github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-07 17:54:07 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): make rule_matching strategy stateless in falco engine

Browse Source 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
This commit is contained in:
Lorenzo Susini
2023-08-10 10:30:14 +00:00
committed by poiana
parent 6e50d2ad83
commit 4e6149e5da
4 changed files with 11 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
userspace/engine/falco_engine.h
View File

@@ -106,11 +106,6 @@ public:
// Only load rules having this priority or more severe.
void set_min_priority(falco_common::priority_type priority);
// Whether or not continuing to evaluate rules for other potential matches
// even if a match already occurred. This option can be set to avoid shadowing
// of rules.
void set_rule_matching(falco_common::rule_matching rule_matching);
//
// Return the ruleset id corresponding to this ruleset name,
// creating a new one if necessary. If you provide any ruleset
@@ -194,14 +189,16 @@ public:
// event source is not thread-safe of its own, so invoking this method
// concurrently with the same source_idx would inherently cause data races
// and lead to undefined behavior.
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx, gen_event *ev, uint16_t ruleset_id);
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx,
gen_event *ev, uint16_t ruleset_id, falco_common::rule_matching strategy);
//
// Wrapper assuming the default ruleset.
//
// This inherits the same thread-safety guarantees.
//
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx, gen_event *ev);
std::unique_ptr<std::vector<rule_result>> process_event(std::size_t source_idx,
gen_event *ev, falco_common::rule_matching strategy);
//
// Configure the engine to support events with the provided
@@ -325,7 +322,6 @@ private:
uint16_t m_next_ruleset_id;
std::map<std::string, uint16_t> m_known_rulesets;
falco_common::priority_type m_min_priority;
falco_common::rule_matching m_rule_matching;
//
// Here's how the sampling ratio and multiplier influence