github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-10-24 13:29:27 +00:00
Code Issues Projects Releases Wiki Activity

Add support for parsing "intersects" operator

Browse Source 
Related to the changes in https://github.com/draios/sysdig/pull/1501,
add support for an "intersects" operator that verifies if any of the
values in the rhs of an expression are found in the set of extracted
values.

For example:

  (a,b,c) in (a,b) is false, but (a,b,c) intersects (a,b) is true.

The code that implements CO_INTERSECTS is in a different commit.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm
2019-09-09 15:51:14 -07:00
committed by Leo Di Donato
parent 6019320f9d
commit b6fec781b7
3 changed files with 16 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
userspace/engine/lua/parser.lua
View File

@@ -192,8 +192,7 @@ local G = {
RelationalExpression =
rel(terminal "FieldName", V"RelOp", V"Value") +
rel(terminal "FieldName", V"InOp", V"InList") +
rel(terminal "FieldName", V"PmatchOp", V"InList") +
rel(terminal "FieldName", V"SetOp", V"InList") +
V"PrimaryExp";
PrimaryExp = symb("(") * V"Filter" * symb(")");
@@ -214,8 +213,9 @@ local G = {
Identifier = V"idStart" * V"idRest"^0;
Macro = V"idStart" * V"idRest"^0 * -P".";
Int = digit^1;
PathString = (alnum + S'.-_/*?')^1;
Index = V"Int" + V"PathString";
PathString = (alnum + S',.-_/*?')^1;
PortRangeString = (V"Int" + S":,")^1;
Index = V"PortRangeString" + V"Int" + V"PathString";
FieldName = V"Identifier" * (P"." + V"Identifier")^1 * (P"[" * V"Index" * P"]")^-1;
Name = C(V"Identifier") * -V"idRest";
Hex = (P("0x") + P("0X")) * xdigit^1;
@@ -243,8 +243,9 @@ local G = {
symb("glob") / "glob" +
symb("startswith") / "startswith" +
symb("endswith") / "endswith";
InOp = kw("in") / "in";
PmatchOp = kw("pmatch") / "pmatch";
SetOp = kw("in") / "in" +
kw("intersects") / "intersects" +
kw("pmatch") / "pmatch";
UnaryBoolOp = kw("not") / "not";
ExistsOp = kw("exists") / "exists";