Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix some things in DNP3 UDP analyzer.

Browse source 
- DeliverPacket override had a wrong parameter.
- Change the DNP3 plugin to provide both UDP and TCP analyzer versions.
- Add a DPD signature.
This commit is contained in:
Jon Siwek 2014-08-06 15:41:53 -05:00
parent 51e936ec59
commit b83d4a9c84
4 changed files with 17 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/protocols/dnp3/dpd.sig
View file

@ -7,3 +7,9 @@ signature dpd_dnp3_server {
tcp-state responder tcp-state responder
enable "dnp3" enable "dnp3"
} }
signature dpd_dnp3_server_udp {
ip-proto == udp
payload /\x05\x64/
enable "dnp3_udp"
}

10
src/analyzer/protocol/dnp3/DNP3.cc
View file

@ -109,13 +109,12 @@ const unsigned int PSEUDO_APP_LAYER_INDEX = 11; // index of first DNP3 app-laye
const unsigned int PSEUDO_TRANSPORT_LEN = 1; // length of DNP3 Transport Layer const unsigned int PSEUDO_TRANSPORT_LEN = 1; // length of DNP3 Transport Layer
const unsigned int PSEUDO_LINK_LAYER_LEN = 8; // length of DNP3 Pseudo Link Layer const unsigned int PSEUDO_LINK_LAYER_LEN = 8; // length of DNP3 Pseudo Link Layer
//bool DNP3_Analyzer::crc_table_initialized = false; bool DNP3_Analyzer::crc_table_initialized = false;
//unsigned int DNP3_Analyzer::crc_table[256]; unsigned int DNP3_Analyzer::crc_table[256];
bool DNP3_UDP_Analyzer::crc_table_initialized = false; bool DNP3_UDP_Analyzer::crc_table_initialized = false;
unsigned int DNP3_UDP_Analyzer::crc_table[256]; unsigned int DNP3_UDP_Analyzer::crc_table[256];
/*
DNP3_Analyzer::DNP3_Analyzer(Connection* c) : TCP_ApplicationAnalyzer("DNP3", c) DNP3_Analyzer::DNP3_Analyzer(Connection* c) : TCP_ApplicationAnalyzer("DNP3", c)
{ {
interp = new binpac::DNP3::DNP3_Conn(this); interp = new binpac::DNP3::DNP3_Conn(this);
@ -378,11 +377,10 @@ unsigned int DNP3_Analyzer::CalcCRC(int len, const u_char* data)
return ~crc & 0xFFFF; return ~crc & 0xFFFF;
} }
*/
// ?? For DNP3 over UDP analyzer. most of the codes are copied and pasted. Better way to reuse the code? // ?? For DNP3 over UDP analyzer. most of the codes are copied and pasted. Better way to reuse the code?
DNP3_UDP_Analyzer::DNP3_UDP_Analyzer(Connection* c) : Analyzer("DNP3", c) DNP3_UDP_Analyzer::DNP3_UDP_Analyzer(Connection* c) : Analyzer("DNP3_UDP", c)
{ {
printf("enter DNP3_UDP_Analyzer\n"); printf("enter DNP3_UDP_Analyzer\n");
@ -405,7 +403,7 @@ void DNP3_UDP_Analyzer::Done()
Analyzer::Done(); Analyzer::Done();
} }
void DNP3_UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, int seq, const IP_Hdr* ip, int caplen) void DNP3_UDP_Analyzer::DeliverPacket(int len, const u_char* data, bool orig, uint64 seq, const IP_Hdr* ip, int caplen)
{ {
printf("enter DNP3_UDP_Analyzer DeliverPacket\n"); printf("enter DNP3_UDP_Analyzer DeliverPacket\n");
Analyzer::DeliverPacket(len, data, orig, seq, ip, caplen); Analyzer::DeliverPacket(len, data, orig, seq, ip, caplen);

8
src/analyzer/protocol/dnp3/DNP3.h
View file

@ -2,13 +2,13 @@
#ifndef ANALYZER_PROTOCOL_DNP3_DNP3_H #ifndef ANALYZER_PROTOCOL_DNP3_DNP3_H
#define ANALYZER_PROTOCOL_DNP3_DNP3_H #define ANALYZER_PROTOCOL_DNP3_DNP3_H
//#include "analyzer/protocol/tcp/TCP.h" #include "analyzer/protocol/tcp/TCP.h"
#include "analyzer/protocol/udp/UDP.h" #include "analyzer/protocol/udp/UDP.h"
#include "dnp3_pac.h" #include "dnp3_pac.h"
namespace analyzer { namespace dnp3 { namespace analyzer { namespace dnp3 {
/*
class DNP3_Analyzer : public tcp::TCP_ApplicationAnalyzer { class DNP3_Analyzer : public tcp::TCP_ApplicationAnalyzer {
public: public:
DNP3_Analyzer(Connection* conn); DNP3_Analyzer(Connection* conn);
@ -52,7 +52,7 @@ private:
static bool crc_table_initialized; static bool crc_table_initialized;
static unsigned int crc_table[256]; static unsigned int crc_table[256];
}; };
*/
class DNP3_UDP_Analyzer : public analyzer::Analyzer { class DNP3_UDP_Analyzer : public analyzer::Analyzer {
public: public:
@ -61,7 +61,7 @@ public:
virtual void Done(); virtual void Done();
virtual void DeliverPacket(int len, const u_char* data, bool orig, virtual void DeliverPacket(int len, const u_char* data, bool orig,
int seq, const IP_Hdr* ip, int caplen); uint64 seq, const IP_Hdr* ip, int caplen);
//virtual void Undelivered(uint64 seq, int len, bool orig); //virtual void Undelivered(uint64 seq, int len, bool orig);
//virtual void EndpointEOF(bool is_orig); //virtual void EndpointEOF(bool is_orig);

7
src/analyzer/protocol/dnp3/Plugin.cc
View file

@ -12,13 +12,12 @@ class Plugin : public plugin::Plugin {
public: public:
plugin::Configuration Configure() plugin::Configuration Configure()
{ {
//AddComponent(new ::analyzer::Component("DNP3", ::analyzer::dnp3::DNP3_Analyzer::Instantiate)); AddComponent(new ::analyzer::Component("DNP3", ::analyzer::dnp3::DNP3_Analyzer::Instantiate));
AddComponent(new ::analyzer::Component("DNP3", ::analyzer::dnp3::DNP3_UDP_Analyzer::Instantiate)); AddComponent(new ::analyzer::Component("DNP3_UDP", ::analyzer::dnp3::DNP3_UDP_Analyzer::Instantiate));
plugin::Configuration config; plugin::Configuration config;
config.name = "Bro::DNP3"; config.name = "Bro::DNP3";
//config.description = "DNP3 analyzer"; config.description = "DNP3 UDP/TCP analyzers";
config.description = "DNP3 UDP analyzer";
return config; return config;
} }
} plugin; } plugin;