Skip to content

ffi storage/v3 - #328

Closed
jasonish wants to merge 18 commits into
mainfrom
ffi-storage/v3
Closed

ffi storage/v3#328
jasonish wants to merge 18 commits into
mainfrom
ffi-storage/v3

Conversation

@jasonish

@jasonish jasonish commented Jun 5, 2026

Copy link
Copy Markdown
Owner
  • bindgen: fix include ordering
    At some point, bindgen include ordering changed such that
    AppLayerGetFileState was being bindgen'd as opaque, as the definition of
    StreamBufferingConfig was not available when bindgen hit
    AppLayerGetFileState, and bindgen processes in order.

    Move the util includes before the app-layer includes to fix the ordering
    problem, but still keep util includes grouped.

    The sys diff is large as many things have been re-ordered.

  • flow-storage: include cleanup

  • ndpi: don't access flow storage directly
    Remove the check for Flow.storage being NULL. With flex arrays, as long as the
    flow is allocation, .storage will never be NULL. We do make sure the flow is
    not NULL, and the storage functions are safe to the storage being NULL.

    Prevents NDPI from accessing this flow field to be less sensitive to ABI
    changes with respect to data structure sizes.

    Ticket: conf: deprecate duplicate includes - v2 OISF/suricata#8632

  • ndpi: flow storage can fail, cleanup if it does

  • flow: add accessor functions
    Add accessor functions to allow NDPI and our plugin examples to access flow fields in an opaque manner.

    Provides accessors for:

    • is ipv4
    • is ipv6
    • ip protocol
    • to server packet count
    • to destination packet count

    Ticket: conf: deprecate duplicate includes - v2 OISF/suricata#8632

  • flow: include cleanup
    Include flow-bindgen.h into flow.h and use flow.h in our source.
    flow-bindgen.h exists for the purposes of bindgen only.

  • ndpi: use flow access functions
    To prevent direct access to the flow structure and be subject to changes in its
    size.

    Ticket: conf: deprecate duplicate includes - v2 OISF/suricata#8632

  • examples: use flow access functions
    To prevent direct access to the flow structure and be subject to changes in its
    size.

    Ticket: conf: deprecate duplicate includes - v2 OISF/suricata#8632

  • flow: prefix FlowAddress with SC

  • flow: addess accessors for flow addresses
    Also moves SCFlowAddress into flow-bindgen.h which allows this accessor
    to be exposed to Rust.

  • flow: update example plugin to use address accessors

  • rust: update bindings to get new flow functions

  • rust/ffi: add wrapper around Flow
    Ticket: smtp: sync in-code defaults with configuration file - v1 OISF/suricata#8599

  • rust/ffi: use Flow wrapper in flow and eve callbacks
    Pass the safe Flow wrapper to the flow init/update/finish callbacks and
    the EVE callback instead of a raw sys::Flow pointer.

    Ticket: smtp: sync in-code defaults with configuration file - v1 OISF/suricata#8599

  • rust/ffi: bindgen flow storage
    Ticket: Nfs read 5812 v1 (master-6.0.x) OISF/suricata#8447

  • rust/ffi: add number setters to jsonbuilder wrapper

  • rust/ffi: add safe flow storage wrapper
    Add a typed FlowStorage wrapper around the flow storage bindings.

    Update example and docs.

    Ticket: Nfs read 5812 v1 (master-6.0.x) OISF/suricata#8447

  • rust/ffi: add flow accessors to flow wrapper
    Ticket: smtp: sync in-code defaults with configuration file - v1 OISF/suricata#8599

jasonish and others added 18 commits June 4, 2026 16:28
At some point, bindgen include ordering changed such that
AppLayerGetFileState was being bindgen'd as opaque, as the definition of
StreamBufferingConfig was not available when bindgen hit
AppLayerGetFileState, and bindgen processes in order.

Move the util includes before the app-layer includes to fix the ordering
problem, but still keep util includes grouped.

The sys diff is large as many things have been re-ordered.
Remove the check for Flow.storage being NULL. With flex arrays, as long as the
flow is allocation, .storage will never be NULL. We do make sure the flow is
not NULL, and the storage functions are safe to the storage being NULL.

Prevents NDPI from accessing this flow field to be less sensitive to ABI
changes with respect to data structure sizes.

Ticket: OISF#8632
Add accessor functions to allow NDPI and our plugin examples to access flow fields in an opaque manner.

Provides accessors for:

- is ipv4
- is ipv6
- ip protocol
- to server packet count
- to destination packet count

Ticket: OISF#8632
Include flow-bindgen.h into flow.h and use flow.h in our source.
flow-bindgen.h exists for the purposes of bindgen only.
To prevent direct access to the flow structure and be subject to changes in its
size.

Ticket: OISF#8632
To prevent direct access to the flow structure and be subject to changes in its
size.

Ticket: OISF#8632
Also moves SCFlowAddress into flow-bindgen.h which allows this accessor
to be exposed to Rust.
Pass the safe Flow wrapper to the flow init/update/finish callbacks and
the EVE callback instead of a raw sys::Flow pointer.

Ticket: OISF#8599
Add a typed FlowStorage<T> wrapper around the flow storage bindings.

Update example and docs.

Ticket: OISF#8447
@github-actions

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown

NOTE: This PR may contain new authors.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant