @@ -1,5 +1,4 @@
> modbus_read_input_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=1119, pid=0, uid=255, function_code=4], 900, 147
> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=2606, pid=0, uid=255, function_code=4], [0, 0, 0, 0, 0, 0, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100, 200
> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=6714, pid=0, uid=255, function_code=4], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3840, 0, 0, 31, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 37, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], 64, 129
> +modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=2606, pid=0, uid=255, function_code=4], [0, 0, 0, 0, 0, 0, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100
> modbus_read_input_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=12993, pid=0, uid=255, function_code=4], 400, 100
> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=17667, pid=0, uid=255, function_code=4], [49, 18012, 51, 42, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 54324, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 69, 63, 64, 65, 66, 67, 68, 49, 189, 51, 52, 53, 54, 4151, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 136, 49, 50, 51, 212, 53, 54, 170, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100, 200
> +modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=17667, pid=0, uid=255, function_code=4], [49, 18012, 51, 42, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 54324, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 69, 63, 64, 65, 66, 67, 68, 49, 189, 51, 52, 53, 54, 4151, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 136, 49, 50, 51, 212, 53, 54, 170, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100
> diff --git a/testing/btest/scripts/base/protocols/modbus/events.bro b/testing/btest/scripts/base/protocols/modbus/events.bro
> index 6c47dc6..f648a0a 100644
> --- a/testing/btest/scripts/base/protocols/modbus/events.bro
> +++ b/testing/btest/scripts/base/protocols/modbus/events.bro
> @@ -41,7 +41,7 @@ event modbus_read_holding_registers_request(c: connection, headers: ModbusHeader
> print "modbus_read_holding_registers_request", c, headers, start_address, quantity;
> }
>
> -event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
> {
> print "modbus_read_holding_registers_response", c, headers, registers;
> }
> @@ -51,7 +51,7 @@ event modbus_read_input_registers_request(c: connection, headers: ModbusHeaders,
> print "modbus_read_input_registers_request", c, headers, start_address, quantity;
> }
>
> -event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
> {
> print "modbus_read_input_registers_response", c, headers, registers;
> }
> @@ -86,7 +86,7 @@ event modbus_write_multiple_coils_response(c: connection, headers: ModbusHeaders
> print "modbus_write_multiple_coils_response", c, headers, start_address, quantity;
> }
>
> -event modbus_write_multiple_registers_request(c: connection, headers: ModbusHeaders, start_address: count, byte_count: count, registers: ModbusRegisters)
> +event modbus_write_multiple_registers_request(c: connection, headers: ModbusHeaders, start_address: count, registers: ModbusRegisters)
> {
> print "modbus_write_multiple_registers_request", c, headers, start_address, registers;
> }
> @@ -126,12 +126,12 @@ event modbus_mask_write_register_response(c: connection, headers: ModbusHeaders,
> print "modbus_mask_write_register_response", c, headers, address, and_mask, or_mask;
> }
>
> -event modbus_read_write_multiple_registers_request(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_byte_count: count, write_registers: ModbusRegisters)
> +event modbus_read_write_multiple_registers_request(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_registers: ModbusRegisters)
> {
> print "modbus_read_write_multiple_registers_request", c, headers, read_start_address, read_quantity, write_start_address, write_registers;
> }
>
> -event modbus_read_write_multiple_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, written_registers: ModbusRegisters)
> +event modbus_read_write_multiple_registers_response(c: connection, headers: ModbusHeaders, written_registers: ModbusRegisters)
> {
> print "modbus_read_write_multiple_registers_response", c, headers, written_registers;
> }
> @@ -141,7 +141,7 @@ event modbus_read_fifo_queue_request(c: connection, headers: ModbusHeaders, star
> print "modbus_read_fifo_queue_request", c, headers, start_address;
> }
>
> -event modbus_read_fifo_queue_response(c: connection, headers: ModbusHeaders, byte_count: count, fifos: ModbusRegisters)
> +event modbus_read_fifo_queue_response(c: connection, headers: ModbusHeaders, fifos: ModbusRegisters)
> {
> print "modbus_read_fifo_queue_response", c, headers, fifos;
> }
> diff --git a/testing/btest/scripts/base/protocols/modbus/register_parsing.bro b/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
> index 300dd75..1641860 100644
> --- a/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
> +++ b/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
> @@ -6,15 +6,16 @@
> # of register values, with the quantity being derived from a byte count value
> # that is also sent. If the byte count value is invalid (e.g. an odd value
> # might not be valid since registers must be 2-byte values), then the parser
> -# should not trigger any asserts, but the resulting event could indicate
> -# the strangeness (i.e. byte_count != 2*|registers|).
> +# should not trigger any asserts, but generate a protocol_violation (in this
> +# case TCP_ApplicationAnalyzer::ProtocolViolation asserts its behavior for
> +# incomplete connections).
>
> event modbus_read_input_registers_request(c: connection, headers: ModbusHeaders, start_address: count, quantity: count)
> {
> print "modbus_read_input_registers_request", c$id, headers, start_address, quantity;
> }
>
> -event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
> {
> - print "modbus_read_input_registers_response", c$id, headers, registers, |registers|, byte_count;
> + print "modbus_read_input_registers_response", c$id, headers, registers, |registers|;
> }
>
> _______________________________________________
> bro-commits mailing list
> bro-commits at bro-ids.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-commits
More information about the bro-dev
mailing list