suricata
detect-modbus.c File Reference
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-modbus.h"
#include "detect-engine-modbus.h"
#include "util-debug.h"
#include "util-byte.h"
#include "app-layer-modbus.h"
#include "stream-tcp.h"
#include "util-unittest.h"
Include dependency graph for detect-modbus.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX_UNIT_ID   "^\\s*\"?\\s*unit\\s+([<>]?\\d+)(<>\\d+)?(,\\s*(.*))?\\s*\"?\\s*$"
 Regex for parsing the Modbus unit id string. More...
 
#define PARSE_REGEX_FUNCTION   "^\\s*\"?\\s*function\\s*(!?[A-z0-9]+)(,\\s*subfunction\\s+(\\d+))?\\s*\"?\\s*$"
 Regex for parsing the Modbus function string. More...
 
#define PARSE_REGEX_ACCESS   "^\\s*\"?\\s*access\\s*(read|write)\\s*(discretes|coils|input|holding)?(,\\s*address\\s+([<>]?\\d+)(<>\\d+)?(,\\s*value\\s+([<>]?\\d+)(<>\\d+)?)?)?\\s*\"?\\s*$"
 Regex for parsing the Modbus access string. More...
 

Functions

void DetectModbusRegisterTests (void)
 this function registers unit tests for DetectModbus More...
 
void DetectModbusRegister (void)
 Registration function for Modbus keyword. More...
 

Detailed Description

Author
David DIALLO diall.nosp@m.o@et.nosp@m..esie.nosp@m.a.fr

Implements the Modbus function and access keywords You can specify a:

  • concrete function like Modbus: function 8, subfunction 4 (diagnostic: Force Listen Only Mode)
  • data (in primary table) register access (r/w) like Modbus: access read coils, address 1000 (.i.e Read coils: at address 1000)
  • write data value at specific address Modbus: access write, address 1500<>2000, value >2000 (Write multiple coils/register: at address between 1500 and 2000 value greater than 2000)

Definition in file detect-modbus.c.

Macro Definition Documentation

◆ PARSE_REGEX_ACCESS

#define PARSE_REGEX_ACCESS   "^\\s*\"?\\s*access\\s*(read|write)\\s*(discretes|coils|input|holding)?(,\\s*address\\s+([<>]?\\d+)(<>\\d+)?(,\\s*value\\s+([<>]?\\d+)(<>\\d+)?)?)?\\s*\"?\\s*$"

Regex for parsing the Modbus access string.

Definition at line 76 of file detect-modbus.c.

◆ PARSE_REGEX_FUNCTION

#define PARSE_REGEX_FUNCTION   "^\\s*\"?\\s*function\\s*(!?[A-z0-9]+)(,\\s*subfunction\\s+(\\d+))?\\s*\"?\\s*$"

Regex for parsing the Modbus function string.

Definition at line 70 of file detect-modbus.c.

◆ PARSE_REGEX_UNIT_ID

#define PARSE_REGEX_UNIT_ID   "^\\s*\"?\\s*unit\\s+([<>]?\\d+)(<>\\d+)?(,\\s*(.*))?\\s*\"?\\s*$"

Regex for parsing the Modbus unit id string.

Definition at line 64 of file detect-modbus.c.

Function Documentation

◆ DetectModbusRegister()

void DetectModbusRegister ( void  )

Registration function for Modbus keyword.

Definition at line 549 of file detect-modbus.c.

References SigTableElmt_::desc, DETECT_AL_MODBUS, SigTableElmt_::Match, SigTableElmt_::name, SCEnter, SigTableElmt_::Setup, sigmatch_table, and SigTableElmt_::url.

Referenced by SigTableSetup().

Here is the caller graph for this function:

◆ DetectModbusRegisterTests()

void DetectModbusRegisterTests ( void  )

this function registers unit tests for DetectModbus

Definition at line 982 of file detect-modbus.c.

References UtRegisterTest().

Here is the call graph for this function: