なぜ「毎日バックアップを取っていた工場」の80%が、ランサムウェアで図面と受発注データを失ったのか？ — SCS評価（★3）とZFS不変金庫

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ModbusVerdict {
    AllowReadTelemetry { unit_id: u8, function_code: u8 },
    DropMalformedMbapHeader,
    BlockUnauthorizedWriteFunction { unit_id: u8, function_code: u8 },
    BlockDiagnosticOrProgrammingFunction { unit_id: u8, function_code: u8 },
}

/// Inspects a raw Modbus/TCP frame (7-byte MBAP header + 1-byte Function Code + PDU data)
/// at the Level 3.5 Industrial DMZ boundary, enforcing strict Read-Only telemetry policy.
#[inline]
pub fn inspect_modbus_tcp_frame(frame: &[u8], allow_writes: bool) -> ModbusVerdict {
    // Minimum Modbus/TCP frame: TransactionID(2) + ProtocolID(2) + Length(2) + UnitID(1) + FC(1) = 8 bytes
    if frame.len() < 8 {
        return ModbusVerdict::DropMalformedMbapHeader;
    }
    let protocol_id = u16::from_be_bytes([frame[2], frame[3]]);
    let declared_len = u16::from_be_bytes([frame[4], frame[5]]) as usize;
    // Protocol ID must be 0x0000 for standard Modbus/TCP, and length must match remaining bytes
    if protocol_id != 0x0000 || declared_len < 2 || frame.len() < 6 + declared_len {
        return ModbusVerdict::DropMalformedMbapHeader;
    }

    let unit_id = frame[6];
    let fc = frame[7];

    match fc {
        // Read Coils (0x01), Discrete Inputs (0x02), Holding Registers (0x03), Input Registers (0x04)
        0x01..=0x04 => ModbusVerdict::AllowReadTelemetry {
            unit_id,
            function_code: fc,
        },
        // Write Single/Multiple Coils & Registers (0x05, 0x06, 0x0F, 0x10, 0x16, 0x17)
        0x05 | 0x06 | 0x0F | 0x10 | 0x16 | 0x17 => {
            if allow_writes {
                ModbusVerdict::AllowReadTelemetry {
                    unit_id,
                    function_code: fc,
                }
            } else {
                ModbusVerdict::BlockUnauthorizedWriteFunction {
                    unit_id,
                    function_code: fc,
                }
            }
        }
        // Diagnostics (0x08), Program Controller, Encapsulated Interface (0x2B), or Exception Masks
        _ => ModbusVerdict::BlockDiagnosticOrProgrammingFunction {
            unit_id,
            function_code: fc,
        },
    }
}