/*

 * Copyright (C) 2014 ANSSI

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 * 3. The name of the author may not be used to endorse or promote products

 *    derived from this software without specific prior written permission.

 *

 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,

 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY

 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL

 * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;

 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,

 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR

 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF

 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

/**

 * \file

 *

 * \author David DIALLO <diallo@et.esiea.fr>

 *

 * App-layer parser for Modbus protocol

 *

 */

#include "suricata-common.h"

#include "util-debug.h"

#include "app-layer-parser.h"

#include "app-layer-modbus.h"

void ModbusParserRegisterTests(void);

/**

 * \brief Function to register the Modbus protocol parser

 */

void RegisterModbusParsers(void)

{

    rs_modbus_register_parser();

#ifdef UNITTESTS

    AppLayerParserRegisterProtocolUnittests(IPPROTO_TCP, ALPROTO_MODBUS, ModbusParserRegisterTests);

#endif

    SCReturn;

}

/* UNITTESTS */

#ifdef UNITTESTS

#include "detect.h"

#include "detect-engine.h"

#include "detect-parse.h"

#include "detect-engine-build.h"

#include "detect-engine-alert.h"

#include "flow-util.h"

#include "util-unittest.h"

#include "util-unittest-helper.h"

#include "stream-tcp.h"

#include "stream-tcp-private.h"

#include "rust.h"

/* Modbus default stream reassembly depth */

#define MODBUS_CONFIG_DEFAULT_STREAM_DEPTH 0

/* Modbus Application Protocol Specification V1.1b3 6.1: Read Coils */

static uint8_t invalidFunctionCode[] = {

    /* Transaction ID */ 0x00, 0x00,

    /* Protocol ID */ 0x00, 0x00,

    /* Length */ 0x00, 0x02,

    /* Unit ID */ 0x00,

    /* Function code */ 0x00

};

/* Modbus Application Protocol Specification V1.1b3 6.1: Read Coils */

/* Example of a request to read discrete outputs 20-38 */

static uint8_t readCoilsReq[] = {/* Transaction ID */    0x00, 0x00,

                                 /* Protocol ID */       0x00, 0x00,

                                 /* Length */            0x00, 0x06,

                                 /* Unit ID */           0x00,

                                 /* Function code */     0x01,

                                 /* Starting Address */  0x78, 0x90,

                                 /* Quantity of coils */ 0x00, 0x13 };

static uint8_t readCoilsRsp[] = {/* Transaction ID */    0x00, 0x00,

                                 /* Protocol ID */       0x00, 0x00,

                                 /* Length */            0x00, 0x06,

                                 /* Unit ID */           0x00,

                                 /* Function code */     0x01,

                                 /* Byte count */        0x03,

                                 /* Coil Status */       0xCD, 0x6B, 0x05 };

static uint8_t readCoilsErrorRsp[] = {

    /* Transaction ID */ 0x00, 0x00,

    /* Protocol ID */ 0x00, 0x00,

    /* Length */ 0x00, 0x03,

    /* Unit ID */ 0x00,

    /* Function code */ 0x81,

    /* Invalid Exception code: should trigger the InvalidExceptionCode ModbusEvent */

    0xFF

};

/* Modbus Application Protocol Specification V1.1b3 6.6: Write Single register */

/* Example of a request to write register 2 to 00 03 hex */

static uint8_t writeSingleRegisterReq[] = {/* Transaction ID */     0x00, 0x0A,

                                           /* Protocol ID */        0x00, 0x00,

                                           /* Length */             0x00, 0x06,

                                           /* Unit ID */            0x00,

                                           /* Function code */      0x06,

                                           /* Register Address */   0x00, 0x01,

                                           /* Register Value */     0x00, 0x03};

static uint8_t invalidWriteSingleRegisterReq[] = {/* Transaction ID */      0x00, 0x0A,

                                                  /* Protocol ID */         0x00, 0x00,

                                                  /* Length */              0x00, 0x04,

                                                  /* Unit ID */             0x00,

                                                  /* Function code */       0x06,

                                                  /* Register Address */    0x00, 0x01};

static uint8_t writeSingleRegisterRsp[] = {/* Transaction ID */         0x00, 0x0A,

                                           /* Protocol ID */            0x00, 0x00,

                                           /* Length */                 0x00, 0x06,

                                           /* Unit ID */                0x00,

                                           /* Function code */          0x06,

                                           /* Register Address */       0x00, 0x01,

                                           /* Register Value */         0x00, 0x03};

/* Modbus Application Protocol Specification V1.1b3 6.12: Write Multiple registers */

/* Example of a request to write two registers starting at 2 to 00 0A and 01 02 hex */

static uint8_t writeMultipleRegistersReq[] = {/* Transaction ID */          0x00, 0x0A,

                                              /* Protocol ID */             0x00, 0x00,

                                              /* Length */                  0x00, 0x0B,

                                              /* Unit ID */                 0x00,

                                              /* Function code */           0x10,

                                              /* Starting Address */        0x00, 0x01,

                                              /* Quantity of Registers */   0x00, 0x02,

                                              /* Byte count */              0x04,

                                              /* Registers Value */         0x00, 0x0A,

                                                                            0x01, 0x02};

static uint8_t writeMultipleRegistersRsp[] = {/* Transaction ID */          0x00, 0x0A,

                                              /* Protocol ID */             0x00, 0x00,

                                              /* Length */                  0x00, 0x06,

                                              /* Unit ID */                 0x00,

                                              /* Function code */           0x10,

                                              /* Starting Address */        0x00, 0x01,

                                              /* Quantity of Registers */   0x00, 0x02};

/* Modbus Application Protocol Specification V1.1b3 6.16: Mask Write Register */

/* Example of a request to mask write to register 5 */

static uint8_t maskWriteRegisterReq[] = {/* Transaction ID */       0x00, 0x0A,

                                         /* Protocol ID */          0x00, 0x00,

                                         /* Length */               0x00, 0x08,

                                         /* Unit ID */              0x00,

                                         /* Function code */        0x16,

                                         /* Reference Address */    0x00, 0x04,

                                         /* And_Mask */             0x00, 0xF2,

                                         /* Or_Mask */              0x00, 0x25};

static uint8_t invalidMaskWriteRegisterReq[] = {/* Transaction ID */    0x00, 0x0A,

                                                /* Protocol ID */       0x00, 0x00,

                                                /* Length */            0x00, 0x06,

                                                /* Unit ID */           0x00,

                                                /* Function code */     0x16,

                                                /* Reference Address */ 0x00, 0x04,

                                                /* And_Mask */          0x00, 0xF2};

static uint8_t maskWriteRegisterRsp[] = {/* Transaction ID */       0x00, 0x0A,

                                         /* Protocol ID */          0x00, 0x00,

                                         /* Length */               0x00, 0x08,

                                         /* Unit ID */              0x00,

                                         /* Function code */        0x16,

                                         /* Reference Address */    0x00, 0x04,

                                         /* And_Mask */             0x00, 0xF2,

                                         /* Or_Mask */              0x00, 0x25};

/* Modbus Application Protocol Specification V1.1b3 6.17: Read/Write Multiple registers */

/* Example of a request to read six registers starting at register 4, */

/* and to write three registers starting at register 15 */

static uint8_t readWriteMultipleRegistersReq[] = {/* Transaction ID */          0x12, 0x34,

                                                  /* Protocol ID */             0x00, 0x00,

                                                  /* Length */                  0x00, 0x11,

                                                  /* Unit ID */                 0x00,

                                                  /* Function code */           0x17,

                                                  /* Read Starting Address */   0x00, 0x03,

                                                  /* Quantity to Read */        0x00, 0x06,

                                                  /* Write Starting Address */  0x00, 0x0E,

                                                  /* Quantity to Write */       0x00, 0x03,

                                                  /* Write Byte count */        0x06,

                                                  /* Write Registers Value */   0x12, 0x34,

                                                                                0x56, 0x78,

                                                                                0x9A, 0xBC};

/* Mismatch value in Byte count 0x0B instead of 0x0C */

static uint8_t readWriteMultipleRegistersRsp[] = {/* Transaction ID */          0x12, 0x34,

                                                  /* Protocol ID */             0x00, 0x00,

                                                  /* Length */                  0x00, 0x0E,

                                                  /* Unit ID */                 0x00,

                                                  /* Function code */           0x17,

                                                  /* Byte count */              0x0B,

                                                  /* Read Registers Value */    0x00, 0xFE,

                                                                                0x0A, 0xCD,

                                                                                0x00, 0x01,

                                                                                0x00, 0x03,

                                                                                0x00, 0x0D,

                                                                                0x00};

/* Modbus Application Protocol Specification V1.1b3 6.8.1: 04 Force Listen Only Mode */

/* Example of a request to to remote device to its Listen Only Mode for Modbus Communications. */

static uint8_t forceListenOnlyMode[] = {/* Transaction ID */     0x0A, 0x00,

                                        /* Protocol ID */        0x00, 0x00,

                                        /* Length */             0x00, 0x06,

                                        /* Unit ID */            0x00,

                                        /* Function code */      0x08,

                                        /* Sub-function code */  0x00, 0x04,

                                        /* Data */               0x00, 0x00};

static uint8_t invalidProtocolIdReq[] = {/* Transaction ID */    0x00, 0x00,

                                         /* Protocol ID */       0x00, 0x01,

                                         /* Length */            0x00, 0x06,

                                         /* Unit ID */           0x00,

                                         /* Function code */     0x01,

                                         /* Starting Address */  0x78, 0x90,

                                         /* Quantity of coils */ 0x00, 0x13 };

static uint8_t invalidLengthWriteMultipleRegistersReq[] = {

                                              /* Transaction ID */          0x00, 0x0A,

                                              /* Protocol ID */             0x00, 0x00,

                                              /* Length */                  0x00, 0x09,

                                              /* Unit ID */                 0x00,

                                              /* Function code */           0x10,

                                              /* Starting Address */        0x00, 0x01,

                                              /* Quantity of Registers */   0x00, 0x02,

                                              /* Byte count */              0x04,

                                              /* Registers Value */         0x00, 0x0A,

                                                                            0x01, 0x02};

static uint8_t exceededLengthWriteMultipleRegistersReq[] = {

                                              /* Transaction ID */          0x00, 0x0A,

                                              /* Protocol ID */             0x00, 0x00,

                                              /* Length */                  0xff, 0xfa,

                                              /* Unit ID */                 0x00,

                                              /* Function code */           0x10,

                                              /* Starting Address */        0x00, 0x01,

                                              /* Quantity of Registers */   0x7f, 0xf9,

                                              /* Byte count */              0xff};

static uint8_t invalidLengthPDUWriteMultipleRegistersReq[] = {

                                              /* Transaction ID */          0x00, 0x0A,

                                              /* Protocol ID */             0x00, 0x00,

                                              /* Length */                  0x00, 0x02,

                                              /* Unit ID */                 0x00,

                                              /* Function code */           0x10};

/** \test Send Modbus Read Coils request/response. */

static int ModbusParserTest01(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    Flow f;

    TcpSession ssn;

    FAIL_IF_NULL(alp_tctx);

    memset(&f, 0, sizeof(f));

    memset(&ssn, 0, sizeof(ssn));

    FLOW_INITIALIZE(&f);

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    StreamTcpInitConfig(true);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, readCoilsReq,

                                sizeof(readCoilsReq));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 0);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 1);

    FAIL_IF_NOT(rs_modbus_message_get_read_request_address(&request) == 0x7890);

    FAIL_IF_NOT(rs_modbus_message_get_read_request_quantity(&request) == 19);

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOCLIENT, readCoilsRsp,

                            sizeof(readCoilsRsp));

    FAIL_IF_NOT(r == 0);

    FAIL_IF_NOT(rs_modbus_state_get_tx_count(modbus_state) == 1);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    PASS;

}

/** \test Send Modbus Write Multiple registers request/response. */

static int ModbusParserTest02(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    Flow f;

    TcpSession ssn;

    FAIL_IF_NULL(alp_tctx);

    memset(&f, 0, sizeof(f));

    memset(&ssn, 0, sizeof(ssn));

    FLOW_INITIALIZE(&f);

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    StreamTcpInitConfig(true);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, writeMultipleRegistersReq,

                                sizeof(writeMultipleRegistersReq));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 0);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 16);

    FAIL_IF_NOT(rs_modbus_message_get_write_multreq_address(&request) == 0x01);

    FAIL_IF_NOT(rs_modbus_message_get_write_multreq_quantity(&request) == 2);

    size_t data_len;

    const uint8_t *data = rs_modbus_message_get_write_multreq_data(&request, &data_len);

    FAIL_IF_NOT(data_len == 4);

    FAIL_IF_NOT(data[0] == 0x00);

    FAIL_IF_NOT(data[1] == 0x0A);

    FAIL_IF_NOT(data[2] == 0x01);

    FAIL_IF_NOT(data[3] == 0x02);

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOCLIENT, writeMultipleRegistersRsp,

                            sizeof(writeMultipleRegistersRsp));

    FAIL_IF_NOT(r == 0);

    FAIL_IF_NOT(rs_modbus_state_get_tx_count(modbus_state) == 1);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    PASS;

}

/** \test Send Modbus Read/Write Multiple registers request/response with mismatch value. */

static int ModbusParserTest03(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    DetectEngineThreadCtx *det_ctx = NULL;

    Flow f;

    Packet *p = NULL;

    Signature *s = NULL;

    TcpSession ssn;

    ThreadVars tv;

    FAIL_IF_NULL(alp_tctx);

    memset(&tv, 0, sizeof(ThreadVars));

    memset(&f, 0, sizeof(Flow));

    memset(&ssn, 0, sizeof(TcpSession));

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

    FLOW_INITIALIZE(&f);

    f.alproto   = ALPROTO_MODBUS;

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    f.flags     |= FLOW_IPV4;

    p->flow         = &f;

    p->flags        |= PKT_HAS_FLOW | PKT_STREAM_EST;

    p->flowflags    |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;

    StreamTcpInitConfig(true);

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

    FAIL_IF_NULL(de_ctx);

    de_ctx->flags |= DE_QUIET;

    s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any "

                                      "(msg:\"Modbus Data mismatch\"; "

                                      "app-layer-event: "

                                      "modbus.value_mismatch; "

                                      "sid:1;)");

    FAIL_IF_NULL(s);

    SigGroupBuild(de_ctx);

    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER,

                                readWriteMultipleRegistersReq,

                                sizeof(readWriteMultipleRegistersReq));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 0);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 23);

    FAIL_IF_NOT(rs_modbus_message_get_rw_multreq_read_address(&request) == 0x03);

    FAIL_IF_NOT(rs_modbus_message_get_rw_multreq_read_quantity(&request) == 6);

    FAIL_IF_NOT(rs_modbus_message_get_rw_multreq_write_address(&request) == 0x0E);

    FAIL_IF_NOT(rs_modbus_message_get_rw_multreq_write_quantity(&request) == 3);

    size_t data_len;

    uint8_t const *data = rs_modbus_message_get_rw_multreq_write_data(&request, &data_len);

    FAIL_IF_NOT(data_len == 6);

    FAIL_IF_NOT(data[0] == 0x12);

    FAIL_IF_NOT(data[1] == 0x34);

    FAIL_IF_NOT(data[2] == 0x56);

    FAIL_IF_NOT(data[3] == 0x78);

    FAIL_IF_NOT(data[4] == 0x9A);

    FAIL_IF_NOT(data[5] == 0xBC);

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOCLIENT, readWriteMultipleRegistersRsp,

                            sizeof(readWriteMultipleRegistersRsp));

    FAIL_IF_NOT(r == 0);

    FAIL_IF_NOT(rs_modbus_state_get_tx_count(modbus_state) == 1);

    /* do detect */

    SigMatchSignatures(&tv, de_ctx, det_ctx, p);

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

    SigGroupCleanup(de_ctx);

    SigCleanSignatures(de_ctx);

    DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);

    DetectEngineCtxFree(de_ctx);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    UTHFreePackets(&p, 1);

    PASS;

}

/** \test Send Modbus Force Listen Only Mode request. */

static int ModbusParserTest04(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    Flow f;

    TcpSession ssn;

    FAIL_IF_NULL(alp_tctx);

    memset(&f, 0, sizeof(f));

    memset(&ssn, 0, sizeof(ssn));

    FLOW_INITIALIZE(&f);

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    StreamTcpInitConfig(true);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, forceListenOnlyMode,

                                sizeof(forceListenOnlyMode));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 0);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 8);

    FAIL_IF_NOT(rs_modbus_message_get_subfunction(&request) == 4);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    PASS;

}

/** \test Send Modbus invalid Protocol version in request. */

static int ModbusParserTest05(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    DetectEngineThreadCtx *det_ctx = NULL;

    Flow f;

    Packet *p = NULL;

    Signature *s = NULL;

    TcpSession ssn;

    ThreadVars tv;

    FAIL_IF_NULL(alp_tctx);

    memset(&tv, 0, sizeof(ThreadVars));

    memset(&f, 0, sizeof(Flow));

    memset(&ssn, 0, sizeof(TcpSession));

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

    FLOW_INITIALIZE(&f);

    f.alproto   = ALPROTO_MODBUS;

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    f.flags     |= FLOW_IPV4;

    p->flow         = &f;

    p->flags        |= PKT_HAS_FLOW | PKT_STREAM_EST;

    p->flowflags    |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;

    StreamTcpInitConfig(true);

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

    FAIL_IF_NULL(de_ctx);

    de_ctx->flags |= DE_QUIET;

    s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any "

                                      "(msg:\"Modbus invalid Protocol version\"; "

                                      "app-layer-event: "

                                      "modbus.invalid_protocol_id; "

                                      "sid:1;)");

    FAIL_IF_NULL(s);

    SigGroupBuild(de_ctx);

    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, invalidProtocolIdReq,

                                sizeof(invalidProtocolIdReq));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    /* do detect */

    SigMatchSignatures(&tv, de_ctx, det_ctx, p);

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

    SigGroupCleanup(de_ctx);

    SigCleanSignatures(de_ctx);

    DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);

    DetectEngineCtxFree(de_ctx);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    UTHFreePackets(&p, 1);

    PASS;

}

/** \test Send Modbus unsolicited response. */

static int ModbusParserTest06(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    DetectEngineThreadCtx *det_ctx = NULL;

    Flow f;

    Packet *p = NULL;

    Signature *s = NULL;

    TcpSession ssn;

    ThreadVars tv;

    FAIL_IF_NULL(alp_tctx);

    memset(&tv, 0, sizeof(ThreadVars));

    memset(&f, 0, sizeof(Flow));

    memset(&ssn, 0, sizeof(TcpSession));

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

    FLOW_INITIALIZE(&f);

    f.alproto   = ALPROTO_MODBUS;

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    f.flags     |= FLOW_IPV4;

    p->flow         = &f;

    p->flags        |= PKT_HAS_FLOW | PKT_STREAM_EST;

    p->flowflags    |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;

    StreamTcpInitConfig(true);

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

    FAIL_IF_NULL(de_ctx);

    de_ctx->flags |= DE_QUIET;

    s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any "

                                      "(msg:\"Modbus unsolicited response\"; "

                                      "app-layer-event: "

                                      "modbus.unsolicited_response; "

                                      "sid:1;)");

    FAIL_IF_NULL(s);

    SigGroupBuild(de_ctx);

    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOCLIENT, readCoilsRsp,

                                sizeof(readCoilsRsp));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    /* do detect */

    SigMatchSignatures(&tv, de_ctx, det_ctx, p);

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

    SigGroupCleanup(de_ctx);

    SigCleanSignatures(de_ctx);

    DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);

    DetectEngineCtxFree(de_ctx);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    UTHFreePackets(&p, 1);

    PASS;

}

/** \test Send Modbus invalid Length request. */

static int ModbusParserTest07(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    DetectEngineThreadCtx *det_ctx = NULL;

    Flow f;

    Packet *p = NULL;

    Signature *s = NULL;

    TcpSession ssn;

    ThreadVars tv;

    FAIL_IF_NULL(alp_tctx);

    memset(&tv, 0, sizeof(ThreadVars));

    memset(&f, 0, sizeof(Flow));

    memset(&ssn, 0, sizeof(TcpSession));

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

    FLOW_INITIALIZE(&f);

    f.alproto   = ALPROTO_MODBUS;

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    f.flags     |= FLOW_IPV4;

    p->flow         = &f;

    p->flags        |= PKT_HAS_FLOW | PKT_STREAM_EST;

    p->flowflags    |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;

    StreamTcpInitConfig(true);

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

    FAIL_IF_NULL(de_ctx);

    de_ctx->flags |= DE_QUIET;

    s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any "

                                      "(msg:\"Modbus invalid Length\"; "

                                      "app-layer-event: "

                                      "modbus.invalid_length; "

                                      "sid:1;)");

    FAIL_IF_NULL(s);

    SigGroupBuild(de_ctx);

    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER,

                                invalidLengthWriteMultipleRegistersReq,

                                sizeof(invalidLengthWriteMultipleRegistersReq));

    FAIL_IF_NOT(r == 1);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    /* do detect */

    SigMatchSignatures(&tv, de_ctx, det_ctx, p);

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

    SigGroupCleanup(de_ctx);

    SigCleanSignatures(de_ctx);

    DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);

    DetectEngineCtxFree(de_ctx);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    UTHFreePackets(&p, 1);

    PASS;

}

/** \test Send Modbus Read Coils request and error response with Exception code invalid. */

static int ModbusParserTest08(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    DetectEngineThreadCtx *det_ctx = NULL;

    Flow f;

    Packet *p = NULL;

    Signature *s = NULL;

    TcpSession ssn;

    ThreadVars tv;

    FAIL_IF_NULL(alp_tctx);

    memset(&tv, 0, sizeof(ThreadVars));

    memset(&f, 0, sizeof(Flow));

    memset(&ssn, 0, sizeof(TcpSession));

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

    FLOW_INITIALIZE(&f);

    f.alproto   = ALPROTO_MODBUS;

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    f.flags     |= FLOW_IPV4;

    p->flow         = &f;

    p->flags        |= PKT_HAS_FLOW | PKT_STREAM_EST;

    p->flowflags    |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;

    StreamTcpInitConfig(true);

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

    FAIL_IF_NULL(de_ctx);

    de_ctx->flags |= DE_QUIET;

    s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any "

                                      "(msg:\"Modbus Exception code invalid\"; "

                                      "app-layer-event: "

                                      "modbus.invalid_exception_code; "

                                      "sid:1;)");

    FAIL_IF_NULL(s);

    SigGroupBuild(de_ctx);

    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, readCoilsReq,

                                sizeof(readCoilsReq));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 0);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 1);

    FAIL_IF_NOT(rs_modbus_message_get_read_request_address(&request) == 0x7890);

    FAIL_IF_NOT(rs_modbus_message_get_read_request_quantity(&request) == 19);

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOCLIENT, readCoilsErrorRsp,

                            sizeof(readCoilsErrorRsp));

    FAIL_IF_NOT(r == 0);

    FAIL_IF_NOT(rs_modbus_state_get_tx_count(modbus_state) == 1);

    /* do detect */

    SigMatchSignatures(&tv, de_ctx, det_ctx, p);

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

    SigGroupCleanup(de_ctx);

    SigCleanSignatures(de_ctx);

    DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);

    DetectEngineCtxFree(de_ctx);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    UTHFreePackets(&p, 1);

    PASS;

}

/** \test Modbus fragmentation - 1 ADU over 2 TCP packets. */

static int ModbusParserTest09(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    Flow f;

    TcpSession ssn;

    uint32_t    input_len = sizeof(readCoilsReq), part2_len = 3;

    uint8_t     *input = readCoilsReq;

    FAIL_IF_NULL(alp_tctx);

    memset(&f, 0, sizeof(f));

    memset(&ssn, 0, sizeof(ssn));

    FLOW_INITIALIZE(&f);

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    StreamTcpInitConfig(true);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, input, input_len - part2_len);

    FAIL_IF_NOT(r == 1);

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOSERVER, input, input_len);

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 0);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 1);

    FAIL_IF_NOT(rs_modbus_message_get_read_request_address(&request) == 0x7890);

    FAIL_IF_NOT(rs_modbus_message_get_read_request_quantity(&request) == 19);

    input_len = sizeof(readCoilsRsp);

    part2_len = 10;

    input = readCoilsRsp;

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOCLIENT, input, input_len - part2_len);

    FAIL_IF_NOT(r == 1);

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOCLIENT, input, input_len);

    FAIL_IF_NOT(r == 0);

    FAIL_IF_NOT(rs_modbus_state_get_tx_count(modbus_state) == 1);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    PASS;

}

/** \test Modbus fragmentation - 2 ADU in 1 TCP packet. */

static int ModbusParserTest10(void) {

    uint32_t    input_len = sizeof(readCoilsReq) + sizeof(writeMultipleRegistersReq);

    uint8_t     *input, *ptr;

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    Flow f;

    TcpSession ssn;

    FAIL_IF_NULL(alp_tctx);

    input  = (uint8_t *) SCMalloc (input_len * sizeof(uint8_t));

    FAIL_IF_NULL(input);

    memcpy(input, readCoilsReq, sizeof(readCoilsReq));

    memcpy(input + sizeof(readCoilsReq), writeMultipleRegistersReq, sizeof(writeMultipleRegistersReq));

    memset(&f, 0, sizeof(f));

    memset(&ssn, 0, sizeof(ssn));

    FLOW_INITIALIZE(&f);

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    StreamTcpInitConfig(true);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, input, input_len);

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    FAIL_IF_NOT(rs_modbus_state_get_tx_count(modbus_state) == 2);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 1);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 16);

    FAIL_IF_NOT(rs_modbus_message_get_write_multreq_address(&request) == 0x01);

    FAIL_IF_NOT(rs_modbus_message_get_write_multreq_quantity(&request) == 2);

    size_t data_len;

    uint8_t const *data = rs_modbus_message_get_write_multreq_data(&request, &data_len);

    FAIL_IF_NOT(data_len == 4);

    FAIL_IF_NOT(data[0] == 0x00);

    FAIL_IF_NOT(data[1] == 0x0A);

    FAIL_IF_NOT(data[2] == 0x01);

    FAIL_IF_NOT(data[3] == 0x02);

    input_len = sizeof(readCoilsRsp) + sizeof(writeMultipleRegistersRsp);

    ptr = (uint8_t *) SCRealloc (input, input_len * sizeof(uint8_t));

    FAIL_IF_NULL(ptr);

    input = ptr;

    memcpy(input, readCoilsRsp, sizeof(readCoilsRsp));

    memcpy(input + sizeof(readCoilsRsp), writeMultipleRegistersRsp, sizeof(writeMultipleRegistersRsp));

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOCLIENT, input, input_len);

    FAIL_IF_NOT(r == 0);

    SCFree(input);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    PASS;

}

/** \test Send Modbus exceed Length request. */

static int ModbusParserTest11(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    DetectEngineThreadCtx *det_ctx = NULL;

    Flow f;

    Packet *p = NULL;

    Signature *s = NULL;

    TcpSession ssn;

    ThreadVars tv;

    size_t input_len = 65536;

    uint8_t *input = SCCalloc(1, input_len);

    FAIL_IF(input == NULL);

    memcpy(input, exceededLengthWriteMultipleRegistersReq,

            sizeof(exceededLengthWriteMultipleRegistersReq));

    FAIL_IF(alp_tctx == NULL);

    memset(&tv, 0, sizeof(ThreadVars));

    memset(&f, 0, sizeof(Flow));

    memset(&ssn, 0, sizeof(TcpSession));

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

    FLOW_INITIALIZE(&f);

    f.alproto   = ALPROTO_MODBUS;

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    f.flags     |= FLOW_IPV4;

    p->flow         = &f;

    p->flags        |= PKT_HAS_FLOW | PKT_STREAM_EST;

    p->flowflags    |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;

    StreamTcpInitConfig(true);

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

    FAIL_IF_NULL(de_ctx);

    de_ctx->flags |= DE_QUIET;

    s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any "

                                      "(msg:\"Modbus invalid Length\"; "

                                      "app-layer-event: "

                                      "modbus.invalid_length; "

                                      "sid:1;)");

    FAIL_IF_NULL(s);

    SigGroupBuild(de_ctx);

    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);

    int r = AppLayerParserParse(

            NULL, alp_tctx, &f, ALPROTO_MODBUS, STREAM_TOSERVER, input, input_len);

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    /* do detect */

    SigMatchSignatures(&tv, de_ctx, det_ctx, p);

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

    SigGroupCleanup(de_ctx);

    SigCleanSignatures(de_ctx);

    DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);

    DetectEngineCtxFree(de_ctx);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    UTHFreePackets(&p, 1);

    PASS;

}

/** \test Send Modbus invalid PDU Length. */

static int ModbusParserTest12(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    DetectEngineThreadCtx *det_ctx = NULL;

    Flow f;

    Packet *p = NULL;

    Signature *s = NULL;

    TcpSession ssn;

    ThreadVars tv;

    FAIL_IF_NULL(alp_tctx);

    memset(&tv, 0, sizeof(ThreadVars));

    memset(&f, 0, sizeof(Flow));

    memset(&ssn, 0, sizeof(TcpSession));

    p = UTHBuildPacket(NULL, 0, IPPROTO_TCP);

    FLOW_INITIALIZE(&f);

    f.alproto   = ALPROTO_MODBUS;

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    f.flags     |= FLOW_IPV4;

    p->flow         = &f;

    p->flags        |= PKT_HAS_FLOW | PKT_STREAM_EST;

    p->flowflags    |= FLOW_PKT_TOSERVER | FLOW_PKT_ESTABLISHED;

    StreamTcpInitConfig(true);

    DetectEngineCtx *de_ctx = DetectEngineCtxInit();

    FAIL_IF_NULL(de_ctx);

    de_ctx->flags |= DE_QUIET;

    s = DetectEngineAppendSig(de_ctx, "alert modbus any any -> any any "

                                      "(msg:\"Modbus invalid Length\"; "

                                      "app-layer-event: "

                                      "modbus.invalid_length; "

                                      "sid:1;)");

    FAIL_IF_NULL(s);

    SigGroupBuild(de_ctx);

    DetectEngineThreadCtxInit(&tv, (void *)de_ctx, (void *)&det_ctx);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER,

                                invalidLengthPDUWriteMultipleRegistersReq,

                                sizeof(invalidLengthPDUWriteMultipleRegistersReq));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    /* do detect */

    SigMatchSignatures(&tv, de_ctx, det_ctx, p);

    FAIL_IF_NOT(PacketAlertCheck(p, 1));

    SigGroupCleanup(de_ctx);

    SigCleanSignatures(de_ctx);

    DetectEngineThreadCtxDeinit(&tv, (void *)det_ctx);

    DetectEngineCtxFree(de_ctx);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    UTHFreePackets(&p, 1);

    PASS;

}

/** \test Send Modbus Mask Write register request/response. */

static int ModbusParserTest13(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    Flow f;

    TcpSession ssn;

    FAIL_IF_NULL(alp_tctx);

    memset(&f, 0, sizeof(f));

    memset(&ssn, 0, sizeof(ssn));

    FLOW_INITIALIZE(&f);

    f.protoctx  = (void *)&ssn;

    f.proto     = IPPROTO_TCP;

    f.alproto   = ALPROTO_MODBUS;

    StreamTcpInitConfig(true);

    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                                STREAM_TOSERVER, maskWriteRegisterReq,

                                sizeof(maskWriteRegisterReq));

    FAIL_IF_NOT(r == 0);

    ModbusState *modbus_state = f.alstate;

    FAIL_IF_NULL(modbus_state);

    ModbusMessage request = rs_modbus_state_get_tx_request(modbus_state, 0);

    FAIL_IF_NULL(request._0);

    FAIL_IF_NOT(rs_modbus_message_get_function(&request) == 22);

    FAIL_IF_NOT(rs_modbus_message_get_and_mask(&request) == 0x00F2);

    FAIL_IF_NOT(rs_modbus_message_get_or_mask(&request) == 0x0025);

    r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_MODBUS,

                            STREAM_TOCLIENT, maskWriteRegisterRsp,

                            sizeof(maskWriteRegisterRsp));

    FAIL_IF_NOT(r == 0);

    FAIL_IF_NOT(rs_modbus_state_get_tx_count(modbus_state) == 1);

    AppLayerParserThreadCtxFree(alp_tctx);

    StreamTcpFreeConfig(true);

    FLOW_DESTROY(&f);

    PASS;

}

/** \test Send Modbus Write single register request/response. */

static int ModbusParserTest14(void) {

    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();

    Flow f;

    TcpSession ssn;

    FAIL_IF_NULL(alp_tctx);

    memset(&f, 0, sizeof(f));

    memset(&ssn, 0, sizeof(ssn));

    FLOW_INITIALIZE(&f);

    f.protoctx  = (void *)&ssn;