github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-24 03:19:40 +00:00
Code Issues Projects Releases Wiki Activity

new(userspace/falco): read output_fields from a lua table

Browse Source 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
This commit is contained in:
Lorenzo Fontana
2019-09-12 17:17:57 +02:00
committed by Leo Di Donato
parent 7f35b7f712
commit 26217cec5c
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
userspace/falco/falco_outputs.cpp
View File

@@ -301,6 +301,7 @@ int falco_outputs::handle_http(lua_State *ls)
return 1;
}
// TODO(fntlnz, leodido): verify if this works with k8s_audit as source
int falco_outputs::handle_grpc(lua_State *ls)
{
// TODO(fntlnz, leodido): do the checks and make sure all the fields are sent
@@ -327,11 +328,25 @@ int falco_outputs::handle_grpc(lua_State *ls)
// }
falco_output_response grpc_res = falco_output_response();
grpc_res.set_rule((char *)lua_tostring(ls, 2));
// grpc_res.set_source(source);
// grpc_res.set_priority(priority);
// rule
grpc_res.set_rule((char *)lua_tostring(ls, 2));
// output
grpc_res.set_output((char *)lua_tostring(ls, 6));
// output fields
auto& fields = *grpc_res.mutable_output_fields();
lua_pushnil(ls);
while (lua_next(ls, 7) != 0) {
fields[lua_tostring(ls, -2)] = lua_tostring(ls, -1);
lua_pop(ls, 1);
}
falco_output_queue::get().push(grpc_res);
return 1;