github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-29 08:07:24 +00:00
Code Issues Projects Releases Wiki Activity

chore(userspace/engine): clean up unused code

Browse Source 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Leonardo Grasso 2020-09-22 18:18:16 +02:00 committed by poiana
parent 78fa43708b
commit 0ff220de1e
2 changed files with 60 additions and 143 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

173
userspace/engine/formats.cpp
View File

@ -20,24 +20,19 @@ limitations under the License.
#include "falco_engine.h" #include "falco_engine.h"
#include "banned.h" // This raises a compilation error when certain functions are used #include "banned.h" // This raises a compilation error when certain functions are used
sinsp *falco_formats::s_inspector = NULL;
sinsp* falco_formats::s_inspector = NULL;
falco_engine *falco_formats::s_engine = NULL; falco_engine *falco_formats::s_engine = NULL;
bool falco_formats::s_json_output = false; bool falco_formats::s_json_output = false;
bool falco_formats::s_json_include_output_property = true; bool falco_formats::s_json_include_output_property = true;
sinsp_evt_formatter_cache *falco_formats::s_formatters = NULL; sinsp_evt_formatter_cache *falco_formats::s_formatters = NULL;
const static struct luaL_reg ll_falco [] = const static struct luaL_reg ll_falco[] =
{ {
{"formatter", &falco_formats::formatter}, {"formatter", &falco_formats::lua_formatter},
{"free_formatter", &falco_formats::free_formatter}, {"free_formatter", &falco_formats::lua_free_formatter},
{"free_formatters", &falco_formats::free_formatters_lua}, {NULL, NULL}};
{"format_event", &falco_formats::format_event_lua},
{"resolve_tokens", &falco_formats::resolve_tokens_lua},
{NULL,NULL}
};
void falco_formats::init(sinsp* inspector, void falco_formats::init(sinsp *inspector,
falco_engine *engine, falco_engine *engine,
lua_State *ls, lua_State *ls,
bool json_output, bool json_output,
@ -55,7 +50,7 @@ void falco_formats::init(sinsp* inspector,
luaL_openlib(ls, "formats", ll_falco, 0); luaL_openlib(ls, "formats", ll_falco, 0);
} }
int falco_formats::formatter(lua_State *ls) int falco_formats::lua_formatter(lua_State *ls)
{ {
string source = luaL_checkstring(ls, -2); string source = luaL_checkstring(ls, -2);
string format = luaL_checkstring(ls, -1); string format = luaL_checkstring(ls, -1);
@ -64,7 +59,7 @@ int falco_formats::formatter(lua_State *ls)
{ {
if(source == "syscall") if(source == "syscall")
{ {
sinsp_evt_formatter* formatter; sinsp_evt_formatter *formatter;
formatter = new sinsp_evt_formatter(s_inspector, format); formatter = new sinsp_evt_formatter(s_inspector, format);
lua_pushlightuserdata(ls, formatter); lua_pushlightuserdata(ls, formatter);
} }
@ -75,11 +70,11 @@ int falco_formats::formatter(lua_State *ls)
lua_pushlightuserdata(ls, formatter); lua_pushlightuserdata(ls, formatter);
} }
} }
catch(sinsp_exception& e) catch(sinsp_exception &e)
{ {
luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what()); luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what());
} }
catch(falco_exception& e) catch(falco_exception &e)
{ {
luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what()); luaL_error(ls, "Invalid output format '%s': '%s'", format.c_str(), e.what());
} }
@ -87,10 +82,10 @@ int falco_formats::formatter(lua_State *ls)
return 1; return 1;
} }
int falco_formats::free_formatter(lua_State *ls) int falco_formats::lua_free_formatter(lua_State *ls)
{ {
if (!lua_islightuserdata(ls, -1) || if(!lua_islightuserdata(ls, -1) ||
!lua_isstring(ls, -2)) !lua_isstring(ls, -2))
{ {
luaL_error(ls, "Invalid argument passed to free_formatter"); luaL_error(ls, "Invalid argument passed to free_formatter");
@ -100,12 +95,12 @@ int falco_formats::free_formatter(lua_State *ls)
if(source == "syscall") if(source == "syscall")
{ {
sinsp_evt_formatter *formatter = (sinsp_evt_formatter *) lua_topointer(ls, -1); sinsp_evt_formatter *formatter = (sinsp_evt_formatter *)lua_topointer(ls, -1);
delete(formatter); delete(formatter);
} }
else else
{ {
json_event_formatter *formatter = (json_event_formatter *) lua_topointer(ls, -1); json_event_formatter *formatter = (json_event_formatter *)lua_topointer(ls, -1);
delete(formatter); delete(formatter);
} }
@ -121,14 +116,8 @@ void falco_formats::free_formatters()
} }
} }
int falco_formats::free_formatters_lua(lua_State *ls) string falco_formats::format_event(const gen_event *evt, const std::string &rule, const std::string &source,
{ const std::string &level, const std::string &format)
free_formatters();
return 0;
}
string falco_formats::format_event(const gen_event* evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format)
{ {
string line; string line;
@ -138,37 +127,37 @@ string falco_formats::format_event(const gen_event* evt, const std::string &rule
if(strcmp(source.c_str(), "syscall") == 0) if(strcmp(source.c_str(), "syscall") == 0)
{ {
// This is "output" // This is "output"
s_formatters->tostring((sinsp_evt *) evt, sformat, &line); s_formatters->tostring((sinsp_evt *)evt, sformat, &line);
if(s_json_output) if(s_json_output)
{ {
sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format(); sinsp_evt::param_fmt cur_fmt = s_inspector->get_buffer_format();
switch(cur_fmt) switch(cur_fmt)
{ {
case sinsp_evt::PF_NORMAL: case sinsp_evt::PF_NORMAL:
s_inspector->set_buffer_format(sinsp_evt::PF_JSON); s_inspector->set_buffer_format(sinsp_evt::PF_JSON);
break; break;
case sinsp_evt::PF_EOLS: case sinsp_evt::PF_EOLS:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONEOLS); s_inspector->set_buffer_format(sinsp_evt::PF_JSONEOLS);
break; break;
case sinsp_evt::PF_HEX: case sinsp_evt::PF_HEX:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEX); s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEX);
break; break;
case sinsp_evt::PF_HEXASCII: case sinsp_evt::PF_HEXASCII:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEXASCII); s_inspector->set_buffer_format(sinsp_evt::PF_JSONHEXASCII);
break; break;
case sinsp_evt::PF_BASE64: case sinsp_evt::PF_BASE64:
s_inspector->set_buffer_format(sinsp_evt::PF_JSONBASE64); s_inspector->set_buffer_format(sinsp_evt::PF_JSONBASE64);
break; break;
default: default:
// do nothing // do nothing
break; break;
} }
// This is output fields // This is output fields
s_formatters->tostring((sinsp_evt *) evt, sformat, &json_line); s_formatters->tostring((sinsp_evt *)evt, sformat, &json_line);
// The formatted string might have a leading newline. If it does, remove it. // The formatted string might have a leading newline. If it does, remove it.
if (json_line[0] == '\n') if(json_line[0] == '\n')
{ {
json_line.erase(0, 1); json_line.erase(0, 1);
} }
@ -179,11 +168,11 @@ string falco_formats::format_event(const gen_event* evt, const std::string &rule
{ {
json_event_formatter formatter(s_engine->json_factory(), sformat); json_event_formatter formatter(s_engine->json_factory(), sformat);
line = formatter.tostring((json_event *) evt); line = formatter.tostring((json_event *)evt);
if(s_json_output) if(s_json_output)
{ {
json_line = formatter.tojson((json_event *) evt); json_line = formatter.tojson((json_event *)evt);
} }
} }
@ -192,15 +181,16 @@ string falco_formats::format_event(const gen_event* evt, const std::string &rule
// message as well as the event time in ns. Use this to build // message as well as the event time in ns. Use this to build
// a more detailed object containing the event time, rule, // a more detailed object containing the event time, rule,
// severity, full output, and fields. // severity, full output, and fields.
if (s_json_output) { if(s_json_output)
{
Json::Value event; Json::Value event;
Json::FastWriter writer; Json::FastWriter writer;
string full_line; string full_line;
// Convert the time-as-nanoseconds to a more json-friendly ISO8601. // Convert the time-as-nanoseconds to a more json-friendly ISO8601.
time_t evttime = evt->get_ts()/1000000000; time_t evttime = evt->get_ts() / 1000000000;
char time_sec[20]; // sizeof "YYYY-MM-DDTHH:MM:SS" char time_sec[20]; // sizeof "YYYY-MM-DDTHH:MM:SS"
char time_ns[12]; // sizeof ".sssssssssZ" char time_ns[12]; // sizeof ".sssssssssZ"
string iso8601evttime; string iso8601evttime;
strftime(time_sec, sizeof(time_sec), "%FT%T", gmtime(&evttime)); strftime(time_sec, sizeof(time_sec), "%FT%T", gmtime(&evttime));
@ -221,9 +211,9 @@ string falco_formats::format_event(const gen_event* evt, const std::string &rule
// Json::FastWriter may add a trailing newline. If it // Json::FastWriter may add a trailing newline. If it
// does, remove it. // does, remove it.
if (full_line[full_line.length()-1] == '\n') if(full_line[full_line.length() - 1] == '\n')
{ {
full_line.resize(full_line.length()-1); full_line.resize(full_line.length() - 1);
} }
// Cheat-graft the output from the formatter into this // Cheat-graft the output from the formatter into this
@ -239,42 +229,7 @@ string falco_formats::format_event(const gen_event* evt, const std::string &rule
return line.c_str(); return line.c_str();
} }
int falco_formats::format_event_lua(lua_State *ls) map<string, string> falco_formats::resolve_tokens(const gen_event *evt, const std::string &source, const std::string &format)
{
string line;
string json_line;
if (!lua_isstring(ls, -1) ||
!lua_isstring(ls, -2) ||
!lua_isstring(ls, -3) ||
!lua_isstring(ls, -4) ||
!lua_islightuserdata(ls, -5)) {
lua_pushstring(ls, "Invalid arguments passed to format_event()");
lua_error(ls);
}
gen_event* evt = (gen_event*)lua_topointer(ls, 1);
const char *rule = (char *) lua_tostring(ls, 2);
const char *source = (char *) lua_tostring(ls, 3);
const char *level = (char *) lua_tostring(ls, 4);
const char *format = (char *) lua_tostring(ls, 5);
string sformat = format;
try {
line = format_event(evt, rule, source, level, format);
}
catch (sinsp_exception& e)
{
string err = "Invalid output format '" + sformat + "': '" + string(e.what()) + "'";
lua_pushstring(ls, err.c_str());
lua_error(ls);
}
lua_pushstring(ls, line.c_str());
return 1;
}
map<string, string> falco_formats::resolve_tokens(const gen_event* evt, const std::string &source, const std::string &format)
{ {
string sformat = format; string sformat = format;
map<string, string> values; map<string, string> values;
@ -286,37 +241,7 @@ map<string, string> falco_formats::resolve_tokens(const gen_event* evt, const st
else else
{ {
json_event_formatter json_formatter(s_engine->json_factory(), sformat); json_event_formatter json_formatter(s_engine->json_factory(), sformat);
values = json_formatter.tomap((json_event*) evt); values = json_formatter.tomap((json_event *)evt);
} }
return values; return values;
} }
int falco_formats::resolve_tokens_lua(lua_State *ls)
{
if(!lua_isstring(ls, -1) ||
!lua_isstring(ls, -2) ||
!lua_islightuserdata(ls, -3))
{
lua_pushstring(ls, "Invalid arguments passed to resolve_tokens()");
lua_error(ls);
}
gen_event *evt = (gen_event *)lua_topointer(ls, 1);
string source = luaL_checkstring(ls, 2);
const char *format = (char *)lua_tostring(ls, 3);
string sformat = format;
map<string, string> values;
values = resolve_tokens(evt, source, sformat);
lua_newtable(ls);
for(auto const& v : values)
{
lua_pushstring(ls, v.first.c_str());
lua_pushstring(ls, v.second.c_str());
lua_settable(ls, -3);
}
return 1;
}

30
userspace/engine/formats.h
View File

@ -18,7 +18,8 @@ limitations under the License.
#include "sinsp.h" #include "sinsp.h"
extern "C" { extern "C"
{
#include "lua.h" #include "lua.h"
#include "lualib.h" #include "lualib.h"
#include "lauxlib.h" #include "lauxlib.h"
@ -31,37 +32,28 @@ class sinsp_evt_formatter;
class falco_formats class falco_formats
{ {
public: public:
static void init(sinsp* inspector, static void init(sinsp *inspector,
falco_engine *engine, falco_engine *engine,
lua_State *ls, lua_State *ls,
bool json_output, bool json_output,
bool json_include_output_property); bool json_include_output_property);
// formatter = falco.formatter(format_string) // formatter = falco.formatter(format_string)
static int formatter(lua_State *ls); static int lua_formatter(lua_State *ls);
// falco.free_formatter(formatter) // falco.free_formatter(formatter)
static int free_formatter(lua_State *ls); static int lua_free_formatter(lua_State *ls);
static void free_formatters(); static void free_formatters();
// falco.free_formatters() static string format_event(const gen_event *evt, const std::string &rule, const std::string &source,
static int free_formatters_lua(lua_State *ls); const std::string &level, const std::string &format);
static string format_event(const gen_event* evt, const std::string &rule, const std::string &source, static map<string, string> resolve_tokens(const gen_event *evt, const std::string &source,
const std::string &level, const std::string &format); const std::string &format);
// formatted_string = falco.format_event(evt, formatter) static sinsp *s_inspector;
static int format_event_lua(lua_State *ls);
static map<string, string> resolve_tokens(const gen_event* evt, const std::string &source,
const std::string &format);
// resolve_tokens = falco.resolve_tokens(evt, formatter)
static int resolve_tokens_lua(lua_State *ls);
static sinsp* s_inspector;
static falco_engine *s_engine; static falco_engine *s_engine;
static sinsp_evt_formatter_cache *s_formatters; static sinsp_evt_formatter_cache *s_formatters;
static bool s_json_output; static bool s_json_output;