Suricata

Most parsers duplicate code to deal with application layer events. Instead, a parser should be able to define the events in an enum and have the rest of the code generated via a derive macro.

For example, given an enum like:

#[derive(Debug, PartialEq, AppLayerEvent)]
pub enum DNSEvent {
    MalformedData,
    NotRequest,
    NotResponse,
    ZFlagSet,
}

the following utility functions will be generated:

• from_id
• as_i32
• to_cstring
• from_cstring
• get_event_info
• get_event_info_by_id