Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Pass parsed file record information with ReadFile/WriteFile events

Browse source
This commit is contained in:
Tim Wojtulewicz 2023-07-25 13:02:50 -07:00
parent 18fd384469
commit 1dc9235cee
11 changed files with 129 additions and 93 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/scripts.base.protocols.modbus.coil_parsing_big/coverage
View file

@ -1,2 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
5 of 32 events triggered by trace
5 of 36 events triggered by trace

2
testing/btest/Baseline/scripts.base.protocols.modbus.coil_parsing_small/coverage
View file

@ -1,2 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
5 of 32 events triggered by trace
5 of 36 events triggered by trace

2
testing/btest/Baseline/scripts.base.protocols.modbus.events/coverage
View file

@ -1,2 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
22 of 32 events triggered by trace
22 of 36 events triggered by trace

4
testing/btest/Baseline/scripts.base.protocols.modbus.events/output
View file

@ -39973,7 +39973,7 @@
1 modbus_read_coils_response, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=1, len=4], [T, F, T, F, T, F, F, F]
1 modbus_read_discrete_inputs_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=2, len=6], 0, 0
1 modbus_read_fifo_queue_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=24, len=6], 0
1 modbus_read_file_record_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=20, len=6]
1 modbus_read_file_record_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=20, len=6], 0, []
1 modbus_read_holding_registers_request, [orig_h=10.0.0.9, orig_p=3082/tcp, resp_h=10.0.0.3, resp_p=502/tcp], [tid=1, pid=0, uid=10, function_code=3, len=6], 5, 2
1 modbus_read_holding_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], [tid=10000, pid=0, uid=255, function_code=3, len=6], 100, 100
1 modbus_read_holding_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], [tid=10004, pid=0, uid=255, function_code=3, len=6], 500, 100
@ -79402,7 +79402,7 @@
1 modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], [tid=9997, pid=0, uid=255, function_code=4, len=203], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
1 modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], [tid=9998, pid=0, uid=255, function_code=4, len=203], [70, 80, 72, 9, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89]
1 modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp, resp_h=10.10.5.85, resp_p=502/tcp], [tid=9999, pid=0, uid=255, function_code=4, len=203], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
1 modbus_write_file_record_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=21, len=6]
1 modbus_write_file_record_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=21, len=6], 0, []
1 modbus_write_multiple_coils_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=15, len=7], 0, []
1 modbus_write_multiple_registers_request, [orig_h=192.168.66.235, orig_p=2582/tcp, resp_h=166.161.16.230, resp_p=502/tcp], [tid=0, pid=0, uid=1, function_code=16, len=7], 0, []
1 modbus_write_single_coil_request, [orig_h=10.0.0.9, orig_p=3082/tcp, resp_h=10.0.0.3, resp_p=502/tcp], [tid=1, pid=0, uid=10, function_code=5, len=6], 1, F

16
testing/btest/scripts/base/protocols/modbus/events.zeek
View file

@ -110,24 +110,24 @@ event modbus_write_multiple_registers_response(c: connection, headers: ModbusHea
print "modbus_write_multiple_registers_response", c$id, headers, start_address, quantity;
}
event modbus_read_file_record_request(c: connection, headers: ModbusHeaders)
event modbus_read_file_record_request(c: connection, headers: ModbusHeaders, byte_count: count, refs: ModbusFileRecordRequests)
{
print "modbus_read_file_record_request", c$id, headers;
print "modbus_read_file_record_request", c$id, headers, byte_count, refs;
}
event modbus_read_file_record_response(c: connection, headers: ModbusHeaders)
event modbus_read_file_record_response(c: connection, headers: ModbusHeaders, byte_count: count, refs: ModbusFileRecordResponses)
{
print "modbus_read_file_record_response", c$id, headers;
print "modbus_read_file_record_response", c$id, headers, byte_count, refs;
}
event modbus_write_file_record_request(c: connection, headers: ModbusHeaders)
event modbus_write_file_record_request(c: connection, headers: ModbusHeaders, byte_count: count, refs: ModbusFileReferences)
{
print "modbus_write_file_record_request", c$id, headers;
print "modbus_write_file_record_request", c$id, headers, byte_count, refs;
}
event modbus_write_file_record_response(c: connection, headers: ModbusHeaders)
event modbus_write_file_record_response(c: connection, headers: ModbusHeaders, byte_count: count, refs: ModbusFileReferences)
{
print "modbus_write_file_record_response", c$id, headers;
print "modbus_write_file_record_response", c$id, headers, byte_count, refs;
}
event modbus_mask_write_register_request(c: connection, headers: ModbusHeaders, address: count, and_mask: count, or_mask: count)