github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-10 02:28:03 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): adapt engine classes to new libsinsp event definitions

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2023-02-17 11:17:37 +00:00 committed by poiana
parent 34ea7a8245
commit 6c38ecaf0e
4 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
userspace/engine/evttype_index_ruleset.cpp
View File

@ -15,7 +15,6 @@ limitations under the License.
*/ */
#include "evttype_index_ruleset.h" #include "evttype_index_ruleset.h"
#include "filter_evttype_resolver.h"
#include "banned.h" // This raises a compilation error when certain functions are used #include "banned.h" // This raises a compilation error when certain functions are used
#include <algorithm> #include <algorithm>
@ -145,7 +144,10 @@ void evttype_index_ruleset::ruleset_filters::evttypes_for_ruleset(std::set<uint1
for(auto &wrap : m_filters) for(auto &wrap : m_filters)
{ {
evttypes.insert(wrap->evttypes.begin(), wrap->evttypes.end()); for (const auto& e : wrap->evttypes)
{
evttypes.insert((uint16_t) e);
}
} }
} }
@ -161,12 +163,11 @@ void evttype_index_ruleset::add(
wrap->filter = filter; wrap->filter = filter;
if(rule.source == falco_common::syscall_source) if(rule.source == falco_common::syscall_source)
{ {
filter_evttype_resolver resolver; wrap->evttypes = libsinsp::filter::ast::ppm_event_codes(condition.get());
resolver.evttypes(condition, wrap->evttypes);
} }
else else
{ {
wrap->evttypes = { ppm_event_type::PPME_PLUGINEVENT_E }; wrap->evttypes = { ppm_event_code::PPME_PLUGINEVENT_E };
} }
m_filters.insert(wrap); m_filters.insert(wrap);
} }

2
userspace/engine/evttype_index_ruleset.h
View File

@ -93,7 +93,7 @@ private:
struct filter_wrapper struct filter_wrapper
{ {
falco_rule rule; falco_rule rule;
std::set<uint16_t> evttypes; libsinsp::events::set<ppm_event_code> evttypes;
std::shared_ptr<gen_event_filter> filter; std::shared_ptr<gen_event_filter> filter;
}; };

2
userspace/engine/json_evt.h
View File

@ -48,7 +48,7 @@ public:
inline uint16_t get_type() const inline uint16_t get_type() const
{ {
// All k8s audit events have the single tag "1". - see falco_engine::process_k8s_audit_event // All k8s audit events have the single tag "1". - see falco_engine::process_k8s_audit_event
return ppm_event_type::PPME_PLUGINEVENT_E; return ppm_event_code::PPME_PLUGINEVENT_E;
} }
protected: protected:

6
userspace/engine/rule_loader_compiler.cpp
View File

@ -21,7 +21,6 @@ limitations under the License.
#include "rule_loader_compiler.h" #include "rule_loader_compiler.h"
#include "filter_macro_resolver.h" #include "filter_macro_resolver.h"
#include "filter_evttype_resolver.h"
#include "filter_warning_resolver.h" #include "filter_warning_resolver.h"
#define MAX_VISIBILITY ((uint32_t) -1) #define MAX_VISIBILITY ((uint32_t) -1)
@ -496,11 +495,10 @@ void rule_loader::compiler::compile_rule_infos(
} }
// populate set of event types and emit an special warning // populate set of event types and emit an special warning
std::set<uint16_t> evttypes = { ppm_event_type::PPME_PLUGINEVENT_E }; libsinsp::events::set<ppm_event_code> evttypes = { ppm_event_code::PPME_PLUGINEVENT_E };
if(rule.source == falco_common::syscall_source) if(rule.source == falco_common::syscall_source)
{ {
evttypes.clear(); evttypes = libsinsp::filter::ast::ppm_event_codes(ast.get());
filter_evttype_resolver().evttypes(ast, evttypes);
if ((evttypes.empty() || evttypes.size() > 100) if ((evttypes.empty() || evttypes.size() > 100)
&& r.warn_evttypes) && r.warn_evttypes)
{ {