Suricata adds a new private protocol. Must you use rust to develop plug-ins? Or you can also use c to develop plug-ins.
In general we require it to be in Rust unless there are good reasons for that protocol parser to be not written in Rust.
Plugins are a different topic, what plugin are you talking about?
Sorry, I thought surciata’s new protocols were all plug-in integrations. Now,I understand that surciata is better off using rust to develop parsers and decode. So, does the latest version of suricata support pure c development parsers and decode? Will adding a protocol to suricata in c create compatibility issues in later versions? I’m just curious about the above question, in fact, I would choose rust development parsing. I know that scripts will generate some code and speed up development. Thank you for your reply
Plugins for parsers are not possible as of now.
C protocol parsers are still fully supported and possible, just note that there aren’t many left, and soon there probably won’t be any left in the core, we also removed the templates for C parsers a while ago. So that’s a good indication of where we are going. Support and documentation for C-based parsers will be less and less just as an artifact of Suricata having less and less of them.
So that’s it. thank you for your reply. wish you a happy life.