From a371a995b4dd97f9e69decd25b643b090fb8f846 Mon Sep 17 00:00:00 2001 From: Jason Dellaluce Date: Tue, 4 Jan 2022 13:29:56 +0000 Subject: [PATCH] update(outputs): adapt grpc output to new protobuf definitions Signed-off-by: Jason Dellaluce --- userspace/falco/outputs_grpc.cpp | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/userspace/falco/outputs_grpc.cpp b/userspace/falco/outputs_grpc.cpp index ed024223..3177f7af 100644 --- a/userspace/falco/outputs_grpc.cpp +++ b/userspace/falco/outputs_grpc.cpp @@ -33,13 +33,20 @@ void falco::outputs::output_grpc::output(const message *msg) auto r = grpc_res.mutable_rule(); *r = msg->rule; - // source + // source_deprecated (maintained for backward compatibility) + // Setting this as reserved would cause old clients to receive the + // 0-index enum element, which is the SYSCALL source in our case. + // This can be misleading for clients with an old version of the + // protobuf, so for now we deprecate the field and add a new PLUGIN + // enum entry instead. + // todo(jasondellaluce): remove source_deprecated and reserve its number falco::schema::source s = falco::schema::source::SYSCALL; if(!falco::schema::source_Parse(msg->source, &s)) { - throw falco_exception("Unknown source passed to output_grpc::output()"); + // unknown source names are expected to come from plugins + s = falco::schema::source::PLUGIN; } - grpc_res.set_source(s); + grpc_res.set_source_deprecated(s); // priority falco::schema::priority p = falco::schema::priority::EMERGENCY; @@ -68,5 +75,9 @@ void falco::outputs::output_grpc::output(const message *msg) auto tags = grpc_res.mutable_tags(); *tags = {msg->tags.begin(), msg->tags.end()}; + // source + auto source = grpc_res.mutable_source(); + *source = msg->source; + falco::grpc::queue::get().push(grpc_res); } \ No newline at end of file