Skip to content

Conversation

jasonish
Copy link
Member

Previous PR: #11935

Add features required for implementing something like nDPI as a plugin, includes:

  • flow init callback
  • flow update callback
  • flow finish callback
  • thread storage (based on flow storage)
  • thread init callback

Still needs:

  • eve log hook

Adds user registerable callbacks for flow initialization, flow
update and flow finish.

Some plugins, such as other DPI libraries like nDPI need a way to hook
into these flow lifecycle events.

Ticket: OISF#7319
Ticket: OISF#7320
@codecov
Copy link

codecov bot commented Oct 11, 2024

Codecov Report

Attention: Patch coverage is 64.00000% with 63 lines in your changes missing coverage. Please review.

Project coverage is 82.73%. Comparing base (58556b7) to head (d061138).
Report is 21 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #11942      +/-   ##
==========================================
- Coverage   82.74%   82.73%   -0.02%     
==========================================
  Files         912      915       +3     
  Lines      249102   249273     +171     
==========================================
+ Hits       206117   206229     +112     
- Misses      42985    43044      +59     
Flag Coverage Δ
fuzzcorpus 60.77% <15.73%> (+0.05%) ⬆️
livemode 18.84% <19.10%> (-0.02%) ⬇️
pcap 43.84% <21.34%> (-0.27%) ⬇️
suricata-verify 62.14% <21.34%> (-0.04%) ⬇️
unittests 58.99% <57.14%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

For library users and plugins that need to hook into the thread life
cycle, perhaps to initialize some thread storage.
This plugin stub shows how a plugin like nDPI might be use the flow
init and flow update callbacks to do its work. Also shows usage of
FlowStorage to avoid modifying the Flow struct directly.
@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 23090

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 23093

@jasonish
Copy link
Member Author

See #11970.

@jasonish jasonish closed this Oct 15, 2024
@jasonish jasonish deleted the ndpi-dummy-plugin/v2 branch March 31, 2025 13:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants