Change from toml to yaml

src/lib.rs

@@ -1,4 +1,4 @@
 pub mod detections;
 pub mod models;
 pub mod omikuji;
-pub mod toml;
+pub mod yaml;

src/main.rs

@@ -7,7 +7,7 @@ use quick_xml::de::DeError;
 use std::{fs, path::PathBuf, process};
 use yamato_event_analyzer::detections::detection;
 use yamato_event_analyzer::omikuji::Omikuji;
-use yamato_event_analyzer::toml;
+use yamato_event_analyzer::yaml;
 
 fn build_app() -> clap::App<'static, 'static> {
     let program = std::env::args()

src/models/mod.rs

@@ -1,2 +1 @@
 pub mod event;
-pub mod rule;

src/models/rule.rs

@@ -1,13 +0,0 @@
-extern crate serde;
-use serde::Deserialize;
-
-#[derive(Debug, Deserialize)]
-pub struct Rule {
-    pub severity: Option<String>,
-    pub name: Option<String>,
-}
-
-#[derive(Debug, Deserialize)]
-pub struct Toml {
-    pub rule: Rule,
-}

src/toml.rs

@@ -1,89 +0,0 @@
-extern crate serde_derive;
-extern crate toml;
-
-use crate::models::rule;
-use std::fs;
-use std::io;
-use std::io::{BufReader, Read};
-use std::path::{Path, PathBuf};
-
-pub struct ParseToml {
-    pub rules: Vec<Result<rule::Toml, toml::de::Error>>,
-}
-
-impl ParseToml {
-    pub fn new() -> ParseToml {
-        ParseToml { rules: Vec::new() }
-    }
-
-    pub fn read_file(&self, path: PathBuf) -> Result<String, String> {
-        let mut file_content = String::new();
-
-        let mut fr = fs::File::open(path)
-            .map(|f| BufReader::new(f))
-            .map_err(|e| e.to_string())?;
-
-        fr.read_to_string(&mut file_content)
-            .map_err(|e| e.to_string())?;
-
-        Ok(file_content)
-    }
-
-    pub fn read_dir<P: AsRef<Path>>(&mut self, path: P) -> io::Result<String> {
-        Ok(fs::read_dir(path)?
-            .filter_map(|entry| {
-                let entry = entry.ok()?;
-                if entry.file_type().ok()?.is_file() {
-                    match self.read_file(entry.path()) {
-                        Ok(s) => &self.rules.push(toml::from_str(&s)),
-                        Err(e) => panic!("fail to read file: {}", e),
-                    };
-                }
-                if entry.file_type().ok()?.is_dir() {
-                    self.read_dir(entry.path());
-                }
-                Some("")
-            })
-            .collect())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-
-    use crate::toml;
-
-    #[test]
-    fn test_read_toml() {
-        let mut toml = toml::ParseToml::new();
-        &toml.read_dir("test_files/rules".to_string());
-
-        for rule in toml.rules {
-            match rule {
-                Ok(_rule) => {
-                    if let Some(severity) = _rule.rule.severity {
-                        assert_eq!("high", severity);
-                    }
-                }
-                Err(_) => (),
-            }
-        }
-    }
-
-    #[test]
-    fn test_read_multiple_dir() {
-        let mut toml = toml::ParseToml::new();
-        &toml.read_dir("test_files".to_string());
-
-        for rule in toml.rules {
-            match rule {
-                Ok(_rule) => {
-                    if let Some(severity) = _rule.rule.severity {
-                        assert_eq!("high", severity);
-                    }
-                }
-                Err(_) => (),
-            }
-        }
-    }
-}

src/yaml.rs

@@ -0,0 +1,80 @@
+extern crate serde_derive;
+extern crate yaml_rust;
+
+use std::fs;
+use std::io;
+use std::io::{BufReader, Read};
+use std::path::{Path, PathBuf};
+use yaml_rust::YamlLoader;
+
+pub struct ParseYaml {
+    pub rules: Vec<yaml_rust::Yaml>,
+}
+
+impl ParseYaml {
+    pub fn new() -> ParseYaml {
+        ParseYaml { rules: Vec::new() }
+    }
+
+    pub fn read_file(&self, path: PathBuf) -> Result<String, String> {
+        let mut file_content = String::new();
+
+        let mut fr = fs::File::open(path)
+            .map(|f| BufReader::new(f))
+            .map_err(|e| e.to_string())?;
+
+        fr.read_to_string(&mut file_content)
+            .map_err(|e| e.to_string())?;
+
+        Ok(file_content)
+    }
+
+    pub fn read_dir<P: AsRef<Path>>(&mut self, path: P) -> io::Result<String> {
+        Ok(fs::read_dir(path)?
+            .filter_map(|entry| {
+                let entry = entry.ok()?;
+                if entry.file_type().ok()?.is_file() {
+                    match self.read_file(entry.path()) {
+                        Ok(s) => {
+                            let docs = YamlLoader::load_from_str(&s).unwrap();
+                            for i in docs {
+                                &self.rules.push(i);
+                            }
+                        }
+                        Err(e) => panic!("fail to read file: {}", e),
+                    };
+                }
+                if entry.file_type().ok()?.is_dir() {
+                    self.read_dir(entry.path());
+                }
+                Some("")
+            })
+            .collect())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+
+    use crate::yaml;
+
+    #[test]
+    fn test_read_yaml() {
+        let mut yaml = yaml::ParseYaml::new();
+        &yaml.read_dir("test_files/rules/yaml/".to_string());
+        for rule in yaml.rules {
+            if rule["title"].as_str().unwrap() == "Sysmon Check command lines" {
+                assert_eq!(
+                    "*",
+                    rule["detection"]["selection"]["CommandLine"]
+                        .as_str()
+                        .unwrap()
+                );
+                assert_eq!(
+                    1,
+                    rule["detection"]["selection"]["EventID"].as_i64().unwrap()
+                );
+            }
+        }
+    }
+}