github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 16:50:34 +00:00
Code Issues Projects Releases Wiki Activity

Enable/disable rules using substrings not regexes

Browse Source 
Given the compiler we currently use, you can't actually enable/disable
regexes in falco_engine::enable_rule using a regex pattern. The regex
either will fail to compile or will compile but not actually match
strings. This is noted on the c++11 compatibility notes for gcc 4.8.2:
https://gcc.gnu.org/onlinedocs/gcc-4.8.2/libstdc++/manual/manual/status.html#status.iso.2011.

The only use of using enable_rule was treating the regex pattern as a
substring match anyway, so we can change the engine to treat the pattern
as a substring.

So change the method/supporting sub-classes to note that the argument is
a substring match, and change falco itself to refer to substrings
instead of patterns.

This fixes https://github.com/falcosecurity/falco/issues/742.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm
2019-07-29 12:10:58 -07:00
committed by Leo Di Donato
parent 4a4701b4fd
commit 3fedd00cfc
5 changed files with 26 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
userspace/engine/falco_engine.h
View File

@@ -76,16 +76,17 @@ public:
void load_rules(const std::string &rules_content, bool verbose, bool all_events, uint64_t &required_engine_version);
//
// Enable/Disable any rules matching the provided pattern
// (regex). When provided, enable/disable these rules in the
// Enable/Disable any rules matching the provided substring.
// If the substring is "", all rules are enabled/disabled.
// When provided, enable/disable these rules in the
// context of the provided ruleset. The ruleset (id) can later
// be passed as an argument to process_event(). This allows
// for different sets of rules being active at once.
//
void enable_rule(const std::string &pattern, bool enabled, const std::string &ruleset);
void enable_rule(const std::string &substring, bool enabled, const std::string &ruleset);
// Wrapper that assumes the default ruleset
void enable_rule(const std::string &pattern, bool enabled);
void enable_rule(const std::string &substring, bool enabled);
//
// Enable/Disable any rules with any of the provided tags (set, exact matches only)