diff --git a/falco.yaml b/falco.yaml index 7e446b47..53235826 100644 --- a/falco.yaml +++ b/falco.yaml @@ -139,6 +139,22 @@ rules_file: - /etc/falco/falco_rules.local.yaml - /etc/falco/rules.d +# [Experimental] `rule_matching` +# +# Falco has to be performant when evaluating rules against events. To quickly +# understand which rules could trigger on a specific event, Falco maintains +# buckets of rules sharing the same event type in a map. Then, the lookup +# in each bucket is performed through linear search. The `rule_matching` +# configuration key's values are: +# - "first": when evaluating conditions of rules in a bucket, Falco will stop +# to evaluate rules if it finds a matching rules. Since rules are stored +# in buckets in the order they are defined in the rules files, this option +# could prevent other rules to trigger even if their condition is met, causing +# a shadowing problem. +# - "all": with this value Falco will continue evaluating all the rules +# stored in the bucket, so that multiple rules could be triggered upon one +# event. +rule_matching: first ################# # Falco plugins # diff --git a/userspace/engine/falco_common.cpp b/userspace/engine/falco_common.cpp index 0b437cc8..44b7a489 100644 --- a/userspace/engine/falco_common.cpp +++ b/userspace/engine/falco_common.cpp @@ -27,6 +27,11 @@ static std::vector priority_names = { "Debug" }; +static std::vector rule_matching_names = { + "first", + "all" +}; + bool falco_common::parse_priority(std::string v, priority_type& out) { for (size_t i = 0; i < priority_names.size(); i++) @@ -79,4 +84,17 @@ std::string falco_common::format_priority(priority_type v, bool shortfmt) throw falco_exception("Unknown priority enum value: " + std::to_string(v)); } return out; +} + +bool falco_common::parse_rule_matching(std::string v, rule_matching& out) +{ + for (size_t i = 0; i < rule_matching_names.size(); i++) + { + if (!strcasecmp(v.c_str(), rule_matching_names[i].c_str())) + { + out = (rule_matching) i; + return true; + } + } + return false; } \ No newline at end of file diff --git a/userspace/engine/falco_common.h b/userspace/engine/falco_common.h index 5a1e822f..6c63eec9 100644 --- a/userspace/engine/falco_common.h +++ b/userspace/engine/falco_common.h @@ -71,4 +71,12 @@ namespace falco_common priority_type parse_priority(std::string v); bool format_priority(priority_type v, std::string& out, bool shortfmt=false); std::string format_priority(priority_type v, bool shortfmt=false); + + enum rule_matching + { + FIRST = 0, + ALL = 1 + }; + + bool parse_rule_matching(std::string v, rule_matching& out); };