rust/ffi: add flow lifecycle callback wrappers - v12 by jasonish · Pull Request #15318 · OISF/suricata

jasonish · 2026-05-05T14:52:47Z

From my FFI backlog, add nice Rust wrappers around the flow lifecycle
callbacks.

Ticket: https://redmine.openinfosecfoundation.org/issues/8446

Remaining in the backlog:

flow storage api
thread storage api
accessors for flow and packet

Provide Rust friendly callback registrations for flow init, update and finish events. These callbacks are implemented as Rust closures. Ticket: OISF#8446

Document for C and Rust, as the C documentation was missing. Ticket: OISF#8446

Ticket: OISF#8446

codecov · 2026-05-05T15:42:03Z

Codecov Report

❌ Patch coverage is 0% with 60 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.63%. Comparing base (72e3d7a) to head (70bf5c9).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #15318      +/-   ##
==========================================
- Coverage   82.66%   82.63%   -0.03%     
==========================================
  Files         993      994       +1     
  Lines      271004   271064      +60     
==========================================
- Hits       224015   223986      -29     
- Misses      46989    47078      +89

Flag	Coverage Δ
fuzzcorpus	`61.05% <0.00%> (-0.03%)`	⬇️
livemode	`18.37% <0.00%> (+<0.01%)`	⬆️
netns	`22.59% <0.00%> (-0.07%)`	⬇️
pcap	`45.19% <0.00%> (-0.07%)`	⬇️
suricata-verify	`66.35% <0.00%> (-0.05%)`	⬇️
unittests	`58.57% <0.00%> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

suricata-qa · 2026-05-05T17:50:02Z

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.uptime	667	688	103.15%
.app_layer.flow.ftp-data	761	-	-
.app_layer.flow.bittorrent-dht	39597	-	-
.app_layer.error.ftp-data.alloc	0	-	-
.app_layer.error.ftp-data.parser	0	-	-
.app_layer.error.ftp-data.internal	0	-	-
.app_layer.error.bittorrent-dht.alloc	0	-	-
.app_layer.error.bittorrent-dht.parser	16	-	-
.app_layer.error.bittorrent-dht.internal	0	-	-
.app_layer.tx.ftp-data	0	-	-
.app_layer.tx.bittorrent-dht	93889	-	-
.app_layer.flow.ftp_data	-	756	-
.app_layer.flow.bittorrent_dht	-	39597	-
.app_layer.error.ftp_data.gap	-	1	-
.app_layer.error.ftp_data.alloc	-	0	-
.app_layer.error.ftp_data.parser	-	0	-
.app_layer.error.ftp_data.internal	-	0	-
.app_layer.error.bittorrent_dht.alloc	-	0	-
.app_layer.error.bittorrent_dht.parser	-	16	-
.app_layer.error.bittorrent_dht.internal	-	0	-
.app_layer.tx.ftp_data	-	0	-
.app_layer.tx.bittorrent_dht	-	93889	-

Pipeline = 31179

suricata-qa · 2026-05-05T17:50:04Z

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.uptime	667	688	103.15%
.app_layer.flow.ftp-data	761	-	-
.app_layer.flow.bittorrent-dht	39597	-	-
.app_layer.error.ftp-data.alloc	0	-	-
.app_layer.error.ftp-data.parser	0	-	-
.app_layer.error.ftp-data.internal	0	-	-
.app_layer.error.bittorrent-dht.alloc	0	-	-
.app_layer.error.bittorrent-dht.parser	16	-	-
.app_layer.error.bittorrent-dht.internal	0	-	-
.app_layer.tx.ftp-data	0	-	-
.app_layer.tx.bittorrent-dht	93889	-	-
.app_layer.flow.ftp_data	-	756	-
.app_layer.flow.bittorrent_dht	-	39597	-
.app_layer.error.ftp_data.gap	-	1	-
.app_layer.error.ftp_data.alloc	-	0	-
.app_layer.error.ftp_data.parser	-	0	-
.app_layer.error.ftp_data.internal	-	0	-
.app_layer.error.bittorrent_dht.alloc	-	0	-
.app_layer.error.bittorrent_dht.parser	-	16	-
.app_layer.error.bittorrent_dht.internal	-	0	-
.app_layer.tx.ftp_data	-	0	-
.app_layer.tx.bittorrent_dht	-	93889	-

Pipeline = 31179

jasonish · 2026-05-05T18:01:27Z

WARNING:

field baseline test %
SURI_TLPR1_stats_chk
.uptime 667 688 103.15%
.app_layer.flow.ftp-data 761 - -
.app_layer.flow.bittorrent-dht 39597 - -
.app_layer.error.ftp-data.alloc 0 - -
.app_layer.error.ftp-data.parser 0 - -
.app_layer.error.ftp-data.internal 0 - -
.app_layer.error.bittorrent-dht.alloc 0 - -
.app_layer.error.bittorrent-dht.parser 16 - -
.app_layer.error.bittorrent-dht.internal 0 - -
.app_layer.tx.ftp-data 0 - -
.app_layer.tx.bittorrent-dht 93889 - -
.app_layer.flow.ftp_data - 756 -
.app_layer.flow.bittorrent_dht - 39597 -
.app_layer.error.ftp_data.gap - 1 -
.app_layer.error.ftp_data.alloc - 0 -
.app_layer.error.ftp_data.parser - 0 -
.app_layer.error.ftp_data.internal - 0 -
.app_layer.error.bittorrent_dht.alloc - 0 -
.app_layer.error.bittorrent_dht.parser - 16 -
.app_layer.error.bittorrent_dht.internal - 0 -
.app_layer.tx.ftp_data - 0 -
.app_layer.tx.bittorrent_dht - 93889 -
Pipeline = 31179

Something up? These changes are non-functional to Suricata proper.

ct0br0 · 2026-05-05T18:30:16Z

I'll rerun it.

suricata-qa · 2026-05-05T21:05:03Z

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.uptime	667	646	96.85%
.app_layer.flow.ftp-data	761	-	-
.app_layer.flow.bittorrent-dht	39597	-	-
.app_layer.error.ftp-data.alloc	0	-	-
.app_layer.error.ftp-data.parser	0	-	-
.app_layer.error.ftp-data.internal	0	-	-
.app_layer.error.bittorrent-dht.alloc	0	-	-
.app_layer.error.bittorrent-dht.parser	16	-	-
.app_layer.error.bittorrent-dht.internal	0	-	-
.app_layer.tx.ftp-data	0	-	-
.app_layer.tx.bittorrent-dht	93889	-	-
.app_layer.flow.ftp_data	-	750	-
.app_layer.flow.bittorrent_dht	-	39597	-
.app_layer.error.ftp_data.gap	-	1	-
.app_layer.error.ftp_data.alloc	-	0	-
.app_layer.error.ftp_data.parser	-	0	-
.app_layer.error.ftp_data.internal	-	0	-
.app_layer.error.bittorrent_dht.alloc	-	0	-
.app_layer.error.bittorrent_dht.parser	-	16	-
.app_layer.error.bittorrent_dht.internal	-	0	-
.app_layer.tx.ftp_data	-	0	-
.app_layer.tx.bittorrent_dht	-	93889	-

Pipeline = 31181

victorjulien · 2026-05-06T08:27:12Z

Weird, the logging changed with #15315 but the issue doesn't show there.

catenacyber · 2026-05-07T08:46:45Z

        working-directory: examples/plugins/rust
-        run: cargo build
+        run: |
+          cargo fmt --check


do you want to use the rustfmt.toml ?

like -- --config-path ../../../rust/rustfmt.toml

I do that for the applayer plugin

No. If a user uses this as a template and copies it somewhere, they are not going to have that rustfmt.toml available, and will automatically have formatting differences. So I think it's best to keep the default formatting, OR we put a rustfmt.toml in there. But I don't think we should prescribe our formatting to plugin authors.

jasonish · 2026-05-07T21:30:34Z

Replaced by #15334

jasonish added 4 commits May 5, 2026 07:59

rust: bindgen flow lifecycle callbacks

22dba7e

Ticket: OISF#8446

rust/ffi: add flow lifecycle callback wrappers

b4460d3

Provide Rust friendly callback registrations for flow init, update and finish events. These callbacks are implemented as Rust closures. Ticket: OISF#8446

doc: document flow life cycle callback API

5624a20

Document for C and Rust, as the C documentation was missing. Ticket: OISF#8446

examples: add flow callbacks to rust plugin example

afde209

Ticket: OISF#8446

jasonish requested review from a team, jufajardini and victorjulien as code owners May 5, 2026 14:52

github-ci: check formatting and clippy on example rust plugin

70bf5c9

jasonish force-pushed the suricata-ffi/v12 branch from 8f4ad63 to 70bf5c9 Compare May 5, 2026 15:12

ct0br0 added the waiting for qa label May 5, 2026

suricata-qa removed the waiting for qa label May 5, 2026

catenacyber reviewed May 7, 2026

View reviewed changes

Comment thread doc/userguide/devguide/extending/flow-lifecycle-callbacks.rst

catenacyber reviewed May 7, 2026

View reviewed changes

Comment thread rust/ffi/src/flow.rs

catenacyber reviewed May 7, 2026

View reviewed changes

Comment thread src/flow-callbacks.h

jasonish mentioned this pull request May 7, 2026

rust/ffi: add flow lifecycle callback wrappers - v13 #15334

Closed

jasonish closed this May 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rust/ffi: add flow lifecycle callback wrappers - v12#15318

rust/ffi: add flow lifecycle callback wrappers - v12#15318
jasonish wants to merge 5 commits into
OISF:mainfrom
jasonish:suricata-ffi/v12

jasonish commented May 5, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 5, 2026 •

edited

Loading

Uh oh!

suricata-qa commented May 5, 2026

Uh oh!

suricata-qa commented May 5, 2026

Uh oh!

jasonish commented May 5, 2026

Uh oh!

ct0br0 commented May 5, 2026

Uh oh!

suricata-qa commented May 5, 2026

Uh oh!

victorjulien commented May 6, 2026

Uh oh!

catenacyber May 7, 2026

Uh oh!

jasonish May 7, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonish commented May 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

Conversation

jasonish commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

suricata-qa commented May 5, 2026

Uh oh!

suricata-qa commented May 5, 2026

Uh oh!

jasonish commented May 5, 2026

Uh oh!

ct0br0 commented May 5, 2026

Uh oh!

suricata-qa commented May 5, 2026

Uh oh!

victorjulien commented May 6, 2026

Uh oh!

catenacyber May 7, 2026

Choose a reason for hiding this comment

Uh oh!

jasonish May 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasonish commented May 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

jasonish commented May 5, 2026 •

edited

Loading

codecov Bot commented May 5, 2026 •

edited

Loading