rsigma 0.24.0

CLI for parsing, validating, linting and evaluating Sigma detection rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135

//! Compile-time inventory of optional Cargo features for the `rsigma` binary.
//!
//! `--help` is not a reliable detector: several features have no unique flag
//! (`evtx`, `logfmt`, `cef`, `daemon-otlp`), and `--input-format` is a free
//! string so clap never lists the gated values. This module is the source of
//! truth for `rsigma --features`, `rsigma --version`, and the `--help` footer.

/// Every optional Cargo feature the `rsigma` binary can be built with, in
/// sorted order. Keep in sync with `[features]` in this crate's `Cargo.toml`.
macro_rules! cli_features {
    ($($name:literal),+ $(,)?) => {
        #[cfg(test)]
        pub const ALL: &[&str] = &[$($name),+];

        pub const ENABLED: &[&str] = &[
            $(
                #[cfg(feature = $name)]
                $name,
            )+
        ];
    };
}

cli_features! {
    "cef",
    "daachorse-index",
    "daemon",
    "daemon-nats",
    "daemon-otlp",
    "daemon-tls",
    "evtx",
    "hunt-postgres",
    "logfmt",
    "mcp",
    "stix-enrich",
    "taxii-sync",
}

pub fn print_enabled() {
    for name in ENABLED {
        println!("{name}");
    }
}

pub fn help_footer() -> &'static str {
    static FOOTER: std::sync::OnceLock<&'static str> = std::sync::OnceLock::new();
    FOOTER.get_or_init(|| leak(format!("Compiled-in features: {}", format_enabled())))
}

pub fn long_version() -> &'static str {
    static VERSION: std::sync::OnceLock<&'static str> = std::sync::OnceLock::new();
    VERSION.get_or_init(|| {
        leak(format!(
            "{}\nfeatures: {}",
            env!("CARGO_PKG_VERSION"),
            format_enabled(),
        ))
    })
}

fn leak(s: String) -> &'static str {
    Box::leak(s.into_boxed_str())
}

fn format_enabled() -> String {
    ENABLED.join(", ")
}

/// True when argv asks for the feature list and does not name a subcommand.
///
/// clap still requires a subcommand, so `rsigma --features` has to be handled
/// before `get_matches`. A non-flag token (a command group) is left to clap.
pub fn requested(args: impl IntoIterator<Item = impl AsRef<str>>) -> bool {
    let mut has_features = false;
    for arg in args {
        let arg = arg.as_ref();
        if arg == "--features" {
            has_features = true;
            continue;
        }
        if arg == "--" || !arg.starts_with('-') {
            return false;
        }
    }
    has_features
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn catalogues_are_sorted() {
        let mut all = ALL.to_vec();
        all.sort_unstable();
        assert_eq!(ALL, all.as_slice());
        let mut enabled = ENABLED.to_vec();
        enabled.sort_unstable();
        assert_eq!(ENABLED, enabled.as_slice());
    }

    #[test]
    fn enabled_is_a_subset_of_all() {
        for name in ENABLED {
            assert!(ALL.contains(name), "unknown feature {name}");
        }
    }

    #[test]
    fn daemon_tracks_the_cfg() {
        assert_eq!(ENABLED.contains(&"daemon"), cfg!(feature = "daemon"));
    }

    #[test]
    fn format_enabled_joins_enabled_names() {
        assert_eq!(format_enabled(), ENABLED.join(", "));
    }

    #[test]
    fn long_version_starts_with_the_crate_version() {
        let version = long_version();
        assert!(version.starts_with(env!("CARGO_PKG_VERSION")), "{version}");
        assert!(version.contains("features:"));
    }

    #[test]
    fn requested_is_true_only_without_a_subcommand() {
        assert!(requested(["--features"]));
        assert!(requested(["--quiet", "--features"]));
        assert!(!requested(["--features", "engine"]));
        assert!(!requested(["engine", "eval", "--features"]));
        assert!(!requested(["--help"]));
        assert!(!requested(Vec::<&str>::new()));
    }
}