github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-05 08:40:52 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/falco): distinguish between sinsp and json events when resolving tokens

Browse Source 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato
2019-09-23 14:13:25 +00:00
committed by Leo Di Donato
parent 944b46cb67
commit 54b3aa9129
3 changed files with 50 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
userspace/engine/formats.cpp
View File

@@ -20,7 +20,6 @@ limitations under the License.
#include <json/json.h>
#include "formats.h"
#include "logger.h"
#include "falco_engine.h"
@@ -266,31 +265,46 @@ int falco_formats::format_event (lua_State *ls)
return 1;
}
#include <iostream>
int falco_formats::resolve_tokens(lua_State *ls)
{
if (!lua_isuserdata(ls, 1) ||
!lua_isstring(ls, 2)) {
lua_pushstring(ls, "Invalid arguments passed to resolve_tokens()");
lua_error(ls);
}
gen_event* evt = (gen_event*) lua_topointer(ls, 1);
const char *format = (char *) lua_tostring(ls, 2);
// if(!lua_isstring(ls, -1) ||
// !lua_isstring(ls, -2) ||
// !lua_islightuserdata(ls, -3))
// {
// lua_pushstring(ls, "Invalid arguments passed to resolve_tokens()");
// lua_error(ls);
// }
gen_event *evt = (gen_event *)lua_topointer(ls, 1);
string source = luaL_checkstring(ls, 2);
const char *format = (char *)lua_tostring(ls, 3);
string sformat = format;
map<string,string> values;
s_formatters->resolve_tokens((sinsp_evt *)evt, sformat, values);
map<string, string> values;
if(source == "syscall")
{
s_formatters->resolve_tokens((sinsp_evt *)evt, sformat, values);
}
// k8s_audit
else
{
json_event_formatter json_formatter(s_engine->json_factory(), sformat);
values = json_formatter.tomap((json_event*) evt);
}
lua_newtable(ls);
int top = lua_gettop(ls);
for (std::map<string, string>::iterator it = values.begin(); it != values.end(); ++it) {
const char* key = it->first.c_str();
const char* value = it->second.c_str();
for(map<string, string>::iterator it = values.begin(); it != values.end(); ++it)
{
std::cout << it->first << ":"<< it->second << ", ";
const char *key = it->first.c_str();
const char *value = it->second.c_str();
lua_pushlstring(ls, key, it->first.size());
lua_pushlstring(ls, value, it->second.size());
lua_settable(ls, top);
}
std::cout << std::endl;
return 1;
}

20
userspace/falco/falco_outputs.cpp
View File

@@ -306,16 +306,16 @@ int falco_outputs::handle_http(lua_State *ls)
int falco_outputs::handle_grpc(lua_State *ls)
{
// check parameters
if(!lua_isuserdata(ls, 1) ||
!lua_isstring(ls, 2) ||
!lua_isstring(ls, 3) ||
!lua_isstring(ls, 4) ||
!lua_isstring(ls, 5) ||
!lua_istable(ls, 6))
{
lua_pushstring(ls, "Invalid arguments passed to handle_grpc()");
lua_error(ls);
}
// if(!lua_isuserdata(ls, 1) ||
// !lua_isstring(ls, 2) ||
// !lua_isstring(ls, 3) ||
// !lua_isstring(ls, 4) ||
// !lua_isstring(ls, 5) ||
// !lua_istable(ls, 6))
// {
// lua_pushstring(ls, "Invalid arguments passed to handle_grpc()");
// lua_error(ls);
// }
response grpc_res = response();

13
userspace/falco/lua/output.lua
View File

@@ -170,7 +170,7 @@ function mod.http_reopen()
end
function mod.grpc(event, rule, source, priority, priority_num, msg, format, options)
fields = formats.resolve_tokens(event, format)
fields = formats.resolve_tokens(event, source, format)
c_outputs.handle_grpc(event, rule, source, priority, msg, fields, options)
end
@@ -178,6 +178,7 @@ function mod.grpc_message(priority, priority_num, msg, options)
-- todo
end
function mod.grpc_cleanup()
end
@@ -215,6 +216,16 @@ function output_event(event, rule, source, priority, priority_num, format)
msg = formats.format_event(event, rule, source, priority, format)
print("---")
print(event)
print(rule)
print(source)
print(priority)
print(priority_num)
print(msg)
print(format)
print("---")
for index, o in ipairs(outputs) do
o.output(event, rule, source, priority, priority_num, msg, format, o.options)
end