Merge remote-tracking branch 'origin/topic/dina/modbus' into topic/robin/modbus-merge

* origin/topic/dina/modbus:
  put some make-up on Modbus analyser
  Modbus analyser, added support: FC=20,21
  Modbus analyzer,added support: FC=1,2,15,24
  Modbus analyzer, current support: FC=3,4,5,6,7,16,22,23

I cleaned up the code a bit, mainly layout style.

I did not include the *.bro scripts for now, but a test script
../testing/btest/scripts/base/protocols/modbus/events.bro that prints
out the value for each event.

Merged the Modbus traces from the ics repository into a single trace
as input for the test. They currently trigger 20 of the 34 events.

Addresses #870.
This commit is contained in:
Robin Sommer 2012-08-28 21:18:37 -07:00
commit cbb31cedc3
17 changed files with 81106 additions and 1 deletions

66
src/Modbus.h Normal file
View file

@ -0,0 +1,66 @@
#ifndef MODBUS_H
#define MODBUS_H
#include "TCP.h"
#include "modbus_pac.h"
class ModbusTCP_Analyzer : public TCP_ApplicationAnalyzer {
public:
ModbusTCP_Analyzer(Connection* conn);
virtual ~ModbusTCP_Analyzer();
virtual void Done();
virtual void DeliverStream(int len, const u_char* data, bool orig);
virtual void Undelivered(int seq, int len, bool orig);
virtual void EndpointEOF(TCP_Reassembler* endp);
static Analyzer* InstantiateAnalyzer(Connection* conn)
{ return new ModbusTCP_Analyzer(conn); }
// Put event names in this function
static bool Available()
{
return modbus_read_coils_request
|| modbus_read_coils_response
|| modbus_read_input_discretes_request
|| modbus_read_input_discretes_response
|| modbus_read_multi_request
|| modbus_read_multi_response
|| modbus_read_input_request
|| modbus_read_input_response
|| modbus_write_single_request
|| modbus_write_single_response
|| modbus_write_coil_request
|| modbus_write_coil_response
|| modbus_force_coils_request
|| modbus_force_coils_response
|| modbus_read_reference_request
|| modbus_read_reference_response
|| modbus_read_single_reference_request
|| modbus_read_single_reference_response
|| modbus_write_reference_request
|| modbus_write_reference_response
|| modbus_write_single_reference
|| modbus_write_multi_request
|| modbus_write_multi_response
|| modbus_mask_write_request
|| modbus_mask_write_response
|| modbus_read_write_request
|| modbus_read_write_response
|| modbus_read_FIFO_request
|| modbus_read_FIFO_response
|| modbus_read_except_request
|| modbus_read_except_response
|| modbus_exception
|| modbus_request
|| modbus_response;
}
protected:
binpac::ModbusTCP::ModbusTCP_Conn* interp;
};
#endif