Re: Extending zeek with rust
Quentin Mallet <[email protected]> Mon, 13 Jan 2020 23:29:33 +0100
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
--===============0525988576== Content-Type: multipart/alternative; boundary="----PEXYGDHNB8DKTZWXWJS9V52ZJ30HUK" Content-Transfer-Encoding: 7bit ------PEXYGDHNB8DKTZWXWJS9V52ZJ30HUK Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Thank you very much for your instructive answer=2E That's pretty much what = I figured, either wrap it up or start writing bindings until my fingers ble= ed, still it's better to get an expert's opinion before resigning oneself= =2E Regards, On 13 Jan 2020, 23:03, at 23:03, Johanna Amann <johanna@ici= r=2Eorg> wrote: >Hi Quentin, > >> I've been looking at several plugin examp= les for zeek and I have >> failed to >> find a definite answer to the foll= owing question: is it possible to >> write >> zeek plugins in Rust? The ob= vious way would be to compile any rust >> implementation in it's own lib an= d then wrap it in C/C++ but I would >> be >> interested in something more = "native"=2E > >Disclaimer: I have not used Rust myself=2E > >The only API t= hat we currently provide for writing plug-ins is based on > >C++=2E So - Ze= ek has to be able to call into your code with the C++ API >that it expects= , and your code has to be able to call back into Zeek=2E > >The way that yo= u outline - with the Rust code in its own library - >sounds like the easie= st alternative=2E > >If Rust can directly call into C++ - and can generate = a library that is > >callable in exactly the way that C++ expects, you migh= t be able to make > >this work without the wrapper - but after a short peek= into the >documetation this does not seem trivially possible=2E > >Johann= a ------PEXYGDHNB8DKTZWXWJS9V52ZJ30HUK Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body style=3D"zoom: 0%;"><div dir=3D"auto">Thank you ve= ry much for your instructive answer=2E That's pretty much what I figured, e= ither wrap it up or start writing bindings until my fingers bleed, still it= 's better to get an expert's opinion before resigning oneself=2E <br></div>= <div dir=3D"auto">Regards, </div> <div class=3D"gmail_quote" >On 13 Jan 20= 20, at 23:03, Johanna Amann <<a href=3D"mailto:johanna@icir=2Eorg" targe= t=3D"_blank">johanna@icir=2Eorg</a>> wrote:<blockquote class=3D"gmail_qu= ote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex; border-left: 1px solid rgb(204, = 204, 204); padding-left: 1ex;"> <pre class=3D"blue">Hi Quentin,<br><br><blo= ckquote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 1ex 0=2E8ex; border-= left: 1px solid #729fcf; padding-left: 1ex;"> I've been looking at several = plugin examples for zeek and I have <br> failed to<br> find a definite answ= er to the following question: is it possible to <br> write<br> zeek plugins= in Rust? The obvious way would be to compile any rust<br> implementation i= n it's own lib and then wrap it in C/C++ but I would <br> be<br> interested= in something more "native"=2E<br></blockquote><br>Disclaimer: I have not u= sed Rust myself=2E<br><br>The only API that we currently provide for writin= g plug-ins is based on <br>C++=2E So - Zeek has to be able to call into you= r code with the C++ API <br>that it expects, and your code has to be able t= o call back into Zeek=2E<br><br>The way that you outline - with the Rust co= de in its own library - <br>sounds like the easiest alternative=2E<br><br>I= f Rust can directly call into C++ - and can generate a library that is <br>= callable in exactly the way that C++ expects, you might be able to make <br= >this work without the wrapper - but after a short peek into the <br>docume= tation this does not seem trivially possible=2E<br><br>Johanna<br></pre></b= lockquote></div></body></html> ------PEXYGDHNB8DKTZWXWJS9V52ZJ30HUK-- --===============0525988576== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============0525988576==--