-
Notifications
You must be signed in to change notification settings - Fork 4
Description
Apologies if an Issue is the wrong place for this sort of question. My project involves reading audit events and parsing them internally. I'm confused how I should use this crate when it doesn't seem like sufficient types are exposed.
From /examples/events.rs:
// SPDX-License-Identifier: MIT
//! This example opens a netlink socket, enables audit events, and prints the
//! events that are being received.
use audit::new_connection;
use futures::stream::StreamExt;
#[tokio::main]
async fn main() -> Result<(), String> {
let (connection, mut handle, mut messages) =
new_connection().map_err(|e| format!("{e}"))?;
tokio::spawn(connection);
handle.enable_events().await.map_err(|e| format!("{e}"))?;
env_logger::init();
while let Some((msg, _)) = messages.next().await {
println!("{msg:?}");
}
Ok(())
}Messages (that aren't a reply from a user-side request) are sent through the connection. The type is Connection<AuditMessage, TokioSocket, NetlinkAuditCodec>. Calling .next().await yields Option<(NetlinkMessage<AuditMessage>, SocketAddr)>.
While AuditMessage is exposed by the crate, NetlinkMessage<AuditMessage> is not, nor is the NetlinkPayload type underneath it. I don't believe there is any type-safe way to access the underlying AuditMessage. Obviously you can use the debug fmt trait, but I have to think there's a better way.
I'm not very familiar with the system as a whole, so I'm unsure where to take this. One option would be for the user to import NetlinkMessage directly from netlink-proto, but that seems to go against the nature of the wrapper. If this crate were to convert the NetlinkMessage into an AuditMessage before sending, we would lose the NetlinkHeader, as well all branches of the NetlinkPayload enum other than InnerMessage.
Please let me know if I'm using the crate wrong, or if there's some contribution I can make to solve this!