falco_plugin/plugin/listen/
mod.rs

1pub mod routine;
2#[doc(hidden)]
3pub mod wrappers;
4
5use crate::base::Plugin;
6use crate::listen::ThreadPool;
7use crate::plugin::error::last_error::LastError;
8use crate::plugin::listen::wrappers::CaptureListenPluginExported;
9use crate::plugin::tables::vtable::writer::LazyTableWriter;
10use crate::tables::LazyTableReader;
11use falco_plugin_api::ss_plugin_capture_listen_input;
12
13/// Support for capture listening plugins
14pub trait CaptureListenPlugin: Plugin + CaptureListenPluginExported {
15    /// # Capture open notification
16    ///
17    /// This method gets called whenever the capture is started
18    fn capture_open(&mut self, listen_input: &CaptureListenInput) -> Result<(), anyhow::Error>;
19
20    /// # Capture close notification
21    ///
22    /// This method gets called whenever the capture is stopped
23    fn capture_close(&mut self, listen_input: &CaptureListenInput) -> Result<(), anyhow::Error>;
24}
25
26/// # The input to a capture listening plugin
27///
28/// It has two fields containing the vtables needed to access tables imported through
29/// the [tables API](`crate::tables`), as well as a [`ThreadPool`] to run tasks
30/// in the background.
31#[derive(Debug)]
32pub struct CaptureListenInput<'t> {
33    /// Accessors to the thread pool for submitting routines to
34    pub thread_pool: ThreadPool,
35    /// Accessors to read table entries
36    pub reader: LazyTableReader<'t>,
37    /// Accessors to modify table entries
38    pub writer: LazyTableWriter<'t>,
39}
40
41impl CaptureListenInput<'_> {
42    pub(in crate::plugin::listen) unsafe fn try_from(
43        value: *const ss_plugin_capture_listen_input,
44        last_error: LastError,
45    ) -> Result<Self, anyhow::Error> {
46        let input = unsafe {
47            value
48                .as_ref()
49                .ok_or_else(|| anyhow::anyhow!("Got null event parse input"))?
50        };
51
52        let thread_pool = ThreadPool::try_from(input.owner, input.routine, last_error.clone())?;
53
54        let reader = unsafe {
55            input
56                .table_reader_ext
57                .as_ref()
58                .ok_or_else(|| anyhow::anyhow!("Got null reader vtable"))?
59        };
60        let writer = unsafe {
61            input
62                .table_writer_ext
63                .as_ref()
64                .ok_or_else(|| anyhow::anyhow!("Got null writer vtable"))?
65        };
66
67        let reader = LazyTableReader::new(reader, last_error.clone());
68        let writer = LazyTableWriter::try_from(writer, last_error)?;
69
70        Ok(Self {
71            thread_pool,
72            reader,
73            writer,
74        })
75    }
76}
falco_plugin/plugin/listen/mod.rs

falco_plugin/plugin/listen/
mod.rs
