Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Tiny bit of cleanup and adapting the new test.

Browse source
This commit is contained in:
Robin Sommer 2013-08-11 16:20:08 -07:00
parent bced60f7a8
commit a927189bdb
2 changed files with 5 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/analyzer/protocol/dnp3/DNP3.cc
View file

@ -189,7 +189,7 @@ bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
} }
// Make sure header checksum is correct. // Make sure header checksum is correct.
if ( ! CheckCRC(PSEUDO_LINK_LAYER_LEN, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN, "header") ) if ( ! CheckCRC(PSEUDO_LINK_LAYER_LEN, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN, "header") )
{ {
ProtocolViolation("broken_checksum"); ProtocolViolation("broken_checksum");
return false; return false;
@ -198,8 +198,9 @@ bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
// If the checksum works out, we're pretty certainly DNP3. // If the checksum works out, we're pretty certainly DNP3.
ProtocolConfirmation(); ProtocolConfirmation();
// (Hui Lin) Make sure that the DNP3 packet includes Pseudo Transport and Pseudo Application Layer data // DNP3 packets without transport and application
if ( ( endp->buffer[PSEUDO_LENGTH_INDEX] + 3 ) == (u_char)PSEUDO_LINK_LAYER_LEN ) // layers can happen, we ignore them.
if ( (endp->buffer[PSEUDO_LENGTH_INDEX] + 3) == PSEUDO_LINK_LAYER_LEN )
{ {
ClearEndpointState(orig); ClearEndpointState(orig);
return true; return true;
@ -221,9 +222,6 @@ bool DNP3_Analyzer::ProcessData(int len, const u_char* data, bool orig)
// BinPAC. // BinPAC.
if ( ++endp->pkt_cnt == 1 ) if ( ++endp->pkt_cnt == 1 )
interp->NewData(orig, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN); interp->NewData(orig, endp->buffer, endp->buffer + PSEUDO_LINK_LAYER_LEN);
} }
if ( ! endp->in_hdr ) if ( ! endp->in_hdr )

2
testing/btest/scripts/base/protocols/dnp3/dnp3_link_only.bro
View file

@ -2,7 +2,7 @@
# @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_link_only.pcap %DIR/events.bro >output # @TEST-EXEC: bro -r $TRACES/dnp3/dnp3_link_only.pcap %DIR/events.bro >output
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output
# @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered # @TEST-EXEC: cat output | awk '{print $1}' | sort | uniq | wc -l >covered
# @TEST-EXEC: cat ${DIST}/src/event.bif | grep "^event dnp3_" | wc -l >total # @TEST-EXEC: cat ${DIST}/src/analyzer/protocol/dnp3/events.bif | grep "^event dnp3_" | wc -l >total
# @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage # @TEST-EXEC: echo `cat covered` of `cat total` events triggered by trace >coverage
# @TEST-EXEC: btest-diff coverage # @TEST-EXEC: btest-diff coverage
# #