rust/ffi: move detection helpers to ffi crate

Ticket: 7666

examples/plugins/altemplate/src/detect.rs

@@ -22,7 +22,7 @@
 
 use super::template::{TemplateTransaction, ALPROTO_TEMPLATE};
 use std::os::raw::{c_int, c_void};
-use suricata::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
+use suricata_ffi::detect::{helper_keyword_register_sticky_buffer, SigTableElmtStickyBuffer};
 use suricata_ffi::{cast_pointer, STREAM_TOCLIENT, STREAM_TOSERVER};
 use suricata_sys::sys::{
     DetectEngineCtx, SCDetectBufferSetActiveList, SCDetectHelperBufferMpmRegister,

rust/ffi/src/detect.rs

@@ -0,0 +1,72 @@
+/* Copyright (C) 2026 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+//! Detection utils.
+
+use std::ffi::{c_int, CString};
+use suricata_sys::sys::{
+    DetectEngineCtx, SCDetectHelperKeywordRegister, SCDetectHelperKeywordSetCleanCString,
+    SCSigTableAppLiteElmt, Signature, SIGMATCH_INFO_MULTI_BUFFER, SIGMATCH_INFO_STICKY_BUFFER,
+    SIGMATCH_NOOPT,
+};
+
+/// Rust app-layer light version of SigTableElmt for simple sticky buffer
+pub struct SigTableElmtStickyBuffer {
+    /// keyword name
+    pub name: String,
+    /// keyword description
+    pub desc: String,
+    /// keyword documentation url
+    pub url: String,
+    /// function callback to parse and setup keyword in rule
+    pub setup: unsafe extern "C" fn(
+        de: *mut DetectEngineCtx,
+        s: *mut Signature,
+        raw: *const std::os::raw::c_char,
+    ) -> c_int,
+}
+
+fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u32) -> u16 {
+    let name = CString::new(kw.name.as_bytes()).unwrap().into_raw();
+    let desc = CString::new(kw.desc.as_bytes()).unwrap().into_raw();
+    let url = CString::new(kw.url.as_bytes()).unwrap().into_raw();
+    let st = SCSigTableAppLiteElmt {
+        name,
+        desc,
+        url,
+        Setup: Some(kw.setup),
+        flags,
+        AppLayerTxMatch: None,
+        Free: None,
+    };
+    unsafe {
+        let r = SCDetectHelperKeywordRegister(&st);
+        SCDetectHelperKeywordSetCleanCString(r);
+        return r;
+    }
+}
+
+pub fn helper_keyword_register_multi_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
+    return helper_keyword_register_buffer_flags(
+        kw,
+        SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER,
+    );
+}
+
+pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
+    return helper_keyword_register_buffer_flags(kw, SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER);
+}

rust/ffi/src/lib.rs

@@ -16,6 +16,7 @@
  */
 
 pub mod debug;
+pub mod detect;
 pub mod eve;
 pub mod jsonbuilder;
 pub mod plugin;

rust/src/detect/mod.rs

@@ -37,12 +37,6 @@ pub mod uri;
 pub mod vlan;
 
 use std::ffi::CString;
-use std::os::raw::c_int;
-
-use suricata_sys::sys::{
-    DetectEngineCtx, SCDetectHelperKeywordRegister, SCDetectHelperKeywordSetCleanCString,
-    SCSigTableAppLiteElmt, Signature,
-};
 
 /// EnumString trait that will be implemented on enums that
 /// derive StringEnum.
@@ -64,52 +58,10 @@ pub trait EnumString<T> {
         Self: Sized;
 }
 
-/// Rust app-layer light version of SigTableElmt for simple sticky buffer
-pub struct SigTableElmtStickyBuffer {
-    /// keyword name
-    pub name: String,
-    /// keyword description
-    pub desc: String,
-    /// keyword documentation url
-    pub url: String,
-    /// function callback to parse and setup keyword in rule
-    pub setup: unsafe extern "C" fn(
-        de: *mut DetectEngineCtx,
-        s: *mut Signature,
-        raw: *const std::os::raw::c_char,
-    ) -> c_int,
-}
-
-fn helper_keyword_register_buffer_flags(kw: &SigTableElmtStickyBuffer, flags: u32) -> u16 {
-    let name = CString::new(kw.name.as_bytes()).unwrap().into_raw();
-    let desc = CString::new(kw.desc.as_bytes()).unwrap().into_raw();
-    let url = CString::new(kw.url.as_bytes()).unwrap().into_raw();
-    let st = SCSigTableAppLiteElmt {
-        name,
-        desc,
-        url,
-        Setup: Some(kw.setup),
-        flags,
-        AppLayerTxMatch: None,
-        Free: None,
-    };
-    unsafe {
-        let r = SCDetectHelperKeywordRegister(&st);
-        SCDetectHelperKeywordSetCleanCString(r);
-        return r;
-    }
-}
-
-pub fn helper_keyword_register_multi_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
-    return helper_keyword_register_buffer_flags(
-        kw,
-        SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER,
-    );
-}
-
-pub fn helper_keyword_register_sticky_buffer(kw: &SigTableElmtStickyBuffer) -> u16 {
-    return helper_keyword_register_buffer_flags(kw, SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER);
-}
+pub use suricata_ffi::detect::{
+    helper_keyword_register_multi_buffer, helper_keyword_register_sticky_buffer,
+    SigTableElmtStickyBuffer,
+};
 
 #[repr(C)]
 #[allow(non_snake_case)]