From c60c03766c937cecc4bee4b98c2e511b2057fd14 Mon Sep 17 00:00:00 2001
From: Vladimir Gavrilov <105977161+0xA50C1A1@users.noreply.github.com>
Date: Tue, 28 Nov 2023 20:03:00 +0300
Subject: Add Schneider Electric’s UMAS detection support (#2180)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Add Schneider Electric’s UMAS detection support

* Swap proto IDs in ndpi_set_detected_protocol

* Update unit test result
---
 src/lib/protocols/modbus.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'src/lib/protocols')

diff --git a/src/lib/protocols/modbus.c b/src/lib/protocols/modbus.c
index 8eb0f8dae..e57b0d69e 100644
--- a/src/lib/protocols/modbus.c
+++ b/src/lib/protocols/modbus.c
@@ -47,9 +47,16 @@ static void ndpi_search_modbus_tcp(struct ndpi_detection_module_struct *ndpi_str
 
       // the fourth parameter of the payload is the length of the segment            
       if((modbus_len-1) == (packet->payload_packet_len - 7 /* ModbusTCP header len */)) {
-	NDPI_LOG_INFO(ndpi_struct, "found MODBUS\n");
-	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MODBUS, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
-	return;
+        /* Check Modbus function code. 0x5A (90) is reserved for UMAS protocol */
+        if (packet->payload[7] == 0x5A) {
+          NDPI_LOG_INFO(ndpi_struct, "found Schneider Electric UMAS\n");
+          ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UMAS, NDPI_PROTOCOL_MODBUS, NDPI_CONFIDENCE_DPI);
+          return;
+        }
+
+        NDPI_LOG_INFO(ndpi_struct, "found MODBUS\n");
+        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MODBUS, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+        return;
       }
     }
   }
-- 
cgit v1.2.3