Suricata

The DNP3 preprocessor incorrectly parses read (function code 1) requests. Read requests only include object headers, not the object values. The DNP3 preprocessor is incorrectly treating 2nd and subsequent object headers in a read request as if they are object values for the 1st header, as shown by the attached eve application layer output for the g50v1 read request. Subsequent testing (not shown) using the signature 'dnp3_obj:50,1; dnp3_obj:60,2;' confirms that this is not just an artefact of the eve output, but that this is how the dnp3_obj rules also parse the fragment.