github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-16 06:48:31 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #98 from draios/add-lists

Browse Source 
Add list support to rules file.
This commit is contained in:
Mark Stemm
2016-07-11 16:05:29 -07:00
committed by GitHub
parent 022614a98d 502941b804
commit 8225dc0762
3 changed files with 94 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
userspace/falco/lua/compiler.lua
View File

@@ -156,7 +156,12 @@ function check_for_ignored_syscalls_events(ast, filter_type, source)
parser.traverse_ast(ast, "BinaryRelOp", cb)
end
function compiler.compile_macro(line)
function compiler.compile_macro(line, list_defs)
for name, items in pairs(list_defs) do
line = string.gsub(line, name, table.concat(items, ", "))
end
local ast, error_msg = parser.parse_filter(line)
if (error_msg) then
@@ -174,7 +179,12 @@ end
--[[
Parses a single filter, then expands macros using passed-in table of definitions. Returns resulting AST.
--]]
function compiler.compile_filter(source, macro_defs)
function compiler.compile_filter(source, macro_defs, list_defs)
for name, items in pairs(list_defs) do
source = string.gsub(source, name, table.concat(items, ", "))
end
local ast, error_msg = parser.parse_filter(source)
if (error_msg) then

25
userspace/falco/lua/rule_loader.lua
View File

@@ -115,7 +115,7 @@ end
-- object. The by_name index is used for things like describing rules,
-- and the by_idx index is used to map the relational node index back
-- to a rule.
local state = {macros={}, filter_ast=nil, rules_by_name={}, n_rules=0, rules_by_idx={}}
local state = {macros={}, lists={}, filter_ast=nil, rules_by_name={}, n_rules=0, rules_by_idx={}}
function load_rules(filename)
@@ -131,9 +131,28 @@ function load_rules(filename)
end
if (v['macro']) then
local ast = compiler.compile_macro(v['condition'])
local ast = compiler.compile_macro(v['condition'], state.lists)
state.macros[v['macro']] = ast.filter.value
elseif (v['list']) then
-- list items are represented in yaml as a native list, so no
-- parsing necessary
local items = {}
-- List items may be references to other lists, so go through
-- the items and expand any references to the items in the list
for i, item in ipairs(v['items']) do
if (state.lists[item] == nil) then
items[#items+1] = item
else
for i, exp_item in ipairs(state.lists[item]) do
items[#items+1] = exp_item
end
end
end
state.lists[v['list']] = items
else -- rule
if (v['rule'] == nil) then
@@ -150,7 +169,7 @@ function load_rules(filename)
v['level'] = priority(v['priority'])
state.rules_by_name[v['rule']] = v
local filter_ast = compiler.compile_filter(v['condition'], state.macros)
local filter_ast = compiler.compile_filter(v['condition'], state.macros, state.lists)
if (filter_ast.type == "Rule") then
state.n_rules = state.n_rules + 1