update: license headers

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
This commit is contained in:
Lorenzo Fontana
2019-10-08 11:53:07 +02:00
committed by Leo Di Donato
parent 0043c4937b
commit c76518c681
142 changed files with 317 additions and 536 deletions

View File

@@ -1,7 +1,6 @@
#
# Copyright (C) 2016-2018 Draios Inc dba Sysdig.
# Copyright (C) 2019 The Falco Authors.
#
# This file is part of falco .
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <fstream>

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <cstdlib>

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
// Gen filtering TODO

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
// The version of rules/filter fields/etc supported by this falco

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <json/json.h>

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2018 Draios inc.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <ctype.h>

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2018 Draios inc.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once
@@ -62,19 +59,22 @@ protected:
class json_event_filter_check : public gen_event_filter_check
{
public:
enum index_mode {
enum index_mode
{
IDX_REQUIRED,
IDX_ALLOWED,
IDX_NONE
};
enum index_type {
enum index_type
{
IDX_KEY,
IDX_NUMERIC
};
// A struct describing a single filtercheck field ("ka.user")
struct field_info {
struct field_info
{
std::string m_name;
std::string m_desc;
@@ -91,7 +91,8 @@ public:
};
// A struct describing a group of filtercheck fields ("ka")
struct check_info {
struct check_info
{
std::string m_name;
std::string m_desc;
@@ -101,10 +102,10 @@ public:
json_event_filter_check();
virtual ~json_event_filter_check();
virtual int32_t parse_field_name(const char* str, bool alloc_state, bool needed_for_filtering);
void add_filter_value(const char* str, uint32_t len, uint32_t i = 0 );
virtual int32_t parse_field_name(const char *str, bool alloc_state, bool needed_for_filtering);
void add_filter_value(const char *str, uint32_t len, uint32_t i = 0);
bool compare(gen_event *evt);
virtual uint8_t* extract(gen_event *evt, uint32_t* len, bool sanitize_strings = true);
virtual uint8_t *extract(gen_event *evt, uint32_t *len, bool sanitize_strings = true);
// Simpler version that returns a string
std::string extract(json_event *evt);
@@ -124,7 +125,6 @@ public:
virtual json_event_filter_check *allocate_new() = 0;
protected:
static std::string def_format(const nlohmann::json &j, std::string &field, std::string &idx);
static std::string json_as_string(const nlohmann::json &j);
@@ -133,15 +133,16 @@ protected:
// jevt.value[/user/username]. This struct represents one of
// those aliases.
typedef std::function<std::string (const nlohmann::json &, std::string &field, std::string &idx)> format_t;
typedef std::function<std::string(const nlohmann::json &, std::string &field, std::string &idx)> format_t;
struct alias {
struct alias
{
// The variants allow for brace-initialization either
// with just the pointer or with both the pointer and
// a format function.
alias();
alias(nlohmann::json::json_pointer ptr);
alias(nlohmann::json::json_pointer ptr, format_t format);
alias(nlohmann::json::json_pointer ptr);
alias(nlohmann::json::json_pointer ptr, format_t format);
virtual ~alias();
// A json pointer used to extract a referenced value
@@ -182,7 +183,6 @@ protected:
format_t m_format;
private:
std::vector<std::string> m_values;
};
@@ -192,14 +192,13 @@ public:
jevt_filter_check();
virtual ~jevt_filter_check();
int32_t parse_field_name(const char* str, bool alloc_state, bool needed_for_filtering);
int32_t parse_field_name(const char *str, bool alloc_state, bool needed_for_filtering);
virtual uint8_t* extract(gen_event *evt, uint32_t* len, bool sanitize_strings = true);
virtual uint8_t *extract(gen_event *evt, uint32_t *len, bool sanitize_strings = true);
json_event_filter_check *allocate_new();
private:
static std::string s_jevt_time_field;
static std::string s_jevt_time_iso_8601_field;
static std::string s_jevt_rawtime_field;
@@ -252,7 +251,6 @@ public:
std::set<std::string> m_tags;
};
class json_event_filter_factory : public gen_event_filter_factory
{
public:
@@ -271,7 +269,6 @@ public:
private:
std::list<std::shared_ptr<json_event_filter_check>> m_defined_checks;
std::list<json_event_filter_check::check_info> m_info;
};
// Unlike the other classes, this does not inherit from a shared class
@@ -289,12 +286,11 @@ public:
std::string tojson(json_event *ev);
std::map<std::string, std::string> tomap(json_event *ev);
void resolve_tokens(json_event *ev, std::list<std::pair<std::string,std::string>> &resolved);
void resolve_tokens(json_event *ev, std::list<std::pair<std::string, std::string>> &resolved);
private:
void parse_format();
// A format token is either a combination of a filtercheck
// name (ka.value) and filtercheck object as key, or an empty
// key and a NULL filtercheck object, combined with a value (
@@ -320,6 +316,3 @@ private:
// All the filterchecks required to resolve tokens in the format string
json_event_filter_factory &m_json_factory;
};

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once

View File

@@ -1,6 +1,4 @@
-- Copyright (C) 2016-2018 Draios Inc dba Sysdig.
--
-- This file is part of falco.
-- Copyright (C) 2019 The Falco Authors.
--
-- Licensed under the Apache License, Version 2.0 (the "License");
-- you may not use this file except in compliance with the License.

View File

@@ -1,6 +1,5 @@
# Copyright (C) 2016-2018 Draios Inc dba Sysdig.
# Copyright (C) 2019 The Falco Authors.
#
# This file is part of falco.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.

View File

@@ -1,6 +1,4 @@
-- Copyright (C) 2016-2018 Draios Inc dba Sysdig.
--
-- This file is part of falco.
-- Copyright (C) 2019 The Falco Authors.
--
-- Licensed under the Apache License, Version 2.0 (the "License");
-- you may not use this file except in compliance with the License.

View File

@@ -1,6 +1,4 @@
-- Copyright (C) 2016-2018 Draios Inc dba Sysdig.
--
-- This file is part of falco.
-- Copyright (C) 2019 The Falco Authors.
--
-- Licensed under the Apache License, Version 2.0 (the "License");
-- you may not use this file except in compliance with the License.

View File

@@ -1,6 +1,4 @@
-- Copyright (C) 2018 Draios inc.
--
-- This file is part of falco.
-- Copyright (C) 2019 The Falco Authors.
--
-- Licensed under the Apache License, Version 2.0 (the "License");
-- you may not use this file except in compliance with the License.

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include "rules.h"

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2018 Draios inc.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include "ruleset.h"
@@ -40,8 +37,8 @@ falco_ruleset::~falco_ruleset()
m_filters.clear();
}
falco_ruleset::ruleset_filters::ruleset_filters()
: m_num_filters(0)
falco_ruleset::ruleset_filters::ruleset_filters():
m_num_filters(0)
{
}
@@ -69,7 +66,7 @@ void falco_ruleset::ruleset_filters::add_filter(filter_wrapper *wrap)
added = true;
if(m_filter_by_event_tag.size() <= etag)
{
m_filter_by_event_tag.resize(etag+1);
m_filter_by_event_tag.resize(etag + 1);
}
if(!m_filter_by_event_tag[etag])
@@ -109,7 +106,7 @@ void falco_ruleset::ruleset_filters::remove_filter(filter_wrapper *wrap)
removed = true;
l->erase(it,
l->end());
l->end());
if(l->size() == 0)
{
@@ -142,11 +139,12 @@ bool falco_ruleset::ruleset_filters::run(gen_event *evt, uint32_t etag)
list<filter_wrapper *> *filters = m_filter_by_event_tag[etag];
if (!filters) {
if(!filters)
{
return false;
}
for (auto &wrap : *filters)
for(auto &wrap : *filters)
{
if(wrap->filter->run(evt))
{
@@ -181,13 +179,13 @@ void falco_ruleset::add(string &name,
for(auto &etag : event_tags)
{
wrap->event_tags.resize(etag+1);
wrap->event_tags.resize(etag + 1);
wrap->event_tags[etag] = true;
}
m_filters.insert(pair<string,filter_wrapper *>(name, wrap));
m_filters.insert(pair<string, filter_wrapper *>(name, wrap));
for(const auto &tag: tags)
for(const auto &tag : tags)
{
auto it = m_filter_by_event_tag.lower_bound(tag);
@@ -195,7 +193,7 @@ void falco_ruleset::add(string &name,
it->first != tag)
{
it = m_filter_by_event_tag.emplace_hint(it,
make_pair(tag, list<filter_wrapper*>()));
make_pair(tag, list<filter_wrapper *>()));
}
it->second.push_back(wrap);
@@ -204,7 +202,7 @@ void falco_ruleset::add(string &name,
void falco_ruleset::enable(const string &substring, bool enabled, uint16_t ruleset)
{
while (m_rulesets.size() < (size_t) ruleset + 1)
while(m_rulesets.size() < (size_t)ruleset + 1)
{
m_rulesets.push_back(new ruleset_filters());
}
@@ -215,7 +213,7 @@ void falco_ruleset::enable(const string &substring, bool enabled, uint16_t rules
matches = (substring == "" || (val.first.find(substring) != string::npos));
if (matches)
if(matches)
{
if(enabled)
{
@@ -231,7 +229,7 @@ void falco_ruleset::enable(const string &substring, bool enabled, uint16_t rules
void falco_ruleset::enable_tags(const set<string> &tags, bool enabled, uint16_t ruleset)
{
while (m_rulesets.size() < (size_t) ruleset + 1)
while(m_rulesets.size() < (size_t)ruleset + 1)
{
m_rulesets.push_back(new ruleset_filters());
}
@@ -254,7 +252,7 @@ void falco_ruleset::enable_tags(const set<string> &tags, bool enabled, uint16_t
uint64_t falco_ruleset::num_rules_for_ruleset(uint16_t ruleset)
{
while (m_rulesets.size() < (size_t) ruleset + 1)
while(m_rulesets.size() < (size_t)ruleset + 1)
{
m_rulesets.push_back(new ruleset_filters());
}
@@ -264,7 +262,7 @@ uint64_t falco_ruleset::num_rules_for_ruleset(uint16_t ruleset)
bool falco_ruleset::run(gen_event *evt, uint32_t etag, uint16_t ruleset)
{
if(m_rulesets.size() < (size_t) ruleset + 1)
if(m_rulesets.size() < (size_t)ruleset + 1)
{
return false;
}
@@ -274,7 +272,7 @@ bool falco_ruleset::run(gen_event *evt, uint32_t etag, uint16_t ruleset)
void falco_ruleset::event_tags_for_ruleset(vector<bool> &evttypes, uint16_t ruleset)
{
if(m_rulesets.size() < (size_t) ruleset + 1)
if(m_rulesets.size() < (size_t)ruleset + 1)
{
return;
}
@@ -294,7 +292,7 @@ void falco_sinsp_ruleset::add(string &name,
set<uint32_t> &evttypes,
set<uint32_t> &syscalls,
set<string> &tags,
sinsp_filter* filter)
sinsp_filter *filter)
{
set<uint32_t> event_tags;
@@ -302,28 +300,28 @@ void falco_sinsp_ruleset::add(string &name,
{
// If no evttypes or syscalls are specified, the filter is
// enabled for all evttypes/syscalls.
for(uint32_t i=0; i < PPM_EVENT_MAX; i++)
for(uint32_t i = 0; i < PPM_EVENT_MAX; i++)
{
evttypes.insert(i);
}
for(uint32_t i=0; i < PPM_SC_MAX; i++)
for(uint32_t i = 0; i < PPM_SC_MAX; i++)
{
syscalls.insert(i);
}
}
for(auto evttype: evttypes)
for(auto evttype : evttypes)
{
event_tags.insert(evttype_to_event_tag(evttype));
}
for(auto syscallid: syscalls)
for(auto syscallid : syscalls)
{
event_tags.insert(syscall_to_event_tag(syscallid));
}
falco_ruleset::add(name, tags, event_tags, (gen_event_filter *) filter);
falco_ruleset::add(name, tags, event_tags, (gen_event_filter *)filter);
}
bool falco_sinsp_ruleset::run(sinsp_evt *evt, uint16_t ruleset)
@@ -344,7 +342,7 @@ bool falco_sinsp_ruleset::run(sinsp_evt *evt, uint16_t ruleset)
etag = evttype_to_event_tag(etype);
}
return falco_ruleset::run((gen_event*) evt, etag, ruleset);
return falco_ruleset::run((gen_event *)evt, etag, ruleset);
}
void falco_sinsp_ruleset::evttypes_for_ruleset(vector<bool> &evttypes, uint16_t ruleset)
@@ -353,7 +351,7 @@ void falco_sinsp_ruleset::evttypes_for_ruleset(vector<bool> &evttypes, uint16_t
event_tags_for_ruleset(event_tags, ruleset);
evttypes.assign(PPM_EVENT_MAX+1, false);
evttypes.assign(PPM_EVENT_MAX + 1, false);
for(uint32_t etype = 0; etype < PPM_EVENT_MAX; etype++)
{
@@ -372,7 +370,7 @@ void falco_sinsp_ruleset::syscalls_for_ruleset(vector<bool> &syscalls, uint16_t
event_tags_for_ruleset(event_tags, ruleset);
syscalls.assign(PPM_EVENT_MAX+1, false);
syscalls.assign(PPM_EVENT_MAX + 1, false);
for(uint32_t syscallid = 0; syscallid < PPM_SC_MAX; syscallid++)
{
@@ -392,6 +390,5 @@ uint32_t falco_sinsp_ruleset::evttype_to_event_tag(uint32_t evttype)
uint32_t falco_sinsp_ruleset::syscall_to_event_tag(uint32_t syscallid)
{
return PPM_EVENT_MAX+1+syscallid;
return PPM_EVENT_MAX + 1 + syscallid;
}

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2018 Draios inc.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#include <cstddef>

View File

@@ -1,7 +1,5 @@
/*
Copyright (C) 2016-2018 Draios Inc dba Sysdig.
This file is part of falco.
Copyright (C) 2019 The Falco Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
@@ -14,7 +12,6 @@ distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#pragma once