poc4 wit rust

Dockerfile

@@ -1,4 +1,16 @@
 ARG BASE_IMAGE=debian:trixie-slim
+
+FROM ${BASE_IMAGE} AS rust-builder
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends cargo rustc \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /build/tzsp-receiver
+COPY rust/tzsp-receiver/Cargo.toml ./Cargo.toml
+COPY rust/tzsp-receiver/src ./src
+RUN cargo test --release \
+    && cargo build --release
+
 FROM ${BASE_IMAGE}
 
 ARG DEBIAN_FRONTEND=noninteractive
@@ -42,12 +54,13 @@ RUN printf '%s\n' \
 
 WORKDIR /opt/ids
 
+COPY --from=rust-builder /build/tzsp-receiver/target/release/mikrosuricata-tzsp /usr/local/bin/mikrosuricata-tzsp
 COPY app /opt/ids/app
 COPY scripts /opt/ids/scripts
 COPY suricata /opt/ids/suricata
 
 RUN chmod +x /opt/ids/scripts/*.sh \
-    && mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata /tmp/suricata-build-test \
+    && mkdir -p /data /var/log/suricata /var/lib/suricata/rules /run/suricata /run/mikrosuricata /tmp/suricata-build-test \
     && suricata -T \
        -c /etc/suricata/suricata.yaml \
        --include /opt/ids/suricata/ids-output.yaml \
@@ -63,6 +76,12 @@ RUN chmod +x /opt/ids/scripts/*.sh \
 ENV PYTHONUNBUFFERED=1 \
     TZSP_BIND=0.0.0.0 \
     TZSP_PORT=37008 \
+    TZSP_RECEIVER_BIN=/usr/local/bin/mikrosuricata-tzsp \
+    TZSP_TELEMETRY_SOCKET=/run/mikrosuricata/tzsp-telemetry.sock \
+    TZSP_RCVBUF_BYTES=33554432 \
+    TZSP_BATCH_SIZE=256 \
+    TZSP_QUEUE_MB=64 \
+    TZSP_DATAGRAM_BYTES=12288 \
     TAP_NAME=suritap0 \
     TAP_MTU=9000 \
     WEB_BIND=0.0.0.0 \
@@ -70,7 +89,7 @@ ENV PYTHONUNBUFFERED=1 \
     DB_PATH=/data/ids.db \
     EVE_PATH=/data/logs/suricata/eve.json \
     SURICATA_LOG_MAX_MB=512 \
-    FORENSIC_PCAP_MODE=blocks \
+    FORENSIC_PCAP_MODE=alerts \
     FORENSIC_PCAP_WINDOW_SECONDS=60 \
     FORENSIC_PCAP_MEMORY_MB=64 \
     FORENSIC_PCAP_MAX_FILES=32 \