github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-08 10:09:40 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/engine): support appending to unknown sources

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce
2023-08-31 14:56:13 +00:00
committed by poiana
parent 88dcdaac8a
commit c8122ff474
5 changed files with 48 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
userspace/engine/rule_loader_compiler.cpp
View File

@@ -394,17 +394,22 @@ void rule_loader::compiler::compile_rule_infos(
filter_warning_resolver warn_resolver;
for (auto &r : col.rules())
{
// skip the rule if it has an unknown source
if (r.unknown_source)
{
continue;
}
// skip the rule if below the minimum priority
if (r.priority > cfg.min_priority)
{
continue;
}
// note: this should not be nullptr if the source is not unknown
auto source = cfg.sources.at(r.source);
// note: this is not supposed to happen
THROW(!source,
std::string("Unknown source ") + r.source,
std::string("Unknown source at compile-time") + r.source,
r.ctx);
// build filter AST by parsing the condition, building exceptions,