suricata
detect-modbus.c File Reference
#include "suricata-common.h"
#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-modbus.h"
#include "detect-engine-modbus.h"
#include "util-debug.h"
#include "app-layer-modbus.h"
#include "stream-tcp.h"
#include "util-unittest.h"
Include dependency graph for detect-modbus.c:

Go to the source code of this file.

Macros

#define PARSE_REGEX_UNIT_ID   "^\\s*\"?\\s*unit\\s+([<>]?\\d+)(<>\\d+)?(,\\s*(.*))?\\s*\"?\\s*$"
 Regex for parsing the Modbus unit id string. More...
 
#define PARSE_REGEX_FUNCTION   "^\\s*\"?\\s*function\\s*(!?[A-z0-9]+)(,\\s*subfunction\\s+(\\d+))?\\s*\"?\\s*$"
 Regex for parsing the Modbus function string. More...
 
#define PARSE_REGEX_ACCESS   "^\\s*\"?\\s*access\\s*(read|write)\\s*(discretes|coils|input|holding)?(,\\s*address\\s+([<>]?\\d+)(<>\\d+)?(,\\s*value\\s+([<>]?\\d+)(<>\\d+)?)?)?\\s*\"?\\s*$"
 Regex for parsing the Modbus access string. More...
 
#define MAX_SUBSTRINGS   30
 

Functions

void DetectModbusRegisterTests (void)
 this function registers unit tests for DetectModbus More...
 
void DetectModbusRegister (void)
 Registration function for Modbus keyword. More...
 

Detailed Description

Author
David DIALLO diall.nosp@m.o@et.nosp@m..esie.nosp@m.a.fr

Implements the Modbus function and access keywords You can specify a:

  • concrete function like Modbus: function 8, subfunction 4 (diagnostic: Force Listen Only Mode)
  • data (in primary table) register access (r/w) like Modbus: access read coils, address 1000 (.i.e Read coils: at address 1000)
  • write data value at specific address Modbus: access write, address 1500<>2000, value >2000 (Write multiple coils/register: at address between 1500 and 2000 value greater than 2000)

Definition in file detect-modbus.c.

Macro Definition Documentation

#define MAX_SUBSTRINGS   30

Definition at line 82 of file detect-modbus.c.

#define PARSE_REGEX_ACCESS   "^\\s*\"?\\s*access\\s*(read|write)\\s*(discretes|coils|input|holding)?(,\\s*address\\s+([<>]?\\d+)(<>\\d+)?(,\\s*value\\s+([<>]?\\d+)(<>\\d+)?)?)?\\s*\"?\\s*$"

Regex for parsing the Modbus access string.

Definition at line 76 of file detect-modbus.c.

Referenced by DetectModbusRegister().

#define PARSE_REGEX_FUNCTION   "^\\s*\"?\\s*function\\s*(!?[A-z0-9]+)(,\\s*subfunction\\s+(\\d+))?\\s*\"?\\s*$"

Regex for parsing the Modbus function string.

Definition at line 69 of file detect-modbus.c.

Referenced by DetectModbusRegister().

#define PARSE_REGEX_UNIT_ID   "^\\s*\"?\\s*unit\\s+([<>]?\\d+)(<>\\d+)?(,\\s*(.*))?\\s*\"?\\s*$"

Regex for parsing the Modbus unit id string.

Definition at line 62 of file detect-modbus.c.

Referenced by DetectModbusRegister().

Function Documentation

void DetectModbusRegisterTests ( void  )

this function registers unit tests for DetectModbus

Definition at line 950 of file detect-modbus.c.

References UtRegisterTest().

Referenced by DetectModbusRegister().

Here is the call graph for this function:

Here is the caller graph for this function: