rust/ffi: add minimal ThreadVars wrapper

Add a Rust wrapper around the raw ThreadVars pointer, intended for use in
callbacks to control lifetime and provide safe accessors.

Author: jasonish

rust/ffi/src/lib.rs

@@ -25,6 +25,7 @@ pub mod flow;
 pub mod jsonbuilder;
 pub mod packet;
 pub mod plugin;
+pub mod threadvars;
 
 pub const IPPROTO_TCP: u8 = 6;
 pub const IPPROTO_UDP: u8 = 17;

rust/ffi/src/threadvars.rs

@@ -0,0 +1,38 @@
+/* Copyright (C) 2026 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+use std::marker::PhantomData;
+
+use suricata_sys::sys;
+
+pub struct ThreadVars<'a> {
+    ptr: *const sys::ThreadVars,
+    _marker: PhantomData<&'a sys::ThreadVars>,
+}
+
+impl<'a> ThreadVars<'a> {
+    pub fn from_ptr(ptr: *const sys::ThreadVars) -> Self {
+        Self {
+            ptr,
+            _marker: PhantomData,
+        }
+    }
+
+    pub fn as_ptr(&self) -> *const sys::ThreadVars {
+        self.ptr
+    }
+}