github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-12 11:32:39 +00:00
Code Issues Projects Releases Wiki Activity

refactor: remove refs to gen_event class family

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2024-02-01 13:10:13 +00:00 committed by poiana
parent 0613f11980
commit 4cffcedba1
21 changed files with 87 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
unit_tests/engine/test_add_source.cpp
View File

@ -31,7 +31,7 @@ namespace
class test_ruleset_factory : public evttype_index_ruleset_factory class test_ruleset_factory : public evttype_index_ruleset_factory
{ {
public: public:
test_ruleset_factory(std::shared_ptr<gen_event_filter_factory> factory): test_ruleset_factory(std::shared_ptr<sinsp_filter_factory> factory):
evttype_index_ruleset_factory(factory) evttype_index_ruleset_factory(factory)
{ {
ruleset = evttype_index_ruleset_factory::new_ruleset(); ruleset = evttype_index_ruleset_factory::new_ruleset();
@ -54,9 +54,9 @@ TEST(AddSource, basic)
sinsp inspector; sinsp inspector;
sinsp_filter_check_list filterchecks; sinsp_filter_check_list filterchecks;
auto filter_factory = std::shared_ptr<gen_event_filter_factory>( auto filter_factory = std::shared_ptr<sinsp_filter_factory>(
new sinsp_filter_factory(&inspector, filterchecks)); new sinsp_filter_factory(&inspector, filterchecks));
auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>( auto formatter_factory = std::shared_ptr<sinsp_evt_formatter_factory>(
new sinsp_evt_formatter_factory(&inspector, filterchecks)); new sinsp_evt_formatter_factory(&inspector, filterchecks));
test_ruleset_factory *test_factory = new test_ruleset_factory(filter_factory); test_ruleset_factory *test_factory = new test_ruleset_factory(filter_factory);
auto ruleset_factory = std::shared_ptr<filter_ruleset_factory>(test_factory); auto ruleset_factory = std::shared_ptr<filter_ruleset_factory>(test_factory);

14
unit_tests/engine/test_alt_rule_loader.cpp
View File

@ -124,7 +124,7 @@ protected:
class test_ruleset : public evttype_index_ruleset class test_ruleset : public evttype_index_ruleset
{ {
public: public:
test_ruleset(std::shared_ptr<gen_event_filter_factory> factory): test_ruleset(std::shared_ptr<sinsp_filter_factory> factory):
evttype_index_ruleset(factory){}; evttype_index_ruleset(factory){};
virtual ~test_ruleset() = default; virtual ~test_ruleset() = default;
@ -154,7 +154,7 @@ public:
class test_ruleset_factory : public filter_ruleset_factory class test_ruleset_factory : public filter_ruleset_factory
{ {
public: public:
test_ruleset_factory(std::shared_ptr<gen_event_filter_factory> factory): test_ruleset_factory(std::shared_ptr<sinsp_filter_factory> factory):
m_filter_factory(factory) m_filter_factory(factory)
{ {
} }
@ -167,7 +167,7 @@ public:
return ret; return ret;
} }
std::shared_ptr<gen_event_filter_factory> m_filter_factory; std::shared_ptr<sinsp_filter_factory> m_filter_factory;
}; };
}; // namespace }; // namespace
@ -235,9 +235,9 @@ static std::shared_ptr<rule_loader::configuration> create_configuration(sinsp& i
sinsp_filter_check_list& filterchecks, sinsp_filter_check_list& filterchecks,
indexed_vector<falco_source>& sources) indexed_vector<falco_source>& sources)
{ {
auto filter_factory = std::shared_ptr<gen_event_filter_factory>( auto filter_factory = std::shared_ptr<sinsp_filter_factory>(
new sinsp_filter_factory(&inspector, filterchecks)); new sinsp_filter_factory(&inspector, filterchecks));
auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>( auto formatter_factory = std::shared_ptr<sinsp_evt_formatter_factory>(
new sinsp_evt_formatter_factory(&inspector, filterchecks)); new sinsp_evt_formatter_factory(&inspector, filterchecks));
auto ruleset_factory = std::shared_ptr<filter_ruleset_factory>( auto ruleset_factory = std::shared_ptr<filter_ruleset_factory>(
new evttype_index_ruleset_factory(filter_factory)); new evttype_index_ruleset_factory(filter_factory));
@ -330,9 +330,9 @@ TEST(engine_loader_alt_loader, falco_engine_alternate_loader)
sinsp inspector; sinsp inspector;
sinsp_filter_check_list filterchecks; sinsp_filter_check_list filterchecks;
auto filter_factory = std::shared_ptr<gen_event_filter_factory>( auto filter_factory = std::shared_ptr<sinsp_filter_factory>(
new sinsp_filter_factory(&inspector, filterchecks)); new sinsp_filter_factory(&inspector, filterchecks));
auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>( auto formatter_factory = std::shared_ptr<sinsp_evt_formatter_factory>(
new sinsp_evt_formatter_factory(&inspector, filterchecks)); new sinsp_evt_formatter_factory(&inspector, filterchecks));
auto ruleset_factory = std::shared_ptr<filter_ruleset_factory>( auto ruleset_factory = std::shared_ptr<filter_ruleset_factory>(
new test_ruleset_factory(filter_factory)); new test_ruleset_factory(filter_factory));

4
unit_tests/engine/test_enable_rule.cpp
View File

@ -56,9 +56,9 @@ static void load_rules(falco_engine& engine, sinsp& inspector, sinsp_filter_chec
{ {
std::unique_ptr<falco::load_result> res; std::unique_ptr<falco::load_result> res;
auto filter_factory = std::shared_ptr<gen_event_filter_factory>( auto filter_factory = std::shared_ptr<sinsp_filter_factory>(
new sinsp_filter_factory(&inspector, filterchecks)); new sinsp_filter_factory(&inspector, filterchecks));
auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>( auto formatter_factory = std::shared_ptr<sinsp_evt_formatter_factory>(
new sinsp_evt_formatter_factory(&inspector, filterchecks)); new sinsp_evt_formatter_factory(&inspector, filterchecks));
engine.add_source("syscall", filter_factory, formatter_factory); engine.add_source("syscall", filter_factory, formatter_factory);

14
unit_tests/engine/test_rulesets.cpp
View File

@ -23,31 +23,31 @@ limitations under the License.
#define RULESET_2 2 #define RULESET_2 2
/* Helpers methods */ /* Helpers methods */
static std::shared_ptr<gen_event_filter_factory> create_factory(filter_check_list& list) static std::shared_ptr<sinsp_filter_factory> create_factory(filter_check_list& list)
{ {
std::shared_ptr<gen_event_filter_factory> ret(new sinsp_filter_factory(NULL, list)); std::shared_ptr<sinsp_filter_factory> ret(new sinsp_filter_factory(NULL, list));
return ret; return ret;
} }
static std::shared_ptr<filter_ruleset> create_ruleset(std::shared_ptr<gen_event_filter_factory> f) static std::shared_ptr<filter_ruleset> create_ruleset(std::shared_ptr<sinsp_filter_factory> f)
{ {
std::shared_ptr<filter_ruleset> ret(new evttype_index_ruleset(f)); std::shared_ptr<filter_ruleset> ret(new evttype_index_ruleset(f));
return ret; return ret;
} }
static std::shared_ptr<libsinsp::filter::ast::expr> create_ast(std::shared_ptr<gen_event_filter_factory> f) static std::shared_ptr<libsinsp::filter::ast::expr> create_ast(std::shared_ptr<sinsp_filter_factory> f)
{ {
libsinsp::filter::parser parser("evt.type=open"); libsinsp::filter::parser parser("evt.type=open");
std::shared_ptr<libsinsp::filter::ast::expr> ret(parser.parse()); std::shared_ptr<libsinsp::filter::ast::expr> ret(parser.parse());
return ret; return ret;
} }
static std::shared_ptr<gen_event_filter> create_filter( static std::shared_ptr<sinsp_filter> create_filter(
std::shared_ptr<gen_event_filter_factory> f, std::shared_ptr<sinsp_filter_factory> f,
std::shared_ptr<libsinsp::filter::ast::expr> ast) std::shared_ptr<libsinsp::filter::ast::expr> ast)
{ {
sinsp_filter_compiler compiler(f, ast.get()); sinsp_filter_compiler compiler(f, ast.get());
std::shared_ptr<gen_event_filter> filter(compiler.compile()); std::shared_ptr<sinsp_filter> filter(compiler.compile());
return filter; return filter;
} }

4
unit_tests/falco/app/actions/test_configure_interesting_sets.cpp
View File

@ -79,9 +79,9 @@ static std::shared_ptr<falco_engine> mock_engine_from_filters(const strset_t& fi
// create a falco engine and load the ruleset // create a falco engine and load the ruleset
sinsp_filter_check_list filterlist; sinsp_filter_check_list filterlist;
std::shared_ptr<falco_engine> res(new falco_engine()); std::shared_ptr<falco_engine> res(new falco_engine());
auto filter_factory = std::shared_ptr<gen_event_filter_factory>( auto filter_factory = std::shared_ptr<sinsp_filter_factory>(
new sinsp_filter_factory(nullptr, filterlist)); new sinsp_filter_factory(nullptr, filterlist));
auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>( auto formatter_factory = std::shared_ptr<sinsp_evt_formatter_factory>(
new sinsp_evt_formatter_factory(nullptr, filterlist)); new sinsp_evt_formatter_factory(nullptr, filterlist));
res->add_source(s_sample_source, filter_factory, formatter_factory); res->add_source(s_sample_source, filter_factory, formatter_factory);
res->load_rules(dummy_rules, "dummy_rules.yaml"); res->load_rules(dummy_rules, "dummy_rules.yaml");

12
userspace/engine/evttype_index_ruleset.cpp
View File

@ -20,7 +20,7 @@ limitations under the License.
#include <algorithm> #include <algorithm>
evttype_index_ruleset::evttype_index_ruleset( evttype_index_ruleset::evttype_index_ruleset(
std::shared_ptr<gen_event_filter_factory> f): m_filter_factory(f) std::shared_ptr<sinsp_filter_factory> f): m_filter_factory(f)
{ {
} }
@ -111,7 +111,7 @@ uint64_t evttype_index_ruleset::ruleset_filters::num_filters()
return m_filters.size(); return m_filters.size();
} }
bool evttype_index_ruleset::ruleset_filters::run(gen_event *evt, falco_rule& match) bool evttype_index_ruleset::ruleset_filters::run(sinsp_evt *evt, falco_rule& match)
{ {
if(evt->get_type() < m_filter_by_event_type.size()) if(evt->get_type() < m_filter_by_event_type.size())
{ {
@ -138,7 +138,7 @@ bool evttype_index_ruleset::ruleset_filters::run(gen_event *evt, falco_rule& mat
return false; return false;
} }
bool evttype_index_ruleset::ruleset_filters::run(gen_event *evt, std::vector<falco_rule>& matches) bool evttype_index_ruleset::ruleset_filters::run(sinsp_evt *evt, std::vector<falco_rule>& matches)
{ {
bool match_found = false; bool match_found = false;
@ -194,7 +194,7 @@ libsinsp::events::set<ppm_event_code> evttype_index_ruleset::ruleset_filters::ev
void evttype_index_ruleset::add( void evttype_index_ruleset::add(
const falco_rule& rule, const falco_rule& rule,
std::shared_ptr<gen_event_filter> filter, std::shared_ptr<sinsp_filter> filter,
std::shared_ptr<libsinsp::filter::ast::expr> condition) std::shared_ptr<libsinsp::filter::ast::expr> condition)
{ {
try try
@ -332,7 +332,7 @@ uint64_t evttype_index_ruleset::enabled_count(uint16_t ruleset_id)
return m_rulesets[ruleset_id]->num_filters(); return m_rulesets[ruleset_id]->num_filters();
} }
bool evttype_index_ruleset::run(gen_event *evt, falco_rule& match, uint16_t ruleset_id) bool evttype_index_ruleset::run(sinsp_evt *evt, falco_rule& match, uint16_t ruleset_id)
{ {
if(m_rulesets.size() < (size_t)ruleset_id + 1) if(m_rulesets.size() < (size_t)ruleset_id + 1)
{ {
@ -342,7 +342,7 @@ bool evttype_index_ruleset::run(gen_event *evt, falco_rule& match, uint16_t rule
return m_rulesets[ruleset_id]->run(evt, match); return m_rulesets[ruleset_id]->run(evt, match);
} }
bool evttype_index_ruleset::run(gen_event *evt, std::vector<falco_rule>& matches, uint16_t ruleset_id) bool evttype_index_ruleset::run(sinsp_evt *evt, std::vector<falco_rule>& matches, uint16_t ruleset_id)
{ {
if(m_rulesets.size() < (size_t)ruleset_id + 1) if(m_rulesets.size() < (size_t)ruleset_id + 1)
{ {

21
userspace/engine/evttype_index_ruleset.h
View File

@ -27,7 +27,6 @@ limitations under the License.
#include <libsinsp/sinsp.h> #include <libsinsp/sinsp.h>
#include <libsinsp/filter.h> #include <libsinsp/filter.h>
#include <libsinsp/event.h> #include <libsinsp/event.h>
#include <libsinsp/gen_filter.h>
/*! /*!
\brief A filter_ruleset that indexes enabled rules by event type, \brief A filter_ruleset that indexes enabled rules by event type,
@ -36,18 +35,18 @@ limitations under the License.
class evttype_index_ruleset: public filter_ruleset class evttype_index_ruleset: public filter_ruleset
{ {
public: public:
evttype_index_ruleset(std::shared_ptr<gen_event_filter_factory> factory); evttype_index_ruleset(std::shared_ptr<sinsp_filter_factory> factory);
virtual ~evttype_index_ruleset(); virtual ~evttype_index_ruleset();
void add( void add(
const falco_rule& rule, const falco_rule& rule,
std::shared_ptr<gen_event_filter> filter, std::shared_ptr<sinsp_filter> filter,
std::shared_ptr<libsinsp::filter::ast::expr> condition) override; std::shared_ptr<libsinsp::filter::ast::expr> condition) override;
void clear() override; void clear() override;
bool run(gen_event *evt, falco_rule& match, uint16_t ruleset_id) override; bool run(sinsp_evt *evt, falco_rule& match, uint16_t ruleset_id) override;
bool run(gen_event *evt, std::vector<falco_rule>&matches, uint16_t ruleset_id) override; bool run(sinsp_evt *evt, std::vector<falco_rule>&matches, uint16_t ruleset_id) override;
uint64_t enabled_count(uint16_t ruleset_id) override; uint64_t enabled_count(uint16_t ruleset_id) override;
@ -102,7 +101,7 @@ private:
falco_rule rule; falco_rule rule;
libsinsp::events::set<ppm_sc_code> sc_codes; libsinsp::events::set<ppm_sc_code> sc_codes;
libsinsp::events::set<ppm_event_code> event_codes; libsinsp::events::set<ppm_event_code> event_codes;
std::shared_ptr<gen_event_filter> filter; std::shared_ptr<sinsp_filter> filter;
}; };
typedef std::list<std::shared_ptr<filter_wrapper>> filter_wrapper_list; typedef std::list<std::shared_ptr<filter_wrapper>> filter_wrapper_list;
@ -121,11 +120,11 @@ private:
// Evaluate an event against the ruleset and return the first rule // Evaluate an event against the ruleset and return the first rule
// that matched. // that matched.
bool run(gen_event *evt, falco_rule& match); bool run(sinsp_evt *evt, falco_rule& match);
// Evaluate an event against the ruleset and return all the // Evaluate an event against the ruleset and return all the
// matching rules. // matching rules.
bool run(gen_event *evt, std::vector<falco_rule>& matches); bool run(sinsp_evt *evt, std::vector<falco_rule>& matches);
libsinsp::events::set<ppm_sc_code> sc_codes(); libsinsp::events::set<ppm_sc_code> sc_codes();
@ -152,7 +151,7 @@ private:
// All filters added. The set of enabled filters is held in m_rulesets // All filters added. The set of enabled filters is held in m_rulesets
std::set<std::shared_ptr<filter_wrapper>> m_filters; std::set<std::shared_ptr<filter_wrapper>> m_filters;
std::shared_ptr<gen_event_filter_factory> m_filter_factory; std::shared_ptr<sinsp_filter_factory> m_filter_factory;
std::vector<std::string> m_ruleset_names; std::vector<std::string> m_ruleset_names;
}; };
@ -160,7 +159,7 @@ class evttype_index_ruleset_factory: public filter_ruleset_factory
{ {
public: public:
inline evttype_index_ruleset_factory( inline evttype_index_ruleset_factory(
std::shared_ptr<gen_event_filter_factory> factory std::shared_ptr<sinsp_filter_factory> factory
): m_filter_factory(factory) { } ): m_filter_factory(factory) { }
inline std::shared_ptr<filter_ruleset> new_ruleset() override inline std::shared_ptr<filter_ruleset> new_ruleset() override
@ -171,5 +170,5 @@ public:
} }
private: private:
std::shared_ptr<gen_event_filter_factory> m_filter_factory; std::shared_ptr<sinsp_filter_factory> m_filter_factory;
}; };

24
userspace/engine/falco_engine.cpp
View File

@ -115,7 +115,7 @@ std::shared_ptr<rule_loader::compiler> falco_engine::get_rule_compiler()
// Return a key that uniquely represents a field class. // Return a key that uniquely represents a field class.
// For now, we assume name + shortdesc is unique. // For now, we assume name + shortdesc is unique.
static std::string fieldclass_key(const gen_event_filter_factory::filter_fieldclass_info &fld_info) static std::string fieldclass_key(const sinsp_filter_factory::filter_fieldclass_info &fld_info)
{ {
return fld_info.name + fld_info.shortdesc; return fld_info.name + fld_info.shortdesc;
} }
@ -372,14 +372,14 @@ libsinsp::events::set<ppm_event_code> falco_engine::event_codes_for_ruleset(cons
return find_source(source)->ruleset->enabled_event_codes(find_ruleset_id(ruleset)); return find_source(source)->ruleset->enabled_event_codes(find_ruleset_id(ruleset));
} }
std::shared_ptr<gen_event_formatter> falco_engine::create_formatter(const std::string &source, std::shared_ptr<sinsp_evt_formatter> falco_engine::create_formatter(const std::string &source,
const std::string &output) const const std::string &output) const
{ {
return find_source(source)->formatter_factory->create_formatter(output); return find_source(source)->formatter_factory->create_formatter(output);
} }
std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_event(std::size_t source_idx, std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_event(std::size_t source_idx,
gen_event *ev, uint16_t ruleset_id, falco_common::rule_matching strategy) sinsp_evt *ev, uint16_t ruleset_id, falco_common::rule_matching strategy)
{ {
// note: there are no thread-safety guarantees on the filter_ruleset::run() // note: there are no thread-safety guarantees on the filter_ruleset::run()
// method, but the thread-safety assumptions of falco_engine::process_event() // method, but the thread-safety assumptions of falco_engine::process_event()
@ -437,14 +437,14 @@ std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_ev
} }
std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_event(std::size_t source_idx, std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_event(std::size_t source_idx,
gen_event *ev, falco_common::rule_matching strategy) sinsp_evt *ev, falco_common::rule_matching strategy)
{ {
return process_event(source_idx, ev, m_default_ruleset_id, strategy); return process_event(source_idx, ev, m_default_ruleset_id, strategy);
} }
std::size_t falco_engine::add_source(const std::string &source, std::size_t falco_engine::add_source(const std::string &source,
std::shared_ptr<gen_event_filter_factory> filter_factory, std::shared_ptr<sinsp_filter_factory> filter_factory,
std::shared_ptr<gen_event_formatter_factory> formatter_factory) std::shared_ptr<sinsp_evt_formatter_factory> formatter_factory)
{ {
// evttype_index_ruleset is the default ruleset implementation // evttype_index_ruleset is the default ruleset implementation
std::shared_ptr<filter_ruleset_factory> ruleset_factory( std::shared_ptr<filter_ruleset_factory> ruleset_factory(
@ -460,8 +460,8 @@ std::size_t falco_engine::add_source(const std::string &source,
} }
std::size_t falco_engine::add_source(const std::string &source, std::size_t falco_engine::add_source(const std::string &source,
std::shared_ptr<gen_event_filter_factory> filter_factory, std::shared_ptr<sinsp_filter_factory> filter_factory,
std::shared_ptr<gen_event_formatter_factory> formatter_factory, std::shared_ptr<sinsp_evt_formatter_factory> formatter_factory,
std::shared_ptr<filter_ruleset_factory> ruleset_factory) std::shared_ptr<filter_ruleset_factory> ruleset_factory)
{ {
falco_source src; falco_source src;
@ -892,22 +892,22 @@ bool falco_engine::is_source_valid(const std::string &source) const
return m_sources.at(source) != nullptr; return m_sources.at(source) != nullptr;
} }
std::shared_ptr<gen_event_filter_factory> falco_engine::filter_factory_for_source(const std::string& source) std::shared_ptr<sinsp_filter_factory> falco_engine::filter_factory_for_source(const std::string& source)
{ {
return find_source(source)->filter_factory; return find_source(source)->filter_factory;
} }
std::shared_ptr<gen_event_filter_factory> falco_engine::filter_factory_for_source(std::size_t source_idx) std::shared_ptr<sinsp_filter_factory> falco_engine::filter_factory_for_source(std::size_t source_idx)
{ {
return find_source(source_idx)->filter_factory; return find_source(source_idx)->filter_factory;
} }
std::shared_ptr<gen_event_formatter_factory> falco_engine::formatter_factory_for_source(const std::string& source) std::shared_ptr<sinsp_evt_formatter_factory> falco_engine::formatter_factory_for_source(const std::string& source)
{ {
return find_source(source)->formatter_factory; return find_source(source)->formatter_factory;
} }
std::shared_ptr<gen_event_formatter_factory> falco_engine::formatter_factory_for_source(std::size_t source_idx) std::shared_ptr<sinsp_evt_formatter_factory> falco_engine::formatter_factory_for_source(std::size_t source_idx)
{ {
return find_source(source_idx)->formatter_factory; return find_source(source_idx)->formatter_factory;
} }

33
userspace/engine/falco_engine.h
View File

@ -15,12 +15,6 @@ See the License for the specific language governing permissions and
limitations under the License. limitations under the License.
*/ */
// Gen filtering TODO
// - DONE Clean up use/sharing of factories amongst engine-related classes.
// - DONE Fix outputs to actually use factories
// - Review gen_filter apis to see if they have only the required interfaces
// - Fix json filterchecks to split json and evt.time filterchecks.
#pragma once #pragma once
#include <atomic> #include <atomic>
@ -30,7 +24,6 @@ limitations under the License.
#include <nlohmann/json.hpp> #include <nlohmann/json.hpp>
#include <libsinsp/gen_filter.h>
#include "filter_ruleset.h" #include "filter_ruleset.h"
#include "rule_loader.h" #include "rule_loader.h"
#include "rule_loader_reader.h" #include "rule_loader_reader.h"
@ -180,7 +173,7 @@ public:
// Represents the result of matching an event against a set of // Represents the result of matching an event against a set of
// rules. // rules.
struct rule_result { struct rule_result {
gen_event *evt; sinsp_evt *evt;
std::string rule; std::string rule;
std::string source; std::string source;
falco_common::priority_type priority_num; falco_common::priority_type priority_num;
@ -214,7 +207,7 @@ public:
// concurrently with the same source_idx would inherently cause data races // concurrently with the same source_idx would inherently cause data races
// and lead to undefined behavior. // and lead to undefined behavior.
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx, std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx,
gen_event *ev, uint16_t ruleset_id, falco_common::rule_matching strategy); sinsp_evt *ev, uint16_t ruleset_id, falco_common::rule_matching strategy);
// //
// Wrapper assuming the default ruleset. // Wrapper assuming the default ruleset.
@ -222,7 +215,7 @@ public:
// This inherits the same thread-safety guarantees. // This inherits the same thread-safety guarantees.
// //
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx, std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx,
gen_event *ev, falco_common::rule_matching strategy); sinsp_evt *ev, falco_common::rule_matching strategy);
// //
// Configure the engine to support events with the provided // Configure the engine to support events with the provided
@ -230,16 +223,16 @@ public:
// Return source index for fast lookup. // Return source index for fast lookup.
// //
std::size_t add_source(const std::string &source, std::size_t add_source(const std::string &source,
std::shared_ptr<gen_event_filter_factory> filter_factory, std::shared_ptr<sinsp_filter_factory> filter_factory,
std::shared_ptr<gen_event_formatter_factory> formatter_factory); std::shared_ptr<sinsp_evt_formatter_factory> formatter_factory);
// //
// Equivalent to above, but allows specifying a ruleset factory // Equivalent to above, but allows specifying a ruleset factory
// for the newly added source. // for the newly added source.
// //
std::size_t add_source(const std::string &source, std::size_t add_source(const std::string &source,
std::shared_ptr<gen_event_filter_factory> filter_factory, std::shared_ptr<sinsp_filter_factory> filter_factory,
std::shared_ptr<gen_event_formatter_factory> formatter_factory, std::shared_ptr<sinsp_evt_formatter_factory> formatter_factory,
std::shared_ptr<filter_ruleset_factory> ruleset_factory); std::shared_ptr<filter_ruleset_factory> ruleset_factory);
// Return whether or not there is a valid filter/formatter // Return whether or not there is a valid filter/formatter
@ -250,15 +243,15 @@ public:
// Given a source, return a formatter factory that can create // Given a source, return a formatter factory that can create
// filters for events of that source. // filters for events of that source.
// //
std::shared_ptr<gen_event_filter_factory> filter_factory_for_source(const std::string& source); std::shared_ptr<sinsp_filter_factory> filter_factory_for_source(const std::string& source);
std::shared_ptr<gen_event_filter_factory> filter_factory_for_source(std::size_t source_idx); std::shared_ptr<sinsp_filter_factory> filter_factory_for_source(std::size_t source_idx);
// //
// Given a source, return a formatter factory that can create // Given a source, return a formatter factory that can create
// formatters for an event. // formatters for an event.
// //
std::shared_ptr<gen_event_formatter_factory> formatter_factory_for_source(const std::string& source); std::shared_ptr<sinsp_evt_formatter_factory> formatter_factory_for_source(const std::string& source);
std::shared_ptr<gen_event_formatter_factory> formatter_factory_for_source(std::size_t source_idx); std::shared_ptr<sinsp_evt_formatter_factory> formatter_factory_for_source(std::size_t source_idx);
// //
// Given a source, return a ruleset factory that can create // Given a source, return a ruleset factory that can create
@ -300,10 +293,10 @@ public:
// //
// Given a source and output string, return an // Given a source and output string, return an
// gen_event_formatter that can format output strings for an // sinsp_evt_formatter that can format output strings for an
// event. // event.
// //
std::shared_ptr<gen_event_formatter> create_formatter(const std::string &source, std::shared_ptr<sinsp_evt_formatter> create_formatter(const std::string &source,
const std::string &output) const; const std::string &output) const;
// The rule loader definition is aliased as it is exactly what we need // The rule loader definition is aliased as it is exactly what we need

2
userspace/engine/falco_rule.h
View File

@ -83,5 +83,5 @@ struct falco_rule
std::set<std::string> exception_fields; std::set<std::string> exception_fields;
falco_common::priority_type priority; falco_common::priority_type priority;
std::shared_ptr<libsinsp::filter::ast::expr> condition; std::shared_ptr<libsinsp::filter::ast::expr> condition;
std::shared_ptr<gen_event_filter> filter; std::shared_ptr<sinsp_filter> filter;
}; };

4
userspace/engine/falco_source.h
View File

@ -49,8 +49,8 @@ struct falco_source
std::string name; std::string name;
std::shared_ptr<filter_ruleset> ruleset; std::shared_ptr<filter_ruleset> ruleset;
std::shared_ptr<filter_ruleset_factory> ruleset_factory; std::shared_ptr<filter_ruleset_factory> ruleset_factory;
std::shared_ptr<gen_event_filter_factory> filter_factory; std::shared_ptr<sinsp_filter_factory> filter_factory;
std::shared_ptr<gen_event_formatter_factory> formatter_factory; std::shared_ptr<sinsp_evt_formatter_factory> formatter_factory;
// Used by the filter_ruleset interface. Filled in when a rule // Used by the filter_ruleset interface. Filled in when a rule
// matches an event. // matches an event.

7
userspace/engine/filter_ruleset.h
View File

@ -22,7 +22,6 @@ limitations under the License.
#include <libsinsp/filter/ast.h> #include <libsinsp/filter/ast.h>
#include <libsinsp/filter.h> #include <libsinsp/filter.h>
#include <libsinsp/event.h> #include <libsinsp/event.h>
#include <libsinsp/gen_filter.h>
#include <libsinsp/events/sinsp_events.h> #include <libsinsp/events/sinsp_events.h>
/*! /*!
@ -61,7 +60,7 @@ public:
*/ */
virtual void add( virtual void add(
const falco_rule& rule, const falco_rule& rule,
std::shared_ptr<gen_event_filter> filter, std::shared_ptr<sinsp_filter> filter,
std::shared_ptr<libsinsp::filter::ast::expr> condition) = 0; std::shared_ptr<libsinsp::filter::ast::expr> condition) = 0;
/*! /*!
@ -114,7 +113,7 @@ public:
\param ruleset_id The id of the ruleset to be used \param ruleset_id The id of the ruleset to be used
*/ */
virtual bool run( virtual bool run(
gen_event *evt, sinsp_evt *evt,
falco_rule& match, falco_rule& match,
uint16_t ruleset_id) = 0; uint16_t ruleset_id) = 0;
@ -127,7 +126,7 @@ public:
\param ruleset_id The id of the ruleset to be used \param ruleset_id The id of the ruleset to be used
*/ */
virtual bool run( virtual bool run(
gen_event *evt, sinsp_evt *evt,
std::vector<falco_rule>& matches, std::vector<falco_rule>& matches,
uint16_t ruleset_id) = 0; uint16_t ruleset_id) = 0;

12
userspace/engine/formats.cpp
View File

@ -33,20 +33,20 @@ falco_formats::~falco_formats()
{ {
} }
std::string falco_formats::format_event(gen_event *evt, const std::string &rule, const std::string &source, std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format, std::set<std::string> &tags, const std::string &level, const std::string &format, std::set<std::string> &tags,
const std::string &hostname) const const std::string &hostname) const
{ {
std::string line; std::string line;
std::shared_ptr<gen_event_formatter> formatter; std::shared_ptr<sinsp_evt_formatter> formatter;
formatter = m_falco_engine->create_formatter(source, format); formatter = m_falco_engine->create_formatter(source, format);
// Format the original output string, regardless of output format // Format the original output string, regardless of output format
formatter->tostring_withformat(evt, line, gen_event_formatter::OF_NORMAL); formatter->tostring_withformat(evt, line, sinsp_evt_formatter::OF_NORMAL);
if(formatter->get_output_format() == gen_event_formatter::OF_JSON) if(formatter->get_output_format() == sinsp_evt_formatter::OF_JSON)
{ {
std::string json_line; std::string json_line;
@ -131,10 +131,10 @@ std::string falco_formats::format_event(gen_event *evt, const std::string &rule,
return line.c_str(); return line.c_str();
} }
std::map<std::string, std::string> falco_formats::get_field_values(gen_event *evt, const std::string &source, std::map<std::string, std::string> falco_formats::get_field_values(sinsp_evt *evt, const std::string &source,
const std::string &format) const const std::string &format) const
{ {
std::shared_ptr<gen_event_formatter> formatter; std::shared_ptr<sinsp_evt_formatter> formatter;
formatter = m_falco_engine->create_formatter(source, format); formatter = m_falco_engine->create_formatter(source, format);

5
userspace/engine/formats.h
View File

@ -19,7 +19,6 @@ limitations under the License.
#include <string> #include <string>
#include <map> #include <map>
#include <libsinsp/gen_filter.h>
#include "falco_engine.h" #include "falco_engine.h"
class falco_formats class falco_formats
@ -30,11 +29,11 @@ public:
bool json_include_tags_property); bool json_include_tags_property);
virtual ~falco_formats(); virtual ~falco_formats();
std::string format_event(gen_event *evt, const std::string &rule, const std::string &source, std::string format_event(sinsp_evt *evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format, std::set<std::string> &tags, const std::string &level, const std::string &format, std::set<std::string> &tags,
const std::string &hostname) const; const std::string &hostname) const;
std::map<std::string, std::string> get_field_values(gen_event *evt, const std::string &source, std::map<std::string, std::string> get_field_values(sinsp_evt *evt, const std::string &source,
const std::string &format) const ; const std::string &format) const ;
protected: protected:

6
userspace/engine/rule_loader_compiler.cpp
View File

@ -60,7 +60,7 @@ static bool is_format_valid(const falco_source& source, std::string fmt, std::st
{ {
try try
{ {
std::shared_ptr<gen_event_formatter> formatter; std::shared_ptr<sinsp_evt_formatter> formatter;
formatter = source.formatter_factory->create_formatter(fmt); formatter = source.formatter_factory->create_formatter(fmt);
return true; return true;
} }
@ -410,13 +410,13 @@ bool rule_loader::compiler::compile_condition(
indexed_vector<falco_list>& lists, indexed_vector<falco_list>& lists,
const indexed_vector<rule_loader::macro_info>& macros, const indexed_vector<rule_loader::macro_info>& macros,
const std::string& condition, const std::string& condition,
std::shared_ptr<gen_event_filter_factory> filter_factory, std::shared_ptr<sinsp_filter_factory> filter_factory,
rule_loader::context cond_ctx, rule_loader::context cond_ctx,
rule_loader::context parent_ctx, rule_loader::context parent_ctx,
bool allow_unknown_fields, bool allow_unknown_fields,
indexed_vector<falco_macro>& macros_out, indexed_vector<falco_macro>& macros_out,
std::shared_ptr<libsinsp::filter::ast::expr>& ast_out, std::shared_ptr<libsinsp::filter::ast::expr>& ast_out,
std::shared_ptr<gen_event_filter>& filter_out) const std::shared_ptr<sinsp_filter>& filter_out) const
{ {
std::set<falco::load_result::load_result::warning_code> warn_codes; std::set<falco::load_result::load_result::warning_code> warn_codes;
filter_warning_resolver warn_resolver; filter_warning_resolver warn_resolver;

4
userspace/engine/rule_loader_compiler.h
View File

@ -64,13 +64,13 @@ protected:
indexed_vector<falco_list>& lists, indexed_vector<falco_list>& lists,
const indexed_vector<rule_loader::macro_info>& macros, const indexed_vector<rule_loader::macro_info>& macros,
const std::string& condition, const std::string& condition,
std::shared_ptr<gen_event_filter_factory> filter_factory, std::shared_ptr<sinsp_filter_factory> filter_factory,
rule_loader::context cond_ctx, rule_loader::context cond_ctx,
rule_loader::context parent_ctx, rule_loader::context parent_ctx,
bool allow_unknown_fields, bool allow_unknown_fields,
indexed_vector<falco_macro>& macros_out, indexed_vector<falco_macro>& macros_out,
std::shared_ptr<libsinsp::filter::ast::expr>& ast_out, std::shared_ptr<libsinsp::filter::ast::expr>& ast_out,
std::shared_ptr<gen_event_filter>& filter_out) const; std::shared_ptr<sinsp_filter>& filter_out) const;
private: private:
void compile_list_infos( void compile_list_infos(

6
userspace/falco/app/actions/init_falco_engine.cpp
View File

@ -69,14 +69,14 @@ void add_source_to_engine(falco::app::state& s, const std::string& src)
auto& filterchecks = *src_info->filterchecks.get(); auto& filterchecks = *src_info->filterchecks.get();
auto* inspector = src_info->inspector.get(); auto* inspector = src_info->inspector.get();
auto filter_factory = std::shared_ptr<gen_event_filter_factory>( auto filter_factory = std::shared_ptr<sinsp_filter_factory>(
new sinsp_filter_factory(inspector, filterchecks)); new sinsp_filter_factory(inspector, filterchecks));
auto formatter_factory = std::shared_ptr<gen_event_formatter_factory>( auto formatter_factory = std::shared_ptr<sinsp_evt_formatter_factory>(
new sinsp_evt_formatter_factory(inspector, filterchecks)); new sinsp_evt_formatter_factory(inspector, filterchecks));
if(s.config->m_json_output) if(s.config->m_json_output)
{ {
formatter_factory->set_output_format(gen_event_formatter::OF_JSON); formatter_factory->set_output_format(sinsp_evt_formatter::OF_JSON);
} }
src_info->engine_idx = s.engine->add_source(src, filter_factory, formatter_factory); src_info->engine_idx = s.engine->add_source(src, filter_factory, formatter_factory);

1
userspace/falco/app/options.h
View File

@ -22,6 +22,7 @@ limitations under the License.
#include <string> #include <string>
#include <vector> #include <vector>
#include <set> #include <set>
#include <list>
namespace cxxopts { class Options; }; namespace cxxopts { class Options; };

2
userspace/falco/falco_outputs.cpp
View File

@ -135,7 +135,7 @@ void falco_outputs::add_output(falco::outputs::config oc)
} }
} }
void falco_outputs::handle_event(gen_event *evt, std::string &rule, std::string &source, void falco_outputs::handle_event(sinsp_evt *evt, std::string &rule, std::string &source,
falco_common::priority_type priority, std::string &format, std::set<std::string> &tags) falco_common::priority_type priority, std::string &format, std::set<std::string> &tags)
{ {
falco_outputs::ctrl_msg cmsg = {}; falco_outputs::ctrl_msg cmsg = {};

3
userspace/falco/falco_outputs.h
View File

@ -20,7 +20,6 @@ limitations under the License.
#include <memory> #include <memory>
#include <map> #include <map>
#include <libsinsp/gen_filter.h>
#include "falco_common.h" #include "falco_common.h"
#include "falco_engine.h" #include "falco_engine.h"
#include "outputs.h" #include "outputs.h"
@ -59,7 +58,7 @@ public:
\brief Format then send the event to all configured outputs (`evt` \brief Format then send the event to all configured outputs (`evt`
is an event that has matched some rule). is an event that has matched some rule).
*/ */
void handle_event(gen_event *evt, std::string &rule, std::string &source, void handle_event(sinsp_evt *evt, std::string &rule, std::string &source,
falco_common::priority_type priority, std::string &format, std::set<std::string> &tags); falco_common::priority_type priority, std::string &format, std::set<std::string> &tags);
/*! /*!

1
userspace/falco/outputs.h
View File

@ -21,7 +21,6 @@ limitations under the License.
#include <map> #include <map>
#include "falco_common.h" #include "falco_common.h"
#include <libsinsp/gen_filter.h>
#include <nlohmann/json.hpp> #include <nlohmann/json.hpp>
namespace falco namespace falco