github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-04 08:04:49 +00:00
Code Issues Projects Releases Wiki Activity

chore(falco): apply code formatting

Browse Source 
Signed-off-by: Poiana <poiana.bot@gmail.com>
This commit is contained in:
Poiana
2024-09-30 10:53:51 +02:00
committed by poiana
parent 11bac9dbd2
commit 50b98b30e5
169 changed files with 8681 additions and 9539 deletions
Download Patch File Download Diff File Expand all files Collapse all files

109
userspace/engine/formats.cpp
View File

@@ -21,41 +21,37 @@ limitations under the License.
#include "falco_engine.h"
falco_formats::falco_formats(std::shared_ptr<const falco_engine> engine,
bool json_include_output_property,
bool json_include_tags_property,
bool json_include_message_property,
bool time_format_iso_8601)
: m_falco_engine(engine),
m_json_include_output_property(json_include_output_property),
m_json_include_tags_property(json_include_tags_property),
m_json_include_message_property(json_include_message_property),
m_time_format_iso_8601(time_format_iso_8601)
{
}
bool json_include_output_property,
bool json_include_tags_property,
bool json_include_message_property,
bool time_format_iso_8601):
m_falco_engine(engine),
m_json_include_output_property(json_include_output_property),
m_json_include_tags_property(json_include_tags_property),
m_json_include_message_property(json_include_message_property),
m_time_format_iso_8601(time_format_iso_8601) {}
falco_formats::~falco_formats()
{
}
falco_formats::~falco_formats() {}
std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format, const std::set<std::string> &tags,
const std::string &hostname, const extra_output_field_t &extra_fields) const
{
std::string falco_formats::format_event(sinsp_evt *evt,
const std::string &rule,
const std::string &source,
const std::string &level,
const std::string &format,
const std::set<std::string> &tags,
const std::string &hostname,
const extra_output_field_t &extra_fields) const {
std::string prefix_format;
std::string message_format = format;
if(m_time_format_iso_8601)
{
if(m_time_format_iso_8601) {
prefix_format = "*%evt.time.iso8601: ";
}
else
{
} else {
prefix_format = "*%evt.time: ";
}
prefix_format += level;
if(message_format[0] != '*')
{
if(message_format[0] != '*') {
message_format = "*" + message_format;
}
@@ -72,15 +68,13 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
std::string message;
message_formatter->tostring_withformat(evt, message, sinsp_evt_formatter::OF_NORMAL);
// The complete Falco output, e.g. "13:53:31.726060287: Critical Some Event Description (proc_exe=bash)..."
// The complete Falco output, e.g. "13:53:31.726060287: Critical Some Event Description
// (proc_exe=bash)..."
std::string output = prefix + " " + message;
if(message_formatter->get_output_format() == sinsp_evt_formatter::OF_NORMAL)
{
if(message_formatter->get_output_format() == sinsp_evt_formatter::OF_NORMAL) {
return output;
}
else if(message_formatter->get_output_format() == sinsp_evt_formatter::OF_JSON)
{
} else if(message_formatter->get_output_format() == sinsp_evt_formatter::OF_JSON) {
std::string json_fields_message;
std::string json_fields_prefix;
@@ -98,8 +92,8 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
// Convert the time-as-nanoseconds to a more json-friendly ISO8601.
time_t evttime = evt->get_ts() / 1000000000;
char time_sec[20]; // sizeof "YYYY-MM-DDTHH:MM:SS"
char time_ns[12]; // sizeof ".sssssssssZ"
char time_sec[20]; // sizeof "YYYY-MM-DDTHH:MM:SS"
char time_ns[12]; // sizeof ".sssssssssZ"
std::string iso8601evttime;
strftime(time_sec, sizeof(time_sec), "%FT%T", gmtime(&evttime));
@@ -112,52 +106,47 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
event["source"] = source;
event["hostname"] = hostname;
if(m_json_include_output_property)
{
if(m_json_include_output_property) {
event["output"] = output;
}
if(m_json_include_tags_property)
{
if(m_json_include_tags_property) {
event["tags"] = tags;
}
if(m_json_include_message_property)
{
if(m_json_include_message_property) {
event["message"] = message;
}
event["output_fields"] = nlohmann::json::parse(json_fields_message);
auto prefix_fields = nlohmann::json::parse(json_fields_prefix);
if (prefix_fields.is_object()) {
for (auto const& el : prefix_fields.items()) {
if(prefix_fields.is_object()) {
for(auto const &el : prefix_fields.items()) {
event["output_fields"][el.key()] = el.value();
}
}
for (auto const& ef : extra_fields)
{
for(auto const &ef : extra_fields) {
std::string fformat = ef.second.first;
if (fformat.size() == 0)
{
if(fformat.size() == 0) {
continue;
}
if (!(fformat[0] == '*'))
{
if(!(fformat[0] == '*')) {
fformat = "*" + fformat;
}
if(ef.second.second) // raw field
if(ef.second.second) // raw field
{
std::string json_field_map;
auto field_formatter = m_falco_engine->create_formatter(source, fformat);
field_formatter->tostring_withformat(evt, json_field_map, sinsp_evt_formatter::OF_JSON);
field_formatter->tostring_withformat(evt,
json_field_map,
sinsp_evt_formatter::OF_JSON);
auto json_obj = nlohmann::json::parse(json_field_map);
event["output_fields"][ef.first] = json_obj[ef.first];
} else
{
} else {
event["output_fields"][ef.first] = format_string(evt, fformat, source);
}
}
@@ -169,8 +158,9 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
return "INVALID_OUTPUT_FORMAT";
}
std::string falco_formats::format_string(sinsp_evt *evt, const std::string &format, const std::string &source) const
{
std::string falco_formats::format_string(sinsp_evt *evt,
const std::string &format,
const std::string &source) const {
std::string line;
std::shared_ptr<sinsp_evt_formatter> formatter;
@@ -180,14 +170,14 @@ std::string falco_formats::format_string(sinsp_evt *evt, const std::string &form
return line;
}
std::map<std::string, std::string> falco_formats::get_field_values(sinsp_evt *evt, const std::string &source,
const std::string &format) const
{
std::map<std::string, std::string> falco_formats::get_field_values(
sinsp_evt *evt,
const std::string &source,
const std::string &format) const {
std::shared_ptr<sinsp_evt_formatter> formatter;
std::string fformat = format;
if(fformat[0] != '*')
{
if(fformat[0] != '*') {
fformat = "*" + fformat;
}
@@ -195,8 +185,7 @@ std::map<std::string, std::string> falco_formats::get_field_values(sinsp_evt *ev
std::map<std::string, std::string> ret;
if (! formatter->get_field_values(evt, ret))
{
if(!formatter->get_field_values(evt, ret)) {
throw falco_exception("Could not extract all field values from event");
}