Conversation
Especially fix setup-app-layer script to not forget this part This allows, for simple loggers, to have a unique definition of the actual logging function with the jsonbuilder. This way, alerts, files, and app-layer event can share the code to output the same data. Ticket: OISF#3827
Ticket: 6500
Ticket: 6501
Ticket: 5977
Ticket: 3827
as fixed patterns can be enough
Only implemented for snmp.version and mqtt.password But should be implemented for more
So that we can have dynamically registered protocols. Doing it at compile time, with CFLAGS=-DALPROTO_DYNAMIC_NB=1, allows to keep the rest of the code using ALPROTO_MAX Ticket: 5053
Ticket: 5053
|
Also draft : |
|
Replaced by #9812 |
| static size_t app_layer_plugins_nb = 0; | ||
| #endif | ||
|
|
||
| int SCPluginRegisterAppLayer(SCAppLayerPlugin *plugin) |
There was a problem hiding this comment.
I'd prefer to not think about registering an app-layer as a plugin. Could app-layers not be registered the same being included or as plugins? For plugin support we just expose the API that Suricata would already be using.
There was a problem hiding this comment.
I do not understand your sentences here... Could you rephrase ?
(Plus I need to push a plugin example)
There was a problem hiding this comment.
Why couldn't a non-plugin AppLayer not register itself through this API? In which case its no longer a plugin API, its just the API for registering app-layers. In short, putting Plugin in here seems a little artificial.
It was a mistake in the EVE file type API which I've already started to undo.
There was a problem hiding this comment.
Ok, so this is just about renaming SCPluginRegisterAppLayer to SCRegisterDynamicAppLayer, do I get it ?
Would we want to get rid of all the static ones ?
There was a problem hiding this comment.
Would we want to get rid of all the static ones ?
Personally I'd think so unless there is a performance hit?
I like to think of plugin support as just exposing the APIs we already use internally. Then there is nothing really different from a built-in or plugin, and we're constantly dog-fooding the APIs.
There was a problem hiding this comment.
And so, should this be moved out of util-plugin.c to app-layer-register.c ?
2 participants
Link to redmine tickets:
https://redmine.openinfosecfoundation.org/issues/3827
https://redmine.openinfosecfoundation.org/issues/5977
https://redmine.openinfosecfoundation.org/issues/6500
https://redmine.openinfosecfoundation.org/issues/6501
https://redmine.openinfosecfoundation.org/issues/5053
Describe changes:
#9799 with more commits
OISF/suricata-verify#1465
Draft cc @jasonish
I think the first commits ie #9768 should be merged first in its own PR
But that gives an overview of the POC