github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-23 19:07:55 +00:00
Code Issues Projects Releases Wiki Activity

Grammar support for priorities

Browse Source
This commit is contained in:
Henri DF
2016-03-29 21:35:07 -07:00
parent 7fcd0b98a0
commit 6158168a97
1 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
userspace/digwatch/lua/compiler.lua
View File

@@ -155,6 +155,18 @@ end
-- grammar -- grammar
local function normalize_level(level)
valid_levels = {"emergency", "alert", "critical", "error", "warning", "notice", "informational", "debug"}
level = string.lower(level)
for i,v in ipairs(valid_levels) do
if (string.find(v, "^"..level)) then
return v
end
end
error("Invalid severity level: "..level)
end
local function filter(e) local function filter(e)
return {type = "Filter", value=e} return {type = "Filter", value=e}
end end
@@ -163,12 +175,12 @@ local function macro (name, filter)
return {type = "MacroDef", name = name, value = filter} return {type = "MacroDef", name = name, value = filter}
end end
local function outputformat (format) local function outputformat (level, format)
return {type = "OutputFormat", value = format} return {type = "OutputFormat", level = normalize_level(level), value = format}
end end
local function functioncall (str, mname, fname, args) local function functioncall (level, str, mname, fname, args)
return {type = "FunctionCall", mname = mname, fname = fname, arguments = args, source = str} return {type = "FunctionCall", level = normalize_level(level), mname = mname, fname = fname, arguments = args, source = str}
end end
local function rule(filter, output) local function rule(filter, output)
@@ -217,7 +229,7 @@ local G = {
MacroDef = (C(V"Macro") * V"Skip" * V"Colon" * (V"Filter")); MacroDef = (C(V"Macro") * V"Skip" * V"Colon" * (V"Filter"));
FuncArgs = symb("(") * list(V"Value", symb(",")) * symb(")"); FuncArgs = symb("(") * list(V"Value", symb(",")) * symb(")");
Output = (C(V"Name" * P(".") * V"Name" * V"FuncArgs") / functioncall) + P(1)^0 / outputformat; Output = (C(V"Identifier") * V"Skip" * C(V"Name" * P(".") * V"Name" * V"FuncArgs") / functioncall) + (C(V"Identifier") * V"Skip" * C(P(1)^0) / outputformat);
-- Terminals -- Terminals
Value = terminal "Number" + terminal "String" + terminal "BareString"; Value = terminal "Number" + terminal "String" + terminal "BareString";