suricatactl: add config command

Currently this is just an entry point into the app provided by the
config crate.

Author: jasonish

rust/Cargo.lock.in

@@ -0,0 +1,239 @@
+// SPDX-FileCopyrightText: Copyright 2026 Open Information Security Foundation
+// SPDX-License-Identifier: GPL-2.0-only
+
+use std::path::Path;
+use std::path::PathBuf;
+
+use clap::Parser;
+use clap::Subcommand;
+use clap::ValueEnum;
+use serde_json::Value;
+
+const SCHEMA_FILENAME: &str = "suricata-yaml.schema.json";
+
+#[derive(Parser, Debug)]
+#[command(about = "Utilities for Suricata configuration files")]
+struct Cli {
+    #[command(subcommand)]
+    command: Command,
+}
+
+#[derive(Subcommand, Debug)]
+enum Command {
+    /// Read and print a Suricata configuration file.
+    Print(PrintArgs),
+
+    /// Validate a Suricata configuration file against a JSON schema.
+    Validate(ValidateArgs),
+
+    /// Print the embedded Suricata YAML JSON schema.
+    PrintSchema,
+
+    /// Merge a loaded Suricata configuration layout into suricata-yaml.schema.json.
+    UpdateSchema(UpdateSchemaArgs),
+}
+
+#[derive(Parser, Debug)]
+struct PrintArgs {
+    /// Path to the Suricata configuration file.
+    path: PathBuf,
+
+    /// Output format.
+    #[arg(long, value_enum, default_value_t = OutputFormat::Yaml)]
+    format: OutputFormat,
+}
+
+#[derive(Parser, Debug)]
+struct ValidateArgs {
+    /// Path to the Suricata configuration file.
+    path: PathBuf,
+
+    /// Path to a JSON schema file. If omitted, the embedded schema is used.
+    #[arg(long)]
+    schema: Option<PathBuf>,
+
+    /// Quiet mode. Print nothing when validation succeeds.
+    #[arg(short, long)]
+    quiet: bool,
+}
+
+#[derive(Parser, Debug)]
+struct UpdateSchemaArgs {
+    /// Path to the Suricata configuration file whose layout should be merged.
+    path: PathBuf,
+
+    /// Dot-path to force-regenerate (can be specified multiple times).
+    ///
+    /// Example: --force stats.exception-policy
+    #[arg(long = "force", value_name = "PATH")]
+    force: Vec<String>,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+enum OutputFormat {
+    Yaml,
+    Json,
+    Debug,
+    Flat,
+}
+
+/// Parse CLI arguments from the process environment and dispatch the selected subcommand.
+pub fn run_from_env() -> Result<(), Box<dyn std::error::Error>> {
+    run_from_iter(std::env::args_os())
+}
+
+/// Parse CLI arguments from any iterator and dispatch the selected subcommand.
+pub fn run_from_iter<I, T>(args: I) -> Result<(), Box<dyn std::error::Error>>
+where
+    I: IntoIterator<Item = T>,
+    T: Into<std::ffi::OsString> + Clone,
+{
+    let cli = Cli::parse_from(args);
+
+    match cli.command {
+        Command::Print(args) => print_config(args),
+        Command::Validate(args) => validate_config(args),
+        Command::PrintSchema => print_schema(),
+        Command::UpdateSchema(args) => update_schema(args),
+    }
+}
+
+// Load a configuration file and print it in the requested format.
+fn print_config(args: PrintArgs) -> Result<(), Box<dyn std::error::Error>> {
+    let config = crate::load_file(&args.path)?;
+
+    match args.format {
+        OutputFormat::Yaml => print!("{}", crate::print_yaml(&config)?),
+        OutputFormat::Json => {
+            println!(
+                "{}",
+                serde_json::to_string_pretty(&crate::config_to_json(&config))?
+            );
+        }
+        OutputFormat::Debug => println!("{config:#?}"),
+        OutputFormat::Flat => print!("{}", crate::print_flat_config(&config)),
+    }
+
+    Ok(())
+}
+
+// Print the embedded Suricata YAML JSON schema.
+fn print_schema() -> Result<(), Box<dyn std::error::Error>> {
+    print!("{}", crate::SURICATA_YAML_SCHEMA);
+    Ok(())
+}
+
+// Load a configuration file, validate it against a schema, and report all issues.
+fn validate_config(args: ValidateArgs) -> Result<(), Box<dyn std::error::Error>> {
+    let config = crate::load_file(&args.path)?;
+    let instance = crate::config_to_json(&config);
+
+    let (schema, schema_label) = if let Some(schema_path) = args.schema {
+        let schema_input = std::fs::read_to_string(&schema_path)?;
+        let schema: serde_json::Value = serde_json::from_str(&schema_input)?;
+        (schema, schema_path.display().to_string())
+    } else {
+        (crate::embedded_schema()?, String::from("embedded schema"))
+    };
+
+    let errors = crate::validate_json_schema(&instance, &schema);
+    if errors.is_empty() {
+        if !args.quiet {
+            println!("OK: {}", args.path.display());
+        }
+        return Ok(());
+    }
+
+    eprintln!(
+        "Validation failed: {} issue(s) in {} against {}",
+        errors.len(),
+        args.path.display(),
+        schema_label
+    );
+    for error in errors {
+        eprintln!("{}", error);
+    }
+
+    Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "schema validation failed").into())
+}
+
+// Merge one loaded config layout into rust/config/suricata-yaml.schema.json.
+fn update_schema(args: UpdateSchemaArgs) -> Result<(), Box<dyn std::error::Error>> {
+    let config = crate::load_file(&args.path)?;
+    let instance = crate::config_to_json(&config);
+
+    let schema_path = Path::new(env!("CARGO_MANIFEST_DIR")).join(SCHEMA_FILENAME);
+    let schema_input = std::fs::read_to_string(&schema_path)?;
+    let mut schema: serde_json::Value = serde_json::from_str(&schema_input)?;
+    let mut original_schema = schema.clone();
+    crate::sort_schema_properties(&mut original_schema);
+
+    for force_path in &args.force {
+        let force_segments = parse_dot_path(force_path)?;
+        if !json_object_path_exists(&instance, &force_segments) {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                format!(
+                    "forced path '{}' does not exist in {}",
+                    force_path,
+                    args.path.display()
+                ),
+            )
+            .into());
+        }
+
+        let removed =
+            crate::remove_schema_property_path(&mut schema, &force_segments).map_err(|error| {
+                std::io::Error::new(
+                    std::io::ErrorKind::InvalidInput,
+                    format!("invalid forced path '{}': {}", force_path, error),
+                )
+            })?;
+        if removed {
+            println!("Force-cleared schema path '{}'", force_path);
+        }
+    }
+
+    crate::merge_instance_layout_additive(&mut schema, &instance);
+    crate::sort_schema_properties(&mut schema);
+    if schema == original_schema {
+        println!("No schema updates required for {}", args.path.display());
+        return Ok(());
+    }
+
+    let output = serde_json::to_string_pretty(&schema)?;
+    std::fs::write(&schema_path, format!("{output}\n"))?;
+
+    println!(
+        "Updated {} using {}",
+        schema_path.display(),
+        args.path.display()
+    );
+
+    Ok(())
+}
+
+fn parse_dot_path(path: &str) -> Result<Vec<&str>, std::io::Error> {
+    let segments = path.split('.').collect::<Vec<_>>();
+    if segments.is_empty() || segments.iter().any(|segment| segment.is_empty()) {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("invalid path '{path}': use non-empty dot-separated segments"),
+        ));
+    }
+    Ok(segments)
+}
+
+fn json_object_path_exists(value: &Value, path: &[&str]) -> bool {
+    let mut current = value;
+    for segment in path {
+        let Some(object) = current.as_object() else {
+            return false;
+        };
+        let Some(next) = object.get(*segment) else {
+            return false;
+        };
+        current = next;
+    }
+    true
+}

rust/config/src/cli.rs

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: Copyright 2026 Open Information Security Foundation
 // SPDX-License-Identifier: GPL-2.0-only
 
+pub mod cli;
 pub mod ffi;
 pub mod loader;
 pub mod schema;