new(libsinsp): capture listening capability

Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
falcosecurity · Jul 15, 2024 · bbcf41e · bbcf41e
1 parent f0bc960
commit bbcf41e
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 6 deletions.
diff --git a/userspace/plugin/plugin_loader.c b/userspace/plugin/plugin_loader.c
@@ -296,6 +296,16 @@ plugin_caps_t plugin_get_capabilities(const plugin_handle_t* h, char* err)
         err_append(err, "must implement both 'plugin_get_async_events' and 'plugin_set_async_event_handler' (async events)", ", ");
     }
 
+    if (h->api.capture_open != NULL && h->api.capture_close != NULL)
+    {
+        caps = (plugin_caps_t)((uint32_t) caps | (uint32_t) CAP_CAPTURE_LISTENING);
+    }
+    else if (h->api.capture_open != NULL)
+    {
+        caps = (plugin_caps_t)((uint32_t) caps | (uint32_t) CAP_BROKEN);
+        err_append(err, "must implement both 'plugin_capture_open' and 'plugin_capture_close' (capture listening)", ", ");
+    }
+
     return caps;
 }
 

diff --git a/userspace/plugin/plugin_loader.h b/userspace/plugin/plugin_loader.h
@@ -39,12 +39,13 @@ extern "C" {
 */
 typedef enum
 {
-    CAP_NONE        = 0,
-    CAP_SOURCING    = 1 << 0,
-    CAP_EXTRACTION  = 1 << 1,
-    CAP_PARSING     = 1 << 2,
-    CAP_ASYNC       = 1 << 3,
-    CAP_BROKEN      = 1 << 31, // used to report inconsistencies
+    CAP_NONE                = 0,
+    CAP_SOURCING            = 1 << 0,
+    CAP_EXTRACTION          = 1 << 1,
+    CAP_PARSING             = 1 << 2,
+    CAP_ASYNC               = 1 << 3,
+    CAP_CAPTURE_LISTENING   = 1 << 4,
+    CAP_BROKEN              = 1 << 31, // used to report inconsistencies
 } plugin_caps_t;
 
 /*!