github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-31 22:16:49 +00:00
Code Issues Projects Releases Wiki Activity

Grammar: parse array lookup in fields

Browse Source
This commit is contained in:
Henri DF 2016-02-28 13:20:35 -08:00
parent e75041c4b9
commit 96942f8034
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
userspace/digwatch/lua/compiler.lua
View File

@ -225,7 +225,7 @@ local G = {
idRest = alnum + P("_");
Identifier = V"idStart" * V"idRest"^0;
Macro = V"idStart" * V"idRest"^0 * -P".";
FieldName = V"Identifier" * (P"." + V"Identifier")^1;
FieldName = V"Identifier" * (P"." + V"Identifier")^1 * (P"[" * V"Int" * P"]")^-1;
Name = C(V"Identifier") * -V"idRest";
Hex = (P("0x") + P("0X")) * xdigit^1;
Expo = S("eE") * S("+-")^-1 * digit^1;
@ -374,7 +374,7 @@ function expand_macros(ast, defs, changed)
if (ast.right.type == "Macro") then
if (defs[ast.right.value] == nil) then
error("Undefined macro ".. ast.right.value .. "used in filter.")
error("Undefined macro ".. ast.right.value .. " used in filter.")
end
ast.right = copy(defs[ast.right.value])
changed = true
@ -387,7 +387,7 @@ function expand_macros(ast, defs, changed)
elseif ast.type == "UnaryBoolOp" then
if (ast.argument.type == "Macro") then
if (defs[ast.argument.value] == nil) then
error("Undefined macro ".. ast.argument.value .. "used in filter.")
error("Undefined macro ".. ast.argument.value .. " used in filter.")
end
ast.argument = copy(defs[ast.argument.value])
changed = true

4
userspace/digwatch/lua/smoke.sh
View File

@ -60,6 +60,10 @@ good "a.b = a.a"
good "a.b = a.a |"
good "a.b = a.a | %evt.type %fd.num blabla"
good "evt.arg[0] contains /bin"
bad "evt.arg[a] contains /bin"
bad "evt.arg[] contains /bin"
bad "a.g in ()"
bad "a.b = b = 1"
bad "(a.b = 1"