rust/config: add a config schema and validation tool

Author: jasonish

rust/Cargo.lock.in

@@ -11,6 +11,8 @@ name = "suricata-config"
 
 [dependencies]
 clap = { version = "4.5.39", default-features = false, features = ["std", "derive", "help", "usage"] }
+jsonschema = { version = "0.14.0", default-features = false, features = ["draft202012"] }
 saphyr = { version = "0.0.6" }
 saphyr-parser = { version = "0.0.6" }
+serde_json = "1.0.143"
 thiserror = "2.0.12"

rust/config/Cargo.toml.in

@@ -1,3 +1,4 @@
-EXTRA_DIST =	Cargo.toml
+EXTRA_DIST =	Cargo.toml \
+		suricata-yaml.schema.json
 
 all-local: Cargo.toml

rust/config/Makefile.am

@@ -3,8 +3,10 @@
 
 pub mod ffi;
 pub mod loader;
+pub mod validate;
 
 pub use loader::{load_file, load_string, LoadError};
+pub use validate::{config_to_json, validate_json_schema, ValidationError};
 
 use saphyr::MappingOwned;
 use saphyr::Yaml;
@@ -22,6 +24,14 @@ pub type Config = YamlOwned;
 /// Limit for nesting depth. Fuzzing can easily reach this.
 const MAX_YAML_NESTING_DEPTH: usize = 255;
 
+/// Embedded default JSON Schema for Suricata YAML configuration.
+pub const SURICATA_YAML_SCHEMA: &str = include_str!("../suricata-yaml.schema.json");
+
+/// Parse and return the embedded default JSON Schema.
+pub fn embedded_schema() -> Result<serde_json::Value, serde_json::Error> {
+    serde_json::from_str(SURICATA_YAML_SCHEMA)
+}
+
 /// Errors returned while parsing a configuration document.
 #[derive(Debug, Error)]
 pub enum ParseError {
@@ -509,6 +519,12 @@ tagged.path: !leaf final
         assert_eq!(config["tagged-key"].as_str(), Some("tagged-value"));
     }
 
+    #[test]
+    fn test_embedded_schema_parses() {
+        let schema = embedded_schema().expect("embedded schema should parse as JSON");
+        assert!(schema["properties"].is_object());
+    }
+
     #[test]
     fn test_null() {
         // Standard YAML null forms.

rust/config/src/lib.rs

@@ -18,6 +18,12 @@ struct Cli {
 enum Command {
     /// Read and print a Suricata configuration file.
     Print(PrintArgs),
+
+    /// Validate a Suricata configuration file against a JSON schema.
+    Validate(ValidateArgs),
+
+    /// Print the embedded Suricata YAML JSON schema.
+    PrintSchema,
 }
 
 #[derive(Parser, Debug)]
@@ -30,9 +36,24 @@ struct PrintArgs {
     format: OutputFormat,
 }
 
+#[derive(Parser, Debug)]
+struct ValidateArgs {
+    /// Path to the Suricata configuration file.
+    path: PathBuf,
+
+    /// Path to a JSON schema file. If omitted, the embedded schema is used.
+    #[arg(long)]
+    schema: Option<PathBuf>,
+
+    /// Quiet mode. Print nothing when validation succeeds.
+    #[arg(short, long)]
+    quiet: bool,
+}
+
 #[derive(Clone, Copy, Debug, ValueEnum)]
 enum OutputFormat {
     Yaml,
+    Json,
     Debug,
     Flat,
 }
@@ -43,6 +64,8 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     match cli.command {
         Command::Print(args) => print_config(args),
+        Command::Validate(args) => validate_config(args),
+        Command::PrintSchema => print_schema(),
     }
 }
 
@@ -52,9 +75,58 @@ fn print_config(args: PrintArgs) -> Result<(), Box<dyn std::error::Error>> {
 
     match args.format {
         OutputFormat::Yaml => print!("{}", suricata_config::print_yaml(&config)?),
+        OutputFormat::Json => {
+            println!(
+                "{}",
+                serde_json::to_string_pretty(&suricata_config::config_to_json(&config))?
+            );
+        }
         OutputFormat::Debug => println!("{config:#?}"),
         OutputFormat::Flat => print!("{}", suricata_config::print_flat_config(&config)),
     }
 
     Ok(())
 }
+
+// Print the embedded Suricata YAML JSON schema.
+fn print_schema() -> Result<(), Box<dyn std::error::Error>> {
+    print!("{}", suricata_config::SURICATA_YAML_SCHEMA);
+    Ok(())
+}
+
+// Load a configuration file, validate it against a schema, and report all issues.
+fn validate_config(args: ValidateArgs) -> Result<(), Box<dyn std::error::Error>> {
+    let config = suricata_config::load_file(&args.path)?;
+    let instance = suricata_config::config_to_json(&config);
+
+    let (schema, schema_label) = if let Some(schema_path) = args.schema {
+        let schema_input = std::fs::read_to_string(&schema_path)?;
+        let schema: serde_json::Value = serde_json::from_str(&schema_input)?;
+        (schema, schema_path.display().to_string())
+    } else {
+        (
+            suricata_config::embedded_schema()?,
+            String::from("embedded schema"),
+        )
+    };
+
+    let errors = suricata_config::validate_json_schema(&instance, &schema);
+    if errors.is_empty() {
+        if !args.quiet {
+            println!("OK: {}", args.path.display());
+        }
+        return Ok(());
+    }
+
+    eprintln!(
+        "Validation failed: {} issue(s) in {} against {}",
+        errors.len(),
+        args.path.display(),
+        schema_label
+    );
+    for error in errors {
+        eprintln!("{}", error);
+    }
+
+    Err(std::io::Error::new(std::io::ErrorKind::InvalidData, "schema validation failed").into())
+}