Wireshark  4.3.0
The Wireshark network protocol analyzer
sinsp-span.h
1 /* sinsp-span.h
2  *
3  * By Gerald Combs
4  * Copyright (C) 2022 Sysdig, Inc.
5  *
6  * Wireshark - Network traffic analyzer
7  * By Gerald Combs <gerald@wireshark.org>
8  * Copyright 1998 Gerald Combs
9  *
10  * SPDX-License-Identifier: GPL-2.0-or-later
11  */
12 
13 #ifndef __SINSP_SPAN_H__
14 #define __SINSP_SPAN_H__
15 
16 #include <stdint.h>
17 
18 #include <epan/ftypes/ftypes.h>
19 #include <wsutil/wmem/wmem.h>
20 
21 #ifdef __cplusplus
22 extern "C" {
23 #endif // __cplusplus
24 
25 #define FALCO_FIELD_NAME_PREFIX "falco."
26 
28 typedef struct sinsp_span_t sinsp_span_t;
29 
30 typedef enum sinsp_field_display_format_e {
31  SFDF_UNKNOWN,
32  SFDF_DECIMAL,
33  SFDF_HEXADECIMAL,
34  SFDF_OCTAL
35 } sinsp_field_display_format_e;
36 
37 typedef struct sinsp_field_info_t {
38  enum ftenum type;
39  sinsp_field_display_format_e display_format;
40  char abbrev[64]; // filter name
41  char display[64]; // display name
42  char description[1024];
43  bool is_hidden;
44  bool is_conversation;
45  bool is_info;
46  bool is_numeric_address;
48 
49 typedef struct sinsp_field_extract_t {
50  uint32_t field_id; // in
51  const char *field_name; // in
52  enum ftenum type; // in, out
53  bool is_present; // out
54  union {
55  uint8_t *bytes;
56  char *str;
57  int32_t i32;
58  int64_t i64;
59  uint32_t u32;
60  uint64_t u64;
61  double dbl;
62  uint8_t ipv6[16];
63  bool boolean;
64  } res;
65  int res_len; // out
66  size_t parent_category; // out
68 
69 sinsp_span_t *create_sinsp_span(void);
70 void destroy_sinsp_span(sinsp_span_t *sinsp_span);
71 
72 // Common routines
73 uint32_t get_sinsp_source_id(sinsp_source_info_t *ssi);
74 const char *get_sinsp_source_last_error(sinsp_source_info_t *ssi);
75 const char *get_sinsp_source_name(sinsp_source_info_t *ssi);
76 const char* get_sinsp_source_description(sinsp_source_info_t *ssi);
77 bool get_sinsp_source_field_info(sinsp_source_info_t *ssi, size_t field_num, sinsp_field_info_t *field);
78 
79 // libsinsp builtin syscall routines.
80 void create_sinsp_syscall_source(sinsp_span_t *sinsp_span, sinsp_source_info_t **ssi_ptr);
81 void open_sinsp_capture(sinsp_span_t *sinsp_span, const char *filepath);
82 void close_sinsp_capture(sinsp_span_t *sinsp_span);
83 size_t get_syscall_source_ncategories(sinsp_source_info_t *ssi);
84 bool get_syscall_source_category_info(sinsp_source_info_t *ssi, size_t category_num, sinsp_field_info_t *field);
85 bool extract_syscall_source_fields(sinsp_span_t *sinsp_span, sinsp_source_info_t *ssi, int64_t seek_pos, uint16_t event_type, uint32_t nparams, uint64_t ts, uint64_t thread_id, uint16_t cpu_id, uint8_t *evt_data, uint32_t evt_datalen, wmem_allocator_t *pool, sinsp_field_extract_t *sinsp_fields, uint32_t sinsp_field_len);
86 
87 // Extractor plugin routines.
88 // These roughly match common_plugin_info
89 char *create_sinsp_plugin_source(sinsp_span_t *sinsp_span, const char* libname, sinsp_source_info_t **ssi_ptr);
90 size_t get_sinsp_source_nfields(sinsp_source_info_t *ssi);
91 bool extract_plugin_source_fields(sinsp_source_info_t *ssi, uint16_t event_type, uint32_t nparams, uint8_t *evt_data, uint32_t evt_datalen, wmem_allocator_t *pool, sinsp_field_extract_t *sinsp_fields, uint32_t sinsp_field_len);
92 
93 
94 #ifdef __cplusplus
95 }
96 #endif // __cplusplus
97 
98 #endif // __SINSP_SPAN_H__
Definition: wmem_allocator.h:27
Definition: sinsp-span.h:49
Definition: sinsp-span.h:37
Definition: sinsp-span.cpp:37
Definition: sinsp-span.cpp:53