feat: support for new field types in plugins

userspace/libsinsp/plugin.cpp

@@ -311,11 +311,8 @@ bool sinsp_plugin::resolve_dylib_symbols(std::string &errstr)
 			strlcpy(tf.m_display, fdisplay.c_str(), sizeof(tf.m_display));
 			strlcpy(tf.m_description, fdesc.c_str(), sizeof(tf.m_description));
 			tf.m_print_format = PF_DEC;
-
-			if (ftype == "string") {
-				tf.m_type = PT_CHARBUF;
-			} else if (ftype == "uint64") {
-				tf.m_type = PT_UINT64;
+			if(m_pt_lut.find(ftype) != m_pt_lut.end()) {
+				tf.m_type = m_pt_lut.at(ftype);
 			} else {
 				throw sinsp_exception(
 						string("error in plugin ") + name() + ": invalid field type " + ftype);

userspace/libsinsp/plugin.h

@@ -178,6 +178,20 @@ class sinsp_plugin
 private:
 	ss_plugin_t* m_state;
 	plugin_handle_t* m_handle;
+	//
+	// Plugin Type Look Up Table
+	//
+	const std::unordered_map<std::string, ppm_param_type> m_pt_lut = {
+		{"string", PT_CHARBUF},
+		{"uint64", PT_UINT64},
+		{"reltime", PT_RELTIME},
+		{"abstime", PT_ABSTIME},
+		{"bool", PT_BOOL},
+		{"ipv4addr", PT_IPV4ADDR},
+		{"ipv4net", PT_IPV4NET},
+		{"ipv6addr", PT_IPV6ADDR},
+		{"ipv6net", PT_IPV6NET},
+	};
 
 	/** Event Sourcing **/
 	scap_source_plugin m_scap_source_plugin;

userspace/libsinsp/plugin_filtercheck.cpp

@@ -197,16 +197,34 @@ bool sinsp_filter_check_plugin::extract(sinsp_evt *evt, OUT vector<extract_value
 		extract_value_t res;
 		switch(type)
 		{
+			case PT_UINT64:
+			case PT_RELTIME:
+			case PT_ABSTIME:
+			{
+				res.len = sizeof(uint64_t);
+				res.ptr = (uint8_t*) &efield.res.u64[i];
+				break;
+			}
+			// maybe these fields could use directly str instead buf
+			case PT_IPV4NET:
+			case PT_IPV6ADDR:
+			case PT_IPV6NET:
+			{
+				res.len = (uint32_t) efield.res.buf[i].len;
+				res.ptr = (uint8_t*) efield.res.buf[i].ptr;
+				break;
+			}
 			case PT_CHARBUF:
 			{
 				res.len = strlen(efield.res.str[i]);
 				res.ptr = (uint8_t*) efield.res.str[i];
 				break;
 			}
-			case PT_UINT64:
+			case PT_BOOL:
+			case PT_IPV4ADDR:
 			{
-				res.len = sizeof(uint64_t);
-				res.ptr = (uint8_t*) &efield.res.u64[i];
+				res.len = sizeof(uint32_t);
+				res.ptr = (uint8_t*) &efield.res.u32[i];
 				break;
 			}
 			default:

userspace/plugin/plugin_api.h

@@ -28,7 +28,7 @@ extern "C" {
 // API versions of this plugin framework
 //
 #define PLUGIN_API_VERSION_MAJOR 2
-#define PLUGIN_API_VERSION_MINOR 0
+#define PLUGIN_API_VERSION_MINOR 1
 #define PLUGIN_API_VERSION_PATCH 0
 
 //
@@ -387,4 +387,4 @@ typedef struct
 
 #ifdef __cplusplus
 }
-#endif
+#endif

userspace/plugin/plugin_types.h

@@ -78,6 +78,11 @@ typedef struct ss_plugin_event
 	uint64_t ts;
 } ss_plugin_event;
 
+typedef struct ss_plugin_byte_buffer{
+	uint32_t len;
+	const void* ptr;
+} ss_plugin_byte_buffer;
+
 // Used in extract_fields functions below to receive a field/arg
 // pair and return an extracted value.
 // field_id: id of the field, as of its index in the list of
@@ -126,6 +131,9 @@ typedef struct ss_plugin_extract_field
     {
 		const char** str;
 		uint64_t* u64;
+		uint32_t* u32;
+		bool* boolean;
+		ss_plugin_byte_buffer* buf;
 	} res;
 	uint64_t res_len;
 
@@ -162,4 +170,4 @@ typedef void ss_instance_t;
 
 #ifdef __cplusplus
 }
-#endif
+#endif