mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-06 08:43:40 +00:00
refactor(userspace/engine): reduce allocations during rules loading
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
parent
d69f329b54
commit
0cc1c5b44f
@ -54,8 +54,8 @@ bool filter_macro_resolver::run(std::shared_ptr<libsinsp::filter::ast::expr>& fi
|
|||||||
}
|
}
|
||||||
|
|
||||||
void filter_macro_resolver::set_macro(
|
void filter_macro_resolver::set_macro(
|
||||||
std::string name,
|
const std::string& name,
|
||||||
std::shared_ptr<libsinsp::filter::ast::expr> macro)
|
const std::shared_ptr<libsinsp::filter::ast::expr>& macro)
|
||||||
{
|
{
|
||||||
m_macros[name] = macro;
|
m_macros[name] = macro;
|
||||||
}
|
}
|
||||||
|
@ -56,8 +56,8 @@ class filter_macro_resolver
|
|||||||
\param macro The AST of the macro.
|
\param macro The AST of the macro.
|
||||||
*/
|
*/
|
||||||
void set_macro(
|
void set_macro(
|
||||||
std::string name,
|
const std::string& name,
|
||||||
std::shared_ptr<libsinsp::filter::ast::expr> macro);
|
const std::shared_ptr<libsinsp::filter::ast::expr>& macro);
|
||||||
|
|
||||||
/*!
|
/*!
|
||||||
\brief used in get_{resolved,unknown}_macros and get_errors
|
\brief used in get_{resolved,unknown}_macros and get_errors
|
||||||
@ -86,6 +86,18 @@ class filter_macro_resolver
|
|||||||
*/
|
*/
|
||||||
const std::vector<value_info>& get_errors() const;
|
const std::vector<value_info>& get_errors() const;
|
||||||
|
|
||||||
|
/*!
|
||||||
|
\brief Clears the resolver by resetting all state related to
|
||||||
|
known macros and everything related to the previous resolution run.
|
||||||
|
*/
|
||||||
|
inline void clear()
|
||||||
|
{
|
||||||
|
m_errors.clear();
|
||||||
|
m_unknown_macros.clear();
|
||||||
|
m_resolved_macros.clear();
|
||||||
|
m_macros.clear();
|
||||||
|
}
|
||||||
|
|
||||||
private:
|
private:
|
||||||
typedef std::unordered_map<
|
typedef std::unordered_map<
|
||||||
std::string,
|
std::string,
|
||||||
|
@ -21,7 +21,6 @@ limitations under the License.
|
|||||||
#include <vector>
|
#include <vector>
|
||||||
|
|
||||||
#include "rule_loader_compiler.h"
|
#include "rule_loader_compiler.h"
|
||||||
#include "filter_macro_resolver.h"
|
|
||||||
#include "filter_warning_resolver.h"
|
#include "filter_warning_resolver.h"
|
||||||
|
|
||||||
#define MAX_VISIBILITY ((uint32_t) -1)
|
#define MAX_VISIBILITY ((uint32_t) -1)
|
||||||
@ -250,7 +249,8 @@ static bool resolve_list(std::string& cnd, const falco_list& list)
|
|||||||
return used;
|
return used;
|
||||||
}
|
}
|
||||||
|
|
||||||
static void resolve_macros(
|
static inline void resolve_macros(
|
||||||
|
filter_macro_resolver& macro_resolver,
|
||||||
const indexed_vector<rule_loader::macro_info>& infos,
|
const indexed_vector<rule_loader::macro_info>& infos,
|
||||||
indexed_vector<falco_macro>& macros,
|
indexed_vector<falco_macro>& macros,
|
||||||
std::shared_ptr<ast::expr>& ast,
|
std::shared_ptr<ast::expr>& ast,
|
||||||
@ -258,7 +258,7 @@ static void resolve_macros(
|
|||||||
uint32_t visibility,
|
uint32_t visibility,
|
||||||
const rule_loader::context &ctx)
|
const rule_loader::context &ctx)
|
||||||
{
|
{
|
||||||
filter_macro_resolver macro_resolver;
|
macro_resolver.clear();
|
||||||
for (const auto &m : infos)
|
for (const auto &m : infos)
|
||||||
{
|
{
|
||||||
if (m.index < visibility)
|
if (m.index < visibility)
|
||||||
@ -391,10 +391,11 @@ void rule_loader::compiler::compile_macros_infos(
|
|||||||
out.at(macro_id)->id = macro_id;
|
out.at(macro_id)->id = macro_id;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
filter_macro_resolver macro_resolver;
|
||||||
for (auto &m : out)
|
for (auto &m : out)
|
||||||
{
|
{
|
||||||
auto info = macro_info_from_name(col, m.name);
|
auto info = macro_info_from_name(col, m.name);
|
||||||
resolve_macros(col.macros(), out, m.condition, info->cond, info->visibility, info->ctx);
|
resolve_macros(macro_resolver, col.macros(), out, m.condition, info->cond, info->visibility, info->ctx);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -407,12 +408,13 @@ static bool err_is_unknown_type_or_field(const std::string& err)
|
|||||||
|
|
||||||
bool rule_loader::compiler::compile_condition(
|
bool rule_loader::compiler::compile_condition(
|
||||||
configuration& cfg,
|
configuration& cfg,
|
||||||
|
filter_macro_resolver& macro_resolver,
|
||||||
indexed_vector<falco_list>& lists,
|
indexed_vector<falco_list>& lists,
|
||||||
const indexed_vector<rule_loader::macro_info>& macros,
|
const indexed_vector<rule_loader::macro_info>& macros,
|
||||||
const std::string& condition,
|
const std::string& condition,
|
||||||
std::shared_ptr<sinsp_filter_factory> filter_factory,
|
std::shared_ptr<sinsp_filter_factory> filter_factory,
|
||||||
rule_loader::context cond_ctx,
|
const rule_loader::context& cond_ctx,
|
||||||
rule_loader::context parent_ctx,
|
const rule_loader::context& parent_ctx,
|
||||||
bool allow_unknown_fields,
|
bool allow_unknown_fields,
|
||||||
indexed_vector<falco_macro>& macros_out,
|
indexed_vector<falco_macro>& macros_out,
|
||||||
std::shared_ptr<libsinsp::filter::ast::expr>& ast_out,
|
std::shared_ptr<libsinsp::filter::ast::expr>& ast_out,
|
||||||
@ -421,7 +423,7 @@ bool rule_loader::compiler::compile_condition(
|
|||||||
std::set<falco::load_result::load_result::warning_code> warn_codes;
|
std::set<falco::load_result::load_result::warning_code> warn_codes;
|
||||||
filter_warning_resolver warn_resolver;
|
filter_warning_resolver warn_resolver;
|
||||||
ast_out = parse_condition(condition, lists, cond_ctx);
|
ast_out = parse_condition(condition, lists, cond_ctx);
|
||||||
resolve_macros(macros, macros_out, ast_out, condition, MAX_VISIBILITY, parent_ctx);
|
resolve_macros(macro_resolver, macros, macros_out, ast_out, condition, MAX_VISIBILITY, parent_ctx);
|
||||||
|
|
||||||
// check for warnings in the filtering condition
|
// check for warnings in the filtering condition
|
||||||
if(warn_resolver.run(ast_out.get(), warn_codes))
|
if(warn_resolver.run(ast_out.get(), warn_codes))
|
||||||
@ -470,6 +472,7 @@ void rule_loader::compiler::compile_rule_infos(
|
|||||||
indexed_vector<falco_rule>& out) const
|
indexed_vector<falco_rule>& out) const
|
||||||
{
|
{
|
||||||
std::string err, condition;
|
std::string err, condition;
|
||||||
|
filter_macro_resolver macro_resolver;
|
||||||
for(const auto& r : col.rules())
|
for(const auto& r : col.rules())
|
||||||
{
|
{
|
||||||
// skip the rule if it has an unknown source
|
// skip the rule if it has an unknown source
|
||||||
@ -522,6 +525,7 @@ void rule_loader::compiler::compile_rule_infos(
|
|||||||
}
|
}
|
||||||
|
|
||||||
if (!compile_condition(cfg,
|
if (!compile_condition(cfg,
|
||||||
|
macro_resolver,
|
||||||
lists,
|
lists,
|
||||||
col.macros(),
|
col.macros(),
|
||||||
condition,
|
condition,
|
||||||
|
@ -20,6 +20,7 @@ limitations under the License.
|
|||||||
#include "rule_loader.h"
|
#include "rule_loader.h"
|
||||||
#include "rule_loader_compile_output.h"
|
#include "rule_loader_compile_output.h"
|
||||||
#include "rule_loader_collector.h"
|
#include "rule_loader_collector.h"
|
||||||
|
#include "filter_macro_resolver.h"
|
||||||
#include "indexed_vector.h"
|
#include "indexed_vector.h"
|
||||||
#include "falco_rule.h"
|
#include "falco_rule.h"
|
||||||
|
|
||||||
@ -61,12 +62,13 @@ protected:
|
|||||||
*/
|
*/
|
||||||
bool compile_condition(
|
bool compile_condition(
|
||||||
configuration& cfg,
|
configuration& cfg,
|
||||||
|
filter_macro_resolver& macro_resolver,
|
||||||
indexed_vector<falco_list>& lists,
|
indexed_vector<falco_list>& lists,
|
||||||
const indexed_vector<rule_loader::macro_info>& macros,
|
const indexed_vector<rule_loader::macro_info>& macros,
|
||||||
const std::string& condition,
|
const std::string& condition,
|
||||||
std::shared_ptr<sinsp_filter_factory> filter_factory,
|
std::shared_ptr<sinsp_filter_factory> filter_factory,
|
||||||
rule_loader::context cond_ctx,
|
const rule_loader::context& cond_ctx,
|
||||||
rule_loader::context parent_ctx,
|
const rule_loader::context& parent_ctx,
|
||||||
bool allow_unknown_fields,
|
bool allow_unknown_fields,
|
||||||
indexed_vector<falco_macro>& macros_out,
|
indexed_vector<falco_macro>& macros_out,
|
||||||
std::shared_ptr<libsinsp::filter::ast::expr>& ast_out,
|
std::shared_ptr<libsinsp::filter::ast::expr>& ast_out,
|
||||||
|
Loading…
Reference in New Issue
Block a user