output-eve: finish exposing to bindgen

As all out output-eve.h is now exposed, merge output-eve.h and
output-eve-bindgen.h back into one file, output-eve.h.

rust/Makefile.am

@@ -152,6 +152,8 @@ if HAVE_BINDGEN
 		--allowlist-function 'SC.*' \
 		--allowlist-var 'SC.*' \
 		--opaque-type 'SCConfNode' \
+		--allowlist-type 'ThreadVars.?' \
+		--opaque-type 'ThreadVars.?' \
 		$(abs_top_srcdir)/src/bindgen.h \
 		-- \
 		-DHAVE_CONFIG_H -I../src -I../rust/gen $(CPPFLAGS)

rust/sys/src/sys.rs

@@ -414,6 +414,29 @@ extern "C" {
 extern "C" {
     pub fn SCConfGetValueNode(node: *const SCConfNode) -> *const ::std::os::raw::c_char;
 }
+#[repr(C)]
+#[derive(Debug, Default, Copy, Clone, PartialEq, Eq)]
+pub struct ThreadVars_ {
+    _unused: [u8; 0],
+}
+pub type ThreadVars = u8;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct Flow_ {
+    _unused: [u8; 0],
+}
+pub type Flow = Flow_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCJsonBuilder {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct Packet_ {
+    _unused: [u8; 0],
+}
+pub type Packet = Packet_;
 pub type ThreadId = u32;
 #[repr(u32)]
 #[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
@@ -552,6 +575,31 @@ pub type SCEveFileType = SCEveFileType_;
 extern "C" {
     pub fn SCRegisterEveFileType(arg1: *mut SCEveFileType) -> bool;
 }
+extern "C" {
+    pub fn SCEveFindFileType(name: *const ::std::os::raw::c_char) -> *mut SCEveFileType;
+}
+#[doc = " \\brief Function type for EVE callbacks.\n\n The function type for callbacks registered with\n SCEveRegisterCallback. This function will be called with the\n SCJsonBuilder just prior to the top-level object being closed. New\n fields may be added, however, there is no way to alter existing\n objects already added to the SCJsonBuilder.\n\n \\param tv The ThreadVars for the thread performing the logging.\n \\param p Packet if available.\n \\param f Flow if available.\n \\param user User data provided during callback registration."]
+pub type SCEveUserCallbackFn = ::std::option::Option<
+    unsafe extern "C" fn(
+        tv: *mut ThreadVars,
+        p: *const Packet,
+        f: *mut Flow,
+        jb: *mut SCJsonBuilder,
+        user: *mut ::std::os::raw::c_void,
+    ),
+>;
+extern "C" {
+    #[doc = " \\brief Register a callback for adding extra information to EVE logs.\n\n Allow users to register a callback for each EVE log. The callback\n is called just before the root object on the SCJsonBuilder is to be\n closed.\n\n New objects and fields can be appended, but existing entries cannot be modified.\n\n Packet and Flow will be provided if available, but will otherwise be\n NULL.\n\n Limitations: At this time the callbacks will only be called for EVE\n loggers that use SCJsonBuilder, notably this means it won't be called\n for stats records at this time.\n\n \\returns true if callback is registered, false is not due to memory\n     allocation error."]
+    pub fn SCEveRegisterCallback(
+        fn_: SCEveUserCallbackFn, user: *mut ::std::os::raw::c_void,
+    ) -> bool;
+}
+extern "C" {
+    #[doc = " \\internal\n\n Run EVE callbacks."]
+    pub fn SCEveRunCallbacks(
+        tv: *mut ThreadVars, p: *const Packet, f: *mut Flow, jb: *mut SCJsonBuilder,
+    );
+}
 extern "C" {
     pub fn SCSigTablePreRegister(
         KeywordsRegister: ::std::option::Option<unsafe extern "C" fn()>,
@@ -636,12 +684,6 @@ extern "C" {
 }
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
-pub struct Flow_ {
-    _unused: [u8; 0],
-}
-pub type Flow = Flow_;
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
 pub struct SigMatchCtx_ {
     _unused: [u8; 0],
 }
@@ -1712,11 +1754,6 @@ extern "C" {
         set: *mut Dataset, data: *const u8, data_len: u32, rep: *const DataRepType,
     ) -> ::std::os::raw::c_int;
 }
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct SCJsonBuilder {
-    _unused: [u8; 0],
-}
 #[doc = " A \"mark\" or saved state for a JsonBuilder object.\n\n The name is full, and the types are u64 as this object is used\n directly in C as well."]
 #[repr(C)]
 #[derive(Debug, Default, Copy, Clone, PartialEq, Eq)]

src/bindgen.h

@@ -39,7 +39,7 @@
 #undef DEBUG_VALIDATION
 #include "conf.h"
 
-#include "output-eve-bindgen.h"
+#include "output-eve.h"
 #include "detect-engine-register.h"
 #include "detect-engine-buffer.h"
 #include "detect-engine-helper.h"

src/output-eve.h

@@ -30,10 +30,197 @@
 #ifndef SURICATA_OUTPUT_EVE_H
 #define SURICATA_OUTPUT_EVE_H
 
+#ifndef SURICATA_BINDGEN_H
 #include "suricata-common.h"
 #include "rust.h"
 #include "conf.h"
-#include "output-eve-bindgen.h"
+#else
+typedef struct ThreadVars_ ThreadVars;
+typedef struct Flow_ Flow;
+typedef struct SCJsonBuilder SCJsonBuilder;
+typedef struct Packet_ Packet;
+#endif
+
+#include "app-layer-protos.h"
+
+typedef uint32_t ThreadId;
+
+typedef enum SCOutputJsonLogDirection {
+    LOG_DIR_PACKET = 0,
+    LOG_DIR_FLOW,
+    LOG_DIR_FLOW_TOCLIENT,
+    LOG_DIR_FLOW_TOSERVER,
+} SCOutputJsonLogDirection;
+
+typedef bool (*EveJsonSimpleTxLogFunc)(const void *, void *);
+
+typedef struct EveJsonSimpleAppLayerLogger {
+    EveJsonSimpleTxLogFunc LogTx;
+    const char *name;
+} EveJsonSimpleAppLayerLogger;
+
+EveJsonSimpleAppLayerLogger *SCEveJsonSimpleGetLogger(AppProto alproto);
+
+typedef struct EveJsonTxLoggerRegistrationData {
+    const char *confname;
+    const char *logname;
+    AppProto alproto;
+    uint8_t dir;
+    EveJsonSimpleTxLogFunc LogTx;
+} EveJsonTxLoggerRegistrationData;
+
+int SCOutputEvePreRegisterLogger(EveJsonTxLoggerRegistrationData reg_data);
+
+/** \brief Function type for EVE file-type initialization. */
+typedef int (*SCEveFileTypeInitFunc)(const SCConfNode *conf, const bool threaded, void **init_data);
+
+/** \brief Function type for EVE file-type thread initialization. */
+typedef int (*SCEveFileTypeThreadInitFunc)(
+        const void *init_data, const ThreadId thread_id, void **thread_data);
+
+/** \brief Function type for EVE file-type writes. */
+typedef int (*SCEveFileTypeWriteFunc)(
+        const char *buffer, const int buffer_len, const void *init_data, void *thread_data);
+
+/** \brief Function type for EVE file-type thread deinitialization. */
+typedef void (*SCEveFileTypeThreadDeinitFunc)(const void *init_data, void *thread_data);
+
+/** \brief Function type for EVE file-type deinitialization. */
+typedef void (*SCEveFileTypeDeinitFunc)(void *init_data);
+
+/** \brief Structure used to define an EVE output file type.
+ *
+ * EVE filetypes implement an object with a file-like interface and
+ * are used to output EVE log records to files, syslog, or
+ * database. They can be built-in such as the syslog (see
+ * SyslogInitialize()) and nullsink (see NullLogInitialize()) outputs,
+ * registered by a library user or dynamically loaded as a plugin.
+ *
+ * The life cycle of an EVE filetype is:
+ *   - Init: called once for each EVE instance using this filetype
+ *   - ThreadInit: called once for each output thread
+ *   - Write: called for each log record
+ *   - ThreadDeinit: called once for each output thread on exit
+ *   - Deinit: called once for each EVE instance using this filetype on exit
+ *
+ * Examples:
+ * - built-in syslog: \ref src/output-eve-syslog.c
+ * - built-in nullsink: \ref src/output-eve-null.c
+ * - example plugin: \ref examples/plugins/c-json-filetype/filetype.c
+ *
+ * ### Multi-Threaded Note:
+ *
+ * The EVE logging system can be configured by the Suricata user to
+ * run in threaded or non-threaded modes. In the default non-threaded
+ * mode, ThreadInit will only be called once and the filetype does not
+ * need to be concerned with threads.
+ *
+ * However, in **threaded** mode, ThreadInit will be called multiple
+ * times and the filetype needs to be thread aware and thread-safe. If
+ * utilizing a unique resource such as a file for each thread then you
+ * may be naturally thread safe. However, if sharing a single file
+ * handle across all threads then your filetype will have to take care
+ * of locking, etc.
+ */
+typedef struct SCEveFileType_ {
+    /**
+     * \brief The name of the output, used in the configuration.
+     *
+     * This name is used by the configuration file to specify the EVE
+     * filetype used.
+     *
+     * For example:
+     *
+     * \code{.yaml}
+     * outputs:
+     *   - eve-log:
+     *       filetype: my-output-name
+     * \endcode
+     */
+    const char *name;
+
+    /**
+     * \brief Function to initialize this filetype.
+     *
+     * \param conf The ConfNode of the `eve-log` configuration
+     *     section this filetype is being initialized for
+     *
+     * \param threaded Flag to specify if the EVE sub-systems is in
+     *     threaded mode or not
+     *
+     * \param init_data An output pointer for filetype specific data
+     *
+     * \retval 0 on success, -1 on failure
+     */
+    SCEveFileTypeInitFunc Init;
+
+    /**
+     * \brief Initialize thread specific data.
+     *
+     * Initialize any thread specific data. For example, if
+     * implementing a file output you might open the files here, so
+     * you have one output file per thread.
+     *
+     * \param init_data Data setup during Init
+     *
+     * \param thread_id A unique ID to differentiate this thread from
+     *     others. If EVE is not in threaded mode this will be called
+     *     once with a ThreadId of 0. In threaded mode the ThreadId of
+     *     0 correlates to the main Suricata thread.
+     *
+     * \param thread_data Output pointer for any data required by this
+     *     thread.
+     *
+     * \retval 0 on success, -1 on failure
+     */
+    SCEveFileTypeThreadInitFunc ThreadInit;
+
+    /**
+     * \brief Called for each EVE log record.
+     *
+     * The Write function is called for each log EVE log record. The
+     * provided buffer contains a fully formatted EVE record in JSON
+     * format.
+     *
+     * \param buffer The fully formatted JSON EVE log record
+     *
+     * \param buffer_len The length of the buffer
+     *
+     * \param init_data The data setup in the call to Init
+     *
+     * \param thread_data The data setup in the call to ThreadInit
+     *
+     * \retval 0 on success, -1 on failure
+     */
+    SCEveFileTypeWriteFunc Write;
+
+    /**
+     * \brief Called to deinitialize each thread.
+     *
+     * This function will be called for each thread. It is where any
+     * resources allocated in ThreadInit should be released.
+     *
+     * \param init_data The data setup in Init
+     *
+     * \param thread_data The data setup in ThreadInit
+     */
+    SCEveFileTypeThreadDeinitFunc ThreadDeinit;
+
+    /**
+     * \brief Final call to deinitialize this filetype.
+     *
+     * Called, usually on exit to deinitialize and free any resources
+     * allocated during Init.
+     *
+     * \param init_data Data setup in the call to Init.
+     */
+    SCEveFileTypeDeinitFunc Deinit;
+
+    /* Internal list management. */
+    TAILQ_ENTRY(SCEveFileType_) entries;
+} SCEveFileType;
+
+bool SCRegisterEveFileType(SCEveFileType *);
 
 SCEveFileType *SCEveFindFileType(const char *name);