suricata-ffi: nicer rust bindings to suricata c interfaces#14753
Draft
suricata-ffi: nicer rust bindings to suricata c interfaces#14753
Conversation
As output-eve-bindgen.h exists to support bindgen, its odd to see other Suricata C files using it. Instead Suricata C code should import "output-eve.h", which itself includes "output-eve-bindgen.h", only broken out to support the external tool bindgen.
There is an unfortunate side-affect that one has to read output-eve-bindgen.h for the documentation on this type, however, I think we can resolve that in time.
Used by Rust output plugins.
This crate is for Rust wrappers around the -sys crate which includes only raw bindings. This is the place to add nice wrappers around those bindings, however it should remain clear of dependencies on the main Suricata core crates. Ticket: OISF#7666
jasonish
requested review from
a team,
jufajardini and
victorjulien
as code owners
jasonish
commented
Feb 4, 2026
rust/ffi/src/eve.rs
Outdated
Comment on lines
38
to
42
| assert!(init.is_none(), "init must not be None"); | ||
| assert!(deinit.is_none(), "deinit must not be None"); | ||
| assert!(write.is_none(), "write must not be None"); | ||
| assert!(thread_init.is_none(), "thread_init must not be None"); | ||
| assert!(thread_deinit.is_none(), "thread_deinit must not be None"); |
Member
Author
There was a problem hiding this comment.
Bindgen crates callback types as Option<...>, but these are not optional. The idea with the assert is they get caught in development.
Member
Author
There was a problem hiding this comment.
These have been flipped to .is_some().. Oops.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #14753 +/- ##
==========================================
+ Coverage 82.15% 82.16% +0.01%
==========================================
Files 1003 1003
Lines 263643 263641 -2
==========================================
+ Hits 216586 216618 +32
+ Misses 47057 47023 -34
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
jasonish
force-pushed
the
suricata-ffi/v1
branch
from
5045db9 to
900edb2
Compare
|
Information: QA ran without warnings. Pipeline = 29445 |
|
Information: QA ran without warnings. Pipeline = 29446 |
Mostly a copy of Suricata core's logging wrappers into the ffi crate. These are not yet used by Suricata-core as they do require the Suricata library to be avaiable, which is not the case with tests. And the `cfg(test)` parameter is not passed through to sub-crates. However, this does allow a plugin (or library) to call the logging macros without depending on the "suricata" crate. Ticket: OISF#7666
jasonish
force-pushed
the
suricata-ffi/v1
branch
from
900edb2 to
e1a4017
Compare
A plugin can now create a "Plugin" struct with Rust strings. The `into_raw` method converts it to a run pointer suitable for returning during plugin registration.
jasonish
force-pushed
the
suricata-ffi/v1
branch
from
e1a4017 to
da5bb76
Compare
|
Information: QA ran without warnings. Pipeline = 29447 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A first take on a zero dependency crate for plugins, etc.
This has allowed me to remove my own ffi glue from my Redis output plugin, as well as remove the main "suricata" crate as a dependency.
Pushing for early comment to ease some near-future plugin exploration.
Related ticket: https://redmine.openinfosecfoundation.org/issues/7666