mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-12 11:32:39 +00:00
Lua parser refactoring
Move compiler loading out of libsinsp/lua_parser.cpp and into a new class in digwatch/rules.cpp. This way the libsinsp support is strictly about providing a lua API for scripts to setup filters. Loading the actual parser and rules is logic that belongs in the app (digwatch in this case, maybe sysdig down the line) rather than there.
This commit is contained in:
parent
c63657acad
commit
9899680064
@ -33,6 +33,9 @@ add_subdirectory(${SYSDIG_DIR} ${PROJECT_BINARY_DIR}/sysdig)
|
|||||||
set(CURL_BUNDLE_DIR "${sysdig_BINARY_DIR}/curl-prefix/src/curl")
|
set(CURL_BUNDLE_DIR "${sysdig_BINARY_DIR}/curl-prefix/src/curl")
|
||||||
set(CURL_INCLUDE_DIR "${CURL_BUNDLE_DIR}/include/")
|
set(CURL_INCLUDE_DIR "${CURL_BUNDLE_DIR}/include/")
|
||||||
set(CURL_LIBRARIES "${CURL_BUNDLE_DIR}/lib/.libs/libcurl.a")
|
set(CURL_LIBRARIES "${CURL_BUNDLE_DIR}/lib/.libs/libcurl.a")
|
||||||
|
|
||||||
|
set(LUAJIT_INCLUDE_DIR "${sysdig_BINARY_DIR}/luajit-prefix/src/luajit/src")
|
||||||
|
|
||||||
if(NOT USE_BUNDLED_OPENSSL)
|
if(NOT USE_BUNDLED_OPENSSL)
|
||||||
set(CURL_SSL_OPTION "")
|
set(CURL_SSL_OPTION "")
|
||||||
else()
|
else()
|
||||||
|
@ -1,4 +1,5 @@
|
|||||||
include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp/third-party/jsoncpp)
|
include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp/third-party/jsoncpp)
|
||||||
|
include_directories("${LUAJIT_INCLUDE_DIR}")
|
||||||
|
|
||||||
if(NOT APPLE)
|
if(NOT APPLE)
|
||||||
include_directories("${CURL_INCLUDE_DIR}")
|
include_directories("${CURL_INCLUDE_DIR}")
|
||||||
@ -8,7 +9,7 @@ endif()
|
|||||||
include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libscap)
|
include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libscap)
|
||||||
include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp)
|
include_directories(${PROJECT_SOURCE_DIR}/../sysdig/userspace/libsinsp)
|
||||||
|
|
||||||
add_executable(digwatch digwatch.cpp)
|
add_executable(digwatch rules.cpp digwatch.cpp)
|
||||||
|
|
||||||
target_link_libraries(digwatch sinsp)
|
target_link_libraries(digwatch sinsp)
|
||||||
|
|
||||||
|
@ -8,15 +8,13 @@
|
|||||||
#include <algorithm>
|
#include <algorithm>
|
||||||
|
|
||||||
#include <sinsp.h>
|
#include <sinsp.h>
|
||||||
#include "lua_parser.h"
|
#include "rules.h"
|
||||||
#include "digwatch.h"
|
#include "digwatch.h"
|
||||||
#include "utils.h"
|
#include "utils.h"
|
||||||
|
|
||||||
#include <unistd.h>
|
#include <unistd.h>
|
||||||
#include <getopt.h>
|
#include <getopt.h>
|
||||||
|
|
||||||
lua_parser* g_lua_parser;
|
|
||||||
|
|
||||||
static void usage();
|
static void usage();
|
||||||
|
|
||||||
//
|
//
|
||||||
@ -127,6 +125,7 @@ int digwatch_init(int argc, char **argv)
|
|||||||
{
|
{
|
||||||
int result;
|
int result;
|
||||||
sinsp* inspector = NULL;
|
sinsp* inspector = NULL;
|
||||||
|
digwatch_rules* rules = NULL;
|
||||||
int op;
|
int op;
|
||||||
uint64_t cnt = -1;
|
uint64_t cnt = -1;
|
||||||
sinsp_evt::param_fmt event_buffer_format = sinsp_evt::PF_NORMAL;
|
sinsp_evt::param_fmt event_buffer_format = sinsp_evt::PF_NORMAL;
|
||||||
@ -234,9 +233,9 @@ int digwatch_init(int argc, char **argv)
|
|||||||
//
|
//
|
||||||
sinsp_evt_formatter formatter(inspector, output_format);
|
sinsp_evt_formatter formatter(inspector, output_format);
|
||||||
|
|
||||||
g_lua_parser = new lua_parser(inspector, user_parser);
|
rules = new digwatch_rules(inspector, user_parser);
|
||||||
|
|
||||||
inspector->set_filter(g_lua_parser->m_filter);
|
inspector->set_filter(rules->get_filter());
|
||||||
inspector->open("");
|
inspector->open("");
|
||||||
|
|
||||||
cinfo = do_inspect(inspector,
|
cinfo = do_inspect(inspector,
|
||||||
|
45
userspace/digwatch/rules.cpp
Normal file
45
userspace/digwatch/rules.cpp
Normal file
@ -0,0 +1,45 @@
|
|||||||
|
#include "rules.h"
|
||||||
|
|
||||||
|
extern "C" {
|
||||||
|
#include "lua.h"
|
||||||
|
#include "lualib.h"
|
||||||
|
#include "lauxlib.h"
|
||||||
|
}
|
||||||
|
|
||||||
|
digwatch_rules::digwatch_rules(sinsp* inspector, string compiler_filename)
|
||||||
|
{
|
||||||
|
m_lua_parser = new lua_parser(inspector);
|
||||||
|
m_ls = m_lua_parser->m_ls;
|
||||||
|
|
||||||
|
trim(compiler_filename);
|
||||||
|
|
||||||
|
ifstream is;
|
||||||
|
is.open(compiler_filename);
|
||||||
|
if(!is.is_open())
|
||||||
|
{
|
||||||
|
throw sinsp_exception("can't open file " + compiler_filename);
|
||||||
|
}
|
||||||
|
|
||||||
|
string scriptstr((istreambuf_iterator<char>(is)),
|
||||||
|
istreambuf_iterator<char>());
|
||||||
|
|
||||||
|
//
|
||||||
|
// Load the compiler script
|
||||||
|
//
|
||||||
|
if(luaL_loadstring(m_ls, scriptstr.c_str()) || lua_pcall(m_ls, 0, 0, 0))
|
||||||
|
{
|
||||||
|
throw sinsp_exception("Failed to load script " +
|
||||||
|
compiler_filename + ": " + lua_tostring(m_ls, -1));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
sinsp_filter* digwatch_rules::get_filter()
|
||||||
|
{
|
||||||
|
return m_lua_parser->get_filter();
|
||||||
|
}
|
||||||
|
|
||||||
|
digwatch_rules::~digwatch_rules()
|
||||||
|
{
|
||||||
|
delete m_lua_parser;
|
||||||
|
}
|
||||||
|
|
17
userspace/digwatch/rules.h
Normal file
17
userspace/digwatch/rules.h
Normal file
@ -0,0 +1,17 @@
|
|||||||
|
#pragma once
|
||||||
|
|
||||||
|
#include "sinsp.h"
|
||||||
|
#include "lua_parser.h"
|
||||||
|
|
||||||
|
class digwatch_rules
|
||||||
|
{
|
||||||
|
public:
|
||||||
|
digwatch_rules(sinsp* inspector, string compiler_filename);
|
||||||
|
~digwatch_rules();
|
||||||
|
void load(string rules_filename);
|
||||||
|
sinsp_filter* get_filter();
|
||||||
|
|
||||||
|
private:
|
||||||
|
lua_parser* m_lua_parser;
|
||||||
|
lua_State* m_ls;
|
||||||
|
};
|
Loading…
Reference in New Issue
Block a user