mirror of
https://github.com/falcosecurity/falco.git
synced 2025-06-27 23:27:20 +00:00
chore(userspace/falco): remove lua code for outputs
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
This commit is contained in:
Leonardo Grasso
poiana
parent
85aa337b63
commit
ac2a9a35cb
1
userspace/falco/lua/.gitignore
vendored
1
userspace/falco/lua/.gitignore
vendored
@ -1 +0,0 @@
|
||||
lyaml*
|
||||
@ -1,271 +0,0 @@
|
||||
-- Copyright (C) 2019 The Falco Authors.
|
||||
--
|
||||
-- Licensed under the Apache License, Version 2.0 (the "License");
|
||||
-- you may not use this file except in compliance with the License.
|
||||
-- You may obtain a copy of the License at
|
||||
--
|
||||
-- http://www.apache.org/licenses/LICENSE-2.0
|
||||
--
|
||||
-- Unless required by applicable law or agreed to in writing, software
|
||||
-- distributed under the License is distributed on an "AS IS" BASIS,
|
||||
-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
-- See the License for the specific language governing permissions and
|
||||
-- limitations under the License.
|
||||
--
|
||||
|
||||
local mod = {}
|
||||
|
||||
local outputs = {}
|
||||
|
||||
function mod.stdout(event, rule, source, priority, priority_num, msg, format, hostname, options)
|
||||
mod.stdout_message(priority, priority_num, msg, options)
|
||||
end
|
||||
|
||||
function mod.stdout_message(priority, priority_num, msg, options)
|
||||
if options.buffered == 0 then
|
||||
io.stdout:setvbuf "no"
|
||||
end
|
||||
print(msg)
|
||||
end
|
||||
|
||||
function mod.stdout_cleanup()
|
||||
io.stdout:flush()
|
||||
end
|
||||
|
||||
-- Note: not actually closing/reopening stdout
|
||||
function mod.stdout_reopen(options)
|
||||
end
|
||||
|
||||
function mod.file_validate(options)
|
||||
if (not type(options.filename) == "string") then
|
||||
error("File output needs to be configured with a valid filename")
|
||||
end
|
||||
|
||||
local file, err = io.open(options.filename, "a+")
|
||||
if file == nil then
|
||||
error("Error with file output: " .. err)
|
||||
end
|
||||
file:close()
|
||||
end
|
||||
|
||||
function mod.file_open(options)
|
||||
if ffile == nil then
|
||||
ffile = io.open(options.filename, "a+")
|
||||
if options.buffered == 0 then
|
||||
ffile:setvbuf "no"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
function mod.file(event, rule, source, priority, priority_num, msg, format, hostname, options)
|
||||
mod.file_message(priority, priority_num, msg, options)
|
||||
end
|
||||
|
||||
function mod.file_message(priority, priority_num, msg, options)
|
||||
if options.keep_alive == "true" then
|
||||
mod.file_open(options)
|
||||
else
|
||||
ffile = io.open(options.filename, "a+")
|
||||
end
|
||||
|
||||
ffile:write(msg, "\n")
|
||||
|
||||
if options.keep_alive == nil or options.keep_alive ~= "true" then
|
||||
ffile:close()
|
||||
ffile = nil
|
||||
end
|
||||
end
|
||||
|
||||
function mod.file_cleanup()
|
||||
if ffile ~= nil then
|
||||
ffile:flush()
|
||||
ffile:close()
|
||||
ffile = nil
|
||||
end
|
||||
end
|
||||
|
||||
function mod.file_reopen(options)
|
||||
if options.keep_alive == "true" then
|
||||
mod.file_cleanup()
|
||||
mod.file_open(options)
|
||||
end
|
||||
end
|
||||
|
||||
function mod.syslog(event, rule, source, priority, priority_num, msg, format, hostname, options)
|
||||
mod.syslog_message(priority, priority_num, msg, options)
|
||||
end
|
||||
|
||||
function mod.syslog_message(priority, priority_num, msg, options)
|
||||
falco.syslog(priority_num, msg)
|
||||
end
|
||||
|
||||
function mod.syslog_cleanup()
|
||||
end
|
||||
|
||||
function mod.syslog_reopen()
|
||||
end
|
||||
|
||||
function mod.program_open(options)
|
||||
if pfile == nil then
|
||||
pfile = io.popen(options.program, "w")
|
||||
if options.buffered == 0 then
|
||||
pfile:setvbuf "no"
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
function mod.program(event, rule, source, priority, priority_num, msg, format, hostname, options)
|
||||
mod.program_message(priority, priority_num, msg, options)
|
||||
end
|
||||
|
||||
function mod.program_message(priority, priority_num, msg, options)
|
||||
-- XXX Ideally we'd check that the program ran
|
||||
-- successfully. However, the luajit we're using returns true even
|
||||
-- when the shell can't run the program.
|
||||
|
||||
-- Note: options are all strings
|
||||
if options.keep_alive == "true" then
|
||||
mod.program_open(options)
|
||||
else
|
||||
pfile = io.popen(options.program, "w")
|
||||
end
|
||||
|
||||
pfile:write(msg, "\n")
|
||||
|
||||
if options.keep_alive == nil or options.keep_alive ~= "true" then
|
||||
pfile:close()
|
||||
pfile = nil
|
||||
end
|
||||
end
|
||||
|
||||
function mod.program_cleanup()
|
||||
if pfile ~= nil then
|
||||
pfile:flush()
|
||||
pfile:close()
|
||||
pfile = nil
|
||||
end
|
||||
end
|
||||
|
||||
function mod.program_reopen(options)
|
||||
if options.keep_alive == "true" then
|
||||
mod.program_cleanup()
|
||||
mod.program_open(options)
|
||||
end
|
||||
end
|
||||
|
||||
function mod.http(event, rule, source, priority, priority_num, msg, format, hostname, options)
|
||||
mod.http_message(priority, priority_num, msg, options)
|
||||
end
|
||||
|
||||
function mod.http_message(priority, priority_num, msg, options)
|
||||
c_outputs.handle_http(options.url, msg)
|
||||
end
|
||||
|
||||
function mod.http_cleanup()
|
||||
end
|
||||
|
||||
function mod.http_reopen()
|
||||
end
|
||||
|
||||
function mod.grpc(event, rule, source, priority, priority_num, msg, format, hostname, options)
|
||||
fields = formats.resolve_tokens(event, source, format)
|
||||
c_outputs.handle_grpc(event, rule, source, priority, msg, fields, hostname, options)
|
||||
end
|
||||
|
||||
function mod.grpc_message(priority, priority_num, msg, options)
|
||||
-- todo(fntlnz, leodido) > gRPC does not support subscribing to dropped events yet
|
||||
end
|
||||
|
||||
|
||||
function mod.grpc_cleanup()
|
||||
end
|
||||
|
||||
function mod.grpc_reopen()
|
||||
end
|
||||
|
||||
function output_event(event, rule, source, priority, priority_num, format, hostname)
|
||||
-- If format starts with a *, remove it, as we're adding our own
|
||||
-- prefix here.
|
||||
if format:sub(1, 1) == "*" then
|
||||
format = format:sub(2)
|
||||
end
|
||||
|
||||
-- time_format_iso_8601 will be the same for all output channels
|
||||
time_format_iso_8601 = 0
|
||||
|
||||
for index, o in ipairs(outputs) do
|
||||
time_format_iso_8601 = o.options.time_format_iso_8601
|
||||
break
|
||||
end
|
||||
|
||||
if source == "syscall" then
|
||||
if time_format_iso_8601 == 1 then
|
||||
format = "*%evt.time.iso8601: " .. priority .. " " .. format
|
||||
else
|
||||
format = "*%evt.time: " .. priority .. " " .. format
|
||||
end
|
||||
else
|
||||
if time_format_iso_8601 == 1 then
|
||||
format = "*%jevt.time.iso8601: " .. priority .. " " .. format
|
||||
else
|
||||
format = "*%jevt.time: " .. priority .. " " .. format
|
||||
end
|
||||
end
|
||||
|
||||
msg = formats.format_event(event, rule, source, priority, format)
|
||||
|
||||
for index, o in ipairs(outputs) do
|
||||
o.output(event, rule, source, priority, priority_num, msg, format, hostname, o.options)
|
||||
end
|
||||
end
|
||||
|
||||
function output_msg(msg, priority, priority_num)
|
||||
for index, o in ipairs(outputs) do
|
||||
o.message(priority, priority_num, msg, o.options)
|
||||
end
|
||||
end
|
||||
|
||||
function output_cleanup()
|
||||
formats.free_formatters()
|
||||
for index, o in ipairs(outputs) do
|
||||
o.cleanup()
|
||||
end
|
||||
end
|
||||
|
||||
function output_reopen()
|
||||
for index, o in ipairs(outputs) do
|
||||
o.reopen(o.options)
|
||||
end
|
||||
end
|
||||
|
||||
function add_output(output_name, buffered, time_format_iso_8601, options)
|
||||
if not (type(mod[output_name]) == "function") then
|
||||
error("rule_loader.add_output(): invalid output_name: " .. output_name)
|
||||
end
|
||||
|
||||
-- outputs can optionally define a validation function so that we don't
|
||||
-- find out at runtime (when an event finally matches a rule!) that the options are invalid
|
||||
if (type(mod[output_name .. "_validate"]) == "function") then
|
||||
mod[output_name .. "_validate"](options)
|
||||
end
|
||||
|
||||
if options == nil then
|
||||
options = {}
|
||||
end
|
||||
|
||||
options.buffered = buffered
|
||||
options.time_format_iso_8601 = time_format_iso_8601
|
||||
|
||||
table.insert(
|
||||
outputs,
|
||||
{
|
||||
output = mod[output_name],
|
||||
cleanup = mod[output_name .. "_cleanup"],
|
||||
reopen = mod[output_name .. "_reopen"],
|
||||
message = mod[output_name .. "_message"],
|
||||
options = options
|
||||
}
|
||||
)
|
||||
end
|
||||
|
||||
return mod
|
||||
@ -1,44 +0,0 @@
|
||||
-- Copyright (C) 2019 The Falco Authors.
|
||||
--
|
||||
-- Licensed under the Apache License, Version 2.0 (the "License");
|
||||
-- you may not use this file except in compliance with the License.
|
||||
-- You may obtain a copy of the License at
|
||||
--
|
||||
-- http://www.apache.org/licenses/LICENSE-2.0
|
||||
--
|
||||
-- Unless required by applicable law or agreed to in writing, software
|
||||
-- distributed under the License is distributed on an "AS IS" BASIS,
|
||||
-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
-- See the License for the specific language governing permissions and
|
||||
-- limitations under the License.
|
||||
--
|
||||
|
||||
local parser = require "parser"
|
||||
|
||||
if #arg ~= 1 then
|
||||
print("Usage: test.lua <string>")
|
||||
os.exit(1)
|
||||
end
|
||||
|
||||
local macros = {}
|
||||
local ast
|
||||
|
||||
local function doit(line)
|
||||
ast = parser.parse_filter(line)
|
||||
|
||||
if not ast then
|
||||
print("error", error_msg)
|
||||
os.exit(1)
|
||||
end
|
||||
|
||||
end
|
||||
for str in string.gmatch(arg[1], "([^;]+)") do
|
||||
doit(str)
|
||||
end
|
||||
|
||||
if (ast and ast.type) then
|
||||
parser.print_ast(ast)
|
||||
end
|
||||
|
||||
os.exit(0)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user