rust/ffi: use Packet wrapper in eve callback signature

Author: jasonish

doc/userguide/devguide/extending/output/eve-hooks.rst

@@ -55,7 +55,7 @@ function pointer plus ``user`` pointer.
 The closure receives:
 
 - ``tv``: the ``ThreadVars`` for the thread performing the logging
-- ``p``: the ``Packet``, if available
+- ``p``: the ``Packet``, or ``None`` if not available
 - ``f``: the ``Flow``, if available
 - ``jb``: a Rust ``JsonBuilder`` wrapper for the current EVE record
 

examples/plugins/rust/src/mod.rs

@@ -3,8 +3,11 @@ use std::ptr::null_mut;
 use suricata_ffi::eve::{self, SCJsonBuilder};
 use suricata_ffi::flow;
 use suricata_ffi::jsonbuilder::JsonBuilder;
+use suricata_ffi::packet::Packet;
 use suricata_ffi::{SCLogError, SCLogNotice};
-use suricata_sys::sys::{Flow, Packet, SCEveRegisterCallback, SCPlugin, ThreadVars};
+use suricata_sys::sys::{
+    Flow, Packet as RawPacket, SCEveRegisterCallback, SCPlugin, ThreadVars,
+};
 
 unsafe extern "C" fn init() {
     suricata_ffi::plugin::init();
@@ -40,7 +43,7 @@ pub fn register_flow_callbacks() -> Result<(), &'static str> {
 
 unsafe extern "C" fn log_eve_raw(
     _tv: *mut ThreadVars,
-    _p: *const Packet,
+    _p: *const RawPacket,
     _f: *mut Flow,
     jb: *mut SCJsonBuilder,
     _user: *mut std::os::raw::c_void,
@@ -53,22 +56,23 @@ unsafe extern "C" fn log_eve_raw(
 
 fn log_eve_wrapped(
     _tv: *mut ThreadVars,
-    _p: *const Packet,
+    p: Option<Packet<'_>>,
     f: *mut Flow,
     jb: &mut JsonBuilder,
 ) -> Result<(), suricata_ffi::jsonbuilder::Error> {
     jb.open_object("rust_wrapped")?;
     jb.set_string("example", "eve-callback")?;
+    jb.set_string("has_packet", if p.is_some() { "true" } else { "false" })?;
     jb.set_string("has_flow", if f.is_null() { "false" } else { "true" })?;
     jb.close()?;
     Ok(())
 }
 
-fn log_flow_init(_tv: *mut ThreadVars, _f: *mut Flow, _p: *const Packet) {
+fn log_flow_init(_tv: *mut ThreadVars, _f: *mut Flow, _p: *const RawPacket) {
     SCLogNotice!("rust example flow init callback: flow={:p}", _f);
 }
 
-fn log_flow_update(_tv: *mut ThreadVars, _f: *mut Flow, _p: *mut Packet) {
+fn log_flow_update(_tv: *mut ThreadVars, _f: *mut Flow, _p: *mut RawPacket) {
     SCLogNotice!(
         "rust example flow update callback: flow={:p}, packet={:p}",
         _f,

rust/ffi/src/eve.rs

@@ -18,7 +18,9 @@
 use std::ffi::CString;
 use std::os::raw::c_void;
 
-pub use suricata_sys::sys::{Flow, Packet, SCEveUserCallbackFn, SCJsonBuilder, ThreadVars};
+pub use suricata_sys::sys::{
+    Flow, Packet as RawPacket, SCEveUserCallbackFn, SCJsonBuilder, ThreadVars,
+};
 use suricata_sys::sys::{
     SCEveFileType, SCEveFileTypeDeinitFunc, SCEveFileTypeInitFunc, SCEveFileTypeThreadDeinitFunc,
     SCEveFileTypeThreadInitFunc, SCEveFileTypeWriteFunc, SCEveRegisterCallback,
@@ -79,7 +81,7 @@ impl EveFileType {
 ///
 /// The callback receives:
 /// - `tv`: the `ThreadVars` for the thread performing the logging
-/// - `p`: the `Packet`, if available
+/// - `p`: the `Packet`, or `None` if not available
 /// - `f`: the `Flow`, if available
 /// - `jb`: the JSON builder for the current EVE record
 ///
@@ -110,9 +112,9 @@ impl EveFileType {
 /// The callback must not panic.
 pub fn register_callback<F>(callback: F) -> Result<(), &'static str>
 where
-    F: Fn(
+    F: for<'a> Fn(
             *mut ThreadVars,
-            *const Packet,
+            Option<crate::packet::Packet<'a>>,
             *mut Flow,
             &mut crate::jsonbuilder::JsonBuilder,
         ) -> Result<(), crate::jsonbuilder::Error>
@@ -134,11 +136,12 @@ where
 /// Internal wrapper used to adapt the C EVE callback to a Rust
 /// closure callback.
 unsafe extern "C" fn callback_wrapper<F>(
-    tv: *mut ThreadVars, p: *const Packet, f: *mut Flow, jb: *mut SCJsonBuilder, user: *mut c_void,
+    tv: *mut ThreadVars, p: *const RawPacket, f: *mut Flow, jb: *mut SCJsonBuilder,
+    user: *mut c_void,
 ) where
-    F: Fn(
+    F: for<'a> Fn(
             *mut ThreadVars,
-            *const Packet,
+            Option<crate::packet::Packet<'a>>,
             *mut Flow,
             &mut crate::jsonbuilder::JsonBuilder,
         ) -> Result<(), crate::jsonbuilder::Error>
@@ -149,7 +152,12 @@ unsafe extern "C" fn callback_wrapper<F>(
     let callback = &*(user as *const F);
     let mut jb = crate::jsonbuilder::JsonBuilder::from_raw(jb);
     let mark = jb.get_mark();
-    if callback(tv, p, f, &mut jb).is_err() {
+    let packet = if p.is_null() {
+        None
+    } else {
+        Some(crate::packet::Packet::from_ptr(p))
+    };
+    if callback(tv, packet, f, &mut jb).is_err() {
         let _ = jb.restore_mark(&mark);
     }
 }