Applayer plugin example and doc

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/4102 with all 6 subtickets

Describe changes:

• add app-layer plugin example with template protocol
• document app-layer plugins

@jufajardini what do you think about the doc ?

@jasonish as you created the tickets, is this what you expected ?

[suricata-qa]

ERROR:

ERROR: QA failed on build_asan.

Pipeline 24249

[victorjulien]

this looks way to broad to me, even containing lots of things we define directly in rust. So why duplicate that? In general, we need to get to a point there this file is not needed at all.

[jasonish]

I see another project here, making Rust plugins a first class citizen. All this "support" code should land in Suricata proper.

I have also needed to fill in some missing bits for an output plugin like this, just haven't brought them back into Suricata. But we probably need some "suricata_plugin" module or crate, that provides this support code to Rust, at least for the plugin specific stuff. Anything that's just filling in missing Suricata API should be in the main suricata rust package.

But it probably brings in more C into Rust, and maybe bindgen is worth another look instead of doing it by hand.

[catenacyber]

containing lots of things we define directly in rust.

Yes

So why duplicate that?

Because my rust plugin needs to know the value of IPPROTO_TCP
I would like to have some #include <libsuricata.h> but that does not work in rust

@jasonish do you have ideas ?

[catenacyber]

But we probably need some "suricata_plugin" module or crate, that provides this support code to Rust, at least for the plugin specific stuff

I will try something...

But even after that, Victor, we will still want some code for JsonBuilder to wrap around the C API to feel like usual...

[codecov]

Codecov Report

Attention: Patch coverage is 94.73684% with 2 lines in your changes missing coverage. Please review.

Project coverage is 80.66%. Comparing base (8f6795d) to head (eec4e3e).
Report is 6 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #12416      +/-   ##
==========================================
+ Coverage   80.63%   80.66%   +0.03%     
==========================================
  Files         918      919       +1     
  Lines      258696   259064     +368     
==========================================
+ Hits       208598   208973     +375     
+ Misses      50098    50091       -7     

Flag	Coverage Δ
fuzzcorpus	56.90% <89.47%> (+0.09%)	⬆️
livemode	19.35% <5.26%> (-0.05%)	⬇️
pcap	44.37% <50.00%> (+0.07%)	⬆️
suricata-verify	63.28% <94.44%> (+0.04%)	⬆️
unittests	58.45% <34.21%> (-0.07%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 24262

[catenacyber]

Something next in #12441