From 4d191ffdb7889ecfb45e539124fe867832d2ba48 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Mon, 28 Oct 2024 15:42:10 -0600
Subject: [PATCH 01/12] rust: integrate bindgen to generate rust bindings to C

Add a minimal integration of bindgen to the build.

This required some refactoring of the C so app-layer-events.h did not
also include "rust.h", which causes issues for bindgen, probably
related to circular references.

AppLayerEventType was chosen as the first step as its an argument type
some app-layer functions that we may want to use bindgen to export
Rust, and one of the requirements of bindgen might be that C functions
should only use datatypes defined in C, and not Rust. Following such a
rule also prevents circular dependencies between Rust and C code.

As bindgen can only accept one header file, we construct a
pseudo-header file of all the headers that need to be
consumed. Makefile dependency checking is done to make sure the
pseudo-header is only generated as needed to avoid rebuilding every
time.

Special handling is required for Windows to use the Windows path.

Ticket: #7341

bindgen: pre-generate rust bindings to C

This simplifies building, as we don't have to worry about path and
such under autoconf/automake. It does however mean when we update C
headers that are exposed to Rust, we manually have to re-generate the
bindings, but this is a check we can do in CI.

It also eliminates the need for everyone who wants to build Suricata
to have bindgen and clang tools installed.
---
 configure.ac                     |  3 +++
 rust/Makefile.am                 | 30 ++++++++++++++++++++++++---
 rust/derive/src/applayerevent.rs |  4 ++--
 rust/src/_sys.rs                 |  6 ++++++
 rust/src/applayer.rs             | 19 +++++++++--------
 rust/src/core.rs                 |  8 --------
 rust/src/ftp/event.rs            |  6 +++---
 rust/src/lib.rs                  |  4 ++++
 rust/src/smb/smb.rs              |  5 +++--
 rust/src/sys.rs                  | 21 +++++++++++++++++++
 src/app-layer-dnp3.c             |  4 ++--
 src/app-layer-events.c           |  5 +++--
 src/app-layer-events.h           | 10 ++++++---
 src/app-layer-htp.c              |  4 ++--
 src/app-layer-parser.c           | 12 +++++------
 src/app-layer-parser.h           |  8 ++++----
 src/app-layer-register.h         |  4 ++--
 src/app-layer-smtp.c             |  4 ++--
 src/app-layer-ssl.c              |  4 ++--
 src/app-layer-tftp.c             |  2 +-
 src/bindgen.h                    | 35 ++++++++++++++++++++++++++++++++
 src/detect-app-layer-event.c     |  6 +++---
 src/output-json-anomaly.c        |  2 +-
 src/rust.h                       |  1 +
 24 files changed, 150 insertions(+), 57 deletions(-)
 create mode 100644 rust/src/_sys.rs
 create mode 100644 rust/src/sys.rs
 create mode 100644 src/bindgen.h

diff --git a/configure.ac b/configure.ac
index ca964d9039a0..a721e6cebb4c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2269,6 +2269,9 @@ fi
        fi
     fi
 
+    AC_PATH_PROG([BINDGEN], [bindgen], [no])
+    AM_CONDITIONAL([HAVE_BINDGEN], [test "x$BINDGEN" != "xno"])
+
     AC_PATH_PROG(CBINDGEN, cbindgen, "no")
     if test "x$CBINDGEN" != "xno"; then
       cbindgen_version=$(cbindgen --version 2>&1 | cut -d' ' -f2-)
diff --git a/rust/Makefile.am b/rust/Makefile.am
index d53eb97090e1..bf2b7b2c0fe3 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -38,12 +38,18 @@ if HAVE_CYGPATH
 CARGO_ENV =	@rustup_home@ \
 		CARGO_HOME="$(CARGO_HOME)" \
 		CARGO_TARGET_DIR="$(e_rustdir)/target" \
-		SURICATA_LUA_SYS_HEADER_DST="$(e_rustdir)/gen"
+		SURICATA_LUA_SYS_HEADER_DST="$(e_rustdir)/gen" \
+		TOP_BUILDDIR=$(abs_top_builddir) \
+		TOP_SRCDIR=$(abs_top_srcdir) \
+		RUST_GENDIR=$(e_rustdir)/gen
 else
 CARGO_ENV =	@rustup_home@ \
 		CARGO_HOME="$(CARGO_HOME)" \
 		CARGO_TARGET_DIR="$(abs_top_builddir)/rust/target" \
-		SURICATA_LUA_SYS_HEADER_DST="$(abs_top_builddir)/rust/gen"
+		SURICATA_LUA_SYS_HEADER_DST="$(abs_top_builddir)/rust/gen" \
+		TOP_BUILDDIR=$(abs_top_builddir) \
+		TOP_SRCDIR=$(abs_top_srcdir) \
+		RUST_GENDIR=$(abs_top_builddir)/rust/gen
 endif
 
 all-local: Cargo.toml
@@ -83,6 +89,21 @@ check:
 vendor:
 	$(CARGO_ENV) $(CARGO) vendor
 
+update-bindings:
+if HAVE_BINDGEN
+	$(BINDGEN) \
+		-o src/_sys.rs \
+		--disable-header-comment \
+		--allowlist-type 'SCAppLayerEventType' \
+		--rustified-enum 'SCAppLayerEventType' \
+		$(abs_top_srcdir)/src/bindgen.h \
+		-- \
+		-DHAVE_CONFIG_H -I../src $(CPPFLAGS)
+else
+	@echo "error: bindgen not installed, can't update bindings"
+	exit 1
+endif
+
 if HAVE_CBINDGEN
 gen/rust-bindings.h: $(RUST_SURICATA_LIB)
 	cd $(abs_top_srcdir)/rust && \
@@ -93,7 +114,10 @@ gen/rust-bindings.h:
 endif
 
 doc:
-	CARGO_HOME=$(CARGO_HOME) $(CARGO) doc --all-features --no-deps
+	CARGO_HOME=$(CARGO_HOME) \
+		$(CARGO_ENV) \
+		SURICATA_LUA_SYS_HEADER_DST="" $(CARGO) doc \
+		--all-features --no-deps
 
 if HAVE_CBINDGEN
 dist/rust-bindings.h:
diff --git a/rust/derive/src/applayerevent.rs b/rust/derive/src/applayerevent.rs
index 1b1a3f86ee9c..52373a497cbb 100644
--- a/rust/derive/src/applayerevent.rs
+++ b/rust/derive/src/applayerevent.rs
@@ -89,7 +89,7 @@ pub fn derive_app_layer_event(input: TokenStream) -> TokenStream {
             unsafe extern "C" fn get_event_info(
                 event_name: *const std::os::raw::c_char,
                 event_id: *mut u8,
-                event_type: *mut #crate_id::core::AppLayerEventType,
+                event_type: *mut #crate_id::sys::SCAppLayerEventType,
             ) -> std::os::raw::c_int {
                 #crate_id::applayer::get_event_info::<#name>(event_name, event_id, event_type)
             }
@@ -97,7 +97,7 @@ pub fn derive_app_layer_event(input: TokenStream) -> TokenStream {
             unsafe extern "C" fn get_event_info_by_id(
                 event_id: u8,
                 event_name: *mut *const std::os::raw::c_char,
-                event_type: *mut #crate_id::core::AppLayerEventType,
+                event_type: *mut #crate_id::sys::SCAppLayerEventType,
             ) -> std::os::raw::c_int {
                 #crate_id::applayer::get_event_info_by_id::<#name>(event_id, event_name, event_type)
             }
diff --git a/rust/src/_sys.rs b/rust/src/_sys.rs
new file mode 100644
index 000000000000..f4f22d34d4bd
--- /dev/null
+++ b/rust/src/_sys.rs
@@ -0,0 +1,6 @@
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum SCAppLayerEventType {
+    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
+    APP_LAYER_EVENT_TYPE_PACKET = 2,
+}
diff --git a/rust/src/applayer.rs b/rust/src/applayer.rs
index 048afbe5a7f5..63c225aaa25f 100644
--- a/rust/src/applayer.rs
+++ b/rust/src/applayer.rs
@@ -18,10 +18,11 @@
 //! Parser registration functions and common interface module.
 
 use std;
-use crate::core::{self,DetectEngineState,AppLayerEventType,AppProto};
+use crate::core::{self,DetectEngineState,AppProto};
 use crate::direction::Direction;
 use crate::filecontainer::FileContainer;
 use crate::flow::Flow;
+use crate::sys::SCAppLayerEventType;
 use std::os::raw::{c_void,c_char,c_int};
 use crate::core::SC;
 use std::ffi::CStr;
@@ -457,8 +458,8 @@ pub type StateTxFreeFn  = unsafe extern "C" fn (*mut c_void, u64);
 pub type StateGetTxFn            = unsafe extern "C" fn (*mut c_void, u64) -> *mut c_void;
 pub type StateGetTxCntFn         = unsafe extern "C" fn (*mut c_void) -> u64;
 pub type StateGetProgressFn = unsafe extern "C" fn (*mut c_void, u8) -> c_int;
-pub type GetEventInfoFn     = unsafe extern "C" fn (*const c_char, event_id: *mut u8, *mut AppLayerEventType) -> c_int;
-pub type GetEventInfoByIdFn = unsafe extern "C" fn (event_id: u8, *mut *const c_char, *mut AppLayerEventType) -> c_int;
+pub type GetEventInfoFn     = unsafe extern "C" fn (*const c_char, event_id: *mut u8, *mut SCAppLayerEventType) -> c_int;
+pub type GetEventInfoByIdFn = unsafe extern "C" fn (event_id: u8, *mut *const c_char, *mut SCAppLayerEventType) -> c_int;
 pub type LocalStorageNewFn  = extern "C" fn () -> *mut c_void;
 pub type LocalStorageFreeFn = extern "C" fn (*mut c_void);
 pub type GetTxFilesFn       = unsafe extern "C" fn (*mut c_void, u8) -> AppLayerGetFileState;
@@ -596,13 +597,13 @@ pub trait AppLayerEvent {
     unsafe extern "C" fn get_event_info(
         event_name: *const std::os::raw::c_char,
         event_id: *mut u8,
-        event_type: *mut core::AppLayerEventType,
+        event_type: *mut SCAppLayerEventType,
     ) -> std::os::raw::c_int;
 
     unsafe extern "C" fn get_event_info_by_id(
         event_id: u8,
         event_name: *mut *const std::os::raw::c_char,
-        event_type: *mut core::AppLayerEventType,
+        event_type: *mut SCAppLayerEventType,
     ) -> std::os::raw::c_int;
 }
 
@@ -625,7 +626,7 @@ pub trait AppLayerEvent {
 pub unsafe fn get_event_info<T: AppLayerEvent>(
     event_name: *const std::os::raw::c_char,
     event_id: *mut u8,
-    event_type: *mut core::AppLayerEventType,
+    event_type: *mut SCAppLayerEventType,
 ) -> std::os::raw::c_int {
     if event_name.is_null() {
         return -1;
@@ -637,7 +638,7 @@ pub unsafe fn get_event_info<T: AppLayerEvent>(
             return -1;
         }
     };
-    *event_type = core::AppLayerEventType::APP_LAYER_EVENT_TYPE_TRANSACTION;
+    *event_type = SCAppLayerEventType::APP_LAYER_EVENT_TYPE_TRANSACTION;
     *event_id = event;
     return 0;
 }
@@ -648,11 +649,11 @@ pub unsafe fn get_event_info<T: AppLayerEvent>(
 pub unsafe fn get_event_info_by_id<T: AppLayerEvent>(
     event_id: u8,
     event_name: *mut *const std::os::raw::c_char,
-    event_type: *mut core::AppLayerEventType,
+    event_type: *mut SCAppLayerEventType,
 ) -> std::os::raw::c_int {
     if let Some(e) = T::from_id(event_id) {
         *event_name = e.to_cstring().as_ptr() as *const std::os::raw::c_char;
-        *event_type = core::AppLayerEventType::APP_LAYER_EVENT_TYPE_TRANSACTION;
+        *event_type = SCAppLayerEventType::APP_LAYER_EVENT_TYPE_TRANSACTION;
         return 0;
     }
     return -1;
diff --git a/rust/src/core.rs b/rust/src/core.rs
index 7e1094a39e90..c188607573d2 100644
--- a/rust/src/core.rs
+++ b/rust/src/core.rs
@@ -25,14 +25,6 @@ use crate::flow::Flow;
 pub enum DetectEngineState {}
 pub enum AppLayerDecoderEvents {}
 
-#[repr(C)]
-#[derive(Debug, PartialEq, Eq, Clone, Copy)]
-#[allow(non_camel_case_types)]
-pub enum AppLayerEventType {
-    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
-    APP_LAYER_EVENT_TYPE_PACKET = 2,
-}
-
 pub const STREAM_START:    u8 = 0x01;
 pub const STREAM_EOF:      u8 = 0x02;
 pub const STREAM_TOSERVER: u8 = 0x04;
diff --git a/rust/src/ftp/event.rs b/rust/src/ftp/event.rs
index cc327369d875..a7edc1688176 100644
--- a/rust/src/ftp/event.rs
+++ b/rust/src/ftp/event.rs
@@ -15,7 +15,7 @@
  * 02110-1301, USA.
  */
 
-use crate::core::AppLayerEventType;
+use crate::sys::SCAppLayerEventType;
 use std::os::raw::{c_char, c_int};
 
 #[derive(Debug, PartialEq, Eq, AppLayerEvent)]
@@ -33,7 +33,7 @@ pub enum FtpEvent {
 /// Unsafe as called from C.
 #[no_mangle]
 pub unsafe extern "C" fn ftp_get_event_info(
-    event_name: *const c_char, event_id: *mut u8, event_type: *mut AppLayerEventType,
+    event_name: *const c_char, event_id: *mut u8, event_type: *mut SCAppLayerEventType,
 ) -> c_int {
     crate::applayer::get_event_info::<FtpEvent>(event_name, event_id, event_type)
 }
@@ -44,7 +44,7 @@ pub unsafe extern "C" fn ftp_get_event_info(
 /// Unsafe as called from C.
 #[no_mangle]
 pub unsafe extern "C" fn ftp_get_event_info_by_id(
-    event_id: u8, event_name: *mut *const c_char, event_type: *mut AppLayerEventType,
+    event_id: u8, event_name: *mut *const c_char, event_type: *mut SCAppLayerEventType,
 ) -> c_int {
     crate::applayer::get_event_info_by_id::<FtpEvent>(event_id, event_name, event_type) as c_int
 }
diff --git a/rust/src/lib.rs b/rust/src/lib.rs
index f28e4c249ace..37dca552e48c 100644
--- a/rust/src/lib.rs
+++ b/rust/src/lib.rs
@@ -143,3 +143,7 @@ pub mod direction;
 
 #[allow(unused_imports)]
 pub use suricata_lua_sys;
+
+// Generated Rust bindings from C.
+/// cbindgen:ignore
+pub mod sys;
diff --git a/rust/src/smb/smb.rs b/rust/src/smb/smb.rs
index 43a44545ad09..4ea2986dfd53 100644
--- a/rust/src/smb/smb.rs
+++ b/rust/src/smb/smb.rs
@@ -57,6 +57,7 @@ use crate::smb::session::*;
 use crate::smb::events::*;
 use crate::smb::files::*;
 use crate::smb::smb2_ioctl::*;
+use crate::sys::SCAppLayerEventType;
 
 #[derive(AppLayerFrameType)]
 pub enum SMBFrameType {
@@ -2267,7 +2268,7 @@ pub unsafe extern "C" fn rs_smb_get_tx_data(
 pub unsafe extern "C" fn rs_smb_state_get_event_info_by_id(
     event_id: u8,
     event_name: *mut *const std::os::raw::c_char,
-    event_type: *mut AppLayerEventType,
+    event_type: *mut SCAppLayerEventType,
 ) -> std::os::raw::c_int {
     SMBEvent::get_event_info_by_id(event_id, event_name, event_type)
 }
@@ -2276,7 +2277,7 @@ pub unsafe extern "C" fn rs_smb_state_get_event_info_by_id(
 pub unsafe extern "C" fn rs_smb_state_get_event_info(
     event_name: *const std::os::raw::c_char,
     event_id: *mut u8,
-    event_type: *mut AppLayerEventType,
+    event_type: *mut SCAppLayerEventType,
 ) -> std::os::raw::c_int {
     SMBEvent::get_event_info(event_name, event_id, event_type)
 }
diff --git a/rust/src/sys.rs b/rust/src/sys.rs
new file mode 100644
index 000000000000..35cef07d7c84
--- /dev/null
+++ b/rust/src/sys.rs
@@ -0,0 +1,21 @@
+/* Copyright (C) 2024 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+// We do this as an include so we can allow non_camel_case_types.
+#![allow(non_camel_case_types)]
+#![allow(non_snake_case)]
+include!("_sys.rs");
diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c
index a1daf3a2e1a4..5538df98c00b 100644
--- a/src/app-layer-dnp3.c
+++ b/src/app-layer-dnp3.c
@@ -1434,7 +1434,7 @@ static int DNP3GetAlstateProgress(void *tx, uint8_t direction)
  * \brief App-layer support.
  */
 static int DNP3StateGetEventInfo(
-        const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
+        const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type)
 {
     if (SCAppLayerGetEventIdByName(event_name, dnp3_decoder_event_table, event_id) == 0) {
         *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
@@ -1447,7 +1447,7 @@ static int DNP3StateGetEventInfo(
  * \brief App-layer support.
  */
 static int DNP3StateGetEventInfoById(
-        uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
+        uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type)
 {
     *event_name = SCMapEnumValueToName(event_id, dnp3_decoder_event_table);
     if (*event_name == NULL) {
diff --git a/src/app-layer-events.c b/src/app-layer-events.c
index eb32ea394671..87d72d890c89 100644
--- a/src/app-layer-events.c
+++ b/src/app-layer-events.c
@@ -23,6 +23,7 @@
  */
 
 #include "app-layer-events.h"
+#include "rust.h"
 #include "util-enum.h"
 
 int SCAppLayerGetEventIdByName(const char *event_name, SCEnumCharMap *table, uint8_t *event_id)
@@ -61,7 +62,7 @@ SCEnumCharMap app_layer_event_pkt_table[ ] = {
 };
 
 int AppLayerGetEventInfoById(
-        uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
+        uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type)
 {
     *event_name = SCMapEnumValueToName(event_id, app_layer_event_pkt_table);
     if (*event_name == NULL) {
@@ -165,7 +166,7 @@ SCEnumCharMap det_ctx_event_table[] = {
 };
 
 int DetectEngineGetEventInfo(
-        const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
+        const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type)
 {
     if (SCAppLayerGetEventIdByName(event_name, det_ctx_event_table, event_id) == 0) {
         *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
diff --git a/src/app-layer-events.h b/src/app-layer-events.h
index 7b4e5e06d075..2542e200faec 100644
--- a/src/app-layer-events.h
+++ b/src/app-layer-events.h
@@ -27,9 +27,13 @@
 
 /* contains fwd declaration of AppLayerDecoderEvents_ */
 #include "decode.h"
-#include "rust.h"
 #include "util-enum.h"
 
+typedef enum SCAppLayerEventType {
+    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
+    APP_LAYER_EVENT_TYPE_PACKET = 2,
+} SCAppLayerEventType;
+
 /**
  * \brief Data structure to store app layer decoder events.
  */
@@ -57,7 +61,7 @@ enum {
 int AppLayerGetPktEventInfo(const char *event_name, uint8_t *event_id);
 
 int AppLayerGetEventInfoById(
-        uint8_t event_id, const char **event_name, AppLayerEventType *event_type);
+        uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type);
 void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event);
 
 static inline int AppLayerDecoderEventsIsEventSet(
@@ -78,7 +82,7 @@ static inline int AppLayerDecoderEventsIsEventSet(
 void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events);
 void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events);
 int DetectEngineGetEventInfo(
-        const char *event_name, uint8_t *event_id, AppLayerEventType *event_type);
+        const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type);
 int SCAppLayerGetEventIdByName(const char *event_name, SCEnumCharMap *table, uint8_t *event_id);
 
 #endif /* SURICATA_APP_LAYER_EVENTS_H */
diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 2448c2b2722c..7524962bb8f5 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -2728,7 +2728,7 @@ void *HtpGetTxForH2(void *alstate)
 }
 
 static int HTPStateGetEventInfo(
-        const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
+        const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type)
 {
     if (SCAppLayerGetEventIdByName(event_name, http_decoder_event_table, event_id) == 0) {
         *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
@@ -2738,7 +2738,7 @@ static int HTPStateGetEventInfo(
 }
 
 static int HTPStateGetEventInfoById(
-        uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
+        uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type)
 {
     *event_name = SCMapEnumValueToName(event_id, http_decoder_event_table);
     if (*event_name == NULL) {
diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index 6285b67d256c..e8de8a7e6aef 100644
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -94,9 +94,9 @@ typedef struct AppLayerParserProtoCtx_
     int complete_ts;
     int complete_tc;
     int (*StateGetEventInfoById)(
-            uint8_t event_id, const char **event_name, AppLayerEventType *event_type);
+            uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type);
     int (*StateGetEventInfo)(
-            const char *event_name, uint8_t *event_id, AppLayerEventType *event_type);
+            const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type);
 
     AppLayerStateData *(*GetStateData)(void *state);
     AppLayerTxData *(*GetTxData)(void *tx);
@@ -537,7 +537,7 @@ void AppLayerParserRegisterStateProgressCompletionStatus(
 
 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
         int (*StateGetEventInfoById)(
-                uint8_t event_id, const char **event_name, AppLayerEventType *event_type))
+                uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type))
 {
     SCEnter();
 
@@ -559,7 +559,7 @@ void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto,
 
 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
         int (*StateGetEventInfo)(
-                const char *event_name, uint8_t *event_id, AppLayerEventType *event_type))
+                const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type))
 {
     SCEnter();
 
@@ -1105,7 +1105,7 @@ int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto,
 }
 
 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
-        uint8_t *event_id, AppLayerEventType *event_type)
+        uint8_t *event_id, SCAppLayerEventType *event_type)
 {
     SCEnter();
     const int ipproto_map = FlowGetProtoMapping(ipproto);
@@ -1117,7 +1117,7 @@ int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *ev
 }
 
 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id,
-        const char **event_name, AppLayerEventType *event_type)
+        const char **event_name, SCAppLayerEventType *event_type)
 {
     SCEnter();
     const int ipproto_map = FlowGetProtoMapping(ipproto);
diff --git a/src/app-layer-parser.h b/src/app-layer-parser.h
index d233edf9eb1f..1e6d77fe98cd 100644
--- a/src/app-layer-parser.h
+++ b/src/app-layer-parser.h
@@ -197,10 +197,10 @@ void AppLayerParserRegisterStateProgressCompletionStatus(
         AppProto alproto, const int ts, const int tc);
 void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto,
         int (*StateGetEventInfo)(
-                const char *event_name, uint8_t *event_id, AppLayerEventType *event_type));
+                const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type));
 void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
         int (*StateGetEventInfoById)(
-                uint8_t event_id, const char **event_name, AppLayerEventType *event_type));
+                uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type));
 void AppLayerParserRegisterGetFrameFuncs(uint8_t ipproto, AppProto alproto,
         AppLayerParserGetFrameIdByNameFn GetFrameIdByName,
         AppLayerParserGetFrameNameByIdFn GetFrameNameById);
@@ -240,9 +240,9 @@ uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
 void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
 int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
 int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
-        uint8_t *event_id, AppLayerEventType *event_type);
+        uint8_t *event_id, SCAppLayerEventType *event_type);
 int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id,
-        const char **event_name, AppLayerEventType *event_type);
+        const char **event_name, SCAppLayerEventType *event_type);
 
 uint64_t AppLayerParserGetTransactionActive(const Flow *f, AppLayerParserState *pstate, uint8_t direction);
 
diff --git a/src/app-layer-register.h b/src/app-layer-register.h
index 6f489c73e248..76b9d9b1549e 100644
--- a/src/app-layer-register.h
+++ b/src/app-layer-register.h
@@ -52,9 +52,9 @@ typedef struct AppLayerParser {
     int (*StateGetProgress)(void *alstate, uint8_t direction);
 
     int (*StateGetEventInfo)(
-            const char *event_name, uint8_t *event_id, AppLayerEventType *event_type);
+            const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type);
     int (*StateGetEventInfoById)(
-            uint8_t event_id, const char **event_name, AppLayerEventType *event_type);
+            uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type);
 
     void *(*LocalStorageAlloc)(void);
     void (*LocalStorageFree)(void *);
diff --git a/src/app-layer-smtp.c b/src/app-layer-smtp.c
index b2bf22a53145..6243cbabaee2 100644
--- a/src/app-layer-smtp.c
+++ b/src/app-layer-smtp.c
@@ -1649,7 +1649,7 @@ static void SMTPFreeMpmState(void)
 }
 
 static int SMTPStateGetEventInfo(
-        const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
+        const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type)
 {
     if (SCAppLayerGetEventIdByName(event_name, smtp_decoder_event_table, event_id) == 0) {
         *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
@@ -1659,7 +1659,7 @@ static int SMTPStateGetEventInfo(
 }
 
 static int SMTPStateGetEventInfoById(
-        uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
+        uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type)
 {
     *event_name = SCMapEnumValueToName(event_id, smtp_decoder_event_table);
     if (*event_name == NULL) {
diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c
index e387c6cc46c4..4a5cb286524e 100644
--- a/src/app-layer-ssl.c
+++ b/src/app-layer-ssl.c
@@ -2983,7 +2983,7 @@ static const char *SSLStateGetFrameNameById(const uint8_t frame_id)
 }
 
 static int SSLStateGetEventInfo(
-        const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
+        const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type)
 {
     if (SCAppLayerGetEventIdByName(event_name, tls_decoder_event_table, event_id) == 0) {
         *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
@@ -2993,7 +2993,7 @@ static int SSLStateGetEventInfo(
 }
 
 static int SSLStateGetEventInfoById(
-        uint8_t event_id, const char **event_name, AppLayerEventType *event_type)
+        uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type)
 {
     *event_name = SCMapEnumValueToName(event_id, tls_decoder_event_table);
     if (*event_name == NULL) {
diff --git a/src/app-layer-tftp.c b/src/app-layer-tftp.c
index 4a9b41176af2..caa23c5c23ba 100644
--- a/src/app-layer-tftp.c
+++ b/src/app-layer-tftp.c
@@ -63,7 +63,7 @@ static void TFTPStateTxFree(void *state, uint64_t tx_id)
 }
 
 static int TFTPStateGetEventInfo(
-        const char *event_name, uint8_t *event_id, AppLayerEventType *event_type)
+        const char *event_name, uint8_t *event_id, SCAppLayerEventType *event_type)
 {
     return -1;
 }
diff --git a/src/bindgen.h b/src/bindgen.h
new file mode 100644
index 000000000000..a62424284887
--- /dev/null
+++ b/src/bindgen.h
@@ -0,0 +1,35 @@
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file Input to bindgen to generate Rust bindings.
+ *
+ * This file should include every header that should have Rust
+ * bindings generated for it. It is then used by bindgen to generate
+ * the Rust bindings.
+ */
+
+#ifndef SURICATA_BINDGEN_H
+#define SURICATA_BINDGEN_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#include "app-layer-protos.h"
+#include "app-layer-events.h"
+
+#endif
diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index 8dd9229f074e..a48def98ab77 100644
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -141,8 +141,8 @@ static int DetectAppLayerEventPktMatch(DetectEngineThreadCtx *det_ctx,
                                            aled->event_id);
 }
 
-static DetectAppLayerEventData *DetectAppLayerEventParsePkt(const char *arg,
-                                                            AppLayerEventType *event_type)
+static DetectAppLayerEventData *DetectAppLayerEventParsePkt(
+        const char *arg, SCAppLayerEventType *event_type)
 {
     uint8_t event_id = 0;
     if (AppLayerGetPktEventInfo(arg, &event_id) != 0) {
@@ -193,7 +193,7 @@ static int DetectAppLayerEventSetup(DetectEngineCtx *de_ctx, Signature *s, const
     while (*arg != '\0' && isspace((unsigned char)*arg))
         arg++;
 
-    AppLayerEventType event_type;
+    SCAppLayerEventType event_type;
     DetectAppLayerEventData *data = NULL;
 
     if (strchr(arg, '.') == NULL) {
diff --git a/src/output-json-anomaly.c b/src/output-json-anomaly.c
index 00f82fa3685e..ae8faf9a3503 100644
--- a/src/output-json-anomaly.c
+++ b/src/output-json-anomaly.c
@@ -181,7 +181,7 @@ static int AnomalyAppLayerDecoderEventJson(ThreadVars *tv, JsonAnomalyLogThread
 
         const char *event_name = NULL;
         uint8_t event_code = decoder_events->events[i];
-        AppLayerEventType event_type;
+        SCAppLayerEventType event_type;
         int r;
         if (is_pktlayer) {
             r = AppLayerGetEventInfoById(event_code, &event_name, &event_type);
diff --git a/src/rust.h b/src/rust.h
index 03cff24c8d26..4ad060275d76 100644
--- a/src/rust.h
+++ b/src/rust.h
@@ -21,6 +21,7 @@
 // hack for include orders cf SCSha256
 typedef struct HttpRangeContainerBlock HttpRangeContainerBlock;
 #include "rust-context.h"
+#include "app-layer-events.h"
 #include "rust-bindings.h"
 
 #define JB_SET_STRING(jb, key, val) jb_set_formatted((jb), "\"" key "\":\"" val "\"")

From 77426c5fd1f49d4f2a27f524ab335493746dd736 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Mon, 28 Oct 2024 16:14:56 -0600
Subject: [PATCH 02/12] app-layer: remove prototypes from decode.h

This lets us remove decode.h from app-layer-events.h as pulling in
app-layer-events.h shouldn't result in pulling in dpdk, and other
includes not related to app-layer-events.

decode.h also doesn't need those forward declarations anymore due to
previous changes.
---
 src/app-layer-events.h | 6 +++---
 src/decode.h           | 6 ++----
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/app-layer-events.h b/src/app-layer-events.h
index 2542e200faec..7f46d4a02435 100644
--- a/src/app-layer-events.h
+++ b/src/app-layer-events.h
@@ -26,7 +26,7 @@
 #define SURICATA_APP_LAYER_EVENTS_H
 
 /* contains fwd declaration of AppLayerDecoderEvents_ */
-#include "decode.h"
+#include "suricata-common.h"
 #include "util-enum.h"
 
 typedef enum SCAppLayerEventType {
@@ -37,7 +37,7 @@ typedef enum SCAppLayerEventType {
 /**
  * \brief Data structure to store app layer decoder events.
  */
-struct AppLayerDecoderEvents_ {
+typedef struct AppLayerDecoderEvents_ {
     /* array of events */
     uint8_t *events;
     /* number of events in the above buffer */
@@ -46,7 +46,7 @@ struct AppLayerDecoderEvents_ {
     uint8_t events_buffer_size;
     /* last logged */
     uint8_t event_last_logged;
-};
+} AppLayerDecoderEvents;
 
 /* app layer pkt level events */
 enum {
diff --git a/src/decode.h b/src/decode.h
index 1b299864a7c0..e7893f50c0ce 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -94,16 +94,14 @@ enum PktSrcEnum {
 
 #include "util-validate.h"
 
+#include "app-layer-events.h"
+
 /* forward declarations */
 struct DetectionEngineThreadCtx_;
 typedef struct AppLayerThreadCtx_ AppLayerThreadCtx;
 
 struct PktPool_;
 
-/* declare these here as they are called from the
- * PACKET_RECYCLE and PACKET_CLEANUP macro's. */
-typedef struct AppLayerDecoderEvents_ AppLayerDecoderEvents;
-
 /* Address */
 typedef struct Address_ {
     char family;

From 4ffa61544aaebb8fe99a2ee8392ffdff518c9bfe Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 29 Oct 2024 11:56:53 -0600
Subject: [PATCH 03/12] bindgen: export SCAppLayerStateGetEventInfoByIdFn from
 C to Rust

Instead of defining this function pointer in type in Rust, and having
it in C signatures, create a type and export it to Rust.

To facilitate this, and new header has been creates,
"app-layer-types.h", this is to avoid the circular reference of C
headers pulling in "rust.h" which are required to generate Rust
bindings.
---
 rust/Makefile.am       |  1 +
 rust/src/_sys.rs       |  7 +++++++
 rust/src/applayer.rs   |  2 +-
 src/Makefile.am        |  1 +
 src/app-layer-events.h |  6 +-----
 src/app-layer-parser.c |  5 ++---
 src/app-layer-types.h  | 31 +++++++++++++++++++++++++++++++
 src/rust.h             |  1 +
 8 files changed, 45 insertions(+), 9 deletions(-)
 create mode 100644 src/app-layer-types.h

diff --git a/rust/Makefile.am b/rust/Makefile.am
index bf2b7b2c0fe3..7242b7226ee3 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -96,6 +96,7 @@ if HAVE_BINDGEN
 		--disable-header-comment \
 		--allowlist-type 'SCAppLayerEventType' \
 		--rustified-enum 'SCAppLayerEventType' \
+		--allowlist-type 'SCAppLayerStateGetEventInfoByIdFn' \
 		$(abs_top_srcdir)/src/bindgen.h \
 		-- \
 		-DHAVE_CONFIG_H -I../src $(CPPFLAGS)
diff --git a/rust/src/_sys.rs b/rust/src/_sys.rs
index f4f22d34d4bd..4e987885d9ed 100644
--- a/rust/src/_sys.rs
+++ b/rust/src/_sys.rs
@@ -4,3 +4,10 @@ pub enum SCAppLayerEventType {
     APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
     APP_LAYER_EVENT_TYPE_PACKET = 2,
 }
+pub type SCAppLayerStateGetEventInfoByIdFn = ::std::option::Option<
+    unsafe extern "C" fn(
+        event_id: u8,
+        event_name: *mut *const ::std::os::raw::c_char,
+        event_type: *mut SCAppLayerEventType,
+    ) -> ::std::os::raw::c_int,
+>;
diff --git a/rust/src/applayer.rs b/rust/src/applayer.rs
index 63c225aaa25f..b955cdf5dbdc 100644
--- a/rust/src/applayer.rs
+++ b/rust/src/applayer.rs
@@ -388,7 +388,7 @@ pub struct RustParser {
     /// Function to get an event id from a description
     pub get_eventinfo:      Option<GetEventInfoFn>,
     /// Function to get an event description from an event id
-    pub get_eventinfo_byid: Option<GetEventInfoByIdFn>,
+    pub get_eventinfo_byid: crate::sys::SCAppLayerStateGetEventInfoByIdFn,
 
     /// Function to allocate local storage
     pub localstorage_new:   Option<LocalStorageNewFn>,
diff --git a/src/Makefile.am b/src/Makefile.am
index 615816953542..a5c9dfecddd5 100755
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -42,6 +42,7 @@ noinst_HEADERS = \
 	app-layer-ssh.h \
 	app-layer-ssl.h \
 	app-layer-tftp.h \
+	app-layer-types.h \
 	app-layer-imap.h \
 	build-info.h \
 	conf.h \
diff --git a/src/app-layer-events.h b/src/app-layer-events.h
index 7f46d4a02435..c33db5db3e26 100644
--- a/src/app-layer-events.h
+++ b/src/app-layer-events.h
@@ -27,13 +27,9 @@
 
 /* contains fwd declaration of AppLayerDecoderEvents_ */
 #include "suricata-common.h"
+#include "app-layer-types.h"
 #include "util-enum.h"
 
-typedef enum SCAppLayerEventType {
-    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
-    APP_LAYER_EVENT_TYPE_PACKET = 2,
-} SCAppLayerEventType;
-
 /**
  * \brief Data structure to store app layer decoder events.
  */
diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index e8de8a7e6aef..eb982e98f26d 100644
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -535,9 +535,8 @@ void AppLayerParserRegisterStateProgressCompletionStatus(
     alp_ctx.ctxs[alproto][FLOW_PROTO_DEFAULT].complete_tc = tc;
 }
 
-void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto,
-        int (*StateGetEventInfoById)(
-                uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type))
+void AppLayerParserRegisterGetEventInfoById(
+        uint8_t ipproto, AppProto alproto, SCAppLayerStateGetEventInfoByIdFn StateGetEventInfoById)
 {
     SCEnter();
 
diff --git a/src/app-layer-types.h b/src/app-layer-types.h
new file mode 100644
index 000000000000..08f8ed526f67
--- /dev/null
+++ b/src/app-layer-types.h
@@ -0,0 +1,31 @@
+/* Copyright (C) 2024 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#ifndef SURICATA_APP_LAYER_TYPES_H
+#define SURICATA_APP_LAYER_TYPES_H
+
+#include <stdint.h>
+
+typedef enum SCAppLayerEventType {
+    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
+    APP_LAYER_EVENT_TYPE_PACKET = 2,
+} SCAppLayerEventType;
+
+typedef int (*SCAppLayerStateGetEventInfoByIdFn)(
+        uint8_t event_id, const char **event_name, SCAppLayerEventType *event_type);
+
+#endif /* !SURICATA_APP_LAYER_TYPES_H */
diff --git a/src/rust.h b/src/rust.h
index 4ad060275d76..251254e351a1 100644
--- a/src/rust.h
+++ b/src/rust.h
@@ -22,6 +22,7 @@
 typedef struct HttpRangeContainerBlock HttpRangeContainerBlock;
 #include "rust-context.h"
 #include "app-layer-events.h"
+#include "app-layer-types.h"
 #include "rust-bindings.h"
 
 #define JB_SET_STRING(jb, key, val) jb_set_formatted((jb), "\"" key "\":\"" val "\"")

From 4d8cd63a266e868d5d043f0585dbc18d0b471a6a Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 29 Oct 2024 12:26:32 -0600
Subject: [PATCH 04/12] bindgen: export AppProto and AppProtoEnum to Rust

This exposes the C define ALPROTO values to Rust without having to
perform some runtime initialization with init_ffi.

As app-layer-protos.h was clean of a circular reference to rust.h we
could use it directly, it just needed the addition of
suricata-common.h.
---
 rust/Makefile.am       |  3 +++
 rust/src/_sys.rs       | 45 ++++++++++++++++++++++++++++++++++++++++++
 rust/src/core.rs       |  9 ++++-----
 src/app-layer-protos.h |  2 ++
 4 files changed, 54 insertions(+), 5 deletions(-)

diff --git a/rust/Makefile.am b/rust/Makefile.am
index 7242b7226ee3..8015718915bf 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -97,6 +97,9 @@ if HAVE_BINDGEN
 		--allowlist-type 'SCAppLayerEventType' \
 		--rustified-enum 'SCAppLayerEventType' \
 		--allowlist-type 'SCAppLayerStateGetEventInfoByIdFn' \
+		--allowlist-type 'AppProto' \
+		--allowlist-type 'AppProtoEnum' \
+		--rustified-enum 'AppProtoEnum' \
 		$(abs_top_srcdir)/src/bindgen.h \
 		-- \
 		-DHAVE_CONFIG_H -I../src $(CPPFLAGS)
diff --git a/rust/src/_sys.rs b/rust/src/_sys.rs
index 4e987885d9ed..31eaeceb1c66 100644
--- a/rust/src/_sys.rs
+++ b/rust/src/_sys.rs
@@ -1,5 +1,50 @@
 #[repr(u32)]
 #[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum AppProtoEnum {
+    ALPROTO_UNKNOWN = 0,
+    ALPROTO_FAILED = 1,
+    ALPROTO_HTTP1 = 2,
+    ALPROTO_FTP = 3,
+    ALPROTO_SMTP = 4,
+    ALPROTO_TLS = 5,
+    ALPROTO_SSH = 6,
+    ALPROTO_IMAP = 7,
+    ALPROTO_JABBER = 8,
+    ALPROTO_SMB = 9,
+    ALPROTO_DCERPC = 10,
+    ALPROTO_IRC = 11,
+    ALPROTO_DNS = 12,
+    ALPROTO_MODBUS = 13,
+    ALPROTO_ENIP = 14,
+    ALPROTO_DNP3 = 15,
+    ALPROTO_NFS = 16,
+    ALPROTO_NTP = 17,
+    ALPROTO_FTPDATA = 18,
+    ALPROTO_TFTP = 19,
+    ALPROTO_IKE = 20,
+    ALPROTO_KRB5 = 21,
+    ALPROTO_QUIC = 22,
+    ALPROTO_DHCP = 23,
+    ALPROTO_SNMP = 24,
+    ALPROTO_SIP = 25,
+    ALPROTO_RFB = 26,
+    ALPROTO_MQTT = 27,
+    ALPROTO_PGSQL = 28,
+    ALPROTO_TELNET = 29,
+    ALPROTO_WEBSOCKET = 30,
+    ALPROTO_LDAP = 31,
+    ALPROTO_DOH2 = 32,
+    ALPROTO_TEMPLATE = 33,
+    ALPROTO_RDP = 34,
+    ALPROTO_HTTP2 = 35,
+    ALPROTO_BITTORRENT_DHT = 36,
+    ALPROTO_POP3 = 37,
+    ALPROTO_HTTP = 38,
+    ALPROTO_MAX_STATIC = 39,
+}
+pub type AppProto = u16;
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
 pub enum SCAppLayerEventType {
     APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
     APP_LAYER_EVENT_TYPE_PACKET = 2,
diff --git a/rust/src/core.rs b/rust/src/core.rs
index c188607573d2..4f5699cde0b5 100644
--- a/rust/src/core.rs
+++ b/rust/src/core.rs
@@ -21,6 +21,8 @@ use std;
 use crate::filecontainer::*;
 use crate::flow::Flow;
 
+pub use crate::sys::{AppProto, AppProtoEnum};
+
 /// Opaque C types.
 pub enum DetectEngineState {}
 pub enum AppLayerDecoderEvents {}
@@ -33,11 +35,8 @@ pub const STREAM_GAP:      u8 = 0x10;
 pub const STREAM_DEPTH:    u8 = 0x20;
 pub const STREAM_MIDSTREAM:u8 = 0x40;
 
-// Application layer protocol identifiers (app-layer-protos.h)
-pub type AppProto = u16;
-
-pub const ALPROTO_UNKNOWN : AppProto = 0;
-pub const ALPROTO_FAILED : AppProto = 1;
+pub const ALPROTO_UNKNOWN : AppProto = AppProtoEnum::ALPROTO_UNKNOWN as u16;
+pub const ALPROTO_FAILED : AppProto = AppProtoEnum::ALPROTO_FAILED as u16;
 
 pub const IPPROTO_TCP : u8 = 6;
 pub const IPPROTO_UDP : u8 = 17;
diff --git a/src/app-layer-protos.h b/src/app-layer-protos.h
index 813e58f13d3b..a2e1f7374289 100644
--- a/src/app-layer-protos.h
+++ b/src/app-layer-protos.h
@@ -25,6 +25,8 @@
 #ifndef SURICATA_APP_LAYER_PROTOS_H
 #define SURICATA_APP_LAYER_PROTOS_H
 
+#include "suricata-common.h"
+
 enum AppProtoEnum {
     ALPROTO_UNKNOWN = 0,
     /* used by the probing parser when alproto detection fails

From 7b78150f87430fea81433081a0fb75c8ae859d4e Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Tue, 29 Oct 2024 12:39:51 -0600
Subject: [PATCH 05/12] dhcp: use ALPROTO_DHCP from bindgen

---
 rust/src/dhcp/dhcp.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/rust/src/dhcp/dhcp.rs b/rust/src/dhcp/dhcp.rs
index 28f6f2613797..61066b890986 100644
--- a/rust/src/dhcp/dhcp.rs
+++ b/rust/src/dhcp/dhcp.rs
@@ -19,10 +19,11 @@ use crate::applayer::{self, *};
 use crate::core::{ALPROTO_UNKNOWN, AppProto, IPPROTO_UDP};
 use crate::dhcp::parser::*;
 use crate::flow::Flow;
+use crate::sys::AppProtoEnum;
 use std;
 use std::ffi::CString;
 
-pub(super) static mut ALPROTO_DHCP: AppProto = ALPROTO_UNKNOWN;
+pub(super) static ALPROTO_DHCP: AppProto = AppProtoEnum::ALPROTO_DHCP as AppProto;
 
 static DHCP_MIN_FRAME_LEN: u32 = 232;
 
@@ -305,10 +306,9 @@ pub unsafe extern "C" fn rs_dhcp_register_parser() {
     let ip_proto_str = CString::new("udp").unwrap();
 
     if AppLayerProtoDetectConfProtoDetectionEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
-        let alproto = AppLayerRegisterProtocolDetection(&parser, 1);
-        ALPROTO_DHCP = alproto;
+        AppLayerRegisterProtocolDetection(&parser, 1);
         if AppLayerParserConfParserEnabled(ip_proto_str.as_ptr(), parser.name) != 0 {
-            let _ = AppLayerRegisterParser(&parser, alproto);
+            let _ = AppLayerRegisterParser(&parser, ALPROTO_DHCP);
         }
     } else {
         SCLogDebug!("Protocol detector and parser disabled for DHCP.");

From 219ec53089c28275c1b5f0cfcff4f80bb81adf5b Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Wed, 22 Jan 2025 11:15:45 -0600
Subject: [PATCH 06/12] github-ci: test if bindgen bindings are up to date

This required us to remove the auto-generated by header as it can
change depending on what version is used.

I suppose different versions could generate slightly different output
that would cause this error out. In which case we may want to use a
custom script that can be a bit smarter output, or simply error out if
any of the headers used in the bindings is newer than the generated
_sys.rs file.
---
 .github/workflows/rust.yml | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 28d8b3ee7218..5206f2a5898c 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -21,20 +21,18 @@ jobs:
     runs-on: ubuntu-latest
     container: almalinux:9
     steps:
-      - name: Cache rust
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
-        with:
-          path: ~/.cargo
-          key: check-rust
-
       - name: Install system packages
         run: |
-          dnf -y install dnf-plugins-core
+          dnf -y install dnf-plugins-core epel-release
           dnf config-manager --set-enabled crb
           dnf -y install \
                 autoconf \
                 automake \
-                cargo-vendor \
+                bindgen \
+                cargo \
+                cbindgen \
+                clang-devel \
+                clippy \
                 diffutils \
                 numactl-devel \
                 dpdk-devel \
@@ -61,21 +59,28 @@ jobs:
                 python3-devel \
                 python3-sphinx \
                 python3-yaml \
+                rust \
+                rustfmt \
                 sudo \
                 which \
                 zlib-devel
 
-      - name: Installing Rust
-        run: |
-          curl https://sh.rustup.rs -sSf | sh -s -- -y
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-      - name: Install cbindgen
-        run: cargo install --debug cbindgen
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
       - run: git config --global --add safe.directory /__w/suricata/suricata
       - run: ./scripts/bundle.sh
       - run: ./autogen.sh
       - run: ./configure --enable-warnings
+      - name: Checking bindgen output
+        working-directory: rust
+        run: |
+          bindgen --version
+          make update-bindings
+          diff=$(git diff src/_sys.rs)
+          if [ "${diff}" ]; then
+              echo "${diff}"
+              echo "::error ::Bindgen bindings appear to be out of date"
+              exit 1
+          fi
       - run: cargo clippy --all-features --fix --allow-no-vcs
         working-directory: rust
       - run: |

From dfb1a533149d493bec81c161fe1aaa59b0d734f5 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Wed, 22 Jan 2025 12:08:39 -0600
Subject: [PATCH 07/12] rust: add bindgen bindings check to make check

If we have bindgen, and we're building in-tree, rebuild the bindings
and compare to the previous bindings and print a warning if there is a
difference.

Only a warning for now, as I'm not sure where this might fail, and I
don't want it to become a nuisance.
---
 rust/Makefile.am | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/rust/Makefile.am b/rust/Makefile.am
index 8015718915bf..49af45bc8eb2 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -81,10 +81,28 @@ clean-local:
 distclean-local:
 	rm -rf vendor dist
 
+check-bindgen-bindings:
+if HAVE_BINDGEN
+	if test "$(top_srcdir)" = "$(top_builddir)"; then \
+		cp src/_sys.rs src/_sys.rs.orig; \
+		$(MAKE) update-bindings; \
+		if diff src/_sys.rs src/_sys.rs.orig > /dev/null 2>&1; then \
+			rm -f src/_sys.rs.orig; \
+		else \
+			echo "WARNING: bindgen bindings may be out of date"; \
+		fi \
+	else \
+		echo "Not checking bindings for out of tree build"; \
+	fi
+else
+	@echo "Unable to check bindgen bindings: bindgen not found"
+endif
+
 check:
 	cd $(abs_top_srcdir)/rust && \
 		$(CARGO_ENV) \
 		$(CARGO) test --all $(RELEASE) --features "$(RUST_FEATURES)"
+	$(MAKE) check-bindgen-bindings
 
 vendor:
 	$(CARGO_ENV) $(CARGO) vendor

From 50362abc0072710406b8e5d58964014e527b9eb0 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Wed, 22 Jan 2025 16:53:20 -0600
Subject: [PATCH 08/12] rust/bindings: add jb_ funcs to bindings

This is an example of how we can use cbindgen -> C for "C" style
functions written in Rust, and then back to Rust with bindgen. The idea
is to build one Rust module that contains all the C bindings, whether or
not the functions are written in Rust or C.
---
 rust/Makefile.am |   5 +-
 rust/src/_sys.rs | 171 +++++++++++++++++++++++++++++++++++++++++++----
 src/bindgen.h    |   1 +
 3 files changed, 164 insertions(+), 13 deletions(-)

diff --git a/rust/Makefile.am b/rust/Makefile.am
index 49af45bc8eb2..b0494f3903bd 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -111,6 +111,8 @@ update-bindings:
 if HAVE_BINDGEN
 	$(BINDGEN) \
 		-o src/_sys.rs \
+		--rust-edition 2021 \
+		--rust-target 1.67.1 \
 		--disable-header-comment \
 		--allowlist-type 'SCAppLayerEventType' \
 		--rustified-enum 'SCAppLayerEventType' \
@@ -118,9 +120,10 @@ if HAVE_BINDGEN
 		--allowlist-type 'AppProto' \
 		--allowlist-type 'AppProtoEnum' \
 		--rustified-enum 'AppProtoEnum' \
+		--allowlist-function 'jb_.*' \
 		$(abs_top_srcdir)/src/bindgen.h \
 		-- \
-		-DHAVE_CONFIG_H -I../src $(CPPFLAGS)
+		-DHAVE_CONFIG_H -I../src -I../rust/gen $(CPPFLAGS)
 else
 	@echo "error: bindgen not installed, can't update bindings"
 	exit 1
diff --git a/rust/src/_sys.rs b/rust/src/_sys.rs
index 31eaeceb1c66..98d60a3d040e 100644
--- a/rust/src/_sys.rs
+++ b/rust/src/_sys.rs
@@ -1,5 +1,18 @@
 #[repr(u32)]
 #[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum SCAppLayerEventType {
+    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
+    APP_LAYER_EVENT_TYPE_PACKET = 2,
+}
+pub type SCAppLayerStateGetEventInfoByIdFn = ::std::option::Option<
+    unsafe extern "C" fn(
+        event_id: u8,
+        event_name: *mut *const ::std::os::raw::c_char,
+        event_type: *mut SCAppLayerEventType,
+    ) -> ::std::os::raw::c_int,
+>;
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
 pub enum AppProtoEnum {
     ALPROTO_UNKNOWN = 0,
     ALPROTO_FAILED = 1,
@@ -43,16 +56,150 @@ pub enum AppProtoEnum {
     ALPROTO_MAX_STATIC = 39,
 }
 pub type AppProto = u16;
-#[repr(u32)]
-#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
-pub enum SCAppLayerEventType {
-    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
-    APP_LAYER_EVENT_TYPE_PACKET = 2,
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct JsonBuilder {
+    _unused: [u8; 0],
+}
+#[doc = " A \"mark\" or saved state for a JsonBuilder object.\n\n The name is full, and the types are u64 as this object is used\n directly in C as well."]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct JsonBuilderMark {
+    pub position: u64,
+    pub state_index: u64,
+    pub state: u64,
+}
+#[test]
+fn bindgen_test_layout_JsonBuilderMark() {
+    const UNINIT: ::std::mem::MaybeUninit<JsonBuilderMark> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<JsonBuilderMark>(),
+        24usize,
+        "Size of JsonBuilderMark"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<JsonBuilderMark>(),
+        8usize,
+        "Alignment of JsonBuilderMark"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).position) as usize - ptr as usize },
+        0usize,
+        "Offset of field: JsonBuilderMark::position"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).state_index) as usize - ptr as usize },
+        8usize,
+        "Offset of field: JsonBuilderMark::state_index"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).state) as usize - ptr as usize },
+        16usize,
+        "Offset of field: JsonBuilderMark::state"
+    );
+}
+extern "C" {
+    pub fn jb_new_object() -> *mut JsonBuilder;
+}
+extern "C" {
+    pub fn jb_new_array() -> *mut JsonBuilder;
+}
+extern "C" {
+    pub fn jb_clone(js: *mut JsonBuilder) -> *mut JsonBuilder;
+}
+extern "C" {
+    pub fn jb_free(js: *mut JsonBuilder);
+}
+extern "C" {
+    pub fn jb_capacity(jb: *mut JsonBuilder) -> usize;
+}
+extern "C" {
+    pub fn jb_reset(jb: *mut JsonBuilder);
+}
+extern "C" {
+    pub fn jb_open_object(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char) -> bool;
+}
+extern "C" {
+    pub fn jb_start_object(js: *mut JsonBuilder) -> bool;
+}
+extern "C" {
+    pub fn jb_open_array(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char) -> bool;
+}
+extern "C" {
+    pub fn jb_set_string(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char,
+        val: *const ::std::os::raw::c_char,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_string_from_bytes(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_base64(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_hex(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_formatted(js: *mut JsonBuilder, formatted: *const ::std::os::raw::c_char)
+        -> bool;
+}
+extern "C" {
+    pub fn jb_append_object(jb: *mut JsonBuilder, obj: *const JsonBuilder) -> bool;
+}
+extern "C" {
+    pub fn jb_set_object(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: *mut JsonBuilder,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_append_string(js: *mut JsonBuilder, val: *const ::std::os::raw::c_char) -> bool;
+}
+extern "C" {
+    pub fn jb_append_string_from_bytes(js: *mut JsonBuilder, bytes: *const u8, len: u32) -> bool;
+}
+extern "C" {
+    pub fn jb_append_base64(js: *mut JsonBuilder, bytes: *const u8, len: u32) -> bool;
+}
+extern "C" {
+    pub fn jb_append_uint(js: *mut JsonBuilder, val: u64) -> bool;
+}
+extern "C" {
+    pub fn jb_append_float(js: *mut JsonBuilder, val: f64) -> bool;
+}
+extern "C" {
+    pub fn jb_set_uint(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: u64) -> bool;
+}
+extern "C" {
+    pub fn jb_set_int(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: i64) -> bool;
+}
+extern "C" {
+    pub fn jb_set_float(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: f64)
+        -> bool;
+}
+extern "C" {
+    pub fn jb_set_bool(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: bool)
+        -> bool;
+}
+extern "C" {
+    pub fn jb_close(js: *mut JsonBuilder) -> bool;
+}
+extern "C" {
+    pub fn jb_len(js: *const JsonBuilder) -> usize;
+}
+extern "C" {
+    pub fn jb_ptr(js: *mut JsonBuilder) -> *const u8;
+}
+extern "C" {
+    pub fn jb_get_mark(js: *mut JsonBuilder, mark: *mut JsonBuilderMark);
+}
+extern "C" {
+    pub fn jb_restore_mark(js: *mut JsonBuilder, mark: *mut JsonBuilderMark) -> bool;
 }
-pub type SCAppLayerStateGetEventInfoByIdFn = ::std::option::Option<
-    unsafe extern "C" fn(
-        event_id: u8,
-        event_name: *mut *const ::std::os::raw::c_char,
-        event_type: *mut SCAppLayerEventType,
-    ) -> ::std::os::raw::c_int,
->;
diff --git a/src/bindgen.h b/src/bindgen.h
index a62424284887..33ad236f09a4 100644
--- a/src/bindgen.h
+++ b/src/bindgen.h
@@ -29,6 +29,7 @@
 #include <stdint.h>
 #include <stdbool.h>
 
+#include "rust.h"
 #include "app-layer-protos.h"
 #include "app-layer-events.h"
 

From f9ba485dd71156ba414eebf854ffa5d5bccaef44 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 23 Jan 2025 09:56:45 -0600
Subject: [PATCH 09/12] bindgen: remove rust-edition argument

Not supported on 0.69.5 as found in many package managers.
---
 rust/Makefile.am | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rust/Makefile.am b/rust/Makefile.am
index b0494f3903bd..400ecf05de59 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -111,7 +111,6 @@ update-bindings:
 if HAVE_BINDGEN
 	$(BINDGEN) \
 		-o src/_sys.rs \
-		--rust-edition 2021 \
 		--rust-target 1.67.1 \
 		--disable-header-comment \
 		--allowlist-type 'SCAppLayerEventType' \

From 2a7b05ecf68ac0c47b0cf82798639b370f43c339 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 23 Jan 2025 10:07:27 -0600
Subject: [PATCH 10/12] rust: stub in suricata-sys crate

This crate will contain bindgen generated bindings to C.
---
 configure.ac           |  1 +
 rust/Cargo.toml.in     |  3 ++-
 rust/Makefile.am       |  6 +++++-
 rust/sys/Cargo.toml.in |  6 ++++++
 rust/sys/Makefile.am   |  3 +++
 rust/sys/src/lib.rs    | 19 +++++++++++++++++++
 6 files changed, 36 insertions(+), 2 deletions(-)
 create mode 100644 rust/sys/Cargo.toml.in
 create mode 100644 rust/sys/Makefile.am
 create mode 100644 rust/sys/src/lib.rs

diff --git a/configure.ac b/configure.ac
index a721e6cebb4c..c9db17e14f78 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2519,6 +2519,7 @@ AC_SUBST(enable_non_bundled_htp)
 AM_CONDITIONAL([BUILD_SHARED_LIBRARY], [test "x$enable_shared" = "xyes"] && [test "x$can_build_shared_library" = "xyes"])
 
 AC_CONFIG_FILES(Makefile src/Makefile rust/Makefile rust/Cargo.lock rust/Cargo.toml rust/derive/Cargo.toml rust/.cargo/config.toml)
+AC_CONFIG_FILES(rust/sys/Makefile rust/sys/Cargo.toml)
 AC_CONFIG_FILES(qa/Makefile qa/coccinelle/Makefile)
 AC_CONFIG_FILES(rules/Makefile doc/Makefile doc/userguide/Makefile)
 AC_CONFIG_FILES(contrib/Makefile contrib/file_processor/Makefile contrib/file_processor/Action/Makefile contrib/file_processor/Processor/Makefile)
diff --git a/rust/Cargo.toml.in b/rust/Cargo.toml.in
index 8fad5fee77e3..5093c78eaac4 100644
--- a/rust/Cargo.toml.in
+++ b/rust/Cargo.toml.in
@@ -7,7 +7,7 @@ edition = "2021"
 rust-version = "1.67.1"
 
 [workspace]
-members = [".", "./derive"]
+members = [".", "./derive", "sys"]
 
 [lib]
 crate-type = ["staticlib", "rlib"]
@@ -68,6 +68,7 @@ hex = "~0.4.3"
 time = "~0.3.36"
 
 suricata-derive = { path = "./derive", version = "@PACKAGE_VERSION@" }
+suricata-sys = { path = "./sys", version = "@PACKAGE_VERSION@" }
 
 suricata-lua-sys = { version = "0.1.0-alpha.5" }
 
diff --git a/rust/Makefile.am b/rust/Makefile.am
index 400ecf05de59..f2011ccc52af 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -1,10 +1,14 @@
+SUBDIRS =	sys
+
 EXTRA_DIST =	src derive \
 		.cargo/config.toml.in \
 		cbindgen.toml \
 		dist/rust-bindings.h \
 		vendor \
 		Cargo.toml Cargo.lock \
-		derive/Cargo.toml
+		derive/Cargo.toml \
+		sys \
+		sys/Cargo.toml
 
 if !DEBUG
 RELEASE = --release
diff --git a/rust/sys/Cargo.toml.in b/rust/sys/Cargo.toml.in
new file mode 100644
index 000000000000..518fe36db910
--- /dev/null
+++ b/rust/sys/Cargo.toml.in
@@ -0,0 +1,6 @@
+[package]
+name = "suricata-sys"
+version = "@PACKAGE_VERSION@"
+edition = "2021"
+license = "GPL-2.0-only"
+description = "Bindings to Suricata C interface"
diff --git a/rust/sys/Makefile.am b/rust/sys/Makefile.am
new file mode 100644
index 000000000000..acf00aeb6850
--- /dev/null
+++ b/rust/sys/Makefile.am
@@ -0,0 +1,3 @@
+EXTRA_DIST =	Cargo.toml
+
+all-local: Cargo.toml
diff --git a/rust/sys/src/lib.rs b/rust/sys/src/lib.rs
new file mode 100644
index 000000000000..9d13a0517cd9
--- /dev/null
+++ b/rust/sys/src/lib.rs
@@ -0,0 +1,19 @@
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+// pub mod sys;
+// pub use sys::*;

From 2743797c434b50f588b0bf890d72391472ef3bed Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 23 Jan 2025 10:30:01 -0600
Subject: [PATCH 11/12] rust: move genering bindgen bindings to suricata-sys
 crate

This allows a plugin, or a library user to interface with the library
just using exported C definitions, and not having to use the main
suricata crate.

It is a common pattern in the Rust ecosystem to have a crate that just
contains the bindings like this.
---
 .github/workflows/rust.yml |    4 +-
 rust/Makefile.am           |   17 +-
 rust/src/_sys.rs           |  205 ----
 rust/src/lib.rs            |    5 +-
 rust/src/sys.rs            |   21 -
 rust/sys/src/lib.rs        |    7 +-
 rust/sys/src/sys.rs        | 2351 ++++++++++++++++++++++++++++++++++++
 7 files changed, 2367 insertions(+), 243 deletions(-)
 delete mode 100644 rust/src/_sys.rs
 delete mode 100644 rust/src/sys.rs
 create mode 100644 rust/sys/src/sys.rs

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 5206f2a5898c..3571edd6a452 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -74,8 +74,8 @@ jobs:
         working-directory: rust
         run: |
           bindgen --version
-          make update-bindings
-          diff=$(git diff src/_sys.rs)
+          make check-bindgen-bindings
+          diff=$(git diff sys)
           if [ "${diff}" ]; then
               echo "${diff}"
               echo "::error ::Bindgen bindings appear to be out of date"
diff --git a/rust/Makefile.am b/rust/Makefile.am
index f2011ccc52af..b41266790016 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -88,10 +88,10 @@ distclean-local:
 check-bindgen-bindings:
 if HAVE_BINDGEN
 	if test "$(top_srcdir)" = "$(top_builddir)"; then \
-		cp src/_sys.rs src/_sys.rs.orig; \
+		cp sys/src/sys.rs sys/src/sys.rs.orig; \
 		$(MAKE) update-bindings; \
-		if diff src/_sys.rs src/_sys.rs.orig > /dev/null 2>&1; then \
-			rm -f src/_sys.rs.orig; \
+		if diff sys/src/sys.rs sys/src/sys.rs.orig > /dev/null 2>&1; then \
+			rm -f sys/src/sys.rs.orig; \
 		else \
 			echo "WARNING: bindgen bindings may be out of date"; \
 		fi \
@@ -114,15 +114,12 @@ vendor:
 update-bindings:
 if HAVE_BINDGEN
 	$(BINDGEN) \
-		-o src/_sys.rs \
+		-o sys/src/sys.rs \
 		--rust-target 1.67.1 \
 		--disable-header-comment \
-		--allowlist-type 'SCAppLayerEventType' \
-		--rustified-enum 'SCAppLayerEventType' \
-		--allowlist-type 'SCAppLayerStateGetEventInfoByIdFn' \
-		--allowlist-type 'AppProto' \
-		--allowlist-type 'AppProtoEnum' \
-		--rustified-enum 'AppProtoEnum' \
+		--default-enum-style rust \
+		--allowlist-type 'SC.*' \
+		--allowlist-type 'AppProto.*' \
 		--allowlist-function 'jb_.*' \
 		$(abs_top_srcdir)/src/bindgen.h \
 		-- \
diff --git a/rust/src/_sys.rs b/rust/src/_sys.rs
deleted file mode 100644
index 98d60a3d040e..000000000000
--- a/rust/src/_sys.rs
+++ /dev/null
@@ -1,205 +0,0 @@
-#[repr(u32)]
-#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
-pub enum SCAppLayerEventType {
-    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
-    APP_LAYER_EVENT_TYPE_PACKET = 2,
-}
-pub type SCAppLayerStateGetEventInfoByIdFn = ::std::option::Option<
-    unsafe extern "C" fn(
-        event_id: u8,
-        event_name: *mut *const ::std::os::raw::c_char,
-        event_type: *mut SCAppLayerEventType,
-    ) -> ::std::os::raw::c_int,
->;
-#[repr(u32)]
-#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
-pub enum AppProtoEnum {
-    ALPROTO_UNKNOWN = 0,
-    ALPROTO_FAILED = 1,
-    ALPROTO_HTTP1 = 2,
-    ALPROTO_FTP = 3,
-    ALPROTO_SMTP = 4,
-    ALPROTO_TLS = 5,
-    ALPROTO_SSH = 6,
-    ALPROTO_IMAP = 7,
-    ALPROTO_JABBER = 8,
-    ALPROTO_SMB = 9,
-    ALPROTO_DCERPC = 10,
-    ALPROTO_IRC = 11,
-    ALPROTO_DNS = 12,
-    ALPROTO_MODBUS = 13,
-    ALPROTO_ENIP = 14,
-    ALPROTO_DNP3 = 15,
-    ALPROTO_NFS = 16,
-    ALPROTO_NTP = 17,
-    ALPROTO_FTPDATA = 18,
-    ALPROTO_TFTP = 19,
-    ALPROTO_IKE = 20,
-    ALPROTO_KRB5 = 21,
-    ALPROTO_QUIC = 22,
-    ALPROTO_DHCP = 23,
-    ALPROTO_SNMP = 24,
-    ALPROTO_SIP = 25,
-    ALPROTO_RFB = 26,
-    ALPROTO_MQTT = 27,
-    ALPROTO_PGSQL = 28,
-    ALPROTO_TELNET = 29,
-    ALPROTO_WEBSOCKET = 30,
-    ALPROTO_LDAP = 31,
-    ALPROTO_DOH2 = 32,
-    ALPROTO_TEMPLATE = 33,
-    ALPROTO_RDP = 34,
-    ALPROTO_HTTP2 = 35,
-    ALPROTO_BITTORRENT_DHT = 36,
-    ALPROTO_POP3 = 37,
-    ALPROTO_HTTP = 38,
-    ALPROTO_MAX_STATIC = 39,
-}
-pub type AppProto = u16;
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct JsonBuilder {
-    _unused: [u8; 0],
-}
-#[doc = " A \"mark\" or saved state for a JsonBuilder object.\n\n The name is full, and the types are u64 as this object is used\n directly in C as well."]
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct JsonBuilderMark {
-    pub position: u64,
-    pub state_index: u64,
-    pub state: u64,
-}
-#[test]
-fn bindgen_test_layout_JsonBuilderMark() {
-    const UNINIT: ::std::mem::MaybeUninit<JsonBuilderMark> = ::std::mem::MaybeUninit::uninit();
-    let ptr = UNINIT.as_ptr();
-    assert_eq!(
-        ::std::mem::size_of::<JsonBuilderMark>(),
-        24usize,
-        "Size of JsonBuilderMark"
-    );
-    assert_eq!(
-        ::std::mem::align_of::<JsonBuilderMark>(),
-        8usize,
-        "Alignment of JsonBuilderMark"
-    );
-    assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).position) as usize - ptr as usize },
-        0usize,
-        "Offset of field: JsonBuilderMark::position"
-    );
-    assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).state_index) as usize - ptr as usize },
-        8usize,
-        "Offset of field: JsonBuilderMark::state_index"
-    );
-    assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).state) as usize - ptr as usize },
-        16usize,
-        "Offset of field: JsonBuilderMark::state"
-    );
-}
-extern "C" {
-    pub fn jb_new_object() -> *mut JsonBuilder;
-}
-extern "C" {
-    pub fn jb_new_array() -> *mut JsonBuilder;
-}
-extern "C" {
-    pub fn jb_clone(js: *mut JsonBuilder) -> *mut JsonBuilder;
-}
-extern "C" {
-    pub fn jb_free(js: *mut JsonBuilder);
-}
-extern "C" {
-    pub fn jb_capacity(jb: *mut JsonBuilder) -> usize;
-}
-extern "C" {
-    pub fn jb_reset(jb: *mut JsonBuilder);
-}
-extern "C" {
-    pub fn jb_open_object(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char) -> bool;
-}
-extern "C" {
-    pub fn jb_start_object(js: *mut JsonBuilder) -> bool;
-}
-extern "C" {
-    pub fn jb_open_array(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char) -> bool;
-}
-extern "C" {
-    pub fn jb_set_string(
-        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char,
-        val: *const ::std::os::raw::c_char,
-    ) -> bool;
-}
-extern "C" {
-    pub fn jb_set_string_from_bytes(
-        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
-    ) -> bool;
-}
-extern "C" {
-    pub fn jb_set_base64(
-        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
-    ) -> bool;
-}
-extern "C" {
-    pub fn jb_set_hex(
-        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
-    ) -> bool;
-}
-extern "C" {
-    pub fn jb_set_formatted(js: *mut JsonBuilder, formatted: *const ::std::os::raw::c_char)
-        -> bool;
-}
-extern "C" {
-    pub fn jb_append_object(jb: *mut JsonBuilder, obj: *const JsonBuilder) -> bool;
-}
-extern "C" {
-    pub fn jb_set_object(
-        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: *mut JsonBuilder,
-    ) -> bool;
-}
-extern "C" {
-    pub fn jb_append_string(js: *mut JsonBuilder, val: *const ::std::os::raw::c_char) -> bool;
-}
-extern "C" {
-    pub fn jb_append_string_from_bytes(js: *mut JsonBuilder, bytes: *const u8, len: u32) -> bool;
-}
-extern "C" {
-    pub fn jb_append_base64(js: *mut JsonBuilder, bytes: *const u8, len: u32) -> bool;
-}
-extern "C" {
-    pub fn jb_append_uint(js: *mut JsonBuilder, val: u64) -> bool;
-}
-extern "C" {
-    pub fn jb_append_float(js: *mut JsonBuilder, val: f64) -> bool;
-}
-extern "C" {
-    pub fn jb_set_uint(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: u64) -> bool;
-}
-extern "C" {
-    pub fn jb_set_int(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: i64) -> bool;
-}
-extern "C" {
-    pub fn jb_set_float(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: f64)
-        -> bool;
-}
-extern "C" {
-    pub fn jb_set_bool(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: bool)
-        -> bool;
-}
-extern "C" {
-    pub fn jb_close(js: *mut JsonBuilder) -> bool;
-}
-extern "C" {
-    pub fn jb_len(js: *const JsonBuilder) -> usize;
-}
-extern "C" {
-    pub fn jb_ptr(js: *mut JsonBuilder) -> *const u8;
-}
-extern "C" {
-    pub fn jb_get_mark(js: *mut JsonBuilder, mark: *mut JsonBuilderMark);
-}
-extern "C" {
-    pub fn jb_restore_mark(js: *mut JsonBuilder, mark: *mut JsonBuilderMark) -> bool;
-}
diff --git a/rust/src/lib.rs b/rust/src/lib.rs
index 37dca552e48c..886c401d61e2 100644
--- a/rust/src/lib.rs
+++ b/rust/src/lib.rs
@@ -144,6 +144,5 @@ pub mod direction;
 #[allow(unused_imports)]
 pub use suricata_lua_sys;
 
-// Generated Rust bindings from C.
-/// cbindgen:ignore
-pub mod sys;
+// Pull in the sys module and re-export.
+pub use suricata_sys::sys;
diff --git a/rust/src/sys.rs b/rust/src/sys.rs
deleted file mode 100644
index 35cef07d7c84..000000000000
--- a/rust/src/sys.rs
+++ /dev/null
@@ -1,21 +0,0 @@
-/* Copyright (C) 2024 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-// We do this as an include so we can allow non_camel_case_types.
-#![allow(non_camel_case_types)]
-#![allow(non_snake_case)]
-include!("_sys.rs");
diff --git a/rust/sys/src/lib.rs b/rust/sys/src/lib.rs
index 9d13a0517cd9..470f6e7a37ee 100644
--- a/rust/sys/src/lib.rs
+++ b/rust/sys/src/lib.rs
@@ -15,5 +15,8 @@
  * 02110-1301, USA.
  */
 
-// pub mod sys;
-// pub use sys::*;
+#![allow(non_camel_case_types)]
+#![allow(non_snake_case)]
+#![allow(clippy::all)]
+
+pub mod sys;
diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs
new file mode 100644
index 000000000000..567d90669cc8
--- /dev/null
+++ b/rust/sys/src/sys.rs
@@ -0,0 +1,2351 @@
+#[repr(C)]
+#[derive(Copy, Clone, Debug, Default, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct __BindgenBitfieldUnit<Storage> {
+    storage: Storage,
+}
+impl<Storage> __BindgenBitfieldUnit<Storage> {
+    #[inline]
+    pub const fn new(storage: Storage) -> Self {
+        Self { storage }
+    }
+}
+impl<Storage> __BindgenBitfieldUnit<Storage>
+where
+    Storage: AsRef<[u8]> + AsMut<[u8]>,
+{
+    #[inline]
+    fn extract_bit(byte: u8, index: usize) -> bool {
+        let bit_index = if cfg!(target_endian = "big") {
+            7 - (index % 8)
+        } else {
+            index % 8
+        };
+        let mask = 1 << bit_index;
+        byte & mask == mask
+    }
+    #[inline]
+    pub fn get_bit(&self, index: usize) -> bool {
+        debug_assert!(index / 8 < self.storage.as_ref().len());
+        let byte_index = index / 8;
+        let byte = self.storage.as_ref()[byte_index];
+        Self::extract_bit(byte, index)
+    }
+    #[inline]
+    pub unsafe fn raw_get_bit(this: *const Self, index: usize) -> bool {
+        debug_assert!(index / 8 < core::mem::size_of::<Storage>());
+        let byte_index = index / 8;
+        let byte = *(core::ptr::addr_of!((*this).storage) as *const u8).offset(byte_index as isize);
+        Self::extract_bit(byte, index)
+    }
+    #[inline]
+    fn change_bit(byte: u8, index: usize, val: bool) -> u8 {
+        let bit_index = if cfg!(target_endian = "big") {
+            7 - (index % 8)
+        } else {
+            index % 8
+        };
+        let mask = 1 << bit_index;
+        if val {
+            byte | mask
+        } else {
+            byte & !mask
+        }
+    }
+    #[inline]
+    pub fn set_bit(&mut self, index: usize, val: bool) {
+        debug_assert!(index / 8 < self.storage.as_ref().len());
+        let byte_index = index / 8;
+        let byte = &mut self.storage.as_mut()[byte_index];
+        *byte = Self::change_bit(*byte, index, val);
+    }
+    #[inline]
+    pub unsafe fn raw_set_bit(this: *mut Self, index: usize, val: bool) {
+        debug_assert!(index / 8 < core::mem::size_of::<Storage>());
+        let byte_index = index / 8;
+        let byte =
+            (core::ptr::addr_of_mut!((*this).storage) as *mut u8).offset(byte_index as isize);
+        *byte = Self::change_bit(*byte, index, val);
+    }
+    #[inline]
+    pub fn get(&self, bit_offset: usize, bit_width: u8) -> u64 {
+        debug_assert!(bit_width <= 64);
+        debug_assert!(bit_offset / 8 < self.storage.as_ref().len());
+        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= self.storage.as_ref().len());
+        let mut val = 0;
+        for i in 0..(bit_width as usize) {
+            if self.get_bit(i + bit_offset) {
+                let index = if cfg!(target_endian = "big") {
+                    bit_width as usize - 1 - i
+                } else {
+                    i
+                };
+                val |= 1 << index;
+            }
+        }
+        val
+    }
+    #[inline]
+    pub unsafe fn raw_get(this: *const Self, bit_offset: usize, bit_width: u8) -> u64 {
+        debug_assert!(bit_width <= 64);
+        debug_assert!(bit_offset / 8 < core::mem::size_of::<Storage>());
+        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= core::mem::size_of::<Storage>());
+        let mut val = 0;
+        for i in 0..(bit_width as usize) {
+            if Self::raw_get_bit(this, i + bit_offset) {
+                let index = if cfg!(target_endian = "big") {
+                    bit_width as usize - 1 - i
+                } else {
+                    i
+                };
+                val |= 1 << index;
+            }
+        }
+        val
+    }
+    #[inline]
+    pub fn set(&mut self, bit_offset: usize, bit_width: u8, val: u64) {
+        debug_assert!(bit_width <= 64);
+        debug_assert!(bit_offset / 8 < self.storage.as_ref().len());
+        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= self.storage.as_ref().len());
+        for i in 0..(bit_width as usize) {
+            let mask = 1 << i;
+            let val_bit_is_set = val & mask == mask;
+            let index = if cfg!(target_endian = "big") {
+                bit_width as usize - 1 - i
+            } else {
+                i
+            };
+            self.set_bit(index + bit_offset, val_bit_is_set);
+        }
+    }
+    #[inline]
+    pub unsafe fn raw_set(this: *mut Self, bit_offset: usize, bit_width: u8, val: u64) {
+        debug_assert!(bit_width <= 64);
+        debug_assert!(bit_offset / 8 < core::mem::size_of::<Storage>());
+        debug_assert!((bit_offset + (bit_width as usize)) / 8 <= core::mem::size_of::<Storage>());
+        for i in 0..(bit_width as usize) {
+            let mask = 1 << i;
+            let val_bit_is_set = val & mask == mask;
+            let index = if cfg!(target_endian = "big") {
+                bit_width as usize - 1 - i
+            } else {
+                i
+            };
+            Self::raw_set_bit(this, index + bit_offset, val_bit_is_set);
+        }
+    }
+}
+pub type __off_t = ::std::os::raw::c_long;
+pub type __off64_t = ::std::os::raw::c_long;
+pub type FILE = _IO_FILE;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct _IO_marker {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct _IO_codecvt {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct _IO_wide_data {
+    _unused: [u8; 0],
+}
+pub type _IO_lock_t = ::std::os::raw::c_void;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct _IO_FILE {
+    pub _flags: ::std::os::raw::c_int,
+    pub _IO_read_ptr: *mut ::std::os::raw::c_char,
+    pub _IO_read_end: *mut ::std::os::raw::c_char,
+    pub _IO_read_base: *mut ::std::os::raw::c_char,
+    pub _IO_write_base: *mut ::std::os::raw::c_char,
+    pub _IO_write_ptr: *mut ::std::os::raw::c_char,
+    pub _IO_write_end: *mut ::std::os::raw::c_char,
+    pub _IO_buf_base: *mut ::std::os::raw::c_char,
+    pub _IO_buf_end: *mut ::std::os::raw::c_char,
+    pub _IO_save_base: *mut ::std::os::raw::c_char,
+    pub _IO_backup_base: *mut ::std::os::raw::c_char,
+    pub _IO_save_end: *mut ::std::os::raw::c_char,
+    pub _markers: *mut _IO_marker,
+    pub _chain: *mut _IO_FILE,
+    pub _fileno: ::std::os::raw::c_int,
+    pub _flags2: ::std::os::raw::c_int,
+    pub _old_offset: __off_t,
+    pub _cur_column: ::std::os::raw::c_ushort,
+    pub _vtable_offset: ::std::os::raw::c_schar,
+    pub _shortbuf: [::std::os::raw::c_char; 1usize],
+    pub _lock: *mut _IO_lock_t,
+    pub _offset: __off64_t,
+    pub _codecvt: *mut _IO_codecvt,
+    pub _wide_data: *mut _IO_wide_data,
+    pub _freeres_list: *mut _IO_FILE,
+    pub _freeres_buf: *mut ::std::os::raw::c_void,
+    pub _prevchain: *mut *mut _IO_FILE,
+    pub _mode: ::std::os::raw::c_int,
+    pub _unused2: [::std::os::raw::c_char; 20usize],
+}
+#[test]
+fn bindgen_test_layout__IO_FILE() {
+    const UNINIT: ::std::mem::MaybeUninit<_IO_FILE> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<_IO_FILE>(),
+        216usize,
+        "Size of _IO_FILE"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<_IO_FILE>(),
+        8usize,
+        "Alignment of _IO_FILE"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: _IO_FILE::_flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_read_ptr) as usize - ptr as usize },
+        8usize,
+        "Offset of field: _IO_FILE::_IO_read_ptr"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_read_end) as usize - ptr as usize },
+        16usize,
+        "Offset of field: _IO_FILE::_IO_read_end"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_read_base) as usize - ptr as usize },
+        24usize,
+        "Offset of field: _IO_FILE::_IO_read_base"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_write_base) as usize - ptr as usize },
+        32usize,
+        "Offset of field: _IO_FILE::_IO_write_base"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_write_ptr) as usize - ptr as usize },
+        40usize,
+        "Offset of field: _IO_FILE::_IO_write_ptr"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_write_end) as usize - ptr as usize },
+        48usize,
+        "Offset of field: _IO_FILE::_IO_write_end"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_buf_base) as usize - ptr as usize },
+        56usize,
+        "Offset of field: _IO_FILE::_IO_buf_base"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_buf_end) as usize - ptr as usize },
+        64usize,
+        "Offset of field: _IO_FILE::_IO_buf_end"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_save_base) as usize - ptr as usize },
+        72usize,
+        "Offset of field: _IO_FILE::_IO_save_base"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_backup_base) as usize - ptr as usize },
+        80usize,
+        "Offset of field: _IO_FILE::_IO_backup_base"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._IO_save_end) as usize - ptr as usize },
+        88usize,
+        "Offset of field: _IO_FILE::_IO_save_end"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._markers) as usize - ptr as usize },
+        96usize,
+        "Offset of field: _IO_FILE::_markers"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._chain) as usize - ptr as usize },
+        104usize,
+        "Offset of field: _IO_FILE::_chain"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._fileno) as usize - ptr as usize },
+        112usize,
+        "Offset of field: _IO_FILE::_fileno"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._flags2) as usize - ptr as usize },
+        116usize,
+        "Offset of field: _IO_FILE::_flags2"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._old_offset) as usize - ptr as usize },
+        120usize,
+        "Offset of field: _IO_FILE::_old_offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._cur_column) as usize - ptr as usize },
+        128usize,
+        "Offset of field: _IO_FILE::_cur_column"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._vtable_offset) as usize - ptr as usize },
+        130usize,
+        "Offset of field: _IO_FILE::_vtable_offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._shortbuf) as usize - ptr as usize },
+        131usize,
+        "Offset of field: _IO_FILE::_shortbuf"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._lock) as usize - ptr as usize },
+        136usize,
+        "Offset of field: _IO_FILE::_lock"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._offset) as usize - ptr as usize },
+        144usize,
+        "Offset of field: _IO_FILE::_offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._codecvt) as usize - ptr as usize },
+        152usize,
+        "Offset of field: _IO_FILE::_codecvt"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._wide_data) as usize - ptr as usize },
+        160usize,
+        "Offset of field: _IO_FILE::_wide_data"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._freeres_list) as usize - ptr as usize },
+        168usize,
+        "Offset of field: _IO_FILE::_freeres_list"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._freeres_buf) as usize - ptr as usize },
+        176usize,
+        "Offset of field: _IO_FILE::_freeres_buf"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._prevchain) as usize - ptr as usize },
+        184usize,
+        "Offset of field: _IO_FILE::_prevchain"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._mode) as usize - ptr as usize },
+        192usize,
+        "Offset of field: _IO_FILE::_mode"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr)._unused2) as usize - ptr as usize },
+        196usize,
+        "Offset of field: _IO_FILE::_unused2"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct __pthread_internal_list {
+    pub __prev: *mut __pthread_internal_list,
+    pub __next: *mut __pthread_internal_list,
+}
+#[test]
+fn bindgen_test_layout___pthread_internal_list() {
+    const UNINIT: ::std::mem::MaybeUninit<__pthread_internal_list> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<__pthread_internal_list>(),
+        16usize,
+        "Size of __pthread_internal_list"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<__pthread_internal_list>(),
+        8usize,
+        "Alignment of __pthread_internal_list"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__prev) as usize - ptr as usize },
+        0usize,
+        "Offset of field: __pthread_internal_list::__prev"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__next) as usize - ptr as usize },
+        8usize,
+        "Offset of field: __pthread_internal_list::__next"
+    );
+}
+pub type __pthread_list_t = __pthread_internal_list;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct __pthread_mutex_s {
+    pub __lock: ::std::os::raw::c_int,
+    pub __count: ::std::os::raw::c_uint,
+    pub __owner: ::std::os::raw::c_int,
+    pub __nusers: ::std::os::raw::c_uint,
+    pub __kind: ::std::os::raw::c_int,
+    pub __spins: ::std::os::raw::c_short,
+    pub __elision: ::std::os::raw::c_short,
+    pub __list: __pthread_list_t,
+}
+#[test]
+fn bindgen_test_layout___pthread_mutex_s() {
+    const UNINIT: ::std::mem::MaybeUninit<__pthread_mutex_s> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<__pthread_mutex_s>(),
+        40usize,
+        "Size of __pthread_mutex_s"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<__pthread_mutex_s>(),
+        8usize,
+        "Alignment of __pthread_mutex_s"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__lock) as usize - ptr as usize },
+        0usize,
+        "Offset of field: __pthread_mutex_s::__lock"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__count) as usize - ptr as usize },
+        4usize,
+        "Offset of field: __pthread_mutex_s::__count"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__owner) as usize - ptr as usize },
+        8usize,
+        "Offset of field: __pthread_mutex_s::__owner"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__nusers) as usize - ptr as usize },
+        12usize,
+        "Offset of field: __pthread_mutex_s::__nusers"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__kind) as usize - ptr as usize },
+        16usize,
+        "Offset of field: __pthread_mutex_s::__kind"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__spins) as usize - ptr as usize },
+        20usize,
+        "Offset of field: __pthread_mutex_s::__spins"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__elision) as usize - ptr as usize },
+        22usize,
+        "Offset of field: __pthread_mutex_s::__elision"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__list) as usize - ptr as usize },
+        24usize,
+        "Offset of field: __pthread_mutex_s::__list"
+    );
+}
+pub type pthread_t = ::std::os::raw::c_ulong;
+#[repr(C)]
+#[derive(Copy, Clone)]
+pub union pthread_mutex_t {
+    pub __data: __pthread_mutex_s,
+    pub __size: [::std::os::raw::c_char; 40usize],
+    pub __align: ::std::os::raw::c_long,
+}
+#[test]
+fn bindgen_test_layout_pthread_mutex_t() {
+    const UNINIT: ::std::mem::MaybeUninit<pthread_mutex_t> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<pthread_mutex_t>(),
+        40usize,
+        "Size of pthread_mutex_t"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<pthread_mutex_t>(),
+        8usize,
+        "Alignment of pthread_mutex_t"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__data) as usize - ptr as usize },
+        0usize,
+        "Offset of field: pthread_mutex_t::__data"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__size) as usize - ptr as usize },
+        0usize,
+        "Offset of field: pthread_mutex_t::__size"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).__align) as usize - ptr as usize },
+        0usize,
+        "Offset of field: pthread_mutex_t::__align"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct pcre2_real_code_8 {
+    _unused: [u8; 0],
+}
+pub type pcre2_code_8 = pcre2_real_code_8;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct pcre2_real_match_data_8 {
+    _unused: [u8; 0],
+}
+pub type pcre2_match_data_8 = pcre2_real_match_data_8;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCTime_t {
+    pub _bitfield_align_1: [u64; 0],
+    pub _bitfield_1: __BindgenBitfieldUnit<[u8; 8usize]>,
+}
+#[test]
+fn bindgen_test_layout_SCTime_t() {
+    assert_eq!(
+        ::std::mem::size_of::<SCTime_t>(),
+        8usize,
+        "Size of SCTime_t"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCTime_t>(),
+        8usize,
+        "Alignment of SCTime_t"
+    );
+}
+impl SCTime_t {
+    #[inline]
+    pub fn secs(&self) -> u64 {
+        unsafe { ::std::mem::transmute(self._bitfield_1.get(0usize, 44u8) as u64) }
+    }
+    #[inline]
+    pub fn set_secs(&mut self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            self._bitfield_1.set(0usize, 44u8, val as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn secs_raw(this: *const Self) -> u64 {
+        unsafe {
+            ::std::mem::transmute(<__BindgenBitfieldUnit<[u8; 8usize]>>::raw_get(
+                ::std::ptr::addr_of!((*this)._bitfield_1),
+                0usize,
+                44u8,
+            ) as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn set_secs_raw(this: *mut Self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            <__BindgenBitfieldUnit<[u8; 8usize]>>::raw_set(
+                ::std::ptr::addr_of_mut!((*this)._bitfield_1),
+                0usize,
+                44u8,
+                val as u64,
+            )
+        }
+    }
+    #[inline]
+    pub fn usecs(&self) -> u64 {
+        unsafe { ::std::mem::transmute(self._bitfield_1.get(44usize, 20u8) as u64) }
+    }
+    #[inline]
+    pub fn set_usecs(&mut self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            self._bitfield_1.set(44usize, 20u8, val as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn usecs_raw(this: *const Self) -> u64 {
+        unsafe {
+            ::std::mem::transmute(<__BindgenBitfieldUnit<[u8; 8usize]>>::raw_get(
+                ::std::ptr::addr_of!((*this)._bitfield_1),
+                44usize,
+                20u8,
+            ) as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn set_usecs_raw(this: *mut Self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            <__BindgenBitfieldUnit<[u8; 8usize]>>::raw_set(
+                ::std::ptr::addr_of_mut!((*this)._bitfield_1),
+                44usize,
+                20u8,
+                val as u64,
+            )
+        }
+    }
+    #[inline]
+    pub fn new_bitfield_1(secs: u64, usecs: u64) -> __BindgenBitfieldUnit<[u8; 8usize]> {
+        let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 8usize]> = Default::default();
+        __bindgen_bitfield_unit.set(0usize, 44u8, {
+            let secs: u64 = unsafe { ::std::mem::transmute(secs) };
+            secs as u64
+        });
+        __bindgen_bitfield_unit.set(44usize, 20u8, {
+            let usecs: u64 = unsafe { ::std::mem::transmute(usecs) };
+            usecs as u64
+        });
+        __bindgen_bitfield_unit
+    }
+}
+#[doc = " Structure to define a Suricata plugin."]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCPlugin_ {
+    pub name: *const ::std::os::raw::c_char,
+    pub license: *const ::std::os::raw::c_char,
+    pub author: *const ::std::os::raw::c_char,
+    pub Init: ::std::option::Option<unsafe extern "C" fn()>,
+}
+#[test]
+fn bindgen_test_layout_SCPlugin_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCPlugin_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCPlugin_>(),
+        32usize,
+        "Size of SCPlugin_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCPlugin_>(),
+        8usize,
+        "Alignment of SCPlugin_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCPlugin_::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).license) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCPlugin_::license"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).author) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCPlugin_::author"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Init) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCPlugin_::Init"
+    );
+}
+#[doc = " Structure to define a Suricata plugin."]
+pub type SCPlugin = SCPlugin_;
+pub type SCPluginRegisterFunc = ::std::option::Option<unsafe extern "C" fn() -> *mut SCPlugin>;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCCapturePlugin_ {
+    pub name: *mut ::std::os::raw::c_char,
+    pub Init: ::std::option::Option<
+        unsafe extern "C" fn(
+            args: *const ::std::os::raw::c_char,
+            plugin_slot: ::std::os::raw::c_int,
+            receive_slot: ::std::os::raw::c_int,
+            decode_slot: ::std::os::raw::c_int,
+        ),
+    >,
+    pub ThreadInit: ::std::option::Option<
+        unsafe extern "C" fn(
+            ctx: *mut ::std::os::raw::c_void,
+            thread_id: ::std::os::raw::c_int,
+            thread_ctx: *mut *mut ::std::os::raw::c_void,
+        ) -> ::std::os::raw::c_int,
+    >,
+    pub ThreadDeinit: ::std::option::Option<
+        unsafe extern "C" fn(
+            ctx: *mut ::std::os::raw::c_void,
+            thread_ctx: *mut ::std::os::raw::c_void,
+        ) -> ::std::os::raw::c_int,
+    >,
+    pub GetDefaultMode:
+        ::std::option::Option<unsafe extern "C" fn() -> *const ::std::os::raw::c_char>,
+    pub entries: SCCapturePlugin___bindgen_ty_1,
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCCapturePlugin___bindgen_ty_1 {
+    pub tqe_next: *mut SCCapturePlugin_,
+    pub tqe_prev: *mut *mut SCCapturePlugin_,
+}
+#[test]
+fn bindgen_test_layout_SCCapturePlugin___bindgen_ty_1() {
+    const UNINIT: ::std::mem::MaybeUninit<SCCapturePlugin___bindgen_ty_1> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCCapturePlugin___bindgen_ty_1>(),
+        16usize,
+        "Size of SCCapturePlugin___bindgen_ty_1"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCCapturePlugin___bindgen_ty_1>(),
+        8usize,
+        "Alignment of SCCapturePlugin___bindgen_ty_1"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).tqe_next) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCCapturePlugin___bindgen_ty_1::tqe_next"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).tqe_prev) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCCapturePlugin___bindgen_ty_1::tqe_prev"
+    );
+}
+#[test]
+fn bindgen_test_layout_SCCapturePlugin_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCCapturePlugin_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCCapturePlugin_>(),
+        56usize,
+        "Size of SCCapturePlugin_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCCapturePlugin_>(),
+        8usize,
+        "Alignment of SCCapturePlugin_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCCapturePlugin_::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Init) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCCapturePlugin_::Init"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).ThreadInit) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCCapturePlugin_::ThreadInit"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).ThreadDeinit) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCCapturePlugin_::ThreadDeinit"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).GetDefaultMode) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCCapturePlugin_::GetDefaultMode"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).entries) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCCapturePlugin_::entries"
+    );
+}
+pub type SCCapturePlugin = SCCapturePlugin_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCAppLayerPlugin_ {
+    pub version: u64,
+    pub name: *mut ::std::os::raw::c_char,
+    pub Register: ::std::option::Option<unsafe extern "C" fn()>,
+    pub KeywordsRegister: ::std::option::Option<unsafe extern "C" fn()>,
+    pub logname: *mut ::std::os::raw::c_char,
+    pub confname: *mut ::std::os::raw::c_char,
+    pub Logger: ::std::option::Option<
+        unsafe extern "C" fn(
+            tx: *mut ::std::os::raw::c_void,
+            jb: *mut ::std::os::raw::c_void,
+        ) -> bool,
+    >,
+}
+#[test]
+fn bindgen_test_layout_SCAppLayerPlugin_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCAppLayerPlugin_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCAppLayerPlugin_>(),
+        56usize,
+        "Size of SCAppLayerPlugin_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCAppLayerPlugin_>(),
+        8usize,
+        "Alignment of SCAppLayerPlugin_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).version) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCAppLayerPlugin_::version"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCAppLayerPlugin_::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Register) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCAppLayerPlugin_::Register"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).KeywordsRegister) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCAppLayerPlugin_::KeywordsRegister"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).logname) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCAppLayerPlugin_::logname"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).confname) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCAppLayerPlugin_::confname"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Logger) as usize - ptr as usize },
+        48usize,
+        "Offset of field: SCAppLayerPlugin_::Logger"
+    );
+}
+pub type SCAppLayerPlugin = SCAppLayerPlugin_;
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum SCError {
+    SC_OK = 0,
+    SC_ENOMEM = 1,
+    SC_EINVAL = 2,
+    SC_ELIMIT = 3,
+    SC_EEXIST = 4,
+    SC_ENOENT = 5,
+    SC_ERR_MAX = 6,
+}
+#[doc = " \\brief Structure used to hold the line_no details of a FG filter"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogFGFilterLine_ {
+    pub line: ::std::os::raw::c_int,
+    pub next: *mut SCLogFGFilterLine_,
+}
+#[test]
+fn bindgen_test_layout_SCLogFGFilterLine_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogFGFilterLine_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogFGFilterLine_>(),
+        16usize,
+        "Size of SCLogFGFilterLine_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogFGFilterLine_>(),
+        8usize,
+        "Alignment of SCLogFGFilterLine_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).line) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogFGFilterLine_::line"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogFGFilterLine_::next"
+    );
+}
+#[doc = " \\brief Structure used to hold the line_no details of a FG filter"]
+pub type SCLogFGFilterLine = SCLogFGFilterLine_;
+#[doc = " \\brief structure used to hold the function details of a FG filter"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogFGFilterFunc_ {
+    pub func: *mut ::std::os::raw::c_char,
+    pub line: *mut SCLogFGFilterLine,
+    pub next: *mut SCLogFGFilterFunc_,
+}
+#[test]
+fn bindgen_test_layout_SCLogFGFilterFunc_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogFGFilterFunc_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogFGFilterFunc_>(),
+        24usize,
+        "Size of SCLogFGFilterFunc_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogFGFilterFunc_>(),
+        8usize,
+        "Alignment of SCLogFGFilterFunc_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).func) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogFGFilterFunc_::func"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).line) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogFGFilterFunc_::line"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCLogFGFilterFunc_::next"
+    );
+}
+#[doc = " \\brief structure used to hold the function details of a FG filter"]
+pub type SCLogFGFilterFunc = SCLogFGFilterFunc_;
+#[doc = " \\brief Structure used to hold FG filters.  Encapsulates filename details,\n        func details, which inturn encapsulates the line_no details"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogFGFilterFile_ {
+    pub file: *mut ::std::os::raw::c_char,
+    pub func: *mut SCLogFGFilterFunc,
+    pub next: *mut SCLogFGFilterFile_,
+}
+#[test]
+fn bindgen_test_layout_SCLogFGFilterFile_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogFGFilterFile_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogFGFilterFile_>(),
+        24usize,
+        "Size of SCLogFGFilterFile_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogFGFilterFile_>(),
+        8usize,
+        "Alignment of SCLogFGFilterFile_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogFGFilterFile_::file"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).func) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogFGFilterFile_::func"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCLogFGFilterFile_::next"
+    );
+}
+#[doc = " \\brief Structure used to hold FG filters.  Encapsulates filename details,\n        func details, which inturn encapsulates the line_no details"]
+pub type SCLogFGFilterFile = SCLogFGFilterFile_;
+#[doc = " \\brief Structure used to hold the thread_list used by FD filters"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogFDFilterThreadList_ {
+    pub entered: ::std::os::raw::c_int,
+    pub t: pthread_t,
+    pub next: *mut SCLogFDFilterThreadList_,
+}
+#[test]
+fn bindgen_test_layout_SCLogFDFilterThreadList_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogFDFilterThreadList_> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogFDFilterThreadList_>(),
+        24usize,
+        "Size of SCLogFDFilterThreadList_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogFDFilterThreadList_>(),
+        8usize,
+        "Alignment of SCLogFDFilterThreadList_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).entered) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogFDFilterThreadList_::entered"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).t) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogFDFilterThreadList_::t"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCLogFDFilterThreadList_::next"
+    );
+}
+#[doc = " \\brief Structure used to hold the thread_list used by FD filters"]
+pub type SCLogFDFilterThreadList = SCLogFDFilterThreadList_;
+#[doc = " \\brief Structure that holds the FD filters"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogFDFilter_ {
+    pub func: *mut ::std::os::raw::c_char,
+    pub next: *mut SCLogFDFilter_,
+}
+#[test]
+fn bindgen_test_layout_SCLogFDFilter_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogFDFilter_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogFDFilter_>(),
+        16usize,
+        "Size of SCLogFDFilter_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogFDFilter_>(),
+        8usize,
+        "Alignment of SCLogFDFilter_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).func) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogFDFilter_::func"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogFDFilter_::next"
+    );
+}
+#[doc = " \\brief Structure that holds the FD filters"]
+pub type SCLogFDFilter = SCLogFDFilter_;
+#[repr(i32)]
+#[doc = " \\brief The various log levels\n NOTE: when adding new level, don't forget to update SCLogMapLogLevelToSyslogLevel()\n      or it may result in logging to syslog with LOG_EMERG priority."]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum SCLogLevel {
+    SC_LOG_NOTSET = -1,
+    SC_LOG_NONE = 0,
+    SC_LOG_ERROR = 1,
+    SC_LOG_WARNING = 2,
+    SC_LOG_NOTICE = 3,
+    SC_LOG_INFO = 4,
+    SC_LOG_PERF = 5,
+    SC_LOG_CONFIG = 6,
+    SC_LOG_DEBUG = 7,
+    SC_LOG_LEVEL_MAX = 8,
+}
+#[repr(u32)]
+#[doc = " \\brief The various output interfaces supported"]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum SCLogOPIface {
+    SC_LOG_OP_IFACE_CONSOLE = 0,
+    SC_LOG_OP_IFACE_FILE = 1,
+    SC_LOG_OP_IFACE_SYSLOG = 2,
+    SC_LOG_OP_IFACE_MAX = 3,
+}
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum SCLogOPType {
+    SC_LOG_OP_TYPE_REGULAR = 0,
+    SC_LOG_OP_TYPE_JSON = 1,
+}
+#[doc = " \\brief Structure to be used when log_level override support would be provided\n        by the logging module"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogOPBuffer_ {
+    pub msg: [::std::os::raw::c_char; 2048usize],
+    pub temp: *mut ::std::os::raw::c_char,
+    pub log_format: *const ::std::os::raw::c_char,
+}
+#[test]
+fn bindgen_test_layout_SCLogOPBuffer_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogOPBuffer_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogOPBuffer_>(),
+        2064usize,
+        "Size of SCLogOPBuffer_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogOPBuffer_>(),
+        8usize,
+        "Alignment of SCLogOPBuffer_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).msg) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogOPBuffer_::msg"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).temp) as usize - ptr as usize },
+        2048usize,
+        "Offset of field: SCLogOPBuffer_::temp"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).log_format) as usize - ptr as usize },
+        2056usize,
+        "Offset of field: SCLogOPBuffer_::log_format"
+    );
+}
+#[doc = " \\brief Structure to be used when log_level override support would be provided\n        by the logging module"]
+pub type SCLogOPBuffer = SCLogOPBuffer_;
+#[doc = " \\brief The output interface context for the logging module"]
+#[repr(C)]
+#[derive(Copy, Clone)]
+pub struct SCLogOPIfaceCtx_ {
+    pub iface: SCLogOPIface,
+    pub use_color: bool,
+    pub type_: SCLogOPType,
+    pub file: *const ::std::os::raw::c_char,
+    pub file_d: *mut FILE,
+    pub rotation_flag: ::std::os::raw::c_int,
+    pub facility: ::std::os::raw::c_int,
+    pub log_level: SCLogLevel,
+    pub log_format: *const ::std::os::raw::c_char,
+    pub fp_mutex: pthread_mutex_t,
+    pub next: *mut SCLogOPIfaceCtx_,
+}
+#[test]
+fn bindgen_test_layout_SCLogOPIfaceCtx_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogOPIfaceCtx_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogOPIfaceCtx_>(),
+        104usize,
+        "Size of SCLogOPIfaceCtx_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogOPIfaceCtx_>(),
+        8usize,
+        "Alignment of SCLogOPIfaceCtx_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).iface) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogOPIfaceCtx_::iface"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).use_color) as usize - ptr as usize },
+        4usize,
+        "Offset of field: SCLogOPIfaceCtx_::use_color"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).type_) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogOPIfaceCtx_::type_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCLogOPIfaceCtx_::file"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file_d) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCLogOPIfaceCtx_::file_d"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).rotation_flag) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCLogOPIfaceCtx_::rotation_flag"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).facility) as usize - ptr as usize },
+        36usize,
+        "Offset of field: SCLogOPIfaceCtx_::facility"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).log_level) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCLogOPIfaceCtx_::log_level"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).log_format) as usize - ptr as usize },
+        48usize,
+        "Offset of field: SCLogOPIfaceCtx_::log_format"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).fp_mutex) as usize - ptr as usize },
+        56usize,
+        "Offset of field: SCLogOPIfaceCtx_::fp_mutex"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        96usize,
+        "Offset of field: SCLogOPIfaceCtx_::next"
+    );
+}
+#[doc = " \\brief The output interface context for the logging module"]
+pub type SCLogOPIfaceCtx = SCLogOPIfaceCtx_;
+#[doc = " \\brief Structure containing init data, that would be passed to\n        SCInitDebugModule()"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogInitData_ {
+    pub startup_message: *const ::std::os::raw::c_char,
+    pub global_log_level: SCLogLevel,
+    pub global_log_format: *const ::std::os::raw::c_char,
+    pub op_filter: *const ::std::os::raw::c_char,
+    pub op_ifaces: *mut SCLogOPIfaceCtx,
+    pub op_ifaces_cnt: u8,
+}
+#[test]
+fn bindgen_test_layout_SCLogInitData_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogInitData_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogInitData_>(),
+        48usize,
+        "Size of SCLogInitData_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogInitData_>(),
+        8usize,
+        "Alignment of SCLogInitData_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).startup_message) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogInitData_::startup_message"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).global_log_level) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogInitData_::global_log_level"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).global_log_format) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCLogInitData_::global_log_format"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_filter) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCLogInitData_::op_filter"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_ifaces) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCLogInitData_::op_ifaces"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_ifaces_cnt) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCLogInitData_::op_ifaces_cnt"
+    );
+}
+#[doc = " \\brief Structure containing init data, that would be passed to\n        SCInitDebugModule()"]
+pub type SCLogInitData = SCLogInitData_;
+#[doc = " \\brief Holds the config state used by the logging api"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCLogConfig_ {
+    pub startup_message: *mut ::std::os::raw::c_char,
+    pub log_level: SCLogLevel,
+    pub log_format: *mut ::std::os::raw::c_char,
+    pub op_filter: *mut ::std::os::raw::c_char,
+    pub op_filter_regex: *mut pcre2_code_8,
+    pub op_filter_regex_match: *mut pcre2_match_data_8,
+    pub op_ifaces: *mut SCLogOPIfaceCtx,
+    pub op_ifaces_cnt: u8,
+}
+#[test]
+fn bindgen_test_layout_SCLogConfig_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCLogConfig_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCLogConfig_>(),
+        64usize,
+        "Size of SCLogConfig_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCLogConfig_>(),
+        8usize,
+        "Alignment of SCLogConfig_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).startup_message) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCLogConfig_::startup_message"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).log_level) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCLogConfig_::log_level"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).log_format) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCLogConfig_::log_format"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_filter) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCLogConfig_::op_filter"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_filter_regex) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCLogConfig_::op_filter_regex"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_filter_regex_match) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCLogConfig_::op_filter_regex_match"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_ifaces) as usize - ptr as usize },
+        48usize,
+        "Offset of field: SCLogConfig_::op_ifaces"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).op_ifaces_cnt) as usize - ptr as usize },
+        56usize,
+        "Offset of field: SCLogConfig_::op_ifaces_cnt"
+    );
+}
+#[doc = " \\brief Holds the config state used by the logging api"]
+pub type SCLogConfig = SCLogConfig_;
+#[repr(C, packed)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCTPHdr_ {
+    pub sh_sport: u16,
+    pub sh_dport: u16,
+    pub sh_vtag: u32,
+    pub sh_sum: u32,
+}
+#[test]
+fn bindgen_test_layout_SCTPHdr_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCTPHdr_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCTPHdr_>(),
+        12usize,
+        "Size of SCTPHdr_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCTPHdr_>(),
+        1usize,
+        "Alignment of SCTPHdr_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sh_sport) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCTPHdr_::sh_sport"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sh_dport) as usize - ptr as usize },
+        2usize,
+        "Offset of field: SCTPHdr_::sh_dport"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sh_vtag) as usize - ptr as usize },
+        4usize,
+        "Offset of field: SCTPHdr_::sh_vtag"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sh_sum) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCTPHdr_::sh_sum"
+    );
+}
+pub type SCTPHdr = SCTPHdr_;
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum SCAppLayerEventType {
+    APP_LAYER_EVENT_TYPE_TRANSACTION = 1,
+    APP_LAYER_EVENT_TYPE_PACKET = 2,
+}
+pub type SCAppLayerStateGetEventInfoByIdFn = ::std::option::Option<
+    unsafe extern "C" fn(
+        event_id: u8,
+        event_name: *mut *const ::std::os::raw::c_char,
+        event_type: *mut SCAppLayerEventType,
+    ) -> ::std::os::raw::c_int,
+>;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCEnumCharMap_ {
+    pub enum_name: *const ::std::os::raw::c_char,
+    pub enum_value: ::std::os::raw::c_int,
+}
+#[test]
+fn bindgen_test_layout_SCEnumCharMap_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCEnumCharMap_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCEnumCharMap_>(),
+        16usize,
+        "Size of SCEnumCharMap_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCEnumCharMap_>(),
+        8usize,
+        "Alignment of SCEnumCharMap_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).enum_name) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCEnumCharMap_::enum_name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).enum_value) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCEnumCharMap_::enum_value"
+    );
+}
+pub type SCEnumCharMap = SCEnumCharMap_;
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum AppProtoEnum {
+    ALPROTO_UNKNOWN = 0,
+    ALPROTO_FAILED = 1,
+    ALPROTO_HTTP1 = 2,
+    ALPROTO_FTP = 3,
+    ALPROTO_SMTP = 4,
+    ALPROTO_TLS = 5,
+    ALPROTO_SSH = 6,
+    ALPROTO_IMAP = 7,
+    ALPROTO_JABBER = 8,
+    ALPROTO_SMB = 9,
+    ALPROTO_DCERPC = 10,
+    ALPROTO_IRC = 11,
+    ALPROTO_DNS = 12,
+    ALPROTO_MODBUS = 13,
+    ALPROTO_ENIP = 14,
+    ALPROTO_DNP3 = 15,
+    ALPROTO_NFS = 16,
+    ALPROTO_NTP = 17,
+    ALPROTO_FTPDATA = 18,
+    ALPROTO_TFTP = 19,
+    ALPROTO_IKE = 20,
+    ALPROTO_KRB5 = 21,
+    ALPROTO_QUIC = 22,
+    ALPROTO_DHCP = 23,
+    ALPROTO_SNMP = 24,
+    ALPROTO_SIP = 25,
+    ALPROTO_RFB = 26,
+    ALPROTO_MQTT = 27,
+    ALPROTO_PGSQL = 28,
+    ALPROTO_TELNET = 29,
+    ALPROTO_WEBSOCKET = 30,
+    ALPROTO_LDAP = 31,
+    ALPROTO_DOH2 = 32,
+    ALPROTO_TEMPLATE = 33,
+    ALPROTO_RDP = 34,
+    ALPROTO_HTTP2 = 35,
+    ALPROTO_BITTORRENT_DHT = 36,
+    ALPROTO_POP3 = 37,
+    ALPROTO_HTTP = 38,
+    ALPROTO_MAX_STATIC = 39,
+}
+pub type AppProto = u16;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct RadixUserData {
+    _unused: [u8; 0],
+}
+#[doc = " \\brief Structure for the node in the radix tree"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCRadix4Node_ {
+    pub _bitfield_align_1: [u64; 0],
+    pub _bitfield_1: __BindgenBitfieldUnit<[u8; 8usize]>,
+    #[doc = " the bit position where the bits differ in the nodes children.  Used\n  to determine the path to be taken during a lookup"]
+    pub bit: u8,
+    #[doc = " bool to see if prefix_stream is filled"]
+    pub has_prefix: bool,
+    #[doc = " the key that has been stored in the tree"]
+    pub prefix_stream: [u8; 4usize],
+    #[doc = " User data that is associated with this key. We need a user data field\n for each netblock value possible since one ip can be associated\n with any of the 32 netblocks."]
+    pub user_data: *mut RadixUserData,
+    #[doc = " the left and the right children of a node"]
+    pub left: *mut SCRadix4Node_,
+    #[doc = " the left and the right children of a node"]
+    pub right: *mut SCRadix4Node_,
+    #[doc = " the parent node for this tree"]
+    pub parent: *mut SCRadix4Node_,
+}
+#[test]
+fn bindgen_test_layout_SCRadix4Node_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCRadix4Node_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCRadix4Node_>(),
+        48usize,
+        "Size of SCRadix4Node_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCRadix4Node_>(),
+        8usize,
+        "Alignment of SCRadix4Node_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).bit) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCRadix4Node_::bit"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).has_prefix) as usize - ptr as usize },
+        9usize,
+        "Offset of field: SCRadix4Node_::has_prefix"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).prefix_stream) as usize - ptr as usize },
+        10usize,
+        "Offset of field: SCRadix4Node_::prefix_stream"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).user_data) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCRadix4Node_::user_data"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).left) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCRadix4Node_::left"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).right) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCRadix4Node_::right"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).parent) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCRadix4Node_::parent"
+    );
+}
+impl SCRadix4Node_ {
+    #[inline]
+    pub fn masks(&self) -> u64 {
+        unsafe { ::std::mem::transmute(self._bitfield_1.get(0usize, 33u8) as u64) }
+    }
+    #[inline]
+    pub fn set_masks(&mut self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            self._bitfield_1.set(0usize, 33u8, val as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn masks_raw(this: *const Self) -> u64 {
+        unsafe {
+            ::std::mem::transmute(<__BindgenBitfieldUnit<[u8; 8usize]>>::raw_get(
+                ::std::ptr::addr_of!((*this)._bitfield_1),
+                0usize,
+                33u8,
+            ) as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn set_masks_raw(this: *mut Self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            <__BindgenBitfieldUnit<[u8; 8usize]>>::raw_set(
+                ::std::ptr::addr_of_mut!((*this)._bitfield_1),
+                0usize,
+                33u8,
+                val as u64,
+            )
+        }
+    }
+    #[inline]
+    pub fn pad1(&self) -> u64 {
+        unsafe { ::std::mem::transmute(self._bitfield_1.get(33usize, 31u8) as u64) }
+    }
+    #[inline]
+    pub fn set_pad1(&mut self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            self._bitfield_1.set(33usize, 31u8, val as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn pad1_raw(this: *const Self) -> u64 {
+        unsafe {
+            ::std::mem::transmute(<__BindgenBitfieldUnit<[u8; 8usize]>>::raw_get(
+                ::std::ptr::addr_of!((*this)._bitfield_1),
+                33usize,
+                31u8,
+            ) as u64)
+        }
+    }
+    #[inline]
+    pub unsafe fn set_pad1_raw(this: *mut Self, val: u64) {
+        unsafe {
+            let val: u64 = ::std::mem::transmute(val);
+            <__BindgenBitfieldUnit<[u8; 8usize]>>::raw_set(
+                ::std::ptr::addr_of_mut!((*this)._bitfield_1),
+                33usize,
+                31u8,
+                val as u64,
+            )
+        }
+    }
+    #[inline]
+    pub fn new_bitfield_1(masks: u64, pad1: u64) -> __BindgenBitfieldUnit<[u8; 8usize]> {
+        let mut __bindgen_bitfield_unit: __BindgenBitfieldUnit<[u8; 8usize]> = Default::default();
+        __bindgen_bitfield_unit.set(0usize, 33u8, {
+            let masks: u64 = unsafe { ::std::mem::transmute(masks) };
+            masks as u64
+        });
+        __bindgen_bitfield_unit.set(33usize, 31u8, {
+            let pad1: u64 = unsafe { ::std::mem::transmute(pad1) };
+            pad1 as u64
+        });
+        __bindgen_bitfield_unit
+    }
+}
+#[doc = " \\brief Structure for the node in the radix tree"]
+pub type SCRadix4Node = SCRadix4Node_;
+#[doc = " \\brief Structure for the radix tree"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCRadix4Tree_ {
+    #[doc = " the root node in the radix tree"]
+    pub head: *mut SCRadix4Node,
+}
+#[test]
+fn bindgen_test_layout_SCRadix4Tree_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCRadix4Tree_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCRadix4Tree_>(),
+        8usize,
+        "Size of SCRadix4Tree_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCRadix4Tree_>(),
+        8usize,
+        "Alignment of SCRadix4Tree_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).head) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCRadix4Tree_::head"
+    );
+}
+#[doc = " \\brief Structure for the radix tree"]
+pub type SCRadix4Tree = SCRadix4Tree_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCRadix4Config_ {
+    pub Free: ::std::option::Option<unsafe extern "C" fn(arg1: *mut ::std::os::raw::c_void)>,
+    #[doc = " function pointer that is supplied by the user to free the user data\n  held by the user field of SCRadix4Node"]
+    pub PrintData: ::std::option::Option<unsafe extern "C" fn(arg1: *mut ::std::os::raw::c_void)>,
+}
+#[test]
+fn bindgen_test_layout_SCRadix4Config_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCRadix4Config_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCRadix4Config_>(),
+        16usize,
+        "Size of SCRadix4Config_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCRadix4Config_>(),
+        8usize,
+        "Alignment of SCRadix4Config_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Free) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCRadix4Config_::Free"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).PrintData) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCRadix4Config_::PrintData"
+    );
+}
+pub type SCRadix4Config = SCRadix4Config_;
+pub type SCRadix4ForEachNodeFunc = ::std::option::Option<
+    unsafe extern "C" fn(
+        node: *const SCRadix4Node,
+        user_data: *mut ::std::os::raw::c_void,
+        netmask: u8,
+        data: *mut ::std::os::raw::c_void,
+    ) -> ::std::os::raw::c_int,
+>;
+#[doc = " \\brief compare content of 2 user data entries\n  \\retval true equal\n  \\retval false not equal"]
+pub type SCRadix4TreeCompareFunc = ::std::option::Option<
+    unsafe extern "C" fn(
+        ud1: *const ::std::os::raw::c_void,
+        ud2: *const ::std::os::raw::c_void,
+    ) -> bool,
+>;
+#[doc = " \\brief Structure for the node in the radix tree"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCRadix6Node_ {
+    #[doc = " the key that has been stored in the tree"]
+    pub prefix_stream: [u8; 16usize],
+    #[doc = " holds bitmap of netmasks that come under this node in the tree"]
+    pub masks: [u8; 17usize],
+    #[doc = " the bit position where the bits differ in the nodes children.  Used\n to determine the path to be taken during a lookup"]
+    pub bit: u8,
+    #[doc = " bool to see if prefix_stream is filled"]
+    pub has_prefix: bool,
+    #[doc = " User data that has is associated with this key. We need a user\n data field for each netblock value possible since one ip can be associated\n with any of the 128 netblocks."]
+    pub user_data: *mut RadixUserData,
+    #[doc = " the left and the right children of a node"]
+    pub left: *mut SCRadix6Node_,
+    #[doc = " the left and the right children of a node"]
+    pub right: *mut SCRadix6Node_,
+    #[doc = " the parent node for this tree"]
+    pub parent: *mut SCRadix6Node_,
+}
+#[test]
+fn bindgen_test_layout_SCRadix6Node_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCRadix6Node_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCRadix6Node_>(),
+        72usize,
+        "Size of SCRadix6Node_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCRadix6Node_>(),
+        8usize,
+        "Alignment of SCRadix6Node_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).prefix_stream) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCRadix6Node_::prefix_stream"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).masks) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCRadix6Node_::masks"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).bit) as usize - ptr as usize },
+        33usize,
+        "Offset of field: SCRadix6Node_::bit"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).has_prefix) as usize - ptr as usize },
+        34usize,
+        "Offset of field: SCRadix6Node_::has_prefix"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).user_data) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCRadix6Node_::user_data"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).left) as usize - ptr as usize },
+        48usize,
+        "Offset of field: SCRadix6Node_::left"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).right) as usize - ptr as usize },
+        56usize,
+        "Offset of field: SCRadix6Node_::right"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).parent) as usize - ptr as usize },
+        64usize,
+        "Offset of field: SCRadix6Node_::parent"
+    );
+}
+#[doc = " \\brief Structure for the node in the radix tree"]
+pub type SCRadix6Node = SCRadix6Node_;
+#[doc = " \\brief Structure for the radix tree"]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCRadix6Tree_ {
+    #[doc = " the root node in the radix tree"]
+    pub head: *mut SCRadix6Node,
+}
+#[test]
+fn bindgen_test_layout_SCRadix6Tree_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCRadix6Tree_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCRadix6Tree_>(),
+        8usize,
+        "Size of SCRadix6Tree_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCRadix6Tree_>(),
+        8usize,
+        "Alignment of SCRadix6Tree_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).head) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCRadix6Tree_::head"
+    );
+}
+#[doc = " \\brief Structure for the radix tree"]
+pub type SCRadix6Tree = SCRadix6Tree_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCRadix6Config_ {
+    pub Free: ::std::option::Option<unsafe extern "C" fn(arg1: *mut ::std::os::raw::c_void)>,
+    #[doc = " function pointer that is supplied by the user to free the user data\n  held by the user field of SCRadix6Node"]
+    pub PrintData: ::std::option::Option<unsafe extern "C" fn(arg1: *mut ::std::os::raw::c_void)>,
+}
+#[test]
+fn bindgen_test_layout_SCRadix6Config_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCRadix6Config_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCRadix6Config_>(),
+        16usize,
+        "Size of SCRadix6Config_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCRadix6Config_>(),
+        8usize,
+        "Alignment of SCRadix6Config_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Free) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCRadix6Config_::Free"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).PrintData) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCRadix6Config_::PrintData"
+    );
+}
+pub type SCRadix6Config = SCRadix6Config_;
+pub type SCRadix6ForEachNodeFunc = ::std::option::Option<
+    unsafe extern "C" fn(
+        node: *const SCRadix6Node,
+        user_data: *mut ::std::os::raw::c_void,
+        netmask: u8,
+        data: *mut ::std::os::raw::c_void,
+    ) -> ::std::os::raw::c_int,
+>;
+#[doc = " \\brief compare content of 2 user data entries\n  \\retval true equal\n  \\retval false not equal"]
+pub type SCRadix6TreeCompareFunc = ::std::option::Option<
+    unsafe extern "C" fn(
+        ud1: *const ::std::os::raw::c_void,
+        ud2: *const ::std::os::raw::c_void,
+    ) -> bool,
+>;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCSha256 {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCSha1 {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCMd5 {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCSigOrderFunc_ {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCDetectRequiresStatus {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCFPSupportSMList_ {
+    pub list_id: ::std::os::raw::c_int,
+    pub priority: ::std::os::raw::c_int,
+    pub next: *mut SCFPSupportSMList_,
+}
+#[test]
+fn bindgen_test_layout_SCFPSupportSMList_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCFPSupportSMList_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCFPSupportSMList_>(),
+        16usize,
+        "Size of SCFPSupportSMList_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCFPSupportSMList_>(),
+        8usize,
+        "Alignment of SCFPSupportSMList_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).list_id) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCFPSupportSMList_::list_id"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).priority) as usize - ptr as usize },
+        4usize,
+        "Offset of field: SCFPSupportSMList_::priority"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCFPSupportSMList_::next"
+    );
+}
+pub type SCFPSupportSMList = SCFPSupportSMList_;
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum Base64Mode {
+    Base64ModeRFC2045 = 0,
+    Base64ModeStrict = 1,
+    Base64ModeRFC4648 = 2,
+}
+pub type ByteBase = u8;
+pub type ByteEndian = u8;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct JsonBuilder {
+    _unused: [u8; 0],
+}
+#[doc = " A \"mark\" or saved state for a JsonBuilder object.\n\n The name is full, and the types are u64 as this object is used\n directly in C as well."]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct JsonBuilderMark {
+    pub position: u64,
+    pub state_index: u64,
+    pub state: u64,
+}
+#[test]
+fn bindgen_test_layout_JsonBuilderMark() {
+    const UNINIT: ::std::mem::MaybeUninit<JsonBuilderMark> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<JsonBuilderMark>(),
+        24usize,
+        "Size of JsonBuilderMark"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<JsonBuilderMark>(),
+        8usize,
+        "Alignment of JsonBuilderMark"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).position) as usize - ptr as usize },
+        0usize,
+        "Offset of field: JsonBuilderMark::position"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).state_index) as usize - ptr as usize },
+        8usize,
+        "Offset of field: JsonBuilderMark::state_index"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).state) as usize - ptr as usize },
+        16usize,
+        "Offset of field: JsonBuilderMark::state"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCDetectByteExtractData {
+    pub local_id: u8,
+    pub nbytes: u8,
+    pub offset: i16,
+    pub name: *const ::std::os::raw::c_char,
+    pub flags: u16,
+    pub endian: ByteEndian,
+    pub base: ByteBase,
+    pub align_value: u8,
+    pub multiplier_value: u16,
+    pub id: u16,
+}
+#[test]
+fn bindgen_test_layout_SCDetectByteExtractData() {
+    const UNINIT: ::std::mem::MaybeUninit<SCDetectByteExtractData> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCDetectByteExtractData>(),
+        32usize,
+        "Size of SCDetectByteExtractData"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCDetectByteExtractData>(),
+        8usize,
+        "Alignment of SCDetectByteExtractData"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).local_id) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCDetectByteExtractData::local_id"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).nbytes) as usize - ptr as usize },
+        1usize,
+        "Offset of field: SCDetectByteExtractData::nbytes"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).offset) as usize - ptr as usize },
+        2usize,
+        "Offset of field: SCDetectByteExtractData::offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCDetectByteExtractData::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCDetectByteExtractData::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).endian) as usize - ptr as usize },
+        18usize,
+        "Offset of field: SCDetectByteExtractData::endian"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).base) as usize - ptr as usize },
+        19usize,
+        "Offset of field: SCDetectByteExtractData::base"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).align_value) as usize - ptr as usize },
+        20usize,
+        "Offset of field: SCDetectByteExtractData::align_value"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).multiplier_value) as usize - ptr as usize },
+        22usize,
+        "Offset of field: SCDetectByteExtractData::multiplier_value"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).id) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCDetectByteExtractData::id"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCDetectTransformFromBase64Data {
+    pub flags: u8,
+    pub nbytes: u32,
+    pub nbytes_str: *const ::std::os::raw::c_char,
+    pub offset: u32,
+    pub offset_str: *const ::std::os::raw::c_char,
+    pub mode: Base64Mode,
+}
+#[test]
+fn bindgen_test_layout_SCDetectTransformFromBase64Data() {
+    const UNINIT: ::std::mem::MaybeUninit<SCDetectTransformFromBase64Data> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCDetectTransformFromBase64Data>(),
+        40usize,
+        "Size of SCDetectTransformFromBase64Data"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCDetectTransformFromBase64Data>(),
+        8usize,
+        "Alignment of SCDetectTransformFromBase64Data"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCDetectTransformFromBase64Data::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).nbytes) as usize - ptr as usize },
+        4usize,
+        "Offset of field: SCDetectTransformFromBase64Data::nbytes"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).nbytes_str) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCDetectTransformFromBase64Data::nbytes_str"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).offset) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCDetectTransformFromBase64Data::offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).offset_str) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCDetectTransformFromBase64Data::offset_str"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).mode) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCDetectTransformFromBase64Data::mode"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCSigTableElmt {
+    pub name: *const ::std::os::raw::c_char,
+    pub desc: *const ::std::os::raw::c_char,
+    pub url: *const ::std::os::raw::c_char,
+    pub flags: u16,
+    pub Setup: ::std::option::Option<
+        unsafe extern "C" fn(
+            de: *mut ::std::os::raw::c_void,
+            s: *mut ::std::os::raw::c_void,
+            raw: *const ::std::os::raw::c_char,
+        ) -> ::std::os::raw::c_int,
+    >,
+    pub Free: ::std::option::Option<
+        unsafe extern "C" fn(de: *mut ::std::os::raw::c_void, ptr: *mut ::std::os::raw::c_void),
+    >,
+    pub AppLayerTxMatch: ::std::option::Option<
+        unsafe extern "C" fn(
+            de: *mut ::std::os::raw::c_void,
+            f: *mut ::std::os::raw::c_void,
+            flags: u8,
+            state: *mut ::std::os::raw::c_void,
+            tx: *mut ::std::os::raw::c_void,
+            sig: *const ::std::os::raw::c_void,
+            ctx: *const ::std::os::raw::c_void,
+        ) -> ::std::os::raw::c_int,
+    >,
+}
+#[test]
+fn bindgen_test_layout_SCSigTableElmt() {
+    const UNINIT: ::std::mem::MaybeUninit<SCSigTableElmt> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCSigTableElmt>(),
+        56usize,
+        "Size of SCSigTableElmt"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCSigTableElmt>(),
+        8usize,
+        "Alignment of SCSigTableElmt"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCSigTableElmt::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).desc) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCSigTableElmt::desc"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).url) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCSigTableElmt::url"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCSigTableElmt::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Setup) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCSigTableElmt::Setup"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Free) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCSigTableElmt::Free"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).AppLayerTxMatch) as usize - ptr as usize },
+        48usize,
+        "Offset of field: SCSigTableElmt::AppLayerTxMatch"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCTransformTableElmt {
+    pub name: *const ::std::os::raw::c_char,
+    pub desc: *const ::std::os::raw::c_char,
+    pub url: *const ::std::os::raw::c_char,
+    pub flags: u16,
+    pub Setup: ::std::option::Option<
+        unsafe extern "C" fn(
+            de: *mut ::std::os::raw::c_void,
+            s: *mut ::std::os::raw::c_void,
+            raw: *const ::std::os::raw::c_char,
+        ) -> ::std::os::raw::c_int,
+    >,
+    pub Free: ::std::option::Option<
+        unsafe extern "C" fn(de: *mut ::std::os::raw::c_void, ptr: *mut ::std::os::raw::c_void),
+    >,
+    pub Transform: ::std::option::Option<
+        unsafe extern "C" fn(
+            inspect_buf: *mut ::std::os::raw::c_void,
+            options: *mut ::std::os::raw::c_void,
+        ),
+    >,
+    pub TransformValidate: ::std::option::Option<
+        unsafe extern "C" fn(
+            content: *const u8,
+            len: u16,
+            context: *mut ::std::os::raw::c_void,
+        ) -> bool,
+    >,
+}
+#[test]
+fn bindgen_test_layout_SCTransformTableElmt() {
+    const UNINIT: ::std::mem::MaybeUninit<SCTransformTableElmt> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCTransformTableElmt>(),
+        64usize,
+        "Size of SCTransformTableElmt"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCTransformTableElmt>(),
+        8usize,
+        "Alignment of SCTransformTableElmt"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCTransformTableElmt::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).desc) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCTransformTableElmt::desc"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).url) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCTransformTableElmt::url"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCTransformTableElmt::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Setup) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCTransformTableElmt::Setup"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Free) as usize - ptr as usize },
+        40usize,
+        "Offset of field: SCTransformTableElmt::Free"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Transform) as usize - ptr as usize },
+        48usize,
+        "Offset of field: SCTransformTableElmt::Transform"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).TransformValidate) as usize - ptr as usize },
+        56usize,
+        "Offset of field: SCTransformTableElmt::TransformValidate"
+    );
+}
+extern "C" {
+    pub fn jb_new_object() -> *mut JsonBuilder;
+}
+extern "C" {
+    pub fn jb_new_array() -> *mut JsonBuilder;
+}
+extern "C" {
+    pub fn jb_clone(js: *mut JsonBuilder) -> *mut JsonBuilder;
+}
+extern "C" {
+    pub fn jb_free(js: *mut JsonBuilder);
+}
+extern "C" {
+    pub fn jb_capacity(jb: *mut JsonBuilder) -> usize;
+}
+extern "C" {
+    pub fn jb_reset(jb: *mut JsonBuilder);
+}
+extern "C" {
+    pub fn jb_open_object(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char) -> bool;
+}
+extern "C" {
+    pub fn jb_start_object(js: *mut JsonBuilder) -> bool;
+}
+extern "C" {
+    pub fn jb_open_array(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char) -> bool;
+}
+extern "C" {
+    pub fn jb_set_string(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char,
+        val: *const ::std::os::raw::c_char,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_string_from_bytes(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_base64(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_hex(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, bytes: *const u8, len: u32,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_set_formatted(js: *mut JsonBuilder, formatted: *const ::std::os::raw::c_char)
+        -> bool;
+}
+extern "C" {
+    pub fn jb_append_object(jb: *mut JsonBuilder, obj: *const JsonBuilder) -> bool;
+}
+extern "C" {
+    pub fn jb_set_object(
+        js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: *mut JsonBuilder,
+    ) -> bool;
+}
+extern "C" {
+    pub fn jb_append_string(js: *mut JsonBuilder, val: *const ::std::os::raw::c_char) -> bool;
+}
+extern "C" {
+    pub fn jb_append_string_from_bytes(js: *mut JsonBuilder, bytes: *const u8, len: u32) -> bool;
+}
+extern "C" {
+    pub fn jb_append_base64(js: *mut JsonBuilder, bytes: *const u8, len: u32) -> bool;
+}
+extern "C" {
+    pub fn jb_append_uint(js: *mut JsonBuilder, val: u64) -> bool;
+}
+extern "C" {
+    pub fn jb_append_float(js: *mut JsonBuilder, val: f64) -> bool;
+}
+extern "C" {
+    pub fn jb_set_uint(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: u64) -> bool;
+}
+extern "C" {
+    pub fn jb_set_int(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: i64) -> bool;
+}
+extern "C" {
+    pub fn jb_set_float(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: f64)
+        -> bool;
+}
+extern "C" {
+    pub fn jb_set_bool(js: *mut JsonBuilder, key: *const ::std::os::raw::c_char, val: bool)
+        -> bool;
+}
+extern "C" {
+    pub fn jb_close(js: *mut JsonBuilder) -> bool;
+}
+extern "C" {
+    pub fn jb_len(js: *const JsonBuilder) -> usize;
+}
+extern "C" {
+    pub fn jb_ptr(js: *mut JsonBuilder) -> *const u8;
+}
+extern "C" {
+    pub fn jb_get_mark(js: *mut JsonBuilder, mark: *mut JsonBuilderMark);
+}
+extern "C" {
+    pub fn jb_restore_mark(js: *mut JsonBuilder, mark: *mut JsonBuilderMark) -> bool;
+}

From 2e853235fb3e1c21889bccc41af3a8bc03f5ffb2 Mon Sep 17 00:00:00 2001
From: Jason Ish <jason.ish@oisf.net>
Date: Thu, 23 Jan 2025 11:09:38 -0600
Subject: [PATCH 12/12] rust: use AppLayerDecoderEvents from bindgen sys
 bindings

A minimal example of how we should use the sys crate for types and
structures that come from C.
---
 rust/Makefile.am     |    1 +
 rust/src/applayer.rs |    3 +-
 rust/src/core.rs     |   11 +-
 rust/sys/src/sys.rs  | 1325 +++++++++++++++++++++++++++++++++++++-----
 4 files changed, 1181 insertions(+), 159 deletions(-)

diff --git a/rust/Makefile.am b/rust/Makefile.am
index b41266790016..4cecd9284caa 100644
--- a/rust/Makefile.am
+++ b/rust/Makefile.am
@@ -120,6 +120,7 @@ if HAVE_BINDGEN
 		--default-enum-style rust \
 		--allowlist-type 'SC.*' \
 		--allowlist-type 'AppProto.*' \
+		--allowlist-type 'AppLayer.*' \
 		--allowlist-function 'jb_.*' \
 		$(abs_top_srcdir)/src/bindgen.h \
 		-- \
diff --git a/rust/src/applayer.rs b/rust/src/applayer.rs
index b955cdf5dbdc..7b5e353167fd 100644
--- a/rust/src/applayer.rs
+++ b/rust/src/applayer.rs
@@ -31,6 +31,7 @@ use crate::core::StreamingBufferConfig;
 // Make the AppLayerEvent derive macro available to users importing
 // AppLayerEvent from this module.
 pub use suricata_derive::AppLayerEvent;
+use suricata_sys::sys;
 
 #[repr(C)]
 pub struct StreamSlice {
@@ -132,7 +133,7 @@ pub struct AppLayerTxData {
     detect_flags_tc: u64,
 
     de_state: *mut DetectEngineState,
-    pub events: *mut core::AppLayerDecoderEvents,
+    pub events: *mut sys::AppLayerDecoderEvents,
 }
 
 impl Default for AppLayerTxData {
diff --git a/rust/src/core.rs b/rust/src/core.rs
index 4f5699cde0b5..7ed41d82052a 100644
--- a/rust/src/core.rs
+++ b/rust/src/core.rs
@@ -18,6 +18,8 @@
 //! This module exposes items from the core "C" code to Rust.
 
 use std;
+use suricata_sys::sys;
+
 use crate::filecontainer::*;
 use crate::flow::Flow;
 
@@ -25,7 +27,6 @@ pub use crate::sys::{AppProto, AppProtoEnum};
 
 /// Opaque C types.
 pub enum DetectEngineState {}
-pub enum AppLayerDecoderEvents {}
 
 pub const STREAM_START:    u8 = 0x01;
 pub const STREAM_EOF:      u8 = 0x02;
@@ -83,11 +84,11 @@ pub type DetectEngineStateFreeFunc =
 pub type AppLayerParserTriggerRawStreamReassemblyFunc =
     extern "C" fn (flow: *const Flow, direction: i32);
 pub type AppLayerDecoderEventsSetEventRawFunc =
-    extern "C" fn (events: *mut *mut AppLayerDecoderEvents,
+    extern "C" fn (events: *mut *mut sys::AppLayerDecoderEvents,
                    event: u8);
 
 pub type AppLayerDecoderEventsFreeEventsFunc =
-    extern "C" fn (events: *mut *mut AppLayerDecoderEvents);
+    extern "C" fn (events: *mut *mut sys::AppLayerDecoderEvents);
 
 pub enum StreamingBufferConfig {}
 
@@ -205,7 +206,7 @@ pub fn sc_app_layer_parser_trigger_raw_stream_reassembly(flow: *const Flow, dire
 
 /// AppLayerDecoderEventsSetEventRaw wrapper.
 pub fn sc_app_layer_decoder_events_set_event_raw(
-    events: *mut *mut AppLayerDecoderEvents, event: u8)
+    events: *mut *mut sys::AppLayerDecoderEvents, event: u8)
 {
     unsafe {
         if let Some(c) = SC {
@@ -216,7 +217,7 @@ pub fn sc_app_layer_decoder_events_set_event_raw(
 
 /// AppLayerDecoderEventsFreeEvents wrapper.
 pub fn sc_app_layer_decoder_events_free_events(
-    events: *mut *mut AppLayerDecoderEvents)
+    events: *mut *mut sys::AppLayerDecoderEvents)
 {
     unsafe {
         if let Some(c) = SC {
diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs
index 567d90669cc8..65c3d5c9c54d 100644
--- a/rust/sys/src/sys.rs
+++ b/rust/sys/src/sys.rs
@@ -1393,6 +1393,59 @@ fn bindgen_test_layout_SCEnumCharMap_() {
     );
 }
 pub type SCEnumCharMap = SCEnumCharMap_;
+#[doc = " \\brief Data structure to store app layer decoder events."]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerDecoderEvents_ {
+    pub events: *mut u8,
+    pub cnt: u8,
+    pub events_buffer_size: u8,
+    pub event_last_logged: u8,
+}
+#[test]
+fn bindgen_test_layout_AppLayerDecoderEvents_() {
+    const UNINIT: ::std::mem::MaybeUninit<AppLayerDecoderEvents_> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<AppLayerDecoderEvents_>(),
+        16usize,
+        "Size of AppLayerDecoderEvents_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<AppLayerDecoderEvents_>(),
+        8usize,
+        "Alignment of AppLayerDecoderEvents_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).events) as usize - ptr as usize },
+        0usize,
+        "Offset of field: AppLayerDecoderEvents_::events"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).cnt) as usize - ptr as usize },
+        8usize,
+        "Offset of field: AppLayerDecoderEvents_::cnt"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).events_buffer_size) as usize - ptr as usize },
+        9usize,
+        "Offset of field: AppLayerDecoderEvents_::events_buffer_size"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).event_last_logged) as usize - ptr as usize },
+        10usize,
+        "Offset of field: AppLayerDecoderEvents_::event_last_logged"
+    );
+}
+#[doc = " \\brief Data structure to store app layer decoder events."]
+pub type AppLayerDecoderEvents = AppLayerDecoderEvents_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerThreadCtx_ {
+    _unused: [u8; 0],
+}
+pub type AppLayerThreadCtx = AppLayerThreadCtx_;
 #[repr(u32)]
 #[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
 pub enum AppProtoEnum {
@@ -1440,6 +1493,12 @@ pub enum AppProtoEnum {
 pub type AppProto = u16;
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
+pub struct AppLayerParserState_ {
+    _unused: [u8; 0],
+}
+pub type AppLayerParserState = AppLayerParserState_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
 pub struct RadixUserData {
     _unused: [u8; 0],
 }
@@ -1831,253 +1890,1213 @@ pub type SCRadix6TreeCompareFunc = ::std::option::Option<
 >;
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
-pub struct SCSha256 {
-    _unused: [u8; 0],
-}
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct SCSha1 {
-    _unused: [u8; 0],
-}
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct SCMd5 {
-    _unused: [u8; 0],
-}
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct SCSigOrderFunc_ {
-    _unused: [u8; 0],
-}
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct SCDetectRequiresStatus {
-    _unused: [u8; 0],
-}
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct SCFPSupportSMList_ {
-    pub list_id: ::std::os::raw::c_int,
-    pub priority: ::std::os::raw::c_int,
-    pub next: *mut SCFPSupportSMList_,
+pub struct StreamingBufferConfig_ {
+    pub buf_size: u32,
+    #[doc = "< max concurrent memory regions. 0 means no limit."]
+    pub max_regions: u16,
+    #[doc = "< max gap size before a new region will be created."]
+    pub region_gap: u32,
+    pub Calloc: ::std::option::Option<
+        unsafe extern "C" fn(n: usize, size: usize) -> *mut ::std::os::raw::c_void,
+    >,
+    pub Realloc: ::std::option::Option<
+        unsafe extern "C" fn(
+            ptr: *mut ::std::os::raw::c_void,
+            orig_size: usize,
+            size: usize,
+        ) -> *mut ::std::os::raw::c_void,
+    >,
+    pub Free:
+        ::std::option::Option<unsafe extern "C" fn(ptr: *mut ::std::os::raw::c_void, size: usize)>,
 }
 #[test]
-fn bindgen_test_layout_SCFPSupportSMList_() {
-    const UNINIT: ::std::mem::MaybeUninit<SCFPSupportSMList_> = ::std::mem::MaybeUninit::uninit();
+fn bindgen_test_layout_StreamingBufferConfig_() {
+    const UNINIT: ::std::mem::MaybeUninit<StreamingBufferConfig_> =
+        ::std::mem::MaybeUninit::uninit();
     let ptr = UNINIT.as_ptr();
     assert_eq!(
-        ::std::mem::size_of::<SCFPSupportSMList_>(),
-        16usize,
-        "Size of SCFPSupportSMList_"
+        ::std::mem::size_of::<StreamingBufferConfig_>(),
+        40usize,
+        "Size of StreamingBufferConfig_"
     );
     assert_eq!(
-        ::std::mem::align_of::<SCFPSupportSMList_>(),
+        ::std::mem::align_of::<StreamingBufferConfig_>(),
         8usize,
-        "Alignment of SCFPSupportSMList_"
+        "Alignment of StreamingBufferConfig_"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).list_id) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).buf_size) as usize - ptr as usize },
         0usize,
-        "Offset of field: SCFPSupportSMList_::list_id"
+        "Offset of field: StreamingBufferConfig_::buf_size"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).priority) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).max_regions) as usize - ptr as usize },
         4usize,
-        "Offset of field: SCFPSupportSMList_::priority"
+        "Offset of field: StreamingBufferConfig_::max_regions"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).region_gap) as usize - ptr as usize },
         8usize,
-        "Offset of field: SCFPSupportSMList_::next"
+        "Offset of field: StreamingBufferConfig_::region_gap"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Calloc) as usize - ptr as usize },
+        16usize,
+        "Offset of field: StreamingBufferConfig_::Calloc"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Realloc) as usize - ptr as usize },
+        24usize,
+        "Offset of field: StreamingBufferConfig_::Realloc"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).Free) as usize - ptr as usize },
+        32usize,
+        "Offset of field: StreamingBufferConfig_::Free"
     );
 }
-pub type SCFPSupportSMList = SCFPSupportSMList_;
-#[repr(u32)]
-#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
-pub enum Base64Mode {
-    Base64ModeRFC2045 = 0,
-    Base64ModeStrict = 1,
-    Base64ModeRFC4648 = 2,
-}
-pub type ByteBase = u8;
-pub type ByteEndian = u8;
-#[repr(C)]
-#[derive(Debug, Copy, Clone)]
-pub struct JsonBuilder {
-    _unused: [u8; 0],
-}
-#[doc = " A \"mark\" or saved state for a JsonBuilder object.\n\n The name is full, and the types are u64 as this object is used\n directly in C as well."]
+pub type StreamingBufferConfig = StreamingBufferConfig_;
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
-pub struct JsonBuilderMark {
-    pub position: u64,
-    pub state_index: u64,
-    pub state: u64,
+pub struct StreamingBufferRegion_ {
+    #[doc = "< memory block for reassembly"]
+    pub buf: *mut u8,
+    #[doc = "< size of memory block"]
+    pub buf_size: u32,
+    #[doc = "< how far we are in buf_size"]
+    pub buf_offset: u32,
+    #[doc = "< stream offset of this region"]
+    pub stream_offset: u64,
+    pub next: *mut StreamingBufferRegion_,
 }
 #[test]
-fn bindgen_test_layout_JsonBuilderMark() {
-    const UNINIT: ::std::mem::MaybeUninit<JsonBuilderMark> = ::std::mem::MaybeUninit::uninit();
+fn bindgen_test_layout_StreamingBufferRegion_() {
+    const UNINIT: ::std::mem::MaybeUninit<StreamingBufferRegion_> =
+        ::std::mem::MaybeUninit::uninit();
     let ptr = UNINIT.as_ptr();
     assert_eq!(
-        ::std::mem::size_of::<JsonBuilderMark>(),
-        24usize,
-        "Size of JsonBuilderMark"
+        ::std::mem::size_of::<StreamingBufferRegion_>(),
+        32usize,
+        "Size of StreamingBufferRegion_"
     );
     assert_eq!(
-        ::std::mem::align_of::<JsonBuilderMark>(),
+        ::std::mem::align_of::<StreamingBufferRegion_>(),
         8usize,
-        "Alignment of JsonBuilderMark"
+        "Alignment of StreamingBufferRegion_"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).position) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).buf) as usize - ptr as usize },
         0usize,
-        "Offset of field: JsonBuilderMark::position"
+        "Offset of field: StreamingBufferRegion_::buf"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).state_index) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).buf_size) as usize - ptr as usize },
         8usize,
-        "Offset of field: JsonBuilderMark::state_index"
+        "Offset of field: StreamingBufferRegion_::buf_size"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).state) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).buf_offset) as usize - ptr as usize },
+        12usize,
+        "Offset of field: StreamingBufferRegion_::buf_offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).stream_offset) as usize - ptr as usize },
         16usize,
-        "Offset of field: JsonBuilderMark::state"
+        "Offset of field: StreamingBufferRegion_::stream_offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        24usize,
+        "Offset of field: StreamingBufferRegion_::next"
     );
 }
+pub type StreamingBufferRegion = StreamingBufferRegion_;
+#[doc = "  \\brief block of continues data"]
+#[repr(C, packed)]
+#[derive(Debug, Copy, Clone)]
+pub struct StreamingBufferBlock {
+    pub offset: u64,
+    pub rb: StreamingBufferBlock__bindgen_ty_1,
+    pub len: u32,
+}
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
-pub struct SCDetectByteExtractData {
-    pub local_id: u8,
-    pub nbytes: u8,
-    pub offset: i16,
-    pub name: *const ::std::os::raw::c_char,
-    pub flags: u16,
-    pub endian: ByteEndian,
-    pub base: ByteBase,
-    pub align_value: u8,
-    pub multiplier_value: u16,
-    pub id: u16,
+pub struct StreamingBufferBlock__bindgen_ty_1 {
+    pub rbe_left: *mut StreamingBufferBlock,
+    pub rbe_right: *mut StreamingBufferBlock,
+    pub rbe_parent: *mut StreamingBufferBlock,
+    pub rbe_color: ::std::os::raw::c_int,
 }
 #[test]
-fn bindgen_test_layout_SCDetectByteExtractData() {
-    const UNINIT: ::std::mem::MaybeUninit<SCDetectByteExtractData> =
+fn bindgen_test_layout_StreamingBufferBlock__bindgen_ty_1() {
+    const UNINIT: ::std::mem::MaybeUninit<StreamingBufferBlock__bindgen_ty_1> =
         ::std::mem::MaybeUninit::uninit();
     let ptr = UNINIT.as_ptr();
     assert_eq!(
-        ::std::mem::size_of::<SCDetectByteExtractData>(),
+        ::std::mem::size_of::<StreamingBufferBlock__bindgen_ty_1>(),
         32usize,
-        "Size of SCDetectByteExtractData"
+        "Size of StreamingBufferBlock__bindgen_ty_1"
     );
     assert_eq!(
-        ::std::mem::align_of::<SCDetectByteExtractData>(),
+        ::std::mem::align_of::<StreamingBufferBlock__bindgen_ty_1>(),
         8usize,
-        "Alignment of SCDetectByteExtractData"
+        "Alignment of StreamingBufferBlock__bindgen_ty_1"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).local_id) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).rbe_left) as usize - ptr as usize },
         0usize,
-        "Offset of field: SCDetectByteExtractData::local_id"
+        "Offset of field: StreamingBufferBlock__bindgen_ty_1::rbe_left"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).nbytes) as usize - ptr as usize },
-        1usize,
-        "Offset of field: SCDetectByteExtractData::nbytes"
+        unsafe { ::std::ptr::addr_of!((*ptr).rbe_right) as usize - ptr as usize },
+        8usize,
+        "Offset of field: StreamingBufferBlock__bindgen_ty_1::rbe_right"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).offset) as usize - ptr as usize },
-        2usize,
-        "Offset of field: SCDetectByteExtractData::offset"
+        unsafe { ::std::ptr::addr_of!((*ptr).rbe_parent) as usize - ptr as usize },
+        16usize,
+        "Offset of field: StreamingBufferBlock__bindgen_ty_1::rbe_parent"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
-        8usize,
-        "Offset of field: SCDetectByteExtractData::name"
+        unsafe { ::std::ptr::addr_of!((*ptr).rbe_color) as usize - ptr as usize },
+        24usize,
+        "Offset of field: StreamingBufferBlock__bindgen_ty_1::rbe_color"
     );
+}
+#[test]
+fn bindgen_test_layout_StreamingBufferBlock() {
+    const UNINIT: ::std::mem::MaybeUninit<StreamingBufferBlock> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
-        16usize,
-        "Offset of field: SCDetectByteExtractData::flags"
+        ::std::mem::size_of::<StreamingBufferBlock>(),
+        44usize,
+        "Size of StreamingBufferBlock"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).endian) as usize - ptr as usize },
-        18usize,
-        "Offset of field: SCDetectByteExtractData::endian"
+        ::std::mem::align_of::<StreamingBufferBlock>(),
+        1usize,
+        "Alignment of StreamingBufferBlock"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).base) as usize - ptr as usize },
-        19usize,
-        "Offset of field: SCDetectByteExtractData::base"
+        unsafe { ::std::ptr::addr_of!((*ptr).offset) as usize - ptr as usize },
+        0usize,
+        "Offset of field: StreamingBufferBlock::offset"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).align_value) as usize - ptr as usize },
-        20usize,
-        "Offset of field: SCDetectByteExtractData::align_value"
+        unsafe { ::std::ptr::addr_of!((*ptr).rb) as usize - ptr as usize },
+        8usize,
+        "Offset of field: StreamingBufferBlock::rb"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).multiplier_value) as usize - ptr as usize },
-        22usize,
-        "Offset of field: SCDetectByteExtractData::multiplier_value"
+        unsafe { ::std::ptr::addr_of!((*ptr).len) as usize - ptr as usize },
+        40usize,
+        "Offset of field: StreamingBufferBlock::len"
     );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SBB {
+    pub rbh_root: *mut StreamingBufferBlock,
+}
+#[test]
+fn bindgen_test_layout_SBB() {
+    const UNINIT: ::std::mem::MaybeUninit<SBB> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(::std::mem::size_of::<SBB>(), 8usize, "Size of SBB");
+    assert_eq!(::std::mem::align_of::<SBB>(), 8usize, "Alignment of SBB");
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).id) as usize - ptr as usize },
-        24usize,
-        "Offset of field: SCDetectByteExtractData::id"
+        unsafe { ::std::ptr::addr_of!((*ptr).rbh_root) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SBB::rbh_root"
     );
 }
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
-pub struct SCDetectTransformFromBase64Data {
-    pub flags: u8,
-    pub nbytes: u32,
-    pub nbytes_str: *const ::std::os::raw::c_char,
-    pub offset: u32,
-    pub offset_str: *const ::std::os::raw::c_char,
-    pub mode: Base64Mode,
+pub struct StreamingBuffer_ {
+    pub region: StreamingBufferRegion,
+    #[doc = "< red black tree of Stream Buffer Blocks"]
+    pub sbb_tree: SBB,
+    #[doc = "< head, should always be the same as RB_MIN"]
+    pub head: *mut StreamingBufferBlock,
+    #[doc = "< data size covered by sbbs"]
+    pub sbb_size: u32,
+    pub regions: u16,
+    pub max_regions: u16,
+    pub buf_size_max: u32,
 }
 #[test]
-fn bindgen_test_layout_SCDetectTransformFromBase64Data() {
-    const UNINIT: ::std::mem::MaybeUninit<SCDetectTransformFromBase64Data> =
-        ::std::mem::MaybeUninit::uninit();
+fn bindgen_test_layout_StreamingBuffer_() {
+    const UNINIT: ::std::mem::MaybeUninit<StreamingBuffer_> = ::std::mem::MaybeUninit::uninit();
     let ptr = UNINIT.as_ptr();
     assert_eq!(
-        ::std::mem::size_of::<SCDetectTransformFromBase64Data>(),
-        40usize,
-        "Size of SCDetectTransformFromBase64Data"
+        ::std::mem::size_of::<StreamingBuffer_>(),
+        64usize,
+        "Size of StreamingBuffer_"
     );
     assert_eq!(
-        ::std::mem::align_of::<SCDetectTransformFromBase64Data>(),
+        ::std::mem::align_of::<StreamingBuffer_>(),
         8usize,
-        "Alignment of SCDetectTransformFromBase64Data"
+        "Alignment of StreamingBuffer_"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        unsafe { ::std::ptr::addr_of!((*ptr).region) as usize - ptr as usize },
         0usize,
-        "Offset of field: SCDetectTransformFromBase64Data::flags"
+        "Offset of field: StreamingBuffer_::region"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).nbytes) as usize - ptr as usize },
-        4usize,
-        "Offset of field: SCDetectTransformFromBase64Data::nbytes"
+        unsafe { ::std::ptr::addr_of!((*ptr).sbb_tree) as usize - ptr as usize },
+        32usize,
+        "Offset of field: StreamingBuffer_::sbb_tree"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).nbytes_str) as usize - ptr as usize },
-        8usize,
-        "Offset of field: SCDetectTransformFromBase64Data::nbytes_str"
+        unsafe { ::std::ptr::addr_of!((*ptr).head) as usize - ptr as usize },
+        40usize,
+        "Offset of field: StreamingBuffer_::head"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).offset) as usize - ptr as usize },
-        16usize,
-        "Offset of field: SCDetectTransformFromBase64Data::offset"
+        unsafe { ::std::ptr::addr_of!((*ptr).sbb_size) as usize - ptr as usize },
+        48usize,
+        "Offset of field: StreamingBuffer_::sbb_size"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).offset_str) as usize - ptr as usize },
-        24usize,
-        "Offset of field: SCDetectTransformFromBase64Data::offset_str"
+        unsafe { ::std::ptr::addr_of!((*ptr).regions) as usize - ptr as usize },
+        52usize,
+        "Offset of field: StreamingBuffer_::regions"
     );
     assert_eq!(
-        unsafe { ::std::ptr::addr_of!((*ptr).mode) as usize - ptr as usize },
-        32usize,
-        "Offset of field: SCDetectTransformFromBase64Data::mode"
+        unsafe { ::std::ptr::addr_of!((*ptr).max_regions) as usize - ptr as usize },
+        54usize,
+        "Offset of field: StreamingBuffer_::max_regions"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).buf_size_max) as usize - ptr as usize },
+        56usize,
+        "Offset of field: StreamingBuffer_::buf_size_max"
+    );
+}
+pub type StreamingBuffer = StreamingBuffer_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCSha256 {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCSha1 {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCMd5 {
+    _unused: [u8; 0],
+}
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum FileState_ {
+    #[doc = "< no state"]
+    FILE_STATE_NONE = 0,
+    #[doc = "< flow file is opened"]
+    FILE_STATE_OPENED = 1,
+    #[doc = "< flow file is completed,\nthere will be no more data."]
+    FILE_STATE_CLOSED = 2,
+    #[doc = "< flow file is not complete, but\nthere will be no more data."]
+    FILE_STATE_TRUNCATED = 3,
+    #[doc = "< file is in an error state"]
+    FILE_STATE_ERROR = 4,
+    FILE_STATE_MAX = 5,
+}
+pub use self::FileState_ as FileState;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct File_ {
+    pub flags: u16,
+    pub name_len: u16,
+    pub state: FileState,
+    pub sb: *mut StreamingBuffer,
+    #[doc = "< id used by protocol parser"]
+    pub file_track_id: u32,
+    #[doc = "< id used in store file name file.<id>"]
+    pub file_store_id: u32,
+    #[doc = "< file descriptor for filestore, not\nopen if equal to -1"]
+    pub fd: ::std::os::raw::c_int,
+    pub name: *mut u8,
+    pub magic: *mut ::std::os::raw::c_char,
+    pub next: *mut File_,
+    pub md5_ctx: *mut SCMd5,
+    pub md5: [u8; 16usize],
+    pub sha1_ctx: *mut SCSha1,
+    pub sha1: [u8; 20usize],
+    pub sha256_ctx: *mut SCSha256,
+    pub sha256: [u8; 32usize],
+    #[doc = "< used in pruning if FILE_USE_DETECT\n   flag is set"]
+    pub content_inspected: u64,
+    pub content_stored: u64,
+    pub size: u64,
+    pub inspect_window: u32,
+    pub inspect_min_size: u32,
+    pub start: u64,
+    pub end: u64,
+    pub sid: *mut u32,
+    pub sid_cnt: u32,
+    pub sid_max: u32,
+}
+#[test]
+fn bindgen_test_layout_File_() {
+    const UNINIT: ::std::mem::MaybeUninit<File_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(::std::mem::size_of::<File_>(), 216usize, "Size of File_");
+    assert_eq!(
+        ::std::mem::align_of::<File_>(),
+        8usize,
+        "Alignment of File_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: File_::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name_len) as usize - ptr as usize },
+        2usize,
+        "Offset of field: File_::name_len"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).state) as usize - ptr as usize },
+        4usize,
+        "Offset of field: File_::state"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sb) as usize - ptr as usize },
+        8usize,
+        "Offset of field: File_::sb"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file_track_id) as usize - ptr as usize },
+        16usize,
+        "Offset of field: File_::file_track_id"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file_store_id) as usize - ptr as usize },
+        20usize,
+        "Offset of field: File_::file_store_id"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).fd) as usize - ptr as usize },
+        24usize,
+        "Offset of field: File_::fd"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        32usize,
+        "Offset of field: File_::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).magic) as usize - ptr as usize },
+        40usize,
+        "Offset of field: File_::magic"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        48usize,
+        "Offset of field: File_::next"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).md5_ctx) as usize - ptr as usize },
+        56usize,
+        "Offset of field: File_::md5_ctx"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).md5) as usize - ptr as usize },
+        64usize,
+        "Offset of field: File_::md5"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sha1_ctx) as usize - ptr as usize },
+        80usize,
+        "Offset of field: File_::sha1_ctx"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sha1) as usize - ptr as usize },
+        88usize,
+        "Offset of field: File_::sha1"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sha256_ctx) as usize - ptr as usize },
+        112usize,
+        "Offset of field: File_::sha256_ctx"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sha256) as usize - ptr as usize },
+        120usize,
+        "Offset of field: File_::sha256"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).content_inspected) as usize - ptr as usize },
+        152usize,
+        "Offset of field: File_::content_inspected"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).content_stored) as usize - ptr as usize },
+        160usize,
+        "Offset of field: File_::content_stored"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).size) as usize - ptr as usize },
+        168usize,
+        "Offset of field: File_::size"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).inspect_window) as usize - ptr as usize },
+        176usize,
+        "Offset of field: File_::inspect_window"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).inspect_min_size) as usize - ptr as usize },
+        180usize,
+        "Offset of field: File_::inspect_min_size"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).start) as usize - ptr as usize },
+        184usize,
+        "Offset of field: File_::start"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).end) as usize - ptr as usize },
+        192usize,
+        "Offset of field: File_::end"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sid) as usize - ptr as usize },
+        200usize,
+        "Offset of field: File_::sid"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sid_cnt) as usize - ptr as usize },
+        208usize,
+        "Offset of field: File_::sid_cnt"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sid_max) as usize - ptr as usize },
+        212usize,
+        "Offset of field: File_::sid_max"
+    );
+}
+pub type File = File_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct FileContainer_ {
+    pub head: *mut File,
+    pub tail: *mut File,
+}
+#[test]
+fn bindgen_test_layout_FileContainer_() {
+    const UNINIT: ::std::mem::MaybeUninit<FileContainer_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<FileContainer_>(),
+        16usize,
+        "Size of FileContainer_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<FileContainer_>(),
+        8usize,
+        "Alignment of FileContainer_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).head) as usize - ptr as usize },
+        0usize,
+        "Offset of field: FileContainer_::head"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).tail) as usize - ptr as usize },
+        8usize,
+        "Offset of field: FileContainer_::tail"
+    );
+}
+pub type FileContainer = FileContainer_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCSigOrderFunc_ {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCDetectRequiresStatus {
+    _unused: [u8; 0],
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCFPSupportSMList_ {
+    pub list_id: ::std::os::raw::c_int,
+    pub priority: ::std::os::raw::c_int,
+    pub next: *mut SCFPSupportSMList_,
+}
+#[test]
+fn bindgen_test_layout_SCFPSupportSMList_() {
+    const UNINIT: ::std::mem::MaybeUninit<SCFPSupportSMList_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCFPSupportSMList_>(),
+        16usize,
+        "Size of SCFPSupportSMList_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCFPSupportSMList_>(),
+        8usize,
+        "Alignment of SCFPSupportSMList_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).list_id) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCFPSupportSMList_::list_id"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).priority) as usize - ptr as usize },
+        4usize,
+        "Offset of field: SCFPSupportSMList_::priority"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCFPSupportSMList_::next"
+    );
+}
+pub type SCFPSupportSMList = SCFPSupportSMList_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct DeStateStoreItem_ {
+    pub flags: u32,
+    pub sid: u32,
+}
+#[test]
+fn bindgen_test_layout_DeStateStoreItem_() {
+    const UNINIT: ::std::mem::MaybeUninit<DeStateStoreItem_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<DeStateStoreItem_>(),
+        8usize,
+        "Size of DeStateStoreItem_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<DeStateStoreItem_>(),
+        4usize,
+        "Alignment of DeStateStoreItem_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: DeStateStoreItem_::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).sid) as usize - ptr as usize },
+        4usize,
+        "Offset of field: DeStateStoreItem_::sid"
+    );
+}
+pub type DeStateStoreItem = DeStateStoreItem_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct DeStateStore_ {
+    pub store: [DeStateStoreItem; 15usize],
+    pub next: *mut DeStateStore_,
+}
+#[test]
+fn bindgen_test_layout_DeStateStore_() {
+    const UNINIT: ::std::mem::MaybeUninit<DeStateStore_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<DeStateStore_>(),
+        128usize,
+        "Size of DeStateStore_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<DeStateStore_>(),
+        8usize,
+        "Alignment of DeStateStore_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).store) as usize - ptr as usize },
+        0usize,
+        "Offset of field: DeStateStore_::store"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).next) as usize - ptr as usize },
+        120usize,
+        "Offset of field: DeStateStore_::next"
+    );
+}
+pub type DeStateStore = DeStateStore_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct DetectEngineStateDirection_ {
+    #[doc = "< head of the list"]
+    pub head: *mut DeStateStore,
+    #[doc = "< current active store"]
+    pub cur: *mut DeStateStore,
+    #[doc = "< tail of the list"]
+    pub tail: *mut DeStateStore,
+    pub cnt: u32,
+    pub filestore_cnt: u16,
+    pub flags: u8,
+}
+#[test]
+fn bindgen_test_layout_DetectEngineStateDirection_() {
+    const UNINIT: ::std::mem::MaybeUninit<DetectEngineStateDirection_> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<DetectEngineStateDirection_>(),
+        32usize,
+        "Size of DetectEngineStateDirection_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<DetectEngineStateDirection_>(),
+        8usize,
+        "Alignment of DetectEngineStateDirection_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).head) as usize - ptr as usize },
+        0usize,
+        "Offset of field: DetectEngineStateDirection_::head"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).cur) as usize - ptr as usize },
+        8usize,
+        "Offset of field: DetectEngineStateDirection_::cur"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).tail) as usize - ptr as usize },
+        16usize,
+        "Offset of field: DetectEngineStateDirection_::tail"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).cnt) as usize - ptr as usize },
+        24usize,
+        "Offset of field: DetectEngineStateDirection_::cnt"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).filestore_cnt) as usize - ptr as usize },
+        28usize,
+        "Offset of field: DetectEngineStateDirection_::filestore_cnt"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        30usize,
+        "Offset of field: DetectEngineStateDirection_::flags"
+    );
+}
+pub type DetectEngineStateDirection = DetectEngineStateDirection_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct DetectEngineState_ {
+    pub dir_state: [DetectEngineStateDirection; 2usize],
+}
+#[test]
+fn bindgen_test_layout_DetectEngineState_() {
+    const UNINIT: ::std::mem::MaybeUninit<DetectEngineState_> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<DetectEngineState_>(),
+        64usize,
+        "Size of DetectEngineState_"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<DetectEngineState_>(),
+        8usize,
+        "Alignment of DetectEngineState_"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).dir_state) as usize - ptr as usize },
+        0usize,
+        "Offset of field: DetectEngineState_::dir_state"
+    );
+}
+pub type DetectEngineState = DetectEngineState_;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerParser {
+    _unused: [u8; 0],
+}
+#[repr(u32)]
+#[derive(Debug, Copy, Clone, Hash, PartialEq, Eq)]
+pub enum Base64Mode {
+    Base64ModeRFC2045 = 0,
+    Base64ModeStrict = 1,
+    Base64ModeRFC4648 = 2,
+}
+pub type ByteBase = u8;
+pub type ByteEndian = u8;
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct JsonBuilder {
+    _unused: [u8; 0],
+}
+#[doc = " A \"mark\" or saved state for a JsonBuilder object.\n\n The name is full, and the types are u64 as this object is used\n directly in C as well."]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct JsonBuilderMark {
+    pub position: u64,
+    pub state_index: u64,
+    pub state: u64,
+}
+#[test]
+fn bindgen_test_layout_JsonBuilderMark() {
+    const UNINIT: ::std::mem::MaybeUninit<JsonBuilderMark> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<JsonBuilderMark>(),
+        24usize,
+        "Size of JsonBuilderMark"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<JsonBuilderMark>(),
+        8usize,
+        "Alignment of JsonBuilderMark"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).position) as usize - ptr as usize },
+        0usize,
+        "Offset of field: JsonBuilderMark::position"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).state_index) as usize - ptr as usize },
+        8usize,
+        "Offset of field: JsonBuilderMark::state_index"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).state) as usize - ptr as usize },
+        16usize,
+        "Offset of field: JsonBuilderMark::state"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerTxConfig {
+    #[doc = " config: log flags"]
+    pub log_flags: u8,
+}
+#[test]
+fn bindgen_test_layout_AppLayerTxConfig() {
+    const UNINIT: ::std::mem::MaybeUninit<AppLayerTxConfig> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<AppLayerTxConfig>(),
+        1usize,
+        "Size of AppLayerTxConfig"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<AppLayerTxConfig>(),
+        1usize,
+        "Alignment of AppLayerTxConfig"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).log_flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: AppLayerTxConfig::log_flags"
+    );
+}
+#[doc = " LoggerFlags tracks which loggers have already been executed."]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct LoggerFlags {
+    pub flags: u32,
+}
+#[test]
+fn bindgen_test_layout_LoggerFlags() {
+    const UNINIT: ::std::mem::MaybeUninit<LoggerFlags> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<LoggerFlags>(),
+        4usize,
+        "Size of LoggerFlags"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<LoggerFlags>(),
+        4usize,
+        "Alignment of LoggerFlags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: LoggerFlags::flags"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerTxData {
+    #[doc = " config: log flags"]
+    pub config: AppLayerTxConfig,
+    #[doc = " The tx has been updated and needs to be processed : detection, logging, cleaning\n It can then be skipped until new data arrives.\n There is a boolean for both directions : to server and to client"]
+    pub updated_tc: bool,
+    pub updated_ts: bool,
+    #[doc = " logger flags for tx logging api"]
+    pub logged: LoggerFlags,
+    #[doc = " track file open/logs so we can know how long to keep the tx"]
+    pub files_opened: u32,
+    pub files_logged: u32,
+    pub files_stored: u32,
+    pub file_flags: u16,
+    #[doc = " Indicated if a file tracking tx, and if so in which direction:\n  0: not a file tx\n STREAM_TOSERVER: file tx, files only in toserver dir\n STREAM_TOCLIENT: file tx , files only in toclient dir\n STREAM_TOSERVER|STREAM_TOCLIENT: files possible in both dirs"]
+    pub file_tx: u8,
+    #[doc = " Number of times this tx data has already been logged for signatures\n not using application layer keywords"]
+    pub guessed_applayer_logged: u8,
+    #[doc = " detection engine flags for use by detection engine"]
+    pub detect_flags_ts: u64,
+    pub detect_flags_tc: u64,
+    pub de_state: *mut DetectEngineState,
+    pub events: *mut AppLayerDecoderEvents,
+}
+#[test]
+fn bindgen_test_layout_AppLayerTxData() {
+    const UNINIT: ::std::mem::MaybeUninit<AppLayerTxData> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<AppLayerTxData>(),
+        56usize,
+        "Size of AppLayerTxData"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<AppLayerTxData>(),
+        8usize,
+        "Alignment of AppLayerTxData"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).config) as usize - ptr as usize },
+        0usize,
+        "Offset of field: AppLayerTxData::config"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).updated_tc) as usize - ptr as usize },
+        1usize,
+        "Offset of field: AppLayerTxData::updated_tc"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).updated_ts) as usize - ptr as usize },
+        2usize,
+        "Offset of field: AppLayerTxData::updated_ts"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).logged) as usize - ptr as usize },
+        4usize,
+        "Offset of field: AppLayerTxData::logged"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).files_opened) as usize - ptr as usize },
+        8usize,
+        "Offset of field: AppLayerTxData::files_opened"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).files_logged) as usize - ptr as usize },
+        12usize,
+        "Offset of field: AppLayerTxData::files_logged"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).files_stored) as usize - ptr as usize },
+        16usize,
+        "Offset of field: AppLayerTxData::files_stored"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file_flags) as usize - ptr as usize },
+        20usize,
+        "Offset of field: AppLayerTxData::file_flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file_tx) as usize - ptr as usize },
+        22usize,
+        "Offset of field: AppLayerTxData::file_tx"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).guessed_applayer_logged) as usize - ptr as usize },
+        23usize,
+        "Offset of field: AppLayerTxData::guessed_applayer_logged"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).detect_flags_ts) as usize - ptr as usize },
+        24usize,
+        "Offset of field: AppLayerTxData::detect_flags_ts"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).detect_flags_tc) as usize - ptr as usize },
+        32usize,
+        "Offset of field: AppLayerTxData::detect_flags_tc"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).de_state) as usize - ptr as usize },
+        40usize,
+        "Offset of field: AppLayerTxData::de_state"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).events) as usize - ptr as usize },
+        48usize,
+        "Offset of field: AppLayerTxData::events"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCDetectByteExtractData {
+    pub local_id: u8,
+    pub nbytes: u8,
+    pub offset: i16,
+    pub name: *const ::std::os::raw::c_char,
+    pub flags: u16,
+    pub endian: ByteEndian,
+    pub base: ByteBase,
+    pub align_value: u8,
+    pub multiplier_value: u16,
+    pub id: u16,
+}
+#[test]
+fn bindgen_test_layout_SCDetectByteExtractData() {
+    const UNINIT: ::std::mem::MaybeUninit<SCDetectByteExtractData> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCDetectByteExtractData>(),
+        32usize,
+        "Size of SCDetectByteExtractData"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCDetectByteExtractData>(),
+        8usize,
+        "Alignment of SCDetectByteExtractData"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).local_id) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCDetectByteExtractData::local_id"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).nbytes) as usize - ptr as usize },
+        1usize,
+        "Offset of field: SCDetectByteExtractData::nbytes"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).offset) as usize - ptr as usize },
+        2usize,
+        "Offset of field: SCDetectByteExtractData::offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).name) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCDetectByteExtractData::name"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCDetectByteExtractData::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).endian) as usize - ptr as usize },
+        18usize,
+        "Offset of field: SCDetectByteExtractData::endian"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).base) as usize - ptr as usize },
+        19usize,
+        "Offset of field: SCDetectByteExtractData::base"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).align_value) as usize - ptr as usize },
+        20usize,
+        "Offset of field: SCDetectByteExtractData::align_value"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).multiplier_value) as usize - ptr as usize },
+        22usize,
+        "Offset of field: SCDetectByteExtractData::multiplier_value"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).id) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCDetectByteExtractData::id"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct SCDetectTransformFromBase64Data {
+    pub flags: u8,
+    pub nbytes: u32,
+    pub nbytes_str: *const ::std::os::raw::c_char,
+    pub offset: u32,
+    pub offset_str: *const ::std::os::raw::c_char,
+    pub mode: Base64Mode,
+}
+#[test]
+fn bindgen_test_layout_SCDetectTransformFromBase64Data() {
+    const UNINIT: ::std::mem::MaybeUninit<SCDetectTransformFromBase64Data> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<SCDetectTransformFromBase64Data>(),
+        40usize,
+        "Size of SCDetectTransformFromBase64Data"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<SCDetectTransformFromBase64Data>(),
+        8usize,
+        "Alignment of SCDetectTransformFromBase64Data"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: SCDetectTransformFromBase64Data::flags"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).nbytes) as usize - ptr as usize },
+        4usize,
+        "Offset of field: SCDetectTransformFromBase64Data::nbytes"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).nbytes_str) as usize - ptr as usize },
+        8usize,
+        "Offset of field: SCDetectTransformFromBase64Data::nbytes_str"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).offset) as usize - ptr as usize },
+        16usize,
+        "Offset of field: SCDetectTransformFromBase64Data::offset"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).offset_str) as usize - ptr as usize },
+        24usize,
+        "Offset of field: SCDetectTransformFromBase64Data::offset_str"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).mode) as usize - ptr as usize },
+        32usize,
+        "Offset of field: SCDetectTransformFromBase64Data::mode"
+    );
+}
+#[doc = " helper for the GetTxFilesFn. Not meant to be embedded as the config\n pointer is passed around in the API."]
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerGetFileState {
+    pub fc: *mut FileContainer,
+    pub cfg: *const StreamingBufferConfig,
+}
+#[test]
+fn bindgen_test_layout_AppLayerGetFileState() {
+    const UNINIT: ::std::mem::MaybeUninit<AppLayerGetFileState> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<AppLayerGetFileState>(),
+        16usize,
+        "Size of AppLayerGetFileState"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<AppLayerGetFileState>(),
+        8usize,
+        "Alignment of AppLayerGetFileState"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).fc) as usize - ptr as usize },
+        0usize,
+        "Offset of field: AppLayerGetFileState::fc"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).cfg) as usize - ptr as usize },
+        8usize,
+        "Offset of field: AppLayerGetFileState::cfg"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerResult {
+    pub status: i32,
+    pub consumed: u32,
+    pub needed: u32,
+}
+#[test]
+fn bindgen_test_layout_AppLayerResult() {
+    const UNINIT: ::std::mem::MaybeUninit<AppLayerResult> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<AppLayerResult>(),
+        12usize,
+        "Size of AppLayerResult"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<AppLayerResult>(),
+        4usize,
+        "Alignment of AppLayerResult"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).status) as usize - ptr as usize },
+        0usize,
+        "Offset of field: AppLayerResult::status"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).consumed) as usize - ptr as usize },
+        4usize,
+        "Offset of field: AppLayerResult::consumed"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).needed) as usize - ptr as usize },
+        8usize,
+        "Offset of field: AppLayerResult::needed"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerStateData {
+    pub file_flags: u16,
+}
+#[test]
+fn bindgen_test_layout_AppLayerStateData() {
+    const UNINIT: ::std::mem::MaybeUninit<AppLayerStateData> = ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<AppLayerStateData>(),
+        2usize,
+        "Size of AppLayerStateData"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<AppLayerStateData>(),
+        2usize,
+        "Alignment of AppLayerStateData"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).file_flags) as usize - ptr as usize },
+        0usize,
+        "Offset of field: AppLayerStateData::file_flags"
+    );
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct AppLayerGetTxIterTuple {
+    pub tx_ptr: *mut ::std::os::raw::c_void,
+    pub tx_id: u64,
+    pub has_next: bool,
+}
+#[test]
+fn bindgen_test_layout_AppLayerGetTxIterTuple() {
+    const UNINIT: ::std::mem::MaybeUninit<AppLayerGetTxIterTuple> =
+        ::std::mem::MaybeUninit::uninit();
+    let ptr = UNINIT.as_ptr();
+    assert_eq!(
+        ::std::mem::size_of::<AppLayerGetTxIterTuple>(),
+        24usize,
+        "Size of AppLayerGetTxIterTuple"
+    );
+    assert_eq!(
+        ::std::mem::align_of::<AppLayerGetTxIterTuple>(),
+        8usize,
+        "Alignment of AppLayerGetTxIterTuple"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).tx_ptr) as usize - ptr as usize },
+        0usize,
+        "Offset of field: AppLayerGetTxIterTuple::tx_ptr"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).tx_id) as usize - ptr as usize },
+        8usize,
+        "Offset of field: AppLayerGetTxIterTuple::tx_id"
+    );
+    assert_eq!(
+        unsafe { ::std::ptr::addr_of!((*ptr).has_next) as usize - ptr as usize },
+        16usize,
+        "Offset of field: AppLayerGetTxIterTuple::has_next"
     );
 }
 #[repr(C)]