Derive Macro EventPayload

#[derive(EventPayload)]
{
    // Attributes available to this derive:
    #[event_payload]
    #[falco_event_crate]
}

Derive event-related traits for a struct

Use this macro to define new event types. For example, the PPME_PLUGINEVENT_E event could be defined as:

#[derive(Default, falco_event::EventPayload)]
#[event_payload(source = Some("syscall"), code = 322, length_type = u32)]
pub struct MyPluginEvent<'a> {
    pub plugin_id: u32,
    pub data: &'a [u8],
}

If the falco_event crate is available under a different path, provide its name in the falco_event_crate attribute:

#[derive(Default, falco_event_alt::EventPayload)]
#[event_payload(source = Some("syscall"), code = 322, length_type = u32)]
#[falco_event_crate(falco_event_alt)]
pub struct MyPluginEvent<'a> {
    pub plugin_id: u32,
    pub data: &'a [u8],
}

To make your struct usable as an event payload, use the #[event_payload] attribute with the following (required) parameters:

• source (Option<&str>) – the name of the event source, for use in plugin metadata
• code (u16) – the raw numeric event type id
• length_type (u16 or u32) – the type of parameter length; most events use u16 but a few notable ones (like PPME_ASYNCEVENT_E and PPME_PLUGINEVENT_E) support larger parameter values and so their length type is u32

This macro can be used only on structs, not enums. Each field of the struct must implement fields::FromBytes and fields::FromBytes. Due to the requirements of FieldMeta-based deserialization, the whole struct must also implement Default and may have at most one lifetime generic parameter.

See above for an example use.

This variant derives the following traits:

• events::FromRawEvent to provide deserialization
• events::PayloadToBytes to provide serialization