add test for exclude rules

src/detections/detection.rs

@@ -11,7 +11,7 @@ use crate::detections::print::MESSAGES;
 use crate::detections::rule;
 use crate::detections::rule::RuleNode;
 use crate::detections::utils::get_serde_number_to_string;
-use crate::fillter::RuleFill;
+use crate::fillter;
 use crate::yaml::ParseYaml;
 
 use std::sync::Arc;
@@ -55,7 +55,7 @@ impl Detection {
     pub fn parse_rule_files(
         level: String,
         rulespath: Option<&str>,
-        fill_ids: &RuleFill,
+        fill_ids: &fillter::RuleFill,
     ) -> Vec<RuleNode> {
         // ルールファイルのパースを実行
         let mut rulefile_loader = ParseYaml::new();
@@ -275,9 +275,7 @@ impl Detection {
 fn test_parse_rule_files() {
     let level = "informational";
     let opt_rule_path = Some("./test_files/rules/level_yaml");
-    let fill_ids = RuleFill {
+    let cole =
-        no_use_rule: std::collections::HashSet::new(),
+        Detection::parse_rule_files(level.to_owned(), opt_rule_path, &fillter::exclude_ids());
-    };
-    let cole = Detection::parse_rule_files(level.to_owned(), opt_rule_path, &fill_ids);
     assert_eq!(5, cole.len());
 }

src/fillter.rs

@@ -1,6 +1,36 @@
+use crate::detections::configs;
 use std::collections::HashSet;
+use std::fs;
 
 #[derive(Clone, Debug)]
 pub struct RuleFill {
     pub no_use_rule: HashSet<String>,
 }
+
+pub fn exclude_ids() -> RuleFill {
+    let mut ids = String::from_utf8(fs::read("config/exclude-rules.txt").unwrap()).unwrap();
+    if !configs::CONFIG
+        .read()
+        .unwrap()
+        .args
+        .is_present("show-noisyalerts")
+    {
+        ids += "\n"; // 改行を入れないとexclude-rulesの一番最後の行とnoisy-rules.txtの一番最後の行が一行にまとめられてしまう。
+        ids += &String::from_utf8(fs::read("config/noisy-rules.txt").unwrap()).unwrap();
+    }
+
+    let mut fill_ids = RuleFill {
+        no_use_rule: HashSet::new(),
+    };
+
+    for v in ids.split_whitespace() {
+        let v = v.to_string();
+        if v.is_empty() {
+            // 空行は無視する。
+            continue;
+        }
+        fill_ids.no_use_rule.insert(v);
+    }
+
+    return fill_ids;
+}

src/main.rs

@@ -13,7 +13,6 @@ use hayabusa::{detections::configs, timeline::timeline::Timeline};
 use hhmmss::Hhmmss;
 use pbr::ProgressBar;
 use serde_json::Value;
-use std::collections::HashSet;
 use std::{
     fs::{self, File},
     path::PathBuf,
@@ -124,34 +123,10 @@ fn analysis_files(evtx_files: Vec<PathBuf>) {
         .to_uppercase();
     println!("Analyzing event files: {:?}", evtx_files.len());
 
-    //除外ルール前処理
-    let mut ids = String::from_utf8(fs::read("config/exclude-rules.txt").unwrap()).unwrap();
-    if !configs::CONFIG
-        .read()
-        .unwrap()
-        .args
-        .is_present("show-noisyalerts")
-    {
-        ids += "\n"; // 改行を入れないとexclude-rulesの一番最後の行とnoisy-rules.txtの一番最後の行が一行にまとめられてしまう。
-        ids += &String::from_utf8(fs::read("config/noisy-rules.txt").unwrap()).unwrap();
-    }
-
-    let mut fill_ids = fillter::RuleFill {
-        no_use_rule: HashSet::new(),
-    };
-
-    for v in ids.split_whitespace() {
-        let v = v.to_string();
-        if v.is_empty() {
-            // 空行は無視する。
-            continue;
-        }
-        fill_ids.no_use_rule.insert(v);
-    }
     let rule_files = detection::Detection::parse_rule_files(
         level,
         configs::CONFIG.read().unwrap().args.value_of("rules"),
-        &fill_ids,
+        &fillter::exclude_ids(),
     );
     let mut pb = ProgressBar::new(evtx_files.len() as u64);
     let mut detection = detection::Detection::new(rule_files);

src/yaml.rs

@@ -160,6 +160,7 @@ impl ParseYaml {
 #[cfg(test)]
 mod tests {
 
+    use crate::fillter;
     use crate::yaml;
     use crate::yaml::RuleFill;
     use std::collections::HashSet;
@@ -211,10 +212,8 @@ mod tests {
     fn test_default_level_read_yaml() {
         let mut yaml = yaml::ParseYaml::new();
         let path = Path::new("test_files/rules/level_yaml");
-        let fill_ids = RuleFill {
+        yaml.read_dir(path.to_path_buf(), &"", &fillter::exclude_ids())
-            no_use_rule: HashSet::new(),
+            .unwrap();
-        };
-        yaml.read_dir(path.to_path_buf(), &"", &fill_ids).unwrap();
         assert_eq!(yaml.files.len(), 5);
     }
 
@@ -222,21 +221,19 @@ mod tests {
     fn test_info_level_read_yaml() {
         let mut yaml = yaml::ParseYaml::new();
         let path = Path::new("test_files/rules/level_yaml");
-        let fill_ids = RuleFill {
+        yaml.read_dir(
-            no_use_rule: HashSet::new(),
+            path.to_path_buf(),
-        };
+            &"informational",
-        yaml.read_dir(path.to_path_buf(), &"informational", &fill_ids)
+            &fillter::exclude_ids(),
-            .unwrap();
+        )
+        .unwrap();
         assert_eq!(yaml.files.len(), 5);
     }
     #[test]
     fn test_low_level_read_yaml() {
         let mut yaml = yaml::ParseYaml::new();
         let path = Path::new("test_files/rules/level_yaml");
-        let fill_ids = RuleFill {
+        yaml.read_dir(path.to_path_buf(), &"LOW", &fillter::exclude_ids())
-            no_use_rule: HashSet::new(),
-        };
-        yaml.read_dir(path.to_path_buf(), &"LOW", &fill_ids)
             .unwrap();
         assert_eq!(yaml.files.len(), 4);
     }
@@ -244,10 +241,7 @@ mod tests {
     fn test_medium_level_read_yaml() {
         let mut yaml = yaml::ParseYaml::new();
         let path = Path::new("test_files/rules/level_yaml");
-        let fill_ids = RuleFill {
+        yaml.read_dir(path.to_path_buf(), &"MEDIUM", &fillter::exclude_ids())
-            no_use_rule: HashSet::new(),
-        };
-        yaml.read_dir(path.to_path_buf(), &"MEDIUM", &fill_ids)
             .unwrap();
         assert_eq!(yaml.files.len(), 3);
     }
@@ -255,10 +249,7 @@ mod tests {
     fn test_high_level_read_yaml() {
         let mut yaml = yaml::ParseYaml::new();
         let path = Path::new("test_files/rules/level_yaml");
-        let fill_ids = RuleFill {
+        yaml.read_dir(path.to_path_buf(), &"HIGH", &fillter::exclude_ids())
-            no_use_rule: HashSet::new(),
-        };
-        yaml.read_dir(path.to_path_buf(), &"HIGH", &fill_ids)
             .unwrap();
         assert_eq!(yaml.files.len(), 2);
     }
@@ -266,11 +257,16 @@ mod tests {
     fn test_critical_level_read_yaml() {
         let mut yaml = yaml::ParseYaml::new();
         let path = Path::new("test_files/rules/level_yaml");
-        let fill_ids = RuleFill {
+        yaml.read_dir(path.to_path_buf(), &"CRITICAL", &fillter::exclude_ids())
-            no_use_rule: HashSet::new(),
-        };
-        yaml.read_dir(path.to_path_buf(), &"CRITICAL", &fill_ids)
             .unwrap();
         assert_eq!(yaml.files.len(), 1);
     }
+    #[test]
+    fn test_exclude_rules_file() {
+        let mut yaml = yaml::ParseYaml::new();
+        let path = Path::new("test_files/rules/exclude_rules");
+        yaml.read_dir(path.to_path_buf(), &"", &fillter::exclude_ids())
+            .unwrap();
+        assert_eq!(yaml.ignorerule_count, 1);
+    }
 }