suricata
output-json-dnp3.c
Go to the documentation of this file.
1 /* Copyright (C) 2015-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "suricata-common.h"
19 #include "detect.h"
20 #include "pkt-var.h"
21 #include "conf.h"
22 
23 #include "threads.h"
24 #include "threadvars.h"
25 #include "tm-threads.h"
26 
27 #include "util-print.h"
28 #include "util-unittest.h"
29 #include "util-buffer.h"
30 #include "util-debug.h"
31 
32 #include "app-layer.h"
33 #include "app-layer-parser.h"
34 #include "app-layer-dnp3.h"
35 #include "app-layer-dnp3-objects.h"
36 
37 #include "detect-dnp3.h"
38 
39 #include "output.h"
40 #include "output-json.h"
41 #include "output-json-dnp3.h"
43 
44 typedef struct LogDNP3FileCtx_ {
45  uint32_t flags;
49 
50 typedef struct LogDNP3LogThread_ {
54 
55 static void JsonDNP3LogLinkControl(SCJsonBuilder *js, uint8_t lc)
56 {
57  SCJbSetBool(js, "dir", DNP3_LINK_DIR(lc));
58  SCJbSetBool(js, "pri", DNP3_LINK_PRI(lc));
59  SCJbSetBool(js, "fcb", DNP3_LINK_FCB(lc));
60  SCJbSetBool(js, "fcv", DNP3_LINK_FCV(lc));
61  SCJbSetUint(js, "function_code", DNP3_LINK_FC(lc));
62 }
63 
64 static void JsonDNP3LogApplicationControl(SCJsonBuilder *js, uint8_t ac)
65 {
66  SCJbSetBool(js, "fir", DNP3_APP_FIR(ac));
67  SCJbSetBool(js, "fin", DNP3_APP_FIN(ac));
68  SCJbSetBool(js, "con", DNP3_APP_CON(ac));
69  SCJbSetBool(js, "uns", DNP3_APP_UNS(ac));
70  SCJbSetUint(js, "sequence", DNP3_APP_SEQ(ac));
71 }
72 
73 /**
74  * \brief Log the items (points) for an object.
75  *
76  * TODO: Autogenerate this function based on object definitions.
77  */
78 static void JsonDNP3LogObjectItems(SCJsonBuilder *js, DNP3Object *object)
79 {
80  DNP3Point *item;
81 
82  TAILQ_FOREACH(item, object->points, next) {
83  SCJbStartObject(js);
84 
85  SCJbSetUint(js, "prefix", item->prefix);
86  SCJbSetUint(js, "index", item->index);
87  if (DNP3PrefixIsSize(object->prefix_code)) {
88  SCJbSetUint(js, "size", item->size);
89  }
90 
91  OutputJsonDNP3SetItem(js, object, item);
92  SCJbClose(js);
93  }
94 }
95 
96 /**
97  * \brief Log the application layer objects.
98  *
99  * \param objects A list of DNP3 objects.
100  * \param jb A SCJsonBuilder instance with an open array.
101  */
102 static void JsonDNP3LogObjects(SCJsonBuilder *js, DNP3ObjectList *objects)
103 {
104  DNP3Object *object;
105 
106  TAILQ_FOREACH(object, objects, next) {
107  SCJbStartObject(js);
108  SCJbSetUint(js, "group", object->group);
109  SCJbSetUint(js, "variation", object->variation);
110  SCJbSetUint(js, "qualifier", object->qualifier);
111  SCJbSetUint(js, "prefix_code", object->prefix_code);
112  SCJbSetUint(js, "range_code", object->range_code);
113  SCJbSetUint(js, "start", object->start);
114  SCJbSetUint(js, "stop", object->stop);
115  SCJbSetUint(js, "count", object->count);
116 
117  if (object->points != NULL && !TAILQ_EMPTY(object->points)) {
118  SCJbOpenArray(js, "points");
119  JsonDNP3LogObjectItems(js, object);
120  SCJbClose(js);
121  }
122 
123  SCJbClose(js);
124  }
125 }
126 
127 static void JsonDNP3LogRequest(SCJsonBuilder *js, DNP3Transaction *dnp3tx)
128 {
129  JB_SET_STRING(js, "type", "request");
130 
131  SCJbOpenObject(js, "control");
132  JsonDNP3LogLinkControl(js, dnp3tx->lh.control);
133  SCJbClose(js);
134 
135  SCJbSetUint(js, "src", DNP3_SWAP16(dnp3tx->lh.src));
136  SCJbSetUint(js, "dst", DNP3_SWAP16(dnp3tx->lh.dst));
137 
138  SCJbOpenObject(js, "application");
139 
140  SCJbOpenObject(js, "control");
141  JsonDNP3LogApplicationControl(js, dnp3tx->ah.control);
142  SCJbClose(js);
143 
144  SCJbSetUint(js, "function_code", dnp3tx->ah.function_code);
145 
146  if (!TAILQ_EMPTY(&dnp3tx->objects)) {
147  SCJbOpenArray(js, "objects");
148  JsonDNP3LogObjects(js, &dnp3tx->objects);
149  SCJbClose(js);
150  }
151 
152  SCJbSetBool(js, "complete", dnp3tx->complete);
153 
154  /* Close application. */
155  SCJbClose(js);
156 }
157 
158 static void JsonDNP3LogResponse(SCJsonBuilder *js, DNP3Transaction *dnp3tx)
159 {
160  if (dnp3tx->ah.function_code == DNP3_APP_FC_UNSOLICITED_RESP) {
161  JB_SET_STRING(js, "type", "unsolicited_response");
162  } else {
163  JB_SET_STRING(js, "type", "response");
164  }
165 
166  SCJbOpenObject(js, "control");
167  JsonDNP3LogLinkControl(js, dnp3tx->lh.control);
168  SCJbClose(js);
169 
170  SCJbSetUint(js, "src", DNP3_SWAP16(dnp3tx->lh.src));
171  SCJbSetUint(js, "dst", DNP3_SWAP16(dnp3tx->lh.dst));
172 
173  SCJbOpenObject(js, "application");
174 
175  SCJbOpenObject(js, "control");
176  JsonDNP3LogApplicationControl(js, dnp3tx->ah.control);
177  SCJbClose(js);
178 
179  SCJbSetUint(js, "function_code", dnp3tx->ah.function_code);
180 
181  if (!TAILQ_EMPTY(&dnp3tx->objects)) {
182  SCJbOpenArray(js, "objects");
183  JsonDNP3LogObjects(js, &dnp3tx->objects);
184  SCJbClose(js);
185  }
186 
187  SCJbSetBool(js, "complete", dnp3tx->complete);
188 
189  /* Close application. */
190  SCJbClose(js);
191 
192  SCJbOpenObject(js, "iin");
193  SCJsonDNP3LogIin(js, (uint16_t)(dnp3tx->iin.iin1 << 8 | dnp3tx->iin.iin2));
194  SCJbClose(js);
195 }
196 
197 bool AlertJsonDnp3(void *vtx, SCJsonBuilder *js)
198 {
199  DNP3Transaction *tx = (DNP3Transaction *)vtx;
200  bool logged = false;
201  SCJbOpenObject(js, "dnp3");
202  if (tx->is_request && tx->done) {
203  SCJbOpenObject(js, "request");
204  JsonDNP3LogRequest(js, tx);
205  SCJbClose(js);
206  logged = true;
207  }
208  if (!tx->is_request && tx->done) {
209  SCJbOpenObject(js, "response");
210  JsonDNP3LogResponse(js, tx);
211  SCJbClose(js);
212  logged = true;
213  }
214  SCJbClose(js);
215  return logged;
216 }
217 
218 static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
219  const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
220 {
221  SCEnter();
222  LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
223  DNP3Transaction *tx = vtx;
224 
225  SCJsonBuilder *js =
226  CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
227  if (unlikely(js == NULL)) {
228  return TM_ECODE_OK;
229  }
230 
231  SCJbOpenObject(js, "dnp3");
232  JsonDNP3LogRequest(js, tx);
233  SCJbClose(js);
234  OutputJsonBuilderBuffer(tv, p, p->flow, js, thread->ctx);
235  SCJbFree(js);
236 
238 }
239 
240 static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
241  const Packet *p, Flow *f, void *state, void *vtx, uint64_t tx_id)
242 {
243  SCEnter();
244  LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
245  DNP3Transaction *tx = vtx;
246 
247  SCJsonBuilder *js =
248  CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL, thread->dnp3log_ctx->eve_ctx);
249  if (unlikely(js == NULL)) {
250  return TM_ECODE_OK;
251  }
252 
253  SCJbOpenObject(js, "dnp3");
254  JsonDNP3LogResponse(js, tx);
255  SCJbClose(js);
256  OutputJsonBuilderBuffer(tv, p, p->flow, js, thread->ctx);
257  SCJbFree(js);
258 
260 }
261 
262 static int JsonDNP3Logger(ThreadVars *tv, void *thread_data, const Packet *p, Flow *f, void *state,
263  void *vtx, uint64_t tx_id)
264 {
265  SCEnter();
266  DNP3Transaction *tx = vtx;
267  if (tx->is_request && tx->done) {
268  JsonDNP3LoggerToServer(tv, thread_data, p, f, state, vtx, tx_id);
269  } else if (!tx->is_request && tx->done) {
270  JsonDNP3LoggerToClient(tv, thread_data, p, f, state, vtx, tx_id);
271  }
273 }
274 
275 static void OutputDNP3LogDeInitCtxSub(OutputCtx *output_ctx)
276 {
277  SCLogDebug("cleaning up sub output_ctx %p", output_ctx);
278  LogDNP3FileCtx *dnp3log_ctx = (LogDNP3FileCtx *)output_ctx->data;
279  SCFree(dnp3log_ctx);
280  SCFree(output_ctx);
281 }
282 
283 static OutputInitResult OutputDNP3LogInitSub(SCConfNode *conf, OutputCtx *parent_ctx)
284 {
285  OutputInitResult result = { NULL, false };
286  OutputJsonCtx *json_ctx = parent_ctx->data;
287 
288  LogDNP3FileCtx *dnp3log_ctx = SCCalloc(1, sizeof(*dnp3log_ctx));
289  if (unlikely(dnp3log_ctx == NULL)) {
290  return result;
291  }
292  dnp3log_ctx->eve_ctx = json_ctx;
293 
294  OutputCtx *output_ctx = SCCalloc(1, sizeof(*output_ctx));
295  if (unlikely(output_ctx == NULL)) {
296  SCFree(dnp3log_ctx);
297  return result;
298  }
299  output_ctx->data = dnp3log_ctx;
300  output_ctx->DeInit = OutputDNP3LogDeInitCtxSub;
301 
302  SCLogInfo("DNP3 log sub-module initialized.");
303 
305 
306  result.ctx = output_ctx;
307  result.ok = true;
308  return result;
309 }
310 
311 
312 static TmEcode JsonDNP3LogThreadInit(ThreadVars *t, const void *initdata, void **data)
313 {
314  LogDNP3LogThread *thread = SCCalloc(1, sizeof(*thread));
315  if (unlikely(thread == NULL)) {
316  return TM_ECODE_FAILED;
317  }
318 
319  if (initdata == NULL) {
320  SCLogDebug("Error getting context for DNP3. \"initdata\" is NULL.");
321  goto error_exit;
322  }
323 
324  thread->dnp3log_ctx = ((OutputCtx *)initdata)->data;
325  thread->ctx = CreateEveThreadCtx(t, thread->dnp3log_ctx->eve_ctx);
326  if (thread->ctx == NULL) {
327  goto error_exit;
328  }
329 
330  *data = (void *)thread;
331 
332  return TM_ECODE_OK;
333 
334 error_exit:
335  SCFree(thread);
336  return TM_ECODE_FAILED;
337 }
338 
339 static TmEcode JsonDNP3LogThreadDeinit(ThreadVars *t, void *data)
340 {
341  LogDNP3LogThread *thread = (LogDNP3LogThread *)data;
342  if (thread == NULL) {
343  return TM_ECODE_OK;
344  }
345  FreeEveThreadCtx(thread->ctx);
346  SCFree(thread);
347  return TM_ECODE_OK;
348 }
349 
351 {
352  OutputRegisterTxSubModule(LOGGER_JSON_TX, "eve-log", "JsonDNP3Log", "eve-log.dnp3",
353  OutputDNP3LogInitSub, ALPROTO_DNP3, JsonDNP3Logger, JsonDNP3LogThreadInit,
354  JsonDNP3LogThreadDeinit);
355 }
LogDNP3LogThread_
Definition: output-json-dnp3.c:50
LogDNP3FileCtx_::flags
uint32_t flags
Definition: output-json-dnp3.c:45
tm-threads.h
DNP3Transaction_::complete
uint8_t complete
Definition: app-layer-dnp3.h:227
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:279
DNP3Transaction_::done
uint8_t done
Definition: app-layer-dnp3.h:226
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
FreeEveThreadCtx
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
Definition: output-json-common.c:58
DNP3Object_
Struct to hold the list of decoded objects.
Definition: app-layer-dnp3.h:192
CreateEveHeader
SCJsonBuilder * CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Definition: output-json.c:850
threads.h
OutputJsonCtx_
Definition: output-json.h:75
Flow_
Flow data structure.
Definition: flow.h:348
logged
int logged
Definition: app-layer-htp.h:1
JsonDNP3LogRegister
void JsonDNP3LogRegister(void)
Definition: output-json-dnp3.c:350
TAILQ_EMPTY
#define TAILQ_EMPTY(head)
Definition: queue.h:248
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
CreateEveThreadCtx
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
Definition: output-json-common.c:29
OutputRegisterTxSubModule
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit)
Definition: output.c:406
DNP3Object_::stop
uint32_t stop
Definition: app-layer-dnp3.h:199
DNP3Transaction_::objects
DNP3ObjectList objects
Definition: app-layer-dnp3.h:221
LogDNP3FileCtx_
Definition: output-json-dnp3.c:44
DNP3PrefixIsSize
int DNP3PrefixIsSize(uint8_t prefix_code)
Check if the prefix code is a size prefix.
Definition: app-layer-dnp3.c:1484
detect-dnp3.h
DNP3_APP_FC_UNSOLICITED_RESP
#define DNP3_APP_FC_UNSOLICITED_RESP
Definition: app-layer-dnp3.h:70
OutputJsonBuilderBuffer
void OutputJsonBuilderBuffer(ThreadVars *tv, const Packet *p, Flow *f, SCJsonBuilder *js, OutputJsonThreadCtx *ctx)
Definition: output-json.c:1015
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
util-unittest.h
OutputCtx_::data
void * data
Definition: tm-modules.h:91
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
OutputCtx_
Definition: tm-modules.h:88
DNP3_SWAP16
#define DNP3_SWAP16(x)
Definition: app-layer-dnp3.h:95
OutputJsonThreadCtx_
Definition: output-json.h:83
output-json-dnp3.h
DNP3Object_::points
DNP3PointList * points
Definition: app-layer-dnp3.h:201
LogDNP3LogThread_::dnp3log_ctx
LogDNP3FileCtx * dnp3log_ctx
Definition: output-json-dnp3.c:51
LogDNP3FileCtx_::include_object_data
uint8_t include_object_data
Definition: output-json-dnp3.c:46
util-debug.h
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:31
DNP3_LINK_FCV
#define DNP3_LINK_FCV(control)
Definition: app-layer-dnp3.h:77
DNP3Transaction_::ah
DNP3ApplicationHeader ah
Definition: app-layer-dnp3.h:224
OutputInitResult_::ctx
OutputCtx * ctx
Definition: output.h:47
DNP3Point_::size
uint32_t size
Definition: app-layer-dnp3.h:181
SCAppLayerParserRegisterLogger
void SCAppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:491
DNP3Transaction_::iin
DNP3InternalInd iin
Definition: app-layer-dnp3.h:225
ALPROTO_DNP3
@ ALPROTO_DNP3
Definition: app-layer-protos.h:50
app-layer-dnp3.h
output-json.h
DNP3_APP_FIR
#define DNP3_APP_FIR(x)
Definition: app-layer-dnp3.h:86
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:281
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
OutputInitResult_::ok
bool ok
Definition: output.h:48
OutputJsonDNP3SetItem
void OutputJsonDNP3SetItem(SCJsonBuilder *js, DNP3Object *object, DNP3Point *point)
Definition: output-json-dnp3-objects.c:33
LOG_DIR_FLOW
@ LOG_DIR_FLOW
Definition: output-eve-bindgen.h:33
app-layer-parser.h
Packet_
Definition: decode.h:501
DNP3Object_::group
uint8_t group
Definition: app-layer-dnp3.h:193
DNP3_LINK_FCB
#define DNP3_LINK_FCB(control)
Definition: app-layer-dnp3.h:76
conf.h
DNP3_LINK_DIR
#define DNP3_LINK_DIR(control)
Definition: app-layer-dnp3.h:74
TmEcode
TmEcode
Definition: tm-threads-common.h:80
DNP3Object_::start
uint32_t start
Definition: app-layer-dnp3.h:198
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:229
DNP3Transaction_::is_request
bool is_request
Definition: app-layer-dnp3.h:215
DNP3Object_::count
uint32_t count
Definition: app-layer-dnp3.h:200
LogDNP3FileCtx_::eve_ctx
OutputJsonCtx * eve_ctx
Definition: output-json-dnp3.c:47
LogDNP3LogThread
struct LogDNP3LogThread_ LogDNP3LogThread
OutputInitResult_
Definition: output.h:46
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
LogDNP3LogThread_::ctx
OutputJsonThreadCtx * ctx
Definition: output-json-dnp3.c:52
suricata-common.h
OutputCtx_::DeInit
void(* DeInit)(struct OutputCtx_ *)
Definition: tm-modules.h:94
DNP3Object_::range_code
uint8_t range_code
Definition: app-layer-dnp3.h:197
DNP3_LINK_PRI
#define DNP3_LINK_PRI(control)
Definition: app-layer-dnp3.h:75
DNP3_APP_UNS
#define DNP3_APP_UNS(x)
Definition: app-layer-dnp3.h:89
DNP3_APP_CON
#define DNP3_APP_CON(x)
Definition: app-layer-dnp3.h:88
DNP3_APP_FIN
#define DNP3_APP_FIN(x)
Definition: app-layer-dnp3.h:87
DNP3Object_::prefix_code
uint8_t prefix_code
Definition: app-layer-dnp3.h:196
output-json-dnp3-objects.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
threadvars.h
LOGGER_JSON_TX
@ LOGGER_JSON_TX
Definition: suricata-common.h:485
LogDNP3FileCtx
struct LogDNP3FileCtx_ LogDNP3FileCtx
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DNP3Object_::variation
uint8_t variation
Definition: app-layer-dnp3.h:194
util-buffer.h
AlertJsonDnp3
bool AlertJsonDnp3(void *vtx, SCJsonBuilder *js)
Definition: output-json-dnp3.c:197
DNP3_APP_SEQ
#define DNP3_APP_SEQ(x)
Definition: app-layer-dnp3.h:90
DNP3Object_::qualifier
uint8_t qualifier
Definition: app-layer-dnp3.h:195
DNP3Point_::index
uint32_t index
Definition: app-layer-dnp3.h:177
DNP3_LINK_FC
#define DNP3_LINK_FC(control)
Definition: app-layer-dnp3.h:78
app-layer-dnp3-objects.h
DNP3Point_::prefix
uint32_t prefix
Definition: app-layer-dnp3.h:176
DNP3Transaction_::lh
DNP3LinkHeader lh
Definition: app-layer-dnp3.h:222
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:285
SCConfNode_
Definition: conf.h:37
DNP3Point_
DNP3 object point.
Definition: app-layer-dnp3.h:175
output.h
DNP3Transaction_
DNP3 transaction.
Definition: app-layer-dnp3.h:211
app-layer.h