search

cisagov / icsnpp-bacnet

Zeek BACnet Parser - CISA ICSNPP
BSD 3-Clause "New" or "Revised" License
15 stars 11 forks source link

Fix a conversion. #6

Closed keithjjones closed 2 years ago

keithjjones commented 2 years ago

🗣 Description

These errors popped up on the pcaps from http://kargs.net/captures/:

1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and analog-value: 2412)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and analog-value: 2413)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and analog-value: 2414)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and analog-value: 2415)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and analog-value: 2416)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 0)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 1)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 2)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 3)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 4)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 5)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 6)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 7)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 8)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 9)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 10)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 11)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 12)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 13)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 14)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 15)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 16)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 17)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 18)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 19)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 32)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 33)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 34)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 35)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 64)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 100)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 101)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 102)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 103)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 104)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 105)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 106)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 107)
1159998343.431785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 329: bad conversion to count (to_count(Bacnet::property_value) and file: 108)
1159998394.256166 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 320: bad conversion to count (to_count(Bacnet::property_value) and PropertyError)
1159998396.334785 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 320: bad conversion to count (to_count(Bacnet::property_value) and PropertyError)
1159998400.256493 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 320: bad conversion to count (to_count(Bacnet::property_value) and PropertyError)
1159998405.255749 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 320: bad conversion to count (to_count(Bacnet::property_value) and PropertyError)
1159998409.274743 error in [REDACTED]zeek/share/zeek/site/packages/./icsnpp-bacnet/./main.zeek, line 320: bad conversion to count (to_count(Bacnet::property_value) and PropertyError)

I modified the code to look for a valid digit before using the to_count function.

💭 Motivation and context

It would cause an error on public pcaps in reporter.log.

🧪 Testing

I did not see any tests in this repo to add to.

✅ Pre-approval checklist

✅ Pre-merge checklist

✅ Post-merge checklist

mmguero commented 2 years ago

Haha, I just barely did cisagov/icsnpp-bacnet#5 to fix this exact issue. Great minds think alike. @Kleinspider as far as I can tell this PR is redundant with the one you just pulled so we can probably just close this. Thanks @keithjjones

keithjjones commented 2 years ago

Oh cool, this is already fixed! I didn't have that updated code on my machine. Please disregard. Thanks!