github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 16:50:34 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): allow the engine to match and handle multiple rules while processing events

Browse Source 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
This commit is contained in:
Lorenzo Susini
2023-08-02 13:23:18 +00:00
committed by poiana
parent 46e8f2c14b
commit 1705c0dab3
7 changed files with 138 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
userspace/engine/falco_engine.h
View File

@@ -106,6 +106,11 @@ public:
// Only load rules having this priority or more severe.
void set_min_priority(falco_common::priority_type priority);
// Whether or not continuing to evaluate rules for other potential matches
// even if a match already occurred. This option can be set to avoid shadowing
// of rules.
void set_rule_matching(falco_common::rule_matching rule_matching);
//
// Return the ruleset id corresponding to this ruleset name,
// creating a new one if necessary. If you provide any ruleset
@@ -189,14 +194,14 @@ public:
// event source is not thread-safe of its own, so invoking this method
// concurrently with the same source_idx would inherently cause data races
// and lead to undefined behavior.
std::unique_ptr<rule_result> process_event(std::size_t source_idx, gen_event *ev, uint16_t ruleset_id);
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx, gen_event *ev, uint16_t ruleset_id);
//
// Wrapper assuming the default ruleset.
//
// This inherits the same thread-safety guarantees.
//
std::unique_ptr<rule_result> process_event(std::size_t source_idx, gen_event *ev);
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx, gen_event *ev);
//
// Configure the engine to support events with the provided
@@ -320,6 +325,7 @@ private:
uint16_t m_next_ruleset_id;
std::map<std::string, uint16_t> m_known_rulesets;
falco_common::priority_type m_min_priority;
falco_common::rule_matching m_rule_matching;
//
// Here's how the sampling ratio and multiplier influence