Detect-engine: Add Modbus detection engine

Management of Modbus Tx

Based on DNS source code.

Signed-off-by: David DIALLO <diallo@et.esia.fr>

src/Makefile.am

@@ -92,6 +92,7 @@ detect-engine.c detect-engine.h \
 detect-engine-content-inspection.c detect-engine-content-inspection.h \
 detect-engine-dcepayload.c detect-engine-dcepayload.h \
 detect-engine-dns.c detect-engine-dns.h \
+detect-engine-modbus.c detect-engine-modbus.h \
 detect-engine-event.c detect-engine-event.h \
 detect-engine-file.c detect-engine-file.h \
 detect-engine-hcbd.c detect-engine-hcbd.h \

src/detect-engine-modbus.h

@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2014 ANSSI
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
+ * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/** \file
+ *
+ *  \author David DIALLO <diallo@et.esiea.fr>
+ */
+
+#ifndef __DETECT_ENGINE_MODBUS_H__
+#define __DETECT_ENGINE_MODBUS_H__
+
+int DetectEngineInspectModbus(ThreadVars *, DetectEngineCtx *de_ctx,
+                              DetectEngineThreadCtx *, Signature *,
+                              Flow *, uint8_t, void *, void *, uint64_t);
+
+void DetectEngineInspectModbusRegisterTests(void);
+#endif /* __DETECT_ENGINE_MODBUS_H__ */

src/detect-engine-state.h

@@ -76,6 +76,7 @@
 #define DE_STATE_FLAG_SIG_CANT_MATCH      (1 << 16)
 #define DE_STATE_FLAG_DNSQUERY_INSPECT    (1 << 17)
 #define DE_STATE_FLAG_APP_EVENT_INSPECT   (1 << 18)
+#define DE_STATE_FLAG_MODBUS_INSPECT	  (1 << 19)
 
 /* state flags */
 #define DETECT_ENGINE_STATE_FLAG_FILE_STORE_DISABLED 0x0001

src/detect-engine.c

@@ -59,6 +59,7 @@
 #include "detect-engine-hrhhd.h"
 #include "detect-engine-file.h"
 #include "detect-engine-dns.h"
+#include "detect-engine-modbus.h"
 
 #include "detect-engine.h"
 #include "detect-engine-state.h"
@@ -254,6 +255,14 @@ void DetectEngineRegisterAppInspectionEngines(void)
           DE_STATE_FLAG_FILE_TS_INSPECT,
           0,
           DetectFileInspectSmtp },
+        /* Modbus */
+        { IPPROTO_TCP,
+          ALPROTO_MODBUS,
+          DETECT_SM_LIST_MODBUS_MATCH,
+          DE_STATE_FLAG_MODBUS_INSPECT,
+          DE_STATE_FLAG_MODBUS_INSPECT,
+          0,
+          DetectEngineInspectModbus },
     };
 
     struct tmp_t data_toclient[] = {
@@ -305,7 +314,15 @@ void DetectEngineRegisterAppInspectionEngines(void)
           DE_STATE_FLAG_HSCD_INSPECT,
           DE_STATE_FLAG_HSCD_INSPECT,
           1,
-          DetectEngineInspectHttpStatCode }
+          DetectEngineInspectHttpStatCode },
+        /* Modbus */
+        { IPPROTO_TCP,
+          ALPROTO_MODBUS,
+          DETECT_SM_LIST_MODBUS_MATCH,
+          DE_STATE_FLAG_MODBUS_INSPECT,
+          DE_STATE_FLAG_MODBUS_INSPECT,
+          0,
+          DetectEngineInspectModbus }
     };
 
     size_t i;

src/runmode-unittests.c

@@ -50,6 +50,7 @@
 #include "detect-engine-hrhhd.h"
 #include "detect-engine-state.h"
 #include "detect-engine-tag.h"
+#include "detect-engine-modbus.h"
 #include "detect-fast-pattern.h"
 #include "flow.h"
 #include "flow-timeout.h"
@@ -249,6 +250,7 @@ void RunUnittests(int list_unittests, char *regex_arg)
     DetectEngineHttpUARegisterTests();
     DetectEngineHttpHHRegisterTests();
     DetectEngineHttpHRHRegisterTests();
+    DetectEngineInspectModbusRegisterTests();
     DetectEngineRegisterTests();
     SCLogRegisterTests();
     MagicRegisterTests();