github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-17 16:21:31 +00:00
Code Issues Projects Releases Wiki Activity

Parser changes to support new sysdig features

Browse Source 
Support "glob" as an operator and allow pathnames to be the index into
bracketed selectors of fields.
This commit is contained in:
Mark Stemm 2016-09-08 16:18:53 -07:00
parent bef628dc05
commit 2fad859600
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
userspace/engine/lua/parser.lua
View File

@ -218,14 +218,16 @@ local G = {
idRest = alnum + P("_"); idRest = alnum + P("_");
Identifier = V"idStart" * V"idRest"^0; Identifier = V"idStart" * V"idRest"^0;
Macro = V"idStart" * V"idRest"^0 * -P"."; Macro = V"idStart" * V"idRest"^0 * -P".";
FieldName = V"Identifier" * (P"." + V"Identifier")^1 * (P"[" * V"Int" * P"]")^-1; Int = digit^1;
PathString = (alnum + S'-_/*?')^1;
Index = V"Int" + V"PathString";
FieldName = V"Identifier" * (P"." + V"Identifier")^1 * (P"[" * V"Index" * P"]")^-1;
Name = C(V"Identifier") * -V"idRest"; Name = C(V"Identifier") * -V"idRest";
Hex = (P("0x") + P("0X")) * xdigit^1; Hex = (P("0x") + P("0X")) * xdigit^1;
Expo = S("eE") * S("+-")^-1 * digit^1; Expo = S("eE") * S("+-")^-1 * digit^1;
Float = (((digit^1 * P(".") * digit^0) + Float = (((digit^1 * P(".") * digit^0) +
(P(".") * digit^1)) * V"Expo"^-1) + (P(".") * digit^1)) * V"Expo"^-1) +
(digit^1 * V"Expo"); (digit^1 * V"Expo");
Int = digit^1;
Number = C(V"Hex" + V"Float" + V"Int") / Number = C(V"Hex" + V"Float" + V"Int") /
function (n) return tonumber(n) end; function (n) return tonumber(n) end;
String = (P'"' * C(((P'\\' * P(1)) + (P(1) - P'"'))^0) * P'"' + P"'" * C(((P"\\" * P(1)) + (P(1) - P"'"))^0) * P"'") / function (s) return fix_str(s) end; String = (P'"' * C(((P'\\' * P(1)) + (P(1) - P'"'))^0) * P'"' + P"'" * C(((P"\\" * P(1)) + (P(1) - P"'"))^0) * P"'") / function (s) return fix_str(s) end;
@ -243,6 +245,7 @@ local G = {
symb(">") / ">" + symb(">") / ">" +
symb("contains") / "contains" + symb("contains") / "contains" +
symb("icontains") / "icontains" + symb("icontains") / "icontains" +
symb("glob") / "glob" +
symb("startswith") / "startswith"; symb("startswith") / "startswith";
InOp = kw("in") / "in"; InOp = kw("in") / "in";
UnaryBoolOp = kw("not") / "not"; UnaryBoolOp = kw("not") / "not";