rust/plugins: expose eve plugin registration to Rust

This allow for an EVE file type plugin written in Rust to register
itself without needing to provide its own Rust bindings.

rust/src/ffi/eve.rs

@@ -0,0 +1,79 @@
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+//! Bindings to Suricata C EVE related functions such as creating a
+//! filetype.
+
+use std::ffi::{c_char, c_int, c_void, CString};
+
+/// cbindgen:ignore
+extern "C" {
+    pub fn SCRegisterEveFileType(filetype: *const EveFileType) -> bool;
+}
+
+pub type EveFileInitFn =
+    unsafe extern "C" fn(conf: *const c_void, threaded: bool, init_data: *mut *mut c_void) -> c_int;
+pub type EveFileDeinitFn = unsafe extern "C" fn(init_data: *const c_void);
+pub type EveFileWriteFn = unsafe extern "C" fn(
+    buffer: *const c_char,
+    buffer_len: c_int,
+    init_data: *const c_void,
+    thread_data: *const c_void,
+) -> c_int;
+pub type EveFileThreadInitFn = unsafe extern "C" fn(
+    init_data: *const c_void,
+    thread_id: std::os::raw::c_int,
+    thread_data: *mut *mut c_void,
+) -> c_int;
+pub type EveFileThreadDeinitFn =
+    unsafe extern "C" fn(init_data: *const c_void, thread_data: *mut c_void);
+
+/// Rust equivalent to C SCEveFileType.
+///
+/// NOTE: Needs to be kept in sync with SCEveFileType.
+///
+/// cbindgen:ignore
+#[repr(C)]
+pub struct EveFileType {
+    name: *const c_char,
+    open: EveFileInitFn,
+    thread_init: EveFileThreadInitFn,
+    write: EveFileWriteFn,
+    thread_deinit: EveFileThreadDeinitFn,
+    close: EveFileDeinitFn,
+    pad: [usize; 2],
+}
+
+impl EveFileType {
+    pub fn new(
+        name: &str, open: EveFileInitFn, close: EveFileDeinitFn, write: EveFileWriteFn,
+        thread_init: EveFileThreadInitFn, thread_deinit: EveFileThreadDeinitFn,
+    ) -> *const Self {
+        // Convert the name to C and forget.
+        let name = CString::new(name).unwrap().into_raw();
+        let file_type = Self {
+            name,
+            open,
+            close,
+            write,
+            thread_init,
+            thread_deinit,
+            pad: [0, 0],
+        };
+        Box::into_raw(Box::new(file_type))
+    }
+}

rust/src/ffi/mod.rs

@@ -20,3 +20,4 @@
 pub mod hashing;
 pub mod base64;
 pub mod strings;
+pub mod eve;

rust/src/plugin.rs

@@ -17,6 +17,36 @@
 
 //! Plugin utility module.
 
+use std::ffi::{c_char, CString};
+
+/// Rust representation of a C plugin.
+///
+/// Mirror of SCPlugin from C and they should be kept in sync.
+#[repr(C)]
+pub struct SCPlugin {
+    name: *const c_char,
+    license: *const c_char,
+    author: *const c_char,
+    init: unsafe extern "C" fn(),
+}
+
+impl SCPlugin {
+    pub fn new(
+        name: &str, license: &str, author: &str, init_fn: unsafe extern "C" fn(),
+    ) -> *const Self {
+        let name = CString::new(name).unwrap();
+        let license = CString::new(license).unwrap();
+        let author = CString::new(author).unwrap();
+        let plugin = SCPlugin {
+            name: name.into_raw(),
+            license: license.into_raw(),
+            author: author.into_raw(),
+            init: init_fn,
+        };
+        Box::into_raw(Box::new(plugin))
+    }
+}
+
 pub fn init() {
     unsafe {
         let context = crate::core::SCGetContext();

src/output-eve.h

@@ -70,6 +70,9 @@ typedef uint32_t ThreadId;
  * may be naturally thread safe. However, if sharing a single file
  * handle across all threads then your filetype will have to take care
  * of locking, etc.
+ *
+ * NOTE: This data structure needs to be kept in sync with the Rust
+ *     mirror of it in rust/src/ffi/eve.rs.
  */
 typedef struct SCEveFileType_ {
     /**

src/suricata-plugin.h

@@ -31,6 +31,8 @@
 
 /**
  * Structure to define a Suricata plugin.
+ *
+ * Needs to be kept in sync with SCPlugin in Rust as well.
  */
 typedef struct SCPlugin_ {
     const char *name;