examples/plugins/rust: add a rust example plugin

Only demonstrates EVE callbacks for now, but I plan to turn this into a
show case of a variety of callbacks a Rust plugin can do as we add Rust
bindings to the ffi crate.

.github/workflows/builds.yml

@@ -212,6 +212,10 @@ jobs:
         working-directory: examples/plugins/c-custom-loggers
         run: make clean all
 
+      - name: Build Rust example plugin
+        working-directory: examples/plugins/rust
+        run: cargo build
+
       - name: Install Suricata and library
         run: make install install-headers install-library
 

examples/plugins/README.md

@@ -14,3 +14,8 @@ for testing capture plugin loading and registration in CI.
 
 An app-layer template plugin with logging and detection.
 Most code copied from rust/src/applayertemplate
+
+## rust
+
+A pure Rust plugin example intended to grow into an omnibus plugin example.
+Currently demonstrates plugin initialization and EVE callback registration.

examples/plugins/rust/.cargo/config.toml

@@ -0,0 +1,2 @@
+[build]
+rustflags = ["-Clink-args=-Wl,-undefined,dynamic_lookup"]

examples/plugins/rust/.gitignore

@@ -0,0 +1,2 @@
+Cargo.lock
+target

examples/plugins/rust/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "suricata-rust-plugin"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+path = "src/mod.rs"
+crate-type = ["cdylib"]
+
+[dependencies]
+suricata-sys = { path = "../../../rust/sys" }
+suricata-ffi = { path = "../../../rust/ffi" }

examples/plugins/rust/README.md

@@ -0,0 +1,5 @@
+# rust example plugin
+
+This is a pure Rust Suricata plugin example.
+
+It is intended to grow into an omnibus Rust plugin example over time.

examples/plugins/rust/src/mod.rs

@@ -0,0 +1,60 @@
+use std::ptr::null_mut;
+
+use suricata_ffi::eve::{self, Flow, Packet, SCJsonBuilder, ThreadVars};
+use suricata_ffi::jsonbuilder::JsonBuilder;
+use suricata_ffi::{SCLogError, SCLogNotice};
+use suricata_sys::sys::{SCEveRegisterCallback, SCPlugin};
+
+unsafe extern "C" fn init() {
+    suricata_ffi::plugin::init();
+    SCLogNotice!("Initializing rust example plugin");
+
+    if let Err(err) = register() {
+        SCLogError!("Failed to register rust example EVE callback: {}", err);
+    }
+}
+
+pub fn register() -> Result<(), &'static str> {
+    if !unsafe { SCEveRegisterCallback(Some(log_eve_raw), null_mut()) } {
+        return Err("Failed to register raw EVE callback");
+    }
+    eve::register_callback(log_eve_wrapped)
+}
+
+unsafe extern "C" fn log_eve_raw(
+    _tv: *mut ThreadVars,
+    _p: *const Packet,
+    _f: *mut Flow,
+    jb: *mut SCJsonBuilder,
+    _user: *mut std::os::raw::c_void,
+) {
+    let mut jb = JsonBuilder::from_raw(jb);
+    let _ = jb.open_object("foobar");
+    let _ = jb.set_string("example", "eve-callback");
+    let _ = jb.close();
+}
+
+fn log_eve_wrapped(
+    _tv: *mut ThreadVars,
+    _p: *const Packet,
+    f: *mut Flow,
+    jb: &mut JsonBuilder,
+) -> Result<(), suricata_ffi::jsonbuilder::Error> {
+    jb.open_object("rust_wrapped")?;
+    jb.set_string("example", "eve-callback")?;
+    jb.set_string("has_flow", if f.is_null() { "false" } else { "true" })?;
+    jb.close()?;
+    Ok(())
+}
+
+#[no_mangle]
+extern "C" fn SCPluginRegister() -> *mut SCPlugin {
+    suricata_ffi::plugin::Plugin {
+        name: "rust",
+        version: env!("CARGO_PKG_VERSION"),
+        license: "MIT",
+        author: "Open Information Security Foundation",
+        init,
+    }
+    .into_raw()
+}