github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-28 15:47:25 +00:00
Code Issues Projects Releases Wiki Activity

Add the new pmatch operator.

Browse Source 
Make changes to the lua-specific rule parser/compiler to handle the
pmatch operator.
This commit is contained in:
Mark Stemm 2016-09-22 14:57:43 -07:00
parent 889b252a3f
commit 930b38b894
3 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
userspace/engine/lua/compiler.lua
View File

@ -143,7 +143,7 @@ function check_for_ignored_syscalls_events(ast, filter_type, source)
(node.left.value == "evt.type" or
node.left.value == "syscall.type") then
if node.operator == "in" then
if node.operator == "in" or node.operator == "pmatch" then
for i, v in ipairs(node.right.elements) do
if v.type == "BareString" then
if node.left.value == "evt.type" then
@ -200,7 +200,7 @@ function get_evttypes(name, ast, source)
if found_not then
found_event_after_not = true
end
if node.operator == "in" then
if node.operator == "in" or node.operator == "pmatch" then
for i, v in ipairs(node.right.elements) do
if v.type == "BareString" then
evtnames[v.value] = 1

2
userspace/engine/lua/parser.lua
View File

@ -199,6 +199,7 @@ local G = {
RelationalExpression =
rel(terminal "FieldName", V"RelOp", V"Value") +
rel(terminal "FieldName", V"InOp", V"InList") +
rel(terminal "FieldName", V"PmatchOp", V"InList") +
V"PrimaryExp";
PrimaryExp = symb("(") * V"Filter" * symb(")");
@ -248,6 +249,7 @@ local G = {
symb("glob") / "glob" +
symb("startswith") / "startswith";
InOp = kw("in") / "in";
PmatchOp = kw("pmatch") / "pmatch";
UnaryBoolOp = kw("not") / "not";
ExistsOp = kw("exists") / "exists";

2
userspace/engine/lua/rule_loader.lua
View File

@ -72,7 +72,7 @@ local function install_filter(node, parent_bool_op)
filter.unnest() -- io.write(")")
elseif t == "BinaryRelOp" then
if (node.operator == "in") then
if (node.operator == "in" or node.operator == "pmatch") then
elements = map(function (el) return el.value end, node.right.elements)
filter.rel_expr(node.left.value, node.operator, elements, node.index)
else