bro-script: Add more advanced implementation

Add a more advanced Bro script implementation that outputs the address
and the register value, one line per address.  This approach also
suffers from the connection assumption described for pasad-simple and
contains no sanity checks at all.

1 files changed, 46 insertions, 0 deletions

diff --git a/bro-script/pasad-parsed.bro b/bro-script/pasad-parsed.bro
new file mode 100644
index 0000000..7fcc905
--- /dev/null
+++ b/bro-script/pasad-parsed.bro
@@ -0,0 +1,46 @@
+## Implementation that outputs pairs of register IDs and values.
+## Otherwise, the same restrictions as with pasad-simple apply.  Additionally,
+## the correct register count is not checked and might lead to indexing errors.
+
+module Pasad;
+
+export {
+	redef enum Log::ID += { LOG };
+
+	type Info: record {
+		start_address:	count	&log;
+		quantity:	count	&log;
+	};
+
+	type Entry: record {
+		address:	count &log;
+		register:	count &log;
+	};
+}
+
+redef record connection += {
+	pasad: Info &optional;
+};
+
+event bro_init() &priority=5
+	{
+	Log::create_stream(Pasad::LOG, [$columns=Entry, $path="pasad-parsed"]);
+	}
+
+event modbus_read_holding_registers_request(c: connection, headers: ModbusHeaders, start_address: count, quantity: count)
+	{
+	c$pasad = [$start_address=start_address, $quantity=quantity];
+	}
+
+event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
+	{
+		local i = 0;
+		while ( i < c$pasad$quantity )
+			{
+			local address = c$pasad$start_address + i;
+			local mb_register = registers[i];
+			local entry  = Entry($address=address, $register=mb_register);
+			Log::write(Pasad::LOG, entry);
+			++i;
+			}
+	}