From b02fa531349f1a1c745afa8b91e9545ee938e869 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Wed, 10 Jun 2026 15:16:26 +0200
Subject: [PATCH] detect: add helper for getting hook name

To fetch hook name from app-layer, or use built-ins.
---
 src/detect-engine.c | 33 +++++++++++++++++++++++++++++++++
 src/detect-engine.h |  2 ++
 2 files changed, 35 insertions(+)

diff --git a/src/detect-engine.c b/src/detect-engine.c
index 01d8e9d95d..111ffd71c8 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -805,6 +805,39 @@ static void AppendAppInspectEngine(DetectEngineCtx *de_ctx,
     s->init_data->init_flags |= SIG_FLAG_INIT_STATE_MATCH;
 }
 
+/**
+ * \param direction STREAM_TOSERVER or STREAM_TOCLIENT
+ */
+const char *DetectEngineAppHookToName(
+        const AppProto p, const uint8_t state, const uint8_t direction)
+{
+    if (!((direction & (STREAM_TOSERVER | STREAM_TOCLIENT)) == STREAM_TOSERVER) &&
+            !((direction & (STREAM_TOSERVER | STREAM_TOCLIENT)) == STREAM_TOCLIENT))
+        return NULL;
+
+    const char *pname = AppLayerParserGetStateNameById(IPPROTO_TCP, // TODO
+            p, state, direction);
+    if (pname == NULL) {
+        if (state == 0) {
+            if (direction == STREAM_TOSERVER) {
+                pname = "request_started";
+            } else {
+                pname = "response_started";
+            }
+        } else {
+            const int complete = AppLayerParserGetStateProgressCompletionStatus(p, direction);
+            if (state == complete) {
+                if (direction == STREAM_TOSERVER) {
+                    pname = "request_complete";
+                } else {
+                    pname = "response_complete";
+                }
+            }
+        }
+    }
+    return pname;
+}
+
 /** \brief get the sm_list for a app hook */
 int DetectEngineAppHookToSmlist(const AppProto p, const uint8_t state, const int direction)
 {
diff --git a/src/detect-engine.h b/src/detect-engine.h
index b6dbddaf79..44f5ed89f9 100644
--- a/src/detect-engine.h
+++ b/src/detect-engine.h
@@ -210,6 +210,8 @@ void DetectLowerSetupCallback(
 
 void DeStateRegisterTests(void);
 
+const char *DetectEngineAppHookToName(
+        const AppProto p, const uint8_t state, const uint8_t direction);
 int DetectEngineAppHookToSmlist(const AppProto p, const uint8_t state, const int direction);
 
 #endif /* SURICATA_DETECT_ENGINE_H */