Thanks for looking into this, Jon.
I'm still seeing crashes with this commit (trace included below). Should I open
a new ticket for this? I don't want to latch onto the merge request at #917
unnecessarily. Thanks,
--Vlad
[New LWP 3282]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/local/bro/bin/bro -i eth4 -U .status -p broctl -p
broctl-live -p local -p'.
Program terminated with signal 6, Aborted.
#0 0x00007f46f893f425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
Thread 1 (Thread 0x7f46fac7e780 (LWP 3282)):
#0 0x00007f46f893f425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007f46f8942b8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007f46f89380ee in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3 0x00007f46f8938192 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
#4 0x000000000068cd9f in ClearPreviousData (this=<optimized out>) at
/home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:213
#5 binpac::FlowBuffer::ClearPreviousData (this=<optimized out>) at
/home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:208
#6 0x000000000068d246 in binpac::FlowBuffer::NewData (this=0xb1b08c0,
begin=0xbfcf7a0 "\300\205", end=0xbfcf7ad "") at
/home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:176
#7 0x0000000000503ce0 in binpac::ModbusTCP::ModbusTCP_Flow::NewData
(this=0x46c1f90, t_begin_of_data=<optimized out>, t_end_of_data=<optimized
out>) at /home/bro/src/bro/build/src/modbus_pac.cc:2867
#8 0x000000000052169d in Analyzer::NextStream (this=0xb1a3640, len=<optimized
out>, data=<optimized out>, is_orig=<optimized out>) at
/home/bro/src/bro/src/Analyzer.cc:369
#9 0x00000000005222b6 in Analyzer::ForwardStream (this=0xb19b240, len=13,
data=0xbfcf7a0 "\300\205", is_orig=false) at
/home/bro/src/bro/src/Analyzer.cc:456
#10 0x0000000000646e80 in TCP_Reassembler::DeliverBlock (this=0x5fdf8c0,
seq=15, len=13, data=0xbfcf7a0 "\300\205") at
/home/bro/src/bro/src/TCP_Reassembler.cc:618
#11 0x00000000006471aa in BlockInserted (start_block=<optimized out>,
this=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:359
#12 TCP_Reassembler::BlockInserted (this=0x5fdf8c0, start_block=<optimized
out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:334
#13 0x0000000000646d28 in TCP_Reassembler::DataSent (this=0x5fdf8c0,
t=<optimized out>, seq=<optimized out>, len=<optimized out>, data=<optimized
out>, replaying=<optimized out>) at /home/bro/src/bro/src/TCP_Reassembler.cc:458
#14 0x0000000000645cc6 in TCP_Endpoint::DataSent (this=0xb1a8790, t=<optimized
out>, seq=15, len=13, caplen=13, data=0x7f46e2eefffe <Address 0x7f46e2eefffe
out of bounds>, ip=<optimized out>, tp=0x7f46e2eeffea) at
/home/bro/src/bro/src/TCP_Endpoint.cc:183
#15 0x00000000006446f8 in TCP_Analyzer::DeliverPacket (this=0xb19b240, len=13,
data=0x7f46e2eefffe <Address 0x7f46e2eefffe out of bounds>, is_orig=false,
seq=<optimized out>, ip=0x7fff69511bf0, caplen=13) at
/home/bro/src/bro/src/TCP.cc:1039
#16 0x0000000000521571 in Analyzer::NextPacket (this=0xb19b240, len=<optimized
out>, data=<optimized out>, is_orig=<optimized out>, seq=<optimized out>,
ip=<optimized out>, caplen=33) at /home/bro/src/bro/src/Analyzer.cc:341
#17 0x000000000053aa70 in Connection::NextPacket (this=<optimized out>,
t=<optimized out>, is_orig=<optimized out>, ip=<optimized out>, len=<optimized
out>, caplen=<optimized out>, data=<optimized out>,
record_packet=@0x7fff69511868: 1, record_content=@0x7fff6951186c: 1,
hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>,
hdr_size=14) at /home/bro/src/bro/src/Conn.cc:259
#18 0x000000000062e2f0 in NetSessions::DoNextPacket (this=0x2bd0c00,
t=1352833032.1424849, hdr=0x1abd040, ip_hdr=0x7fff69511bf0, pkt=0x7f46e2eeffc8
<Address 0x7f46e2eeffc8 out of bounds>, hdr_size=14, encapsulation=0x0) at
/home/bro/src/bro/src/Sessions.cc:700
#19 0x000000000062f8c5 in NetSessions::NextPacket (this=0x2bd0c00,
t=1352833032.1424849, hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8
out of bounds>, hdr_size=14, pkt_elem=<optimized out>) at
/home/bro/src/bro/src/Sessions.cc:238
#20 0x00000000005ec14b in net_packet_dispatch (t=1352833032.1424849,
hdr=0x1abd040, pkt=0x7f46e2eeffc8 <Address 0x7f46e2eeffc8 out of bounds>,
hdr_size=14, src_ps=0x1abd000, pkt_elem=0x0) at /home/bro/src/bro/src/Net.cc:353
#21 0x00000000005fb0cf in Process (this=0x1abd000) at
/home/bro/src/bro/src/PktSrc.cc:303
#22 PktSrc::Process (this=0x1abd000) at /home/bro/src/bro/src/PktSrc.cc:175
#23 0x00000000005ec547 in net_run () at /home/bro/src/bro/src/Net.cc:446
#24 0x00000000004c06ea in main (argc=<optimized out>, argv=<optimized out>) at
/home/bro/src/bro/src/main.cc:1073
==== No reporter.log
==== stderr.log
listening on eth4, capture length 8192 bytes
bro: /home/bro/src/bro/aux/binpac/lib/binpac_buffer.cc:213: void
binpac::FlowBuffer::ClearPreviousData(): Assertion `buffer_n_ == 0' failed.
/usr/local/bro/share/broctl/scripts/run-bro: line 60: 3282 Aborted
(core dumped) nohup $mybro $@
On Nov 13, 2012, at 1:12 PM, Jonathan Siwek <[email protected]> wrote:
> Repository : ssh://[email protected]/bro
>
> On branch : topic/jsiwek/modbus-fixes
> Link :
> http://tracker.bro-ids.org/bro/changeset/fd5eb23fa6ac654471d71645eb37dacc6d45896b/bro
>
>> ---------------------------------------------------------------
>
> commit fd5eb23fa6ac654471d71645eb37dacc6d45896b
> Author: Jon Siwek <[email protected]>
> Date: Tue Nov 13 12:09:14 2012 -0600
>
> Remove byte count parameter from modbus events carrying register arrays
>
> Instead of these events being generated for invalid byte count values
> (they should always be even, not odd), a protocol_violation is raised.
>
> modbus_read_holding_registers_response
> modbus_read_input_registers_response
> modbus_write_multiple_registers_request
> modbus_read_write_multiple_registers_request
> modbus_read_write_multiple_registers_response
> modbus_read_fifo_queue_respons
>
>
>> ---------------------------------------------------------------
>
> fd5eb23fa6ac654471d71645eb37dacc6d45896b
> scripts/policy/protocols/modbus/track-memmap.bro | 2 +-
> src/event.bif | 24 ++-------
> src/modbus-analyzer.pac | 50 +++++++++++++++++--
> .../output | 5 +-
> .../btest/scripts/base/protocols/modbus/events.bro | 12 ++--
> .../base/protocols/modbus/register_parsing.bro | 9 ++--
> 6 files changed, 64 insertions(+), 38 deletions(-)
>
> diff --git a/scripts/policy/protocols/modbus/track-memmap.bro
> b/scripts/policy/protocols/modbus/track-memmap.bro
> index cc02ce9..fc02d9b 100644
> --- a/scripts/policy/protocols/modbus/track-memmap.bro
> +++ b/scripts/policy/protocols/modbus/track-memmap.bro
> @@ -60,7 +60,7 @@ event modbus_read_holding_registers_request(c: connection,
> headers: ModbusHeader
> c$modbus$track_address = start_address+1;
> }
>
> -event modbus_read_holding_registers_response(c: connection, headers:
> ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_holding_registers_response(c: connection, headers:
> ModbusHeaders, registers: ModbusRegisters)
> {
> local slave = c$id$resp_h;
>
> diff --git a/src/event.bif b/src/event.bif
> index cc8acb1..b965c26 100644
> --- a/src/event.bif
> +++ b/src/event.bif
> @@ -6623,10 +6623,8 @@ event modbus_read_holding_registers_request%(c:
> connection, headers: ModbusHeade
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register
> values.
> -##
> ## registers: The register values returned from the device.
> -event modbus_read_holding_registers_response%(c: connection, headers:
> ModbusHeaders, byte_count: count, registers: ModbusRegisters%);
> +event modbus_read_holding_registers_response%(c: connection, headers:
> ModbusHeaders, registers: ModbusRegisters%);
>
> ## Generated for a Modbus read input registers request.
> ##
> @@ -6645,10 +6643,8 @@ event modbus_read_input_registers_request%(c:
> connection, headers: ModbusHeaders
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register
> values.
> -##
> ## registers: The register values returned from the device.
> -event modbus_read_input_registers_response%(c: connection, headers:
> ModbusHeaders, byte_count: count, registers: ModbusRegisters%);
> +event modbus_read_input_registers_response%(c: connection, headers:
> ModbusHeaders, registers: ModbusRegisters%);
>
> ## Generated for a Modbus write single coil request.
> ##
> @@ -6724,10 +6720,8 @@ event modbus_write_multiple_coils_response%(c:
> connection, headers: ModbusHeader
> ##
> ## start_address: The memory address of the first register to be written.
> ##
> -## byte_count: The number of bytes in the message that comprise register
> values.
> -##
> ## registers: The values to be written to the registers.
> -event modbus_write_multiple_registers_request%(c: connection, headers:
> ModbusHeaders, start_address: count, byte_count: count, registers:
> ModbusRegisters%);
> +event modbus_write_multiple_registers_request%(c: connection, headers:
> ModbusHeaders, start_address: count, registers: ModbusRegisters%);
>
> ## Generated for a Modbus write multiple registers response.
> ##
> @@ -6818,10 +6812,8 @@ event modbus_mask_write_register_response%(c:
> connection, headers: ModbusHeaders
> ##
> ## write_start_address: The memory address of the first register to be
> written.
> ##
> -## write_byte_count: Number of bytes in message that comprise register
> values.
> -##
> ## write_registers: The values to be written to the registers.
> -event modbus_read_write_multiple_registers_request%(c: connection, headers:
> ModbusHeaders, read_start_address: count, read_quantity: count,
> write_start_address: count, write_byte_count: count, write_registers:
> ModbusRegisters%);
> +event modbus_read_write_multiple_registers_request%(c: connection, headers:
> ModbusHeaders, read_start_address: count, read_quantity: count,
> write_start_address: count, write_registers: ModbusRegisters%);
>
> ## Generated for a Modbus read/write multiple registers response.
> ##
> @@ -6829,10 +6821,8 @@ event modbus_read_write_multiple_registers_request%(c:
> connection, headers: Modb
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register
> values.
> -##
> ## written_registers: The register values read from the registers specified
> in the request.
> -event modbus_read_write_multiple_registers_response%(c: connection, headers:
> ModbusHeaders, byte_count: count, written_registers: ModbusRegisters%);
> +event modbus_read_write_multiple_registers_response%(c: connection, headers:
> ModbusHeaders, written_registers: ModbusRegisters%);
>
> ## Generated for a Modbus read FIFO queue request.
> ##
> @@ -6849,10 +6839,8 @@ event modbus_read_fifo_queue_request%(c: connection,
> headers: ModbusHeaders, sta
> ##
> ## headers: The headers for the modbus function.
> ##
> -## byte_count: The number of bytes in the message that comprise register
> values.
> -##
> ## fifos: The register values read from the FIFO queue on the device.
> -event modbus_read_fifo_queue_response%(c: connection, headers:
> ModbusHeaders, byte_count: count, fifos: ModbusRegisters%);
> +event modbus_read_fifo_queue_response%(c: connection, headers:
> ModbusHeaders, fifos: ModbusRegisters%);
>
> ## Raised for informational messages reported via Bro's reporter framework.
> Such
> ## messages may be generated internally by the event engine and also by other
> diff --git a/src/modbus-analyzer.pac b/src/modbus-analyzer.pac
> index 155da96..b03df9d 100644
> --- a/src/modbus-analyzer.pac
> +++ b/src/modbus-analyzer.pac
> @@ -135,8 +135,16 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=3
> function deliver_ReadHoldingRegistersResponse(header:
> ModbusTCP_TransportHeader, message: ReadHoldingRegistersResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read holding register
> response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_holding_registers_response )
> {
> +
> VectorVal* t = new
> VectorVal(BifType::Vector::ModbusRegisters);
> for ( unsigned int i=0; i <
> ${message.registers}->size(); ++i )
> {
> @@ -147,7 +155,6 @@ refine flow ModbusTCP_Flow += {
>
> BifEvent::generate_modbus_read_holding_registers_response(connection()->bro_analyzer(),
>
> connection()->bro_analyzer()->Conn(),
>
> HeaderToBro(header),
> -
> ${message.byte_count},
>
> t);
> }
>
> @@ -172,6 +179,13 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=4
> function deliver_ReadInputRegistersResponse(header:
> ModbusTCP_TransportHeader, message: ReadInputRegistersResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read input register
> response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_input_registers_response )
> {
> VectorVal* t = new
> VectorVal(BifType::Vector::ModbusRegisters);
> @@ -184,7 +198,6 @@ refine flow ModbusTCP_Flow += {
>
> BifEvent::generate_modbus_read_input_registers_response(connection()->bro_analyzer(),
>
> connection()->bro_analyzer()->Conn(),
>
> HeaderToBro(header),
> -
> ${message.byte_count},
>
> t);
> }
>
> @@ -309,6 +322,13 @@ refine flow ModbusTCP_Flow += {
> # REQUEST FC=16
> function deliver_WriteMultipleRegistersRequest(header:
> ModbusTCP_TransportHeader, message: WriteMultipleRegistersRequest): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus write multiple
> registers request byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_write_multiple_registers_request )
> {
> VectorVal * t = new
> VectorVal(BifType::Vector::ModbusRegisters);
> @@ -321,7 +341,7 @@ refine flow ModbusTCP_Flow += {
>
> BifEvent::generate_modbus_write_multiple_registers_request(connection()->bro_analyzer(),
>
> connection()->bro_analyzer()->Conn(),
>
> HeaderToBro(header),
> -
> ${message.start_address}, ${message.byte_count}, t);
> +
> ${message.start_address}, t);
> }
>
> return true;
> @@ -486,6 +506,13 @@ refine flow ModbusTCP_Flow += {
> # REQUEST FC=23
> function deliver_ReadWriteMultipleRegistersRequest(header:
> ModbusTCP_TransportHeader, message: ReadWriteMultipleRegistersRequest): bool
> %{
> + if ( ${message.write_byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read write multiple
> registers request write byte count %d", ${message.write_byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_write_multiple_registers_request )
> {
> VectorVal* t = new
> VectorVal(BifType::Vector::ModbusRegisters);
> @@ -501,7 +528,6 @@ refine flow ModbusTCP_Flow += {
>
> ${message.read_start_address},
>
> ${message.read_quantity},
>
> ${message.write_start_address},
> -
> ${message.write_byte_count},
>
> t);
> }
>
> @@ -511,6 +537,13 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=23
> function deliver_ReadWriteMultipleRegistersResponse(header:
> ModbusTCP_TransportHeader, message: ReadWriteMultipleRegistersResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read write multiple
> registers response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_write_multiple_registers_response )
> {
> VectorVal* t = new
> VectorVal(BifType::Vector::ModbusRegisters);
> @@ -523,7 +556,6 @@ refine flow ModbusTCP_Flow += {
>
> BifEvent::generate_modbus_read_write_multiple_registers_response(connection()->bro_analyzer(),
>
> connection()->bro_analyzer()->Conn(),
>
> HeaderToBro(header),
> -
> ${message.byte_count},
>
> t);
> }
>
> @@ -548,6 +580,13 @@ refine flow ModbusTCP_Flow += {
> # RESPONSE FC=24
> function deliver_ReadFIFOQueueResponse(header:
> ModbusTCP_TransportHeader, message: ReadFIFOQueueResponse): bool
> %{
> + if ( ${message.byte_count} % 2 != 0 )
> + {
> + connection()->bro_analyzer()->ProtocolViolation(
> + fmt("invalid value for modbus read FIFO queue
> response byte count %d", ${message.byte_count}));
> + return false;
> + }
> +
> if ( ::modbus_read_fifo_queue_response )
> {
> VectorVal* t = new VectorVal(new
> VectorType(base_type(TYPE_COUNT)));
> @@ -560,7 +599,6 @@ refine flow ModbusTCP_Flow += {
>
> BifEvent::generate_modbus_read_fifo_queue_response(connection()->bro_analyzer(),
>
> connection()->bro_analyzer()->Conn(),
>
> HeaderToBro(header),
> -
> ${message.byte_count},
> t);
> }
>
> diff --git
> a/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
>
> b/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
> index 353f85d..5bb5f1b 100644
> ---
> a/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
> +++
> b/testing/btest/Baseline/scripts.base.protocols.modbus.register_parsing/output
> @@ -1,5 +1,4 @@
> modbus_read_input_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp,
> resp_h=10.10.5.104, resp_p=502/tcp], [tid=1119, pid=0, uid=255,
> function_code=4], 900, 147
> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp,
> resp_h=10.10.5.104, resp_p=502/tcp], [tid=2606, pid=0, uid=255,
> function_code=4], [0, 0, 0, 0, 0, 0, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690], 100, 200
> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp,
> resp_h=10.10.5.104, resp_p=502/tcp], [tid=6714, pid=0, uid=255,
> function_code=4], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3840, 0, 0,
> 31, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 37, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
> 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], 64, 129
> +modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp,
> resp_h=10.10.5.104, resp_p=502/tcp], [tid=2606, pid=0, uid=255,
> function_code=4], [0, 0, 0, 0, 0, 0, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690], 100
> modbus_read_input_registers_request, [orig_h=10.1.1.234, orig_p=51411/tcp,
> resp_h=10.10.5.104, resp_p=502/tcp], [tid=12993, pid=0, uid=255,
> function_code=4], 400, 100
> -modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp,
> resp_h=10.10.5.104, resp_p=502/tcp], [tid=17667, pid=0, uid=255,
> function_code=4], [49, 18012, 51, 42, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62,
> 63, 64, 65, 66, 67, 68, 49, 50, 51, 54324, 53, 54, 55, 56, 57, 58, 59, 60,
> 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59,
> 60, 61, 69, 63, 64, 65, 66, 67, 68, 49, 189, 51, 52, 53, 54, 4151, 56, 57,
> 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 136, 49, 50, 51, 212, 53, 54, 170,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690], 100, 200
> +modbus_read_input_registers_response, [orig_h=10.1.1.234, orig_p=51411/tcp,
> resp_h=10.10.5.104, resp_p=502/tcp], [tid=17667, pid=0, uid=255,
> function_code=4], [49, 18012, 51, 42, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62,
> 63, 64, 65, 66, 67, 68, 49, 50, 51, 54324, 53, 54, 55, 56, 57, 58, 59, 60,
> 61, 62, 63, 64, 65, 66, 67, 68, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59,
> 60, 61, 69, 63, 64, 65, 66, 67, 68, 49, 189, 51, 52, 53, 54, 4151, 56, 57,
> 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 136, 49, 50, 51, 212, 53, 54, 170,
> 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690, 43690,
> 43690, 43690], 100
> diff --git a/testing/btest/scripts/base/protocols/modbus/events.bro
> b/testing/btest/scripts/base/protocols/modbus/events.bro
> index 6c47dc6..f648a0a 100644
> --- a/testing/btest/scripts/base/protocols/modbus/events.bro
> +++ b/testing/btest/scripts/base/protocols/modbus/events.bro
> @@ -41,7 +41,7 @@ event modbus_read_holding_registers_request(c: connection,
> headers: ModbusHeader
> print "modbus_read_holding_registers_request", c, headers, start_address,
> quantity;
> }
>
> -event modbus_read_holding_registers_response(c: connection, headers:
> ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_holding_registers_response(c: connection, headers:
> ModbusHeaders, registers: ModbusRegisters)
> {
> print "modbus_read_holding_registers_response", c, headers, registers;
> }
> @@ -51,7 +51,7 @@ event modbus_read_input_registers_request(c: connection,
> headers: ModbusHeaders,
> print "modbus_read_input_registers_request", c, headers, start_address,
> quantity;
> }
>
> -event modbus_read_input_registers_response(c: connection, headers:
> ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_input_registers_response(c: connection, headers:
> ModbusHeaders, registers: ModbusRegisters)
> {
> print "modbus_read_input_registers_response", c, headers, registers;
> }
> @@ -86,7 +86,7 @@ event modbus_write_multiple_coils_response(c: connection,
> headers: ModbusHeaders
> print "modbus_write_multiple_coils_response", c, headers, start_address,
> quantity;
> }
>
> -event modbus_write_multiple_registers_request(c: connection, headers:
> ModbusHeaders, start_address: count, byte_count: count, registers:
> ModbusRegisters)
> +event modbus_write_multiple_registers_request(c: connection, headers:
> ModbusHeaders, start_address: count, registers: ModbusRegisters)
> {
> print "modbus_write_multiple_registers_request", c, headers,
> start_address, registers;
> }
> @@ -126,12 +126,12 @@ event modbus_mask_write_register_response(c:
> connection, headers: ModbusHeaders,
> print "modbus_mask_write_register_response", c, headers, address,
> and_mask, or_mask;
> }
>
> -event modbus_read_write_multiple_registers_request(c: connection, headers:
> ModbusHeaders, read_start_address: count, read_quantity: count,
> write_start_address: count, write_byte_count: count, write_registers:
> ModbusRegisters)
> +event modbus_read_write_multiple_registers_request(c: connection, headers:
> ModbusHeaders, read_start_address: count, read_quantity: count,
> write_start_address: count, write_registers: ModbusRegisters)
> {
> print "modbus_read_write_multiple_registers_request", c, headers,
> read_start_address, read_quantity, write_start_address, write_registers;
> }
>
> -event modbus_read_write_multiple_registers_response(c: connection, headers:
> ModbusHeaders, byte_count: count, written_registers: ModbusRegisters)
> +event modbus_read_write_multiple_registers_response(c: connection, headers:
> ModbusHeaders, written_registers: ModbusRegisters)
> {
> print "modbus_read_write_multiple_registers_response", c, headers,
> written_registers;
> }
> @@ -141,7 +141,7 @@ event modbus_read_fifo_queue_request(c: connection,
> headers: ModbusHeaders, star
> print "modbus_read_fifo_queue_request", c, headers, start_address;
> }
>
> -event modbus_read_fifo_queue_response(c: connection, headers: ModbusHeaders,
> byte_count: count, fifos: ModbusRegisters)
> +event modbus_read_fifo_queue_response(c: connection, headers: ModbusHeaders,
> fifos: ModbusRegisters)
> {
> print "modbus_read_fifo_queue_response", c, headers, fifos;
> }
> diff --git a/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
> b/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
> index 300dd75..1641860 100644
> --- a/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
> +++ b/testing/btest/scripts/base/protocols/modbus/register_parsing.bro
> @@ -6,15 +6,16 @@
> # of register values, with the quantity being derived from a byte count value
> # that is also sent. If the byte count value is invalid (e.g. an odd value
> # might not be valid since registers must be 2-byte values), then the parser
> -# should not trigger any asserts, but the resulting event could indicate
> -# the strangeness (i.e. byte_count != 2*|registers|).
> +# should not trigger any asserts, but generate a protocol_violation (in this
> +# case TCP_ApplicationAnalyzer::ProtocolViolation asserts its behavior for
> +# incomplete connections).
>
> event modbus_read_input_registers_request(c: connection, headers:
> ModbusHeaders, start_address: count, quantity: count)
> {
> print "modbus_read_input_registers_request", c$id, headers,
> start_address, quantity;
> }
>
> -event modbus_read_input_registers_response(c: connection, headers:
> ModbusHeaders, byte_count: count, registers: ModbusRegisters)
> +event modbus_read_input_registers_response(c: connection, headers:
> ModbusHeaders, registers: ModbusRegisters)
> {
> - print "modbus_read_input_registers_response", c$id, headers, registers,
> |registers|, byte_count;
> + print "modbus_read_input_registers_response", c$id, headers, registers,
> |registers|;
> }
>
> _______________________________________________
> bro-commits mailing list
> [email protected]
> http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-commits
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
