github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-03 07:34:53 +00:00
Code Issues Projects Releases Wiki Activity

Rules versioning (#492)

Browse Source 
* Add ability to print field names only

Add ability to print field names only instead of all information about
fields (description, etc) using -N cmdline option.

This will be used to add some versioning support steps that check for a
changed set of fields.

* Add an engine version that changes w/ filter flds

Add a method falco_engine::engine_version() that returns the current
engine version (e.g. set of supported fields, rules objects, operators,
etc.). It's defined in falco_engine_version.h, starts at 2 and should be
updated whenever a breaking change is made.

The most common reason for an engine change will be an update to the set
of filter fields. To make this easy to diagnose, add a build time check
that compares the sha256 output of "falco --list -N" against a value
that's embedded in falco_engine_version.h. A mismatch fails the build.

* Check engine version when loading rules

A rules file can now have a field "required_engine_version N". If
present, the number is compared to the falco engine version. If the
falco engine version is less, an error is thrown.

* Unit tests for engine versioning

Add a required version: 2 to one trace file to check the positive case
and add a new test that verifies that a too-new rules file won't be loaded.

* Rename falco test docker image

Rename sysdig/falco to falcosecurity/falco in unit tests.

* Don't pin falco_rules.yaml to an engine version

Currently, falco_rules.yaml is compatible with versions <= 0.13.1 other
than the required_engine_version object itself, so keep that line
commented out so users can use this rules file with older falco
versions.

We'll uncomment it with the first incompatible falco engine change.
This commit is contained in:
Mark Stemm
2019-01-29 12:43:15 -08:00
committed by GitHub
parent a78212cc62
commit 513cf2ed8b
16 changed files with 247 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
userspace/engine/falco_engine.cpp
View File

@@ -23,6 +23,7 @@ limitations under the License.
#include <fstream>
#include "falco_engine.h"
#include "falco_engine_version.h"
#include "config_falco_engine.h"
#include "formats.h"
@@ -76,6 +77,71 @@ falco_engine::~falco_engine()
}
}
uint32_t falco_engine::engine_version()
{
return (uint32_t) FALCO_ENGINE_VERSION;
}
#define DESCRIPTION_TEXT_START 16
#define CONSOLE_LINE_LEN 79
void falco_engine::list_fields(bool names_only)
{
for(auto &chk_field : json_factory().get_fields())
{
if(!names_only)
{
printf("\n----------------------\n");
printf("Field Class: %s (%s)\n\n", chk_field.name.c_str(), chk_field.desc.c_str());
}
for(auto &field : chk_field.fields)
{
uint32_t l, m;
printf("%s", field.name.c_str());
if(names_only)
{
printf("\n");
continue;
}
uint32_t namelen = field.name.size();
if(namelen >= DESCRIPTION_TEXT_START)
{
printf("\n");
namelen = 0;
}
for(l = 0; l < DESCRIPTION_TEXT_START - namelen; l++)
{
printf(" ");
}
size_t desclen = field.desc.size();
for(l = 0; l < desclen; l++)
{
if(l % (CONSOLE_LINE_LEN - DESCRIPTION_TEXT_START) == 0 && l != 0)
{
printf("\n");
for(m = 0; m < DESCRIPTION_TEXT_START; m++)
{
printf(" ");
}
}
printf("%c", field.desc.at(l));
}
printf("\n");
}
}
}
void falco_engine::load_rules(const string &rules_content, bool verbose, bool all_events)
{
// The engine must have been given an inspector by now.