Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix issues with Modbus message logging

Browse source 
This commit fixes three issues with Zeek's Modbus message logging:

1 - Some exception responses (e.g., READ_COILS_EXCEPTION) are logged
    twice: once without and once with the exception message.
2 - Some exception responses (e.g., PROGRAM_484_EXCEPTION) are not
    logged.
3 - Some known but reserved function codes (e.g., PROGRAM_UNITY) are
    logged as unk-xxx (e.g., unk-90), while it would be possible to
    log their known name.

To address these inconsistencies, the modbus parser has been updated
to parse all exception responses (i.e., all responses where the MSB
of the function code is set) using the already defined Exception
message.
Also, the Modbus main.zeek script has been updated to consistently
demand logging exception responses to the specialized
modbus_exception event, rather than logging some exception responses
in the modbus_message event and others in the modbus_exception event.
Finally, the main.zeek script has been updated to make sure that
for every known function code, the corresponding exception code was
also present, and the enumeration of known function codes in
consts.zeek has been expanded.

Closes #3984
This commit is contained in:
Emmanuele Zambon 2024-10-12 14:07:26 +02:00
parent 4763282f36
commit 792aacc8e5
7 changed files with 290 additions and 205 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/base/protocols/modbus/main.zeek
View file

@ -45,6 +45,25 @@ event zeek_init() &priority=5
Log::create_stream(Modbus::LOG, [$columns=Info, $ev=log_modbus, $path="modbus", $policy=log_policy]);
Analyzer::register_for_ports(Analyzer::ANALYZER_MODBUS, ports);
}
function build_func(func: count): string
{
local masked = func & ~0x80;
# If the function code is in function_codes, use it. Also,
# if the masked value isn't in function_codes, use function_codes
# &default functionality.
if ( func in function_codes || masked !in function_codes )
return function_codes[func];
local s = function_codes[masked];
# Suffix exceptions with _EXCEPTION.
if ( func & 0x80 == 0x80 )
s += "_EXCEPTION";
return s;
}
event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &priority=5
{
@ -56,7 +75,7 @@ event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &prio
c$modbus$ts = network_time();
c$modbus$tid = headers$tid;
c$modbus$unit = headers$uid;
c$modbus$func = function_codes[headers$function_code];
c$modbus$func = build_func(headers$function_code);
## If this message is from the TCP originator, it is a request. Otherwise,
## it is a response.
c$modbus$pdu_type = is_orig ? "REQ" : "RESP";
@ -65,7 +84,7 @@ event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &prio
event modbus_message(c: connection, headers: ModbusHeaders, is_orig: bool) &priority=-5
{
# Don't log now if this is an exception (log in the exception event handler)
if ( headers$function_code <= 0x81 || headers$function_code >= 0x98 )
if ( headers$function_code < 0x80 )
Log::write(LOG, c$modbus);
}