[Bro-Dev] [Bro-Commits] [git/bro] topic/jsiwek/modbus-fixes: Remove byte count parameter from modbus events carrying register arrays (fd5eb23)
Siwek, Jonathan Luke
jsiwek at illinois.edu
Tue Nov 13 12:35:21 PST 2012
On Nov 13, 2012, at 1:11 PM, Vlad Grigorescu <vladg at cmu.edu> wrote:
> I'm still seeing crashes with this commit (trace included below). Should I open a new ticket for this? I don't want to latch onto the merge request at #917 unnecessarily. Thanks,
Did you also checkout the changes I did in the aux/binpac repo (I did changes in branch "topic/jsiwek/modbus-fixes" in both bro and aux/binpac) ?
That stack trace looks similar to something I encountered that needed a change in binpac.
Jon
> [New LWP 3282]
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
> Core was generated by `/usr/local/bro/bin/bro -i eth4 -U .status -p broctl -p broctl-live -p local -p'.
> Program terminated with signal 6, Aborted.
> #0 0x00007f46f893f425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
>
> Thread 1 (Thread 0x7f46fac7e780 (LWP 3282)):
> #0 0x00007f46f893f425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
> #1 0x00007f46f8942b8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
> #2 0x00007f46f89380ee in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> #3 0x00007f46f8938192 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
> #4 0x000000000068cd9f in ClearPreviousData (this=<optimized out>) at /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:213
> #5 binpac::FlowBuffer::ClearPreviousData (this=<optimized out>) at /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:208
> #6 0x000000000068d246 in binpac::FlowBuffer::NewData (this=0xb1b08c0, begin=0xbfcf7a0 "\300\205", end=0xbfcf7ad "") at /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:176
> #7 0x0000000000503ce0 in binpac::ModbusTCP::ModbusTCP_Flow::NewData (this=0x46c1f90, t_begin_of_data=<optimized out>, t_end_of_data=<optimized out>) at /home/bro/src/bro/build/src/modbus_pac.cc:2867
> #8 0x000000000052169d in Analyzer::NextStream (this=0xb1a3640, len=<optimized out>, data=<optimized out>, is_orig=<optimized out>) at /home/bro/src/bro/src/Analyzer.cc:369
> #9 0x00000000005222b6 in Analyzer::ForwardStream (this=0xb19b240, len=13, data=0xbfcf7a0 "\300\205", is_orig=false) at /home/bro/src/bro/src/Analyzer.cc:456
> #10 0x0000000000646e80 in TCP_Reassembler::DeliverBlock (this=0x5fdf8c0, seq=15, len=13, data=0xbfcf7a0 "\300\205") at /home/bro/src/bro/src/TCP_Reassembler.cc:618
> #11 0x00000000006471aa in BlockInserted (start_block=<optimized out>, this=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:359
> #12 TCP_Reassembler::BlockInserted (this=0x5fdf8c0, start_block=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:334
> #13 0x0000000000646d28 in TCP_Reassembler::DataSent (this=0x5fdf8c0, t=<optimized out>, seq=<optimized out>, len=<optimized out>, data=<optimized out>, replaying=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:458
> #14 0x0000000000645cc6 in TCP_Endpoint::DataSent (this=0xb1a8790, t=<optimized out>, seq=15, len=13, caplen=13, data=0x7f46e2eefffe <Address 0x7f46e2eefffe out of bounds>, ip=<optimized out>, tp=0x7f46e2eeffea) at /home/bro/src/bro/src/TCP_Endpoint.cc:183
> #15 0x00000000006446f8 in TCP_Analyzer::DeliverPacket (this=0xb19b240, len=13, data=0x7f46e2eefffe <Address 0x7f46e2eefffe out of bounds>, is_orig=false, seq=<optimized out>, ip=0x7fff69511bf0, caplen=13) at /home/bro/src/bro/src/TCP.cc:1039
> #16 0x0000000000521571 in Analyzer::NextPacket (this=0xb19b240, len=<optimized out>, data=<optimized out>, is_orig=<optimized out>, seq=<optimized out>, ip=<optimized out>, caplen=33) at /home/bro/src/bro/src/Analyzer.cc:341
> #17 0x000000000053aa70 in Connection::NextPacket (this=<optimized out>, t=<optimized out>, is_orig=<optimized out>, ip=<optimized out>, len=<optimized out>, caplen=<optimized out>, data=<optimized out>, record_packet=@0x7fff69511868: 1, record_content=@0x7fff6951186c: 1, hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14) at /home/bro/src/bro/src/Conn.cc:259
> #18 0x000000000062e2f0 in NetSessions::DoNextPacket (this=0x2bd0c00, t=1352833032.1424849, hdr=0x1abd040, ip_hdr=0x7fff69511bf0, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14, encapsulation=0x0) at /home/bro/src/bro/src/Sessions.cc:700
> #19 0x000000000062f8c5 in NetSessions::NextPacket (this=0x2bd0c00, t=1352833032.1424849, hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14, pkt_elem=<optimized out>) at /home/bro/src/bro/src/Sessions.cc:238
> #20 0x00000000005ec14b in net_packet_dispatch (t=1352833032.1424849, hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14, src_ps=0x1abd000, pkt_elem=0x0) at /home/bro/src/bro/src/Net.cc:353
> #21 0x00000000005fb0cf in Process (this=0x1abd000) at /home/bro/src/bro/src/PktSrc.cc:303
> #22 PktSrc::Process (this=0x1abd000) at /home/bro/src/bro/src/PktSrc.cc:175
> #23 0x00000000005ec547 in net_run () at /home/bro/src/bro/src/Net.cc:446
> #24 0x00000000004c06ea in main (argc=<optimized out>, argv=<optimized out>) at /home/bro/src/bro/src/main.cc:1073
>
> ==== No reporter.log
>
> ==== stderr.log
> listening on eth4, capture length 8192 bytes
>
> bro: /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:213: void binpac::FlowBuffer::ClearPreviousData(): Assertion `buffer_n_ == 0' failed.
> /usr/local/bro/share/broctl/scripts/run-bro: line 60: 3282 Aborted (core dumped) nohup $mybro $@
>
>
>
> On Nov 13, 2012, at 1:12 PM, Jonathan Siwek <jsiwek at ncsa.illinois.edu> wrote:
>
>> Repository : ssh://git@bro-ids.icir.org/bro
>>
>> On branch : topic/jsiwek/modbus-fixes
>> Link : http://tracker.bro-ids.org/bro/changeset/fd5eb23fa6ac654471d71645eb37dacc6d45896b/bro
>>
>>> ---------------------------------------------------------------
>>
>> commit fd5eb23fa6ac654471d71645eb37dacc6d45896b
>> Author: Jon Siwek <jsiwek at ncsa.illinois.edu>
>> Date: Tue Nov 13 12:09:14 2012 -0600
>>
>> Remove byte count parameter from modbus events carrying register arrays
>>
>> Instead of these events being generated for invalid byte count values
>> (they should always be even, not odd), a protocol_violation is raised.
>>
>> modbus_read_holding_registers_response
>> modbus_read_input_registers_response
>> modbus_write_multiple_registers_request
>> modbus_read_write_multiple_registers_request
>> modbus_read_write_multiple_registers_response
>> modbus_read_fifo_queue_respons
>>
>>
>>> ---------------------------------------------------------------
>>
>> fd5eb23fa6ac654471d71645eb37dacc6d45896b
>> scripts/policy/protocols/modbus/track-memmap.bro | 2 +-
>> src/event.bif | 24 ++-------
>> src/modbus-analyzer.pac | 50 +++++++++++++++++--
>> .../output | 5 +-
>> .../btest/scripts/base/protocols/modbus/events.bro | 12 ++--
>> .../base/protocols/modbus/register_parsing.bro | 9 ++--
>> 6 files changed, 64 insertions(+), 38 deletions(-)
>>
>> diff --git a/scripts/policy/protocols/modbus/track-memmap.bro b/scripts/policy/protocols/modbus/track-memmap.bro
>> index cc02ce9..fc02d9b 100644
>> --- a/scripts/policy/protocols/modbus/track-memmap.bro
>> +++ b/scripts/policy/protocols/modbus/track-memmap.bro
>> @@ -60,7 +60,7 @@ event modbus_read_holding_registers_request(c: connection, headers: ModbusHeader
>> c$modbus$track_address = start_address+1;
>> }
>>
>> -event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
>> +event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
>> {
>> local slave = c$id$resp_h;
>>
>> diff --git a/src/event.bif b/src/event.bif
>> index cc8acb1..b965c26 100644
>> --- a/src/event.bif
>> +++ b/src/event.bif
>> @@ -6623,10 +6623,8 @@ event modbus_read_holding_registers_request%(c: connection, headers: ModbusHeade
>> ##
>> ## headers: The headers for the modbus function.
>> ##
>> -## byte_count: The number of bytes in the message that comprise register values.
>> -##
>> ## registers: The register values returned from the device.
>> -event modbus_read_holding_registers_response%(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters%);
>> +event modbus_read_holding_registers_response%(c: connection, headers: ModbusHeaders, registers: ModbusRegisters%);
>>
>> ## Generated for a Modbus read input registers request.
>> ##
>> @@ -6645,10 +6643,8 @@ event modbus_read_input_registers_request%(c: connection, headers: ModbusHeaders
>> ##
>> ## headers: The headers for the modbus function.
>> ##
>> -## byte_count: The number of bytes in the message that comprise register values.
>> -##
>> ## registers: The register values returned from the device.
>> -event modbus_read_input_registers_response%(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters%);
>> +event modbus_read_input_registers_response%(c: connection, headers: ModbusHeaders, registers: ModbusRegisters%);
>>
>> ## Generated for a Modbus write single coil request.
>> ##
>> @@ -6724,10 +6720,8 @@ event modbus_write_multiple_coils_response%(c: connection, headers: ModbusHeader
>> ##
>> ## start_address: The memory address of the first register to be written.
>> ##
>> -## byte_count: The number of bytes in the message that comprise register values.
>> -##
>> ## registers: The values to be written to the registers.
>> -event modbus_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, start_address: count, byte_count: count, registers: ModbusRegisters%);
>> +event modbus_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, start_address: count, registers: ModbusRegisters%);
>>
>> ## Generated for a Modbus write multiple registers response.
>> ##
>> @@ -6818,10 +6812,8 @@ event modbus_mask_write_register_response%(c: connection, headers: ModbusHeaders
>> ##
>> ## write_start_address: The memory address of the first register to be written.
>> ##
>> -## write_byte_count: Number of bytes in message that comprise register values.
>> -##
>> ## write_registers: The values to be written to the registers.
>> -event modbus_read_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_byte_count: count, write_registers: ModbusRegisters%);
>> +event modbus_read_write_multiple_registers_request%(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_registers: ModbusRegisters%);
>>
>> ## Generated for a Modbus read/write multiple registers response.
>> ##
>> @@ -6829,10 +6821,8 @@ event modbus_read_write_multiple_registers_request%(c: connection, headers: Modb
>> ##
>> ## headers: The headers for the modbus function.
>> ##
>> -## byte_count: The number of bytes in the message that comprise register values.
>> -##
>> ## written_registers: The register values read from the registers specified in the request.
>> -event modbus_read_write_multiple_registers_response%(c: connection, headers: ModbusHeaders, byte_count: count, written_registers: ModbusRegisters%);
>> +event modbus_read_write_multiple_registers_response%(c: connection, headers: ModbusHeaders, written_registers: ModbusRegisters%);
>>
>> ## Generated for a Modbus read FIFO queue request.
>> ##
>> @@ -6849,10 +6839,8 @@ event modbus_read_fifo_queue_request%(c: connection, headers: ModbusHeaders, sta
>> ##
>> ## headers: The headers for the modbus function.
>> ##
>> -## byte_count: The number of bytes in the message that comprise register values.
>> -##
>> ## fifos: The register values read from the FIFO queue on the device.
>> -event modbus_read_fifo_queue_response%(c: connection, headers: ModbusHeaders, byte_count: count, fifos: ModbusRegisters%);
>> +event modbus_read_fifo_queue_response%(c: connection, headers: ModbusHeaders, fifos: ModbusRegisters%);
>>
>> ## Raised for informational messages reported via Bro's reporter framework. Such
>> ## messages may be generated internally by the event engine and also by other
>> diff --git a/src/modbus-analyzer.pac b/src/modbus-analyzer.pac
>> index 155da96..b03df9d 100644
>> --- a/src/modbus-analyzer.pac
>> +++ b/src/modbus-analyzer.pac
>> @@ -135,8 +135,16 @@ refine flow ModbusTCP_Flow += {
>> # RESPONSE FC=3
>> function deliver_ReadHoldingRegistersResponse(header: ModbusTCP_TransportHeader, message: ReadHoldingRegistersResponse): bool
>> %{
>> + if ( ${message.byte_count} % 2 != 0 )
>> + {
>> + connection()->bro_analyzer()->ProtocolViolation(
>> + fmt("invalid value for modbus read holding register response byte count %d", ${message.byte_count}));
>> + return false;
>> + }
>> +
>> if ( ::modbus_read_holding_registers_response )
>> {
>> +
>> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
>> for ( unsigned int i=0; i < ${message.registers}->size(); ++i )
>> {
>> @@ -147,7 +155,6 @@ refine flow ModbusTCP_Flow += {
>> BifEvent::generate_modbus_read_holding_registers_response(connection()->bro_analyzer(),
>> connection()->bro_analyzer()->Conn(),
>> HeaderToBro(header),
>> - ${message.byte_count},
>> t);
>> }
>>
>> @@ -172,6 +179,13 @@ refine flow ModbusTCP_Flow += {
>> # RESPONSE FC=4
>> function deliver_ReadInputRegistersResponse(header: ModbusTCP_TransportHeader, message: ReadInputRegistersResponse): bool
>> %{
>> + if ( ${message.byte_count} % 2 != 0 )
>> + {
>> + connection()->bro_analyzer()->ProtocolViolation(
>> + fmt("invalid value for modbus read input register response byte count %d", ${message.byte_count}));
>> + return false;
>> + }
>> +
>> if ( ::modbus_read_input_registers_response )
>> {
>> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
>> @@ -184,7 +198,6 @@ refine flow ModbusTCP_Flow += {
>> BifEvent::generate_modbus_read_input_registers_response(connection()->bro_analyzer(),
>> connection()->bro_analyzer()->Conn(),
>> HeaderToBro(header),
>> - ${message.byte_count},
>> t);
>> }
>>
>> @@ -309,6 +322,13 @@ refine flow ModbusTCP_Flow += {
>> # REQUEST FC=16
>> function deliver_WriteMultipleRegistersRequest(header: ModbusTCP_TransportHeader, message: WriteMultipleRegistersRequest): bool
>> %{
>> + if ( ${message.byte_count} % 2 != 0 )
>> + {
>> + connection()->bro_analyzer()->ProtocolViolation(
>> + fmt("invalid value for modbus write multiple registers request byte count %d", ${message.byte_count}));
>> + return false;
>> + }
>> +
>> if ( ::modbus_write_multiple_registers_request )
>> {
>> VectorVal * t = new VectorVal(BifType::Vector::ModbusRegisters);
>> @@ -321,7 +341,7 @@ refine flow ModbusTCP_Flow += {
>> BifEvent::generate_modbus_write_multiple_registers_request(connection()->bro_analyzer(),
>> connection()->bro_analyzer()->Conn(),
>> HeaderToBro(header),
>> - ${message.start_address}, ${message.byte_count}, t);
>> + ${message.start_address}, t);
>> }
>>
>> return true;
>> @@ -486,6 +506,13 @@ refine flow ModbusTCP_Flow += {
>> # REQUEST FC=23
>> function deliver_ReadWriteMultipleRegistersRequest(header: ModbusTCP_TransportHeader, message: ReadWriteMultipleRegistersRequest): bool
>> %{
>> + if ( ${message.write_byte_count} % 2 != 0 )
>> + {
>> + connection()->bro_analyzer()->ProtocolViolation(
>> + fmt("invalid value for modbus read write multiple registers request write byte count %d", ${message.write_byte_count}));
>> + return false;
>> + }
>> +
>> if ( ::modbus_read_write_multiple_registers_request )
>> {
>> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
>> @@ -501,7 +528,6 @@ refine flow ModbusTCP_Flow += {
>> ${message.read_start_address},
>> ${message.read_quantity},
>> ${message.write_start_address},
>> - ${message.write_byte_count},
>> t);
>> }
>>
>> @@ -511,6 +537,13 @@ refine flow ModbusTCP_Flow += {
>> # RESPONSE FC=23
>> function deliver_ReadWriteMultipleRegistersResponse(header: ModbusTCP_TransportHeader, message: ReadWriteMultipleRegistersResponse): bool
>> %{
>> + if ( ${message.byte_count} % 2 != 0 )
>> + {
>> + connection()->bro_analyzer()->ProtocolViolation(
>> + fmt("invalid value for modbus read write multiple registers response byte count %d", ${message.byte_count}));
>> + return false;
>> + }
>> +
>> if ( ::modbus_read_write_multiple_registers_response )
>> {
>> VectorVal* t = new VectorVal(BifType::Vector::ModbusRegisters);
>> @@ -523,7 +556,6 @@ refine flow ModbusTCP_Flow += {
>> BifEvent::generate_modbus_read_write_multiple_registers_response(connection()->bro_analyzer(),
>> connection()->bro_analyzer()->Conn(),
>> HeaderToBro(header),
>> - ${message.byte_count},
>> t);
>> }
>>
>> @@ -548,6 +580,13 @@ refine flow ModbusTCP_Flow += {
>> # RESPONSE FC=24
>> function deliver_ReadFIFOQueueResponse(header: ModbusTCP_TransportHeader, message: ReadFIFOQueueResponse): bool
>> %{
>> + if ( ${message.byte_count} % 2 != 0 )
>> + {
>> + connection()->bro_analyzer()->ProtocolViolation(
>> + fmt("invalid value for modbus read FIFO queue response byte count %d", ${message.byte_count}));
>> + return false;
>> + }
>> +
>> if ( ::modbus_read_fifo_queue_response )
>> {
>> VectorVal* t = new VectorVal(new VectorType(base_type(TYPE_COUNT)));
>> @@ -560,7 +599,6 @@ refine flow ModbusTCP_Flow += {
>> BifEvent::generate_modbus_read_fifo_queue_response(connection()->bro_analyzer(),
>> connection()->bro_analyzer()->Conn(),
>> HeaderToBro(header),
>> - ${message.byte_count},
>> t);
>> }
>>
>> diff --git a/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output b/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
>> index 353f85d..5bb5f1b 100644
>> --- a/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
>> +++ b/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
>> @@ -1,5 +1,4 @@
>> modbus_read_input_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=1119, pid=0, uid=255, function_code=4], 900, 147
>> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=2606, pid=0, uid=255, function_code=4], [0, 0, 0, 0, 0, 0, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100, 200
>> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=6714, pid=0, uid=255, function_code=4], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3840, 0, 0, 31, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 37, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], 64, 129
>> +modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=2606, pid=0, uid=255, function_code=4], [0, 0, 0, 0, 0, 0, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100
>> modbus_read_input_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=12993, pid=0, uid=255, function_code=4], 400, 100
>> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=17667, pid=0, uid=255, function_code=4], [49, 18012, 51, 42, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 54324, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 69, 63, 64, 65, 66, 67, 68, 49, 189, 51, 52, 53, 54, 4151, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 136, 49, 50, 51, 212, 53, 54, 170, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100, 200
>> +modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.104, resp_p=502/tcp], [tid=17667, pid=0, uid=255, function_code=4], [49, 18012, 51, 42, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 54324, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 69, 63, 64, 65, 66, 67, 68, 49, 189, 51, 52, 53, 54, 4151, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 136, 49, 50, 51, 212, 53, 54, 170, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690], 100
>> diff --git a/testing/btest/scripts/base/protocols/modbus/events.bro b/testing/btest/scripts/base/protocols/modbus/events.bro
>> index 6c47dc6..f648a0a 100644
>> --- a/testing/btest/scripts/base/protocols/modbus/events.bro
>> +++ b/testing/btest/scripts/base/protocols/modbus/events.bro
>> @@ -41,7 +41,7 @@ event modbus_read_holding_registers_request(c: connection, headers: ModbusHeader
>> print "modbus_read_holding_registers_request", c, headers, start_address, quantity;
>> }
>>
>> -event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
>> +event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
>> {
>> print "modbus_read_holding_registers_response", c, headers, registers;
>> }
>> @@ -51,7 +51,7 @@ event modbus_read_input_registers_request(c: connection, headers: ModbusHeaders,
>> print "modbus_read_input_registers_request", c, headers, start_address, quantity;
>> }
>>
>> -event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
>> +event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
>> {
>> print "modbus_read_input_registers_response", c, headers, registers;
>> }
>> @@ -86,7 +86,7 @@ event modbus_write_multiple_coils_response(c: connection, headers: ModbusHeaders
>> print "modbus_write_multiple_coils_response", c, headers, start_address, quantity;
>> }
>>
>> -event modbus_write_multiple_registers_request(c: connection, headers: ModbusHeaders, start_address: count, byte_count: count, registers: ModbusRegisters)
>> +event modbus_write_multiple_registers_request(c: connection, headers: ModbusHeaders, start_address: count, registers: ModbusRegisters)
>> {
>> print "modbus_write_multiple_registers_request", c, headers, start_address, registers;
>> }
>> @@ -126,12 +126,12 @@ event modbus_mask_write_register_response(c: connection, headers: ModbusHeaders,
>> print "modbus_mask_write_register_response", c, headers, address, and_mask, or_mask;
>> }
>>
>> -event modbus_read_write_multiple_registers_request(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_byte_count: count, write_registers: ModbusRegisters)
>> +event modbus_read_write_multiple_registers_request(c: connection, headers: ModbusHeaders, read_start_address: count, read_quantity: count, write_start_address: count, write_registers: ModbusRegisters)
>> {
>> print "modbus_read_write_multiple_registers_request", c, headers, read_start_address, read_quantity, write_start_address, write_registers;
>> }
>>
>> -event modbus_read_write_multiple_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, written_registers: ModbusRegisters)
>> +event modbus_read_write_multiple_registers_response(c: connection, headers: ModbusHeaders, written_registers: ModbusRegisters)
>> {
>> print "modbus_read_write_multiple_registers_response", c, headers, written_registers;
>> }
>> @@ -141,7 +141,7 @@ event modbus_read_fifo_queue_request(c: connection, headers: ModbusHeaders, star
>> print "modbus_read_fifo_queue_request", c, headers, start_address;
>> }
>>
>> -event modbus_read_fifo_queue_response(c: connection, headers: ModbusHeaders, byte_count: count, fifos: ModbusRegisters)
>> +event modbus_read_fifo_queue_response(c: connection, headers: ModbusHeaders, fifos: ModbusRegisters)
>> {
>> print "modbus_read_fifo_queue_response", c, headers, fifos;
>> }
>> diff --git a/testing/btest/scripts/base/protocols/modbus/register_parsing.bro b/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
>> index 300dd75..1641860 100644
>> --- a/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
>> +++ b/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
>> @@ -6,15 +6,16 @@
>> # of register values, with the quantity being derived from a byte count value
>> # that is also sent. If the byte count value is invalid (e.g. an odd value
>> # might not be valid since registers must be 2-byte values), then the parser
>> -# should not trigger any asserts, but the resulting event could indicate
>> -# the strangeness (i.e. byte_count != 2*|registers|).
>> +# should not trigger any asserts, but generate a protocol_violation (in this
>> +# case TCP_ApplicationAnalyzer::ProtocolViolation asserts its behavior for
>> +# incomplete connections).
>>
>> event modbus_read_input_registers_request(c: connection, headers: ModbusHeaders, start_address: count, quantity: count)
>> {
>> print "modbus_read_input_registers_request", c$id, headers, start_address, quantity;
>> }
>>
>> -event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, byte_count: count, registers: ModbusRegisters)
>> +event modbus_read_input_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
>> {
>> - print "modbus_read_input_registers_response", c$id, headers, registers, |registers|, byte_count;
>> + print "modbus_read_input_registers_response", c$id, headers, registers, |registers|;
>> }
>>
>> _______________________________________________
>> bro-commits mailing list
>> bro-commits at bro-ids.org
>> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-commits
>
>
> _______________________________________________
> bro-dev mailing list
> bro-dev at bro-ids.org
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
>
More information about the bro-dev
mailing list