suricata
output-json-dnp3.c
Go to the documentation of this file.
1 /* Copyright (C) 2015-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "debug.h"
20 #include "detect.h"
21 #include "pkt-var.h"
22 #include "conf.h"
23 
24 #include "threads.h"
25 #include "threadvars.h"
26 #include "tm-threads.h"
27 
28 #include "util-print.h"
29 #include "util-unittest.h"
30 #include "util-buffer.h"
31 #include "util-crypt.h"
32 #include "util-debug.h"
33 
34 #include "app-layer.h"
35 #include "app-layer-parser.h"
36 #include "app-layer-dnp3.h"
37 #include "app-layer-dnp3-objects.h"
38 
39 #include "detect-dnp3.h"
40 
41 #include "output.h"
42 #include "output-json.h"
43 #include "output-json-dnp3.h"
45 
46 typedef struct LogDNP3FileCtx_ {
48  uint32_t flags;
52 
53 typedef struct LogDNP3LogThread_ {
58 
59 static void JsonDNP3LogLinkControl(JsonBuilder *js, uint8_t lc)
60 {
61  jb_set_bool(js, "dir", DNP3_LINK_DIR(lc));
62  jb_set_bool(js, "pri", DNP3_LINK_PRI(lc));
63  jb_set_bool(js, "fcb", DNP3_LINK_FCB(lc));
64  jb_set_bool(js, "fcv", DNP3_LINK_FCV(lc));
65  jb_set_uint(js, "function_code", DNP3_LINK_FC(lc));
66 }
67 
68 static void JsonDNP3LogIin(JsonBuilder *js, uint16_t iin)
69 {
70  jb_open_array(js, "indicators");
71 
72  if (iin) {
73  int mapping = 0;
74  do {
75  if (iin & DNP3IndicatorsMap[mapping].value) {
76  jb_append_string(js, DNP3IndicatorsMap[mapping].name);
77  }
78  mapping++;
79  } while (DNP3IndicatorsMap[mapping].name != NULL);
80  }
81  jb_close(js);
82 }
83 
84 static void JsonDNP3LogApplicationControl(JsonBuilder *js, uint8_t ac)
85 {
86  jb_set_bool(js, "fir", DNP3_APP_FIR(ac));
87  jb_set_bool(js, "fin", DNP3_APP_FIN(ac));
88  jb_set_bool(js, "con", DNP3_APP_CON(ac));
89  jb_set_bool(js, "uns", DNP3_APP_UNS(ac));
90  jb_set_uint(js, "sequence", DNP3_APP_SEQ(ac));
91 }
92 
93 /**
94  * \brief Log the items (points) for an object.
95  *
96  * TODO: Autogenerate this function based on object definitions.
97  */
98 static void JsonDNP3LogObjectItems(JsonBuilder *js, DNP3Object *object)
99 {
100  DNP3Point *item;
101 
102  TAILQ_FOREACH(item, object->points, next) {
103  jb_start_object(js);
104 
105  jb_set_uint(js, "prefix", item->prefix);
106  jb_set_uint(js, "index", item->index);
107  if (DNP3PrefixIsSize(object->prefix_code)) {
108  jb_set_uint(js, "size", item->size);
109  }
110 
111  OutputJsonDNP3SetItem(js, object, item);
112  jb_close(js);
113  }
114 }
115 
116 /**
117  * \brief Log the application layer objects.
118  *
119  * \param objects A list of DNP3 objects.
120  * \param jb A JsonBuilder instance with an open array.
121  */
122 static void JsonDNP3LogObjects(JsonBuilder *js, DNP3ObjectList *objects)
123 {
124  DNP3Object *object;
125 
126  TAILQ_FOREACH(object, objects, next) {
127  jb_start_object(js);
128  jb_set_uint(js, "group", object->group);
129  jb_set_uint(js, "variation", object->variation);
130  jb_set_uint(js, "qualifier", object->qualifier);
131  jb_set_uint(js, "prefix_code", object->prefix_code);
132  jb_set_uint(js, "range_code", object->range_code);
133  jb_set_uint(js, "start", object->start);
134  jb_set_uint(js, "stop", object->stop);
135  jb_set_uint(js, "count", object->count);
136 
137  if (object->points != NULL && !TAILQ_EMPTY(object->points)) {
138  jb_open_array(js, "points");
139  JsonDNP3LogObjectItems(js, object);
140  jb_close(js);
141  }
142 
143  jb_close(js);
144  }
145 }
146 
147 void JsonDNP3LogRequest(JsonBuilder *js, DNP3Transaction *dnp3tx)
148 {
149  JB_SET_STRING(js, "type", "request");
150 
151  jb_open_object(js, "control");
152  JsonDNP3LogLinkControl(js, dnp3tx->request_lh.control);
153  jb_close(js);
154 
155  jb_set_uint(js, "src", DNP3_SWAP16(dnp3tx->request_lh.src));
156  jb_set_uint(js, "dst", DNP3_SWAP16(dnp3tx->request_lh.dst));
157 
158  jb_open_object(js, "application");
159 
160  jb_open_object(js, "control");
161  JsonDNP3LogApplicationControl(js, dnp3tx->request_ah.control);
162  jb_close(js);
163 
164  jb_set_uint(js, "function_code", dnp3tx->request_ah.function_code);
165 
166  jb_open_array(js, "objects");
167  JsonDNP3LogObjects(js, &dnp3tx->request_objects);
168  jb_close(js);
169 
170  jb_set_bool(js, "complete", dnp3tx->request_complete);
171 
172  /* Close application. */
173  jb_close(js);
174 }
175 
176 void JsonDNP3LogResponse(JsonBuilder *js, DNP3Transaction *dnp3tx)
177 {
178  if (dnp3tx->response_ah.function_code == DNP3_APP_FC_UNSOLICITED_RESP) {
179  JB_SET_STRING(js, "type", "unsolicited_response");
180  }
181  else {
182  JB_SET_STRING(js, "type", "response");
183  }
184 
185  jb_open_object(js, "control");
186  JsonDNP3LogLinkControl(js, dnp3tx->response_lh.control);
187  jb_close(js);
188 
189  jb_set_uint(js, "src", DNP3_SWAP16(dnp3tx->response_lh.src));
190  jb_set_uint(js, "dst", DNP3_SWAP16(dnp3tx->response_lh.dst));
191 
192  jb_open_object(js, "application");
193 
194  jb_open_object(js, "control");
195  JsonDNP3LogApplicationControl(js, dnp3tx->response_ah.control);
196  jb_close(js);
197 
198  jb_set_uint(js, "function_code", dnp3tx->response_ah.function_code);
199 
200  jb_open_array(js, "objects");
201  JsonDNP3LogObjects(js, &dnp3tx->response_objects);
202  jb_close(js);
203 
204  jb_set_bool(js, "complete", dnp3tx->response_complete);
205 
206  /* Close application. */
207  jb_close(js);
208 
209  jb_open_object(js, "iin");
210  JsonDNP3LogIin(js, dnp3tx->response_iin.iin1 << 8 | dnp3tx->response_iin.iin2);
211  jb_close(js);
212 }
213 
214 static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
215  const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
216 {
217  SCEnter();
218  LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
219  DNP3Transaction *tx = vtx;
220 
221  MemBuffer *buffer = (MemBuffer *)thread->buffer;
222 
223  MemBufferReset(buffer);
224  if (tx->has_request && tx->request_done) {
225  JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL);
226  if (unlikely(js == NULL)) {
227  return TM_ECODE_OK;
228  }
229 
230  EveAddCommonOptions(&thread->dnp3log_ctx->cfg, p, f, js);
231 
232  jb_open_object(js, "dnp3");
233  JsonDNP3LogRequest(js, tx);
234  jb_close(js);
235  OutputJsonBuilderBuffer(js, thread->file_ctx, &buffer);
236  jb_free(js);
237  }
238 
240 }
241 
242 static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
243  const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
244 {
245  SCEnter();
246  LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
247  DNP3Transaction *tx = vtx;
248 
249  MemBuffer *buffer = (MemBuffer *)thread->buffer;
250 
251  MemBufferReset(buffer);
252  if (tx->has_response && tx->response_done) {
253  JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL);
254  if (unlikely(js == NULL)) {
255  return TM_ECODE_OK;
256  }
257 
258  EveAddCommonOptions(&thread->dnp3log_ctx->cfg, p, f, js);
259  jb_open_object(js, "dnp3");
260  JsonDNP3LogResponse(js, tx);
261  jb_close(js);
262  OutputJsonBuilderBuffer(js, thread->file_ctx, &buffer);
263  jb_free(js);
264  }
265 
267 }
268 
269 static void OutputDNP3LogDeInitCtxSub(OutputCtx *output_ctx)
270 {
271  SCLogDebug("cleaning up sub output_ctx %p", output_ctx);
272  LogDNP3FileCtx *dnp3log_ctx = (LogDNP3FileCtx *)output_ctx->data;
273  SCFree(dnp3log_ctx);
274  SCFree(output_ctx);
275 }
276 
277 #define DEFAULT_LOG_FILENAME "dnp3.json"
278 
279 static OutputInitResult OutputDNP3LogInitSub(ConfNode *conf, OutputCtx *parent_ctx)
280 {
281  OutputInitResult result = { NULL, false };
282  OutputJsonCtx *json_ctx = parent_ctx->data;
283 
284  LogDNP3FileCtx *dnp3log_ctx = SCCalloc(1, sizeof(*dnp3log_ctx));
285  if (unlikely(dnp3log_ctx == NULL)) {
286  return result;
287  }
288  dnp3log_ctx->file_ctx = json_ctx->file_ctx;
289  dnp3log_ctx->cfg = json_ctx->cfg;
290 
291  OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
292  if (unlikely(output_ctx == NULL)) {
293  SCFree(dnp3log_ctx);
294  return result;
295  }
296  output_ctx->data = dnp3log_ctx;
297  output_ctx->DeInit = OutputDNP3LogDeInitCtxSub;
298 
299  SCLogInfo("DNP3 log sub-module initialized.");
300 
302 
303  result.ctx = output_ctx;
304  result.ok = true;
305  return result;
306 }
307 
308 
309 static TmEcode JsonDNP3LogThreadInit(ThreadVars *t, const void *initdata, void **data)
310 {
311  LogDNP3LogThread *thread = SCCalloc(1, sizeof(*thread));
312  if (unlikely(thread == NULL)) {
313  return TM_ECODE_FAILED;
314  }
315 
316  if (initdata == NULL) {
317  SCLogDebug("Error getting context for DNP3. \"initdata\" is NULL.");
318  goto error_exit;
319  }
320 
322  if (unlikely(thread->buffer == NULL)) {
323  goto error_exit;
324  }
325 
326  thread->dnp3log_ctx = ((OutputCtx *)initdata)->data;
327  thread->file_ctx = LogFileEnsureExists(thread->dnp3log_ctx->file_ctx, t->id);
328  if (!thread->file_ctx) {
329  goto error_exit;
330  }
331 
332  *data = (void *)thread;
333 
334  return TM_ECODE_OK;
335 
336 error_exit:
337  if (thread->buffer != NULL) {
338  MemBufferFree(thread->buffer);
339  }
340  SCFree(thread);
341  return TM_ECODE_FAILED;
342 }
343 
344 static TmEcode JsonDNP3LogThreadDeinit(ThreadVars *t, void *data)
345 {
346  LogDNP3LogThread *thread = (LogDNP3LogThread *)data;
347  if (thread == NULL) {
348  return TM_ECODE_OK;
349  }
350  if (thread->buffer != NULL) {
351  MemBufferFree(thread->buffer);
352  }
353  SCFree(thread);
354  return TM_ECODE_OK;
355 }
356 
358 {
359  /* Register direction aware eve sub-modules. */
361  "JsonDNP3Log", "eve-log.dnp3", OutputDNP3LogInitSub, ALPROTO_DNP3,
362  JsonDNP3LoggerToServer, 0, 1, JsonDNP3LogThreadInit,
363  JsonDNP3LogThreadDeinit, NULL);
365  "JsonDNP3Log", "eve-log.dnp3", OutputDNP3LogInitSub, ALPROTO_DNP3,
366  JsonDNP3LoggerToClient, 1, 1, JsonDNP3LogThreadInit,
367  JsonDNP3LogThreadDeinit, NULL);
368 }
LogDNP3LogThread_
Definition: output-json-dnp3.c:53
LogDNP3FileCtx_::flags
uint32_t flags
Definition: output-json-dnp3.c:48
tm-threads.h
DNP3Transaction_::response_lh
DNP3LinkHeader response_lh
Definition: app-layer-dnp3.h:233
DNP3Transaction_::response_done
uint8_t response_done
Definition: app-layer-dnp3.h:232
LOGGER_JSON_DNP3_TS
@ LOGGER_JSON_DNP3_TS
Definition: suricata-common.h:458
OutputJsonCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json.h:104
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
DNP3Transaction_::request_done
uint8_t request_done
Definition: app-layer-dnp3.h:218
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
DNP3Object_
Struct to hold the list of decoded objects.
Definition: app-layer-dnp3.h:191
DNP3Transaction_::has_request
uint8_t has_request
Definition: app-layer-dnp3.h:217
JSON_OUTPUT_BUFFER_SIZE
#define JSON_OUTPUT_BUFFER_SIZE
Definition: output-json.h:63
threads.h
OutputJsonCtx_
Definition: output-json.h:101
Flow_
Flow data structure.
Definition: flow.h:347
OutputJsonCommonSettings_
Definition: output-json.h:91
LogFileCtx_
Definition: util-logopenfile.h:60
JsonDNP3LogRegister
void JsonDNP3LogRegister(void)
Definition: output-json-dnp3.c:357
TAILQ_EMPTY
#define TAILQ_EMPTY(head)
Definition: queue.h:347
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:350
DNP3Object_::stop
uint32_t stop
Definition: app-layer-dnp3.h:198
LogDNP3FileCtx_
Definition: output-json-dnp3.c:46
DNP3PrefixIsSize
int DNP3PrefixIsSize(uint8_t prefix_code)
Check if the prefix code is a size prefix.
Definition: app-layer-dnp3.c:1576
detect-dnp3.h
OutputJsonBuilderBuffer
int OutputJsonBuilderBuffer(JsonBuilder *js, LogFileCtx *file_ctx, MemBuffer **buffer)
Definition: output-json.c:985
EveAddCommonOptions
void EveAddCommonOptions(const OutputJsonCommonSettings *cfg, const Packet *p, const Flow *f, JsonBuilder *js)
Definition: output-json.c:444
DNP3_APP_FC_UNSOLICITED_RESP
#define DNP3_APP_FC_UNSOLICITED_RESP
Definition: app-layer-dnp3.h:69
LogDNP3LogThread_::file_ctx
LogFileCtx * file_ctx
Definition: output-json-dnp3.c:54
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
DNP3Transaction_::response_complete
uint8_t response_complete
Definition: app-layer-dnp3.h:240
LogDNP3FileCtx_::cfg
OutputJsonCommonSettings cfg
Definition: output-json-dnp3.c:50
util-unittest.h
DNP3Transaction_::has_response
uint8_t has_response
Definition: app-layer-dnp3.h:231
OutputCtx_::data
void * data
Definition: tm-modules.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
OutputCtx_
Definition: tm-modules.h:78
DNP3_SWAP16
#define DNP3_SWAP16(x)
Definition: app-layer-dnp3.h:94
output-json-dnp3.h
DNP3Object_::points
DNP3PointList * points
Definition: app-layer-dnp3.h:200
LogDNP3LogThread_::dnp3log_ctx
LogDNP3FileCtx * dnp3log_ctx
Definition: output-json-dnp3.c:55
DNP3IndicatorsMap
DNP3Mapping DNP3IndicatorsMap[]
Definition: detect-dnp3.c:59
LogDNP3FileCtx_::include_object_data
uint8_t include_object_data
Definition: output-json-dnp3.c:49
util-debug.h
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:24
DNP3_LINK_FCV
#define DNP3_LINK_FCV(control)
Definition: app-layer-dnp3.h:76
DNP3Transaction_::response_iin
DNP3InternalInd response_iin
Definition: app-layer-dnp3.h:236
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:44
DNP3Point_::size
uint32_t size
Definition: app-layer-dnp3.h:180
CreateEveHeader
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr)
Definition: output-json.c:853
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:44
app-layer-dnp3.h
output-json.h
OutputRegisterTxSubModuleWithProgress
void OutputRegisterTxSubModuleWithProgress(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, int tc_log_progress, int ts_log_progress, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
Definition: output.c:378
DNP3_APP_FIR
#define DNP3_APP_FIR(x)
Definition: app-layer-dnp3.h:85
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:456
util-print.h
DNP3Transaction_::request_complete
uint8_t request_complete
Definition: app-layer-dnp3.h:225
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
util-crypt.h
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
LogFileEnsureExists
LogFileCtx * LogFileEnsureExists(LogFileCtx *parent_ctx, int thread_id)
LogFileEnsureExists() Ensure a log file context for the thread exists.
Definition: util-logopenfile.c:659
OutputInitResult_::ok
bool ok
Definition: output.h:45
JsonDNP3LogResponse
void JsonDNP3LogResponse(JsonBuilder *js, DNP3Transaction *dnp3tx)
Definition: output-json-dnp3.c:176
app-layer-parser.h
ThreadVars_::id
int id
Definition: threadvars.h:87
LogDNP3FileCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json-dnp3.c:47
Packet_
Definition: decode.h:414
DNP3Object_::group
uint8_t group
Definition: app-layer-dnp3.h:192
DNP3_LINK_FCB
#define DNP3_LINK_FCB(control)
Definition: app-layer-dnp3.h:75
conf.h
DNP3_LINK_DIR
#define DNP3_LINK_DIR(control)
Definition: app-layer-dnp3.h:73
TmEcode
TmEcode
Definition: tm-threads-common.h:79
DNP3Object_::start
uint32_t start
Definition: app-layer-dnp3.h:197
MemBuffer_
Definition: util-buffer.h:27
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
DNP3Transaction_::request_ah
DNP3ApplicationHeader request_ah
Definition: app-layer-dnp3.h:221
DNP3Transaction_::response_ah
DNP3ApplicationHeader response_ah
Definition: app-layer-dnp3.h:235
MemBufferReset
#define MemBufferReset(mem_buffer)
Reset the mem buffer.
Definition: util-buffer.h:42
DNP3Object_::count
uint32_t count
Definition: app-layer-dnp3.h:199
LogDNP3LogThread
struct LogDNP3LogThread_ LogDNP3LogThread
OutputInitResult_
Definition: output.h:43
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:84
DNP3Object_::range_code
uint8_t range_code
Definition: app-layer-dnp3.h:196
MemBufferFree
void MemBufferFree(MemBuffer *buffer)
Definition: util-buffer.c:82
DNP3_LINK_PRI
#define DNP3_LINK_PRI(control)
Definition: app-layer-dnp3.h:74
DNP3_APP_UNS
#define DNP3_APP_UNS(x)
Definition: app-layer-dnp3.h:88
DNP3_APP_CON
#define DNP3_APP_CON(x)
Definition: app-layer-dnp3.h:87
DNP3_APP_FIN
#define DNP3_APP_FIN(x)
Definition: app-layer-dnp3.h:86
DNP3Object_::prefix_code
uint8_t prefix_code
Definition: app-layer-dnp3.h:195
output-json-dnp3-objects.h
DNP3Transaction_::request_lh
DNP3LinkHeader request_lh
Definition: app-layer-dnp3.h:219
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
OutputJsonDNP3SetItem
void OutputJsonDNP3SetItem(JsonBuilder *js, DNP3Object *object, DNP3Point *point)
Definition: output-json-dnp3-objects.c:34
threadvars.h
LOG_DIR_FLOW
@ LOG_DIR_FLOW
Definition: output-json.h:40
LOGGER_JSON_DNP3_TC
@ LOGGER_JSON_DNP3_TC
Definition: suricata-common.h:459
DNP3Transaction_::request_objects
DNP3ObjectList request_objects
Definition: app-layer-dnp3.h:229
LogDNP3FileCtx
struct LogDNP3FileCtx_ LogDNP3FileCtx
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ConfNode_
Definition: conf.h:32
DNP3Object_::variation
uint8_t variation
Definition: app-layer-dnp3.h:193
util-buffer.h
DNP3_APP_SEQ
#define DNP3_APP_SEQ(x)
Definition: app-layer-dnp3.h:89
OutputJsonCtx_::file_ctx
LogFileCtx * file_ctx
Definition: output-json.h:102
DNP3Object_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:194
JsonDNP3LogRequest
void JsonDNP3LogRequest(JsonBuilder *js, DNP3Transaction *dnp3tx)
Definition: output-json-dnp3.c:147
DNP3Point_::index
uint32_t index
Definition: app-layer-dnp3.h:176
DNP3_LINK_FC
#define DNP3_LINK_FC(control)
Definition: app-layer-dnp3.h:77
app-layer-dnp3-objects.h
DNP3Point_::prefix
uint32_t prefix
Definition: app-layer-dnp3.h:175
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:304
DNP3Point_
DNP3 object point.
Definition: app-layer-dnp3.h:174
MemBufferCreateNew
MemBuffer * MemBufferCreateNew(uint32_t size)
Definition: util-buffer.c:32
debug.h
output.h
DNP3Transaction_
DNP3 transaction.
Definition: app-layer-dnp3.h:210
DNP3Transaction_::response_objects
DNP3ObjectList response_objects
Definition: app-layer-dnp3.h:244
app-layer.h
LogDNP3LogThread_::buffer
MemBuffer * buffer
Definition: output-json-dnp3.c:56