From 014fbab3ef87b8e71444431796ac7ac9b84dee83 Mon Sep 17 00:00:00 2001
From: Robin Krahl <guskraro@student.gu.se>
Date: Wed, 4 Oct 2017 14:51:12 +0200
Subject: broevent: Combine the pasad-parsed script with midbro

---
 broccoli/script/modbus.bro | 90 +++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 81 insertions(+), 9 deletions(-)

(limited to 'broccoli/script/modbus.bro')

diff --git a/broccoli/script/modbus.bro b/broccoli/script/modbus.bro
index a2caed9..813bf9c 100644
--- a/broccoli/script/modbus.bro
+++ b/broccoli/script/modbus.bro
@@ -1,26 +1,98 @@
 @load frameworks/communication/listen
+
 module Pasad;
 
 redef Communication::listen_port = 47760/tcp;
 
 redef Communication::listen_ssl = F;
 
-global response: event(register: count, uid: count);
+## DATA STRUCTURES
+
+export {
+    redef enum Log::ID += { LOG };
+
+    type Transaction: record {
+        start_address:  count;
+        quantity:   count;
+    };
+
+    type TransactionTable: table[count] of Transaction;
+
+    type Info: record {
+        transactions:   TransactionTable    &default=TransactionTable();
+    };
+
+    type RegisterData: record {
+        ip:         addr    &log;
+        uid:        count   &log;
+        regtype:    string  &log;
+        address:    count   &log;
+        register:   count   &log;
+    };
+}
+
+redef record connection += {
+    pasad: Info &default=Info();
+};
 
 redef Communication::nodes += {
-	["broevent"] = [$host = 127.0.0.1, $events = /broevent/, $connect=F, $ssl=F]
+    ["pasad"] = [$host = 127.0.0.1, $events = /pasad/, $connect=F, $ssl=F]
 };
 
-event modbus_read_holding_registers_request(c: connection, headers: ModbusHeaders, start_adress: count, quantity: count)
+## CUSTOM EVENTS
 
-{
-    print fmt("Request: %d", quantity);
+event pasad_register_received(data: RegisterData) {
+    Log::write(Pasad::LOG, data);
+    print fmt("Received address=%d, register=%d", data$address, data$register);
 }
 
-event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
+event pasad_unmatched_response(tid: count) {
+    print fmt("Unmatched response: tid=%d", tid);
+}
+
+## CUSTOM FUNCTIONS
+
+function pasad_generate_events(transaction: Transaction, c: connection,
+        headers: ModbusHeaders, registers: ModbusRegisters, regtype: string) {
+    # TODO: check registers size
+    local i = 0;
+    while (i < transaction$quantity) {
+        local data = RegisterData(
+                $ip=c$id$orig_h,
+                $uid=headers$uid,
+                $regtype=regtype,
+                $address=transaction$start_address + i,
+                $register=registers[i]
+        );
+        event pasad_register_received(data);
+        ++i;
+    }
+}
 
-{
-    print fmt("Response: %d", registers[0]);
-    event response(registers[0],headers$uid);
+## EVENT HANDLERS
+
+event bro_init() &priority=5 {
+    Log::create_stream(Pasad::LOG, [$columns=RegisterData, $path="pasad-parsed"]);
+}
+
+event modbus_read_holding_registers_request(c: connection,
+        headers: ModbusHeaders, start_address: count, quantity: count) {
+    local tid = headers$tid;
+    local transaction = Transaction(
+            $start_address=start_address,
+            $quantity=quantity
+    );
+    c$pasad$transactions[tid] = transaction;
 }
 
+event modbus_read_holding_registers_response(c: connection,
+        headers: ModbusHeaders, registers: ModbusRegisters) {
+    local tid = headers$tid;
+    if (tid !in c$pasad$transactions) {
+        event pasad_unmatched_response(tid);
+        return;
+    }
+    local transaction = c$pasad$transactions[tid];
+    delete c$pasad$transactions[tid];
+    pasad_generate_events(transaction, c, headers, registers, "h");
+}
-- 
cgit v1.2.1