sinsp-span.h

/* sinsp-span.h
 *
 * By Gerald Combs
 * Copyright (C) 2022 Sysdig, Inc.
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <[email protected]>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */
 
#ifndef __SINSP_SPAN_H__
#define __SINSP_SPAN_H__
 
#include <stdint.h>
 
#include <epan/ftypes/ftypes.h>
#include <wsutil/wmem/wmem.h>
#include <wiretap/wtap.h>
 
#ifdef __cplusplus
extern "C" {
#endif // __cplusplus
 
#define FALCO_FIELD_NAME_PREFIX "falco."
 
#define N_PROC_LINEAGE_ENTRIES 16
#define N_PROC_LINEAGE_ENTRY_FIELDS 4
 
typedef struct sinsp_source_info_t sinsp_source_info_t;
typedef struct sinsp_span_t sinsp_span_t;

typedef enum sinsp_field_display_format_e {
    SFDF_UNKNOWN,     
    SFDF_DECIMAL,     
    SFDF_HEXADECIMAL, 
    SFDF_OCTAL        
} sinsp_field_display_format_e;
 

typedef enum sinsp_syscall_category_e {
    SSC_EVENT,        
    SSC_EVTARGS,      
    SSC_PROCESS,      
    SSC_PROCLINEAGE,  
    SSC_USER,         
    SSC_GROUP,        
    SSC_CONTAINER,    
    SSC_FD,           
    SSC_FS,           
/*  SSC_SYSLOG, */    
    SSC_FDLIST,       
    SSC_OTHER,        
    NUM_SINSP_SYSCALL_CATEGORIES 
} sinsp_syscall_category_e;
 

typedef struct sinsp_field_info_t {
    enum ftenum                  type;            
    sinsp_field_display_format_e display_format;  
    char abbrev[64];                              
    char display[64];                             
    char description[1024];                       
    bool skip;            
    bool is_info;         
    bool is_conversation; 
    bool is_numeric_address; 
} sinsp_field_info_t;
 

#define SFE_SMALL_BUF_SIZE 8

typedef struct sinsp_field_extract_t {
    union {
        uint8_t    *bytes;                     
        const char *str;                       
        int32_t     i32;                       
        int64_t     i64;                       
        uint32_t    u32;                       
        uint64_t    u64;                       
        double      dbl;                       
        bool        boolean;                   
        char        small_str[SFE_SMALL_BUF_SIZE];   
        uint8_t     small_bytes[SFE_SMALL_BUF_SIZE]; 
    } res;
    int      res_len;   
    uint16_t field_idx; 
} sinsp_field_extract_t;
 

#define PLUGIN_EVENT_HEADER_SIZE (26 + 4 + 4 + 4)

typedef struct plugin_field_extract_t {
    uint32_t    field_id;    
    const char *field_name;  
    enum ftenum type;        
    bool        is_present;  
    bool        is_generated;

    union {
        uint8_t    *bytes;    
        const char *str;      
        int32_t     i32;      
        int64_t     i64;      
        uint32_t    u32;      
        uint64_t    u64;      
        double      dbl;      
        uint8_t     ipv6[16]; 
        bool        boolean;  
    } res;
    int data_start;  
    int data_length; 
} plugin_field_extract_t;

sinsp_span_t *create_sinsp_span(void);

void destroy_sinsp_span(sinsp_span_t *sinsp_span);
 
// Common routines
uint32_t get_sinsp_source_id(sinsp_source_info_t *ssi);

const char *get_sinsp_source_last_error(sinsp_source_info_t *ssi);

const char *get_sinsp_source_name(sinsp_source_info_t *ssi);

const char *get_sinsp_source_description(sinsp_source_info_t *ssi);

bool get_sinsp_source_field_info(sinsp_source_info_t *ssi, size_t field_num, sinsp_field_info_t *field);
 
// libsinsp builtin syscall routines.

void create_sinsp_syscall_source(sinsp_span_t *sinsp_span, sinsp_source_info_t **ssi_ptr);

void open_sinsp_capture(sinsp_span_t *sinsp_span, struct wtap *wth,
                        const struct wtap_rec *first_event_rec);

void feed_sinsp_event_block(sinsp_span_t *sinsp_span, const struct wtap_rec *rec,
                            const uint8_t *event_data, uint32_t event_data_len);
 
//uint32_t process_syscall_capture(sinsp_span_t * sinsp_span, sinsp_source_info_t *ssi, uint32_t to_event);

void close_sinsp_capture(sinsp_span_t *sinsp_span);

bool extract_syscall_source_fields(sinsp_span_t *sinsp_span, sinsp_source_info_t *ssi, uint32_t frame_num, sinsp_field_extract_t **sinsp_fields, uint32_t *sinsp_field_len, void** sisnp_evt_info);

sinsp_syscall_category_e get_syscall_parent_category(sinsp_source_info_t *ssi, size_t field_check_idx);

bool get_extracted_syscall_source_fields(sinsp_span_t *sinsp_span, uint32_t frame_num, sinsp_field_extract_t **sinsp_fields, uint32_t *sinsp_field_len, void** sinsp_evt_info);

char* get_evt_arg_name(void* sinsp_evt_info, uint32_t arg_num);

bool evt_creates_fd(void* sinsp_evt_info);
 
// Extractor plugin routines.
// These roughly match common_plugin_info

char *create_sinsp_plugin_source(sinsp_span_t *sinsp_span, const char* libname, sinsp_source_info_t **ssi_ptr);

size_t get_sinsp_source_nfields(sinsp_source_info_t *ssi);

bool extract_plugin_source_fields(sinsp_source_info_t *ssi, uint32_t event_num, const uint8_t *evt_data, uint32_t evt_datalen, wmem_allocator_t *pool, plugin_field_extract_t *sinsp_fields, uint32_t sinsp_field_len);
 
 
#ifdef __cplusplus
}
#endif // __cplusplus
 
#endif // __SINSP_SPAN_H__