55 static void JsonDNP3LogLinkControl(SCJsonBuilder *js, uint8_t lc)
64 static void JsonDNP3LogApplicationControl(SCJsonBuilder *js, uint8_t ac)
78 static void JsonDNP3LogObjectItems(SCJsonBuilder *js,
DNP3Object *
object)
85 SCJbSetUint(js,
"prefix", item->
prefix);
86 SCJbSetUint(js,
"index", item->
index);
88 SCJbSetUint(js,
"size", item->
size);
102 static void JsonDNP3LogObjects(SCJsonBuilder *js, DNP3ObjectList *objects)
108 SCJbSetUint(js,
"group", object->
group);
109 SCJbSetUint(js,
"variation", object->
variation);
110 SCJbSetUint(js,
"qualifier", object->
qualifier);
111 SCJbSetUint(js,
"prefix_code", object->
prefix_code);
112 SCJbSetUint(js,
"range_code", object->
range_code);
113 SCJbSetUint(js,
"start", object->
start);
114 SCJbSetUint(js,
"stop", object->
stop);
115 SCJbSetUint(js,
"count", object->
count);
118 SCJbOpenArray(js,
"points");
119 JsonDNP3LogObjectItems(js,
object);
127 static void JsonDNP3LogRequest(SCJsonBuilder *js,
DNP3Transaction *dnp3tx)
131 SCJbOpenObject(js,
"control");
132 JsonDNP3LogLinkControl(js, dnp3tx->
lh.control);
138 SCJbOpenObject(js,
"application");
140 SCJbOpenObject(js,
"control");
141 JsonDNP3LogApplicationControl(js, dnp3tx->
ah.control);
144 SCJbSetUint(js,
"function_code", dnp3tx->
ah.function_code);
147 SCJbOpenArray(js,
"objects");
148 JsonDNP3LogObjects(js, &dnp3tx->
objects);
152 SCJbSetBool(js,
"complete", dnp3tx->
complete);
158 static void JsonDNP3LogResponse(SCJsonBuilder *js,
DNP3Transaction *dnp3tx)
166 SCJbOpenObject(js,
"control");
167 JsonDNP3LogLinkControl(js, dnp3tx->
lh.control);
173 SCJbOpenObject(js,
"application");
175 SCJbOpenObject(js,
"control");
176 JsonDNP3LogApplicationControl(js, dnp3tx->
ah.control);
179 SCJbSetUint(js,
"function_code", dnp3tx->
ah.function_code);
182 SCJbOpenArray(js,
"objects");
183 JsonDNP3LogObjects(js, &dnp3tx->
objects);
187 SCJbSetBool(js,
"complete", dnp3tx->
complete);
192 SCJbOpenObject(js,
"iin");
193 SCJsonDNP3LogIin(js, (uint16_t)(dnp3tx->
iin.iin1 << 8 | dnp3tx->
iin.iin2));
201 SCJbOpenObject(js,
"dnp3");
203 SCJbOpenObject(js,
"request");
204 JsonDNP3LogRequest(js, tx);
209 SCJbOpenObject(js,
"response");
210 JsonDNP3LogResponse(js, tx);
218 static int JsonDNP3LoggerToServer(
ThreadVars *
tv,
void *thread_data,
219 const Packet *p,
Flow *f,
void *state,
void *vtx, uint64_t tx_id)
231 SCJbOpenObject(js,
"dnp3");
232 JsonDNP3LogRequest(js, tx);
240 static int JsonDNP3LoggerToClient(
ThreadVars *
tv,
void *thread_data,
241 const Packet *p,
Flow *f,
void *state,
void *vtx, uint64_t tx_id)
253 SCJbOpenObject(js,
"dnp3");
254 JsonDNP3LogResponse(js, tx);
263 void *vtx, uint64_t tx_id)
268 JsonDNP3LoggerToServer(
tv, thread_data, p, f, state, vtx, tx_id);
270 JsonDNP3LoggerToClient(
tv, thread_data, p, f, state, vtx, tx_id);
275 static void OutputDNP3LogDeInitCtxSub(
OutputCtx *output_ctx)
277 SCLogDebug(
"cleaning up sub output_ctx %p", output_ctx);
289 if (
unlikely(dnp3log_ctx == NULL)) {
292 dnp3log_ctx->
eve_ctx = json_ctx;
299 output_ctx->
data = dnp3log_ctx;
300 output_ctx->
DeInit = OutputDNP3LogDeInitCtxSub;
302 SCLogInfo(
"DNP3 log sub-module initialized.");
306 result.
ctx = output_ctx;
312 static TmEcode JsonDNP3LogThreadInit(
ThreadVars *t,
const void *initdata,
void **data)
319 if (initdata == NULL) {
320 SCLogDebug(
"Error getting context for DNP3. \"initdata\" is NULL.");
326 if (thread->
ctx == NULL) {
330 *data = (
void *)thread;
342 if (thread == NULL) {
353 OutputDNP3LogInitSub,
ALPROTO_DNP3, JsonDNP3Logger, JsonDNP3LogThreadInit,
354 JsonDNP3LogThreadDeinit);