Go to the documentation of this file.
55 static void JsonDNP3LogLinkControl(JsonBuilder *js, uint8_t lc)
64 static void JsonDNP3LogIin(JsonBuilder *js, uint16_t iin)
67 jb_open_array(js,
"indicators");
80 static void JsonDNP3LogApplicationControl(JsonBuilder *js, uint8_t ac)
94 static void JsonDNP3LogObjectItems(JsonBuilder *js,
DNP3Object *
object)
101 jb_set_uint(js,
"prefix", item->
prefix);
102 jb_set_uint(js,
"index", item->
index);
104 jb_set_uint(js,
"size", item->
size);
118 static void JsonDNP3LogObjects(JsonBuilder *js, DNP3ObjectList *objects)
124 jb_set_uint(js,
"group", object->
group);
125 jb_set_uint(js,
"variation", object->
variation);
126 jb_set_uint(js,
"qualifier", object->
qualifier);
127 jb_set_uint(js,
"prefix_code", object->
prefix_code);
128 jb_set_uint(js,
"range_code", object->
range_code);
129 jb_set_uint(js,
"start", object->
start);
130 jb_set_uint(js,
"stop", object->
stop);
131 jb_set_uint(js,
"count", object->
count);
134 jb_open_array(js,
"points");
135 JsonDNP3LogObjectItems(js,
object);
147 jb_open_object(js,
"control");
148 JsonDNP3LogLinkControl(js, dnp3tx->
lh.control);
154 jb_open_object(js,
"application");
156 jb_open_object(js,
"control");
157 JsonDNP3LogApplicationControl(js, dnp3tx->
ah.control);
160 jb_set_uint(js,
"function_code", dnp3tx->
ah.function_code);
163 jb_open_array(js,
"objects");
164 JsonDNP3LogObjects(js, &dnp3tx->
objects);
168 jb_set_bool(js,
"complete", dnp3tx->
complete);
182 jb_open_object(js,
"control");
183 JsonDNP3LogLinkControl(js, dnp3tx->
lh.control);
189 jb_open_object(js,
"application");
191 jb_open_object(js,
"control");
192 JsonDNP3LogApplicationControl(js, dnp3tx->
ah.control);
195 jb_set_uint(js,
"function_code", dnp3tx->
ah.function_code);
198 jb_open_array(js,
"objects");
199 JsonDNP3LogObjects(js, &dnp3tx->
objects);
203 jb_set_bool(js,
"complete", dnp3tx->
complete);
208 jb_open_object(js,
"iin");
209 JsonDNP3LogIin(js, (uint16_t)(dnp3tx->
iin.iin1 << 8 | dnp3tx->
iin.iin2));
213 static int JsonDNP3LoggerToServer(
ThreadVars *
tv,
void *thread_data,
214 const Packet *p,
Flow *f,
void *state,
void *vtx, uint64_t tx_id)
225 jb_open_object(js,
"dnp3");
234 static int JsonDNP3LoggerToClient(
ThreadVars *
tv,
void *thread_data,
235 const Packet *p,
Flow *f,
void *state,
void *vtx, uint64_t tx_id)
246 jb_open_object(js,
"dnp3");
256 void *vtx, uint64_t tx_id)
261 JsonDNP3LoggerToServer(
tv, thread_data, p, f, state, vtx, tx_id);
263 JsonDNP3LoggerToClient(
tv, thread_data, p, f, state, vtx, tx_id);
268 static void OutputDNP3LogDeInitCtxSub(
OutputCtx *output_ctx)
270 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
276 #define DEFAULT_LOG_FILENAME "dnp3.json"
284 if (
unlikely(dnp3log_ctx == NULL)) {
287 dnp3log_ctx->
eve_ctx = json_ctx;
294 output_ctx->
data = dnp3log_ctx;
295 output_ctx->
DeInit = OutputDNP3LogDeInitCtxSub;
297 SCLogInfo(
"DNP3 log sub-module initialized.");
301 result.
ctx = output_ctx;
307 static TmEcode JsonDNP3LogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
314 if (initdata == NULL) {
315 SCLogDebug(
"Error getting context for DNP3. \"initdata\" is NULL.");
321 if (thread->
ctx == NULL) {
325 *data = (
void *)thread;
337 if (thread == NULL) {
348 OutputDNP3LogInitSub,
ALPROTO_DNP3, JsonDNP3Logger, JsonDNP3LogThreadInit,
349 JsonDNP3LogThreadDeinit, NULL);
struct HtpBodyChunk_ * next
void FreeEveThreadCtx(OutputJsonThreadCtx *ctx)
Struct to hold the list of decoded objects.
int OutputJsonBuilderBuffer(JsonBuilder *js, OutputJsonThreadCtx *ctx)
void JsonDNP3LogRegister(void)
#define TAILQ_EMPTY(head)
#define TAILQ_FOREACH(var, head, field)
OutputJsonThreadCtx * CreateEveThreadCtx(ThreadVars *t, OutputJsonCtx *ctx)
int DNP3PrefixIsSize(uint8_t prefix_code)
Check if the prefix code is a size prefix.
#define DNP3_APP_FC_UNSOLICITED_RESP
LogDNP3FileCtx * dnp3log_ctx
DNP3Mapping DNP3IndicatorsMap[]
uint8_t include_object_data
#define JB_SET_STRING(jb, key, val)
#define DNP3_LINK_FCV(control)
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
JsonBuilder * CreateEveHeader(const Packet *p, enum OutputJsonLogDirection dir, const char *event_type, JsonAddrInfo *addr, OutputJsonCtx *eve_ctx)
Per thread variable structure.
void JsonDNP3LogResponse(JsonBuilder *js, DNP3Transaction *dnp3tx)
#define DNP3_LINK_FCB(control)
#define DNP3_LINK_DIR(control)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
struct LogDNP3LogThread_ LogDNP3LogThread
OutputJsonThreadCtx * ctx
void(* DeInit)(struct OutputCtx_ *)
#define DNP3_LINK_PRI(control)
void OutputRegisterTxSubModule(LoggerId id, const char *parent_name, const char *name, const char *conf_name, OutputInitSubFunc InitFunc, AppProto alproto, TxLogger TxLogFunc, ThreadInitFunc ThreadInit, ThreadDeinitFunc ThreadDeinit, ThreadExitPrintStatsFunc ThreadExitPrintStats)
void OutputJsonDNP3SetItem(JsonBuilder *js, DNP3Object *object, DNP3Point *point)
struct LogDNP3FileCtx_ LogDNP3FileCtx
void JsonDNP3LogRequest(JsonBuilder *js, DNP3Transaction *dnp3tx)
#define DNP3_LINK_FC(control)