Suricata

To provide a stable ABI (and even API) between patch releases, it is important not to break the application binary interface of library or plugin users. Small things like changing the size of a data structure can break the interface.

libabigail (https://sourceware.org/libabigail/) can detect such changes. For example, I changed the size of the SCPlugin_ struct and was able to detect this and was shown the warning:

  [C] 'function bool RegisterPlugin(SCPlugin*, void*)' has some indirect sub-type changes:
    parameter 1 of type 'SCPlugin*' has sub-type changes:
      in pointed to type 'typedef SCPlugin':
        underlying type 'struct SCPlugin_' changed:
          type size changed from 448 to 512 (in bits)
          1 data member insertion:
            'uint64_t version0', at offset 64 (in bits)
          6 data member changes:
            'const char* suricata_version' offset changed from 64 to 128 (in bits) (by +64 bits)
            'const char* name' offset changed from 128 to 192 (in bits) (by +64 bits)
            'const char* plugin_version' offset changed from 192 to 256 (in bits) (by +64 bits)
            'const char* license' offset changed from 256 to 320 (in bits) (by +64 bits)
            'const char* author' offset changed from 320 to 384 (in bits) (by +64 bits)
            'void ()* Init' offset changed from 384 to 448 (in bits) (by +64 bits)

But it's also very noisy. It works against the shared library, which has all the mangled Rust names in it that can also change between builds. So we'd have to impose strong filtering before it becomes useful.