github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-10-22 03:49:36 +00:00
Code Issues Projects Releases Wiki Activity

Compile and load digwatch rules!

Browse Source
This commit is contained in:
Henri DF
2016-02-20 21:17:45 -08:00
parent e1cdd62f2f
commit 3d58c3c9ae
6 changed files with 122 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
userspace/digwatch/digwatch.cpp
View File

@@ -33,7 +33,7 @@ static void usage()
" -h, --help Print this page\n"
" -m <filename>, --main-lua <filename>\n"
" Name of lua compiler main file\n"
" (default: rules_loader.lua\n"
" (default: rules_loader.lua)\n"
" -M <num_seconds> Stop collecting after <num_seconds> reached.\n"
" -N Don't convert port numbers to names.\n"
" -n <num>, --numevents=<num>\n"
@@ -244,18 +244,18 @@ int digwatch_init(int argc, char **argv)
//
sinsp_evt_formatter formatter(inspector, output_format);
trim(lua_main_filename);
if (lua_main_filename.size() == 0)
{
lua_main_filename = DIGWATCH_LUA_MAIN;
}
char* env_lua_dir = getenv("DIGWATCH_LUA_DIR");
if (env_lua_dir)
{
lua_dir = string(env_lua_dir);
}
trim(lua_main_filename);
if (lua_main_filename.size() == 0)
{
lua_main_filename = lua_dir + DIGWATCH_LUA_MAIN;
}
rules = new digwatch_rules(inspector, lua_main_filename, lua_dir);
rules->load_rules(rules_file);

18
userspace/digwatch/rules.cpp
View File

@@ -67,18 +67,18 @@ void digwatch_rules::load_rules(string rules_filename)
throw sinsp_exception("can't open file " + rules_filename);
}
lua_getglobal(m_ls, m_lua_compiler_cb.c_str());
lua_getglobal(m_ls, m_lua_load_rule.c_str());
if(lua_isfunction(m_ls, -1))
{
lua_pop(m_ls, 1);
} else {
throw sinsp_exception("No function " + m_lua_compiler_cb + " found in lua compiler module");
throw sinsp_exception("No function " + m_lua_load_rule + " found in lua compiler module");
}
std::string line;
while (std::getline(is, line))
{
lua_getglobal(m_ls, m_lua_compiler_cb.c_str());
lua_getglobal(m_ls, m_lua_load_rule.c_str());
lua_pushstring(m_ls, line.c_str());
if(lua_pcall(m_ls, 1, 0, 0) != 0)
@@ -89,6 +89,18 @@ void digwatch_rules::load_rules(string rules_filename)
}
}
lua_getglobal(m_ls, m_lua_on_done.c_str());
if(lua_isfunction(m_ls, -1))
{
if(lua_pcall(m_ls, 0, 0, 0) != 0)
{
const char* lerr = lua_tostring(m_ls, -1);
string err = "Error installing rules: " + string(lerr);
throw sinsp_exception(err);
}
} else {
throw sinsp_exception("No function " + m_lua_on_done + " found in lua compiler module");
}
}

4
userspace/digwatch/rules.h
View File

@@ -17,6 +17,6 @@ class digwatch_rules
lua_parser* m_lua_parser;
lua_State* m_ls;
string m_lua_compiler_cb = "load_rules";
string m_lua_;
string m_lua_load_rule = "load_rule";
string m_lua_on_done = "on_done";
};