github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-31 22:16:49 +00:00
Code Issues Projects Releases Wiki Activity

chore(userspace/falco): rename sources app state list for more clarity

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2022-08-30 16:11:49 +00:00 committed by poiana
parent 25e9bd1c91
commit d17e173e35
7 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
userspace/falco/app_actions/init_clients.cpp
View File

@ -27,7 +27,7 @@ application::run_result application::init_clients()
return run_result::ok();
}
auto inspector = m_state->sources.at(falco_common::syscall_source)->inspector;
auto inspector = m_state->source_infos.at(falco_common::syscall_source)->inspector;
falco_logger::log(LOG_DEBUG, "Setting metadata download max size to " + to_string(m_state->config->m_metadata_download_max_mb) + " MB\n");
falco_logger::log(LOG_DEBUG, "Setting metadata download chunk wait time to " + to_string(m_state->config->m_metadata_download_chunk_wait_us) + " μs\n");

6
userspace/falco/app_actions/init_falco_engine.cpp
View File

@ -58,7 +58,7 @@ void application::configure_output_format()
void application::add_source_to_engine(const std::string& src)
{
auto src_info = m_state->sources.at(src);
auto src_info = m_state->source_infos.at(src);
std::shared_ptr<gen_event_filter_factory> filter_factory = nullptr;
std::shared_ptr<gen_event_formatter_factory> formatter_factory = nullptr;
@ -71,7 +71,7 @@ void application::add_source_to_engine(const std::string& src)
}
else
{
auto &filterchecks = m_state->sources.at(src)->filterchecks;
auto &filterchecks = m_state->source_infos.at(src)->filterchecks;
filter_factory = std::shared_ptr<gen_event_filter_factory>(
new sinsp_filter_factory(src_info->inspector.get(), filterchecks));
formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
@ -120,7 +120,7 @@ application::run_result application::init_falco_engine()
{
bool added = false;
auto source_idx = manager->source_idx_by_plugin_id(p->id(), added);
auto engine_idx = m_state->sources.at(p->event_source())->engine_idx;
auto engine_idx = m_state->source_infos.at(p->event_source())->engine_idx;
if (!added || source_idx != engine_idx)
{
return run_result::fatal("Could not add event source in the engine: " + p->event_source());

2
userspace/falco/app_actions/init_inspectors.cpp
View File

@ -112,7 +112,7 @@ application::run_result application::init_inspectors()
for (const auto &src : m_state->loaded_sources)
{
auto src_info = m_state->sources.at(src);
auto src_info = m_state->source_infos.at(src);
// in capture mode, every event source uses the offline inspector.
// in live mode, we create a new inspector for each event source

8
userspace/falco/app_actions/load_plugins.cpp
View File

@ -27,12 +27,12 @@ application::run_result application::load_plugins()
return run_result::fatal("Can not load/use plugins with musl optimized build");
}
#endif
auto empty_src = state::source_info{};
auto empty_src_info = state::source_info{};
// Initialize the set of loaded event sources.
// By default, the set includes the 'syscall' event source
m_state->sources.clear();
m_state->sources.insert(empty_src, falco_common::syscall_source);
m_state->source_infos.clear();
m_state->source_infos.insert(empty_src_info, falco_common::syscall_source);
m_state->loaded_sources = { falco_common::syscall_source };
// Initialize map of plugin configs
@ -53,7 +53,7 @@ application::run_result application::load_plugins()
if(plugin->caps() & CAP_SOURCING)
{
auto sname = plugin->event_source();
m_state->sources.insert(empty_src, sname);
m_state->source_infos.insert(empty_src_info, sname);
m_state->loaded_sources.insert(sname);
}
}

8
userspace/falco/app_actions/process_events.cpp
View File

@ -58,13 +58,13 @@ application::run_result application::do_inspect(
bool rate_limiter_enabled = m_state->config->m_notifications_rate > 0;
bool source_engine_idx_found = false;
bool is_capture_mode = source.empty();
bool syscall_source_engine_idx = m_state->sources.at(falco_common::syscall_source)->engine_idx;
bool syscall_source_engine_idx = m_state->source_infos.at(falco_common::syscall_source)->engine_idx;
std::size_t source_engine_idx = 0;
std::vector<std::string> source_names = inspector->get_plugin_manager()->sources();
source_names.push_back(falco_common::syscall_source);
if (!is_capture_mode)
{
source_engine_idx = m_state->sources.at(source)->engine_idx;
source_engine_idx = m_state->source_infos.at(source)->engine_idx;
}
// if enabled, init rate limiter
@ -333,7 +333,7 @@ application::run_result application::process_events()
ctxs.reserve(m_state->enabled_sources.size());
for (auto source : m_state->enabled_sources)
{
auto src_info = m_state->sources.at(source);
auto src_info = m_state->source_infos.at(source);
auto ctx_idx = ctxs.size();
ctxs.emplace_back();
ctxs[ctx_idx].source = source;
@ -385,7 +385,7 @@ application::run_result application::process_events()
ctx.thread = nullptr;
}
falco_logger::log(LOG_DEBUG, "Closing event source '" + ctx.source + "'\n");
m_state->sources.at(ctx.source)->inspector->close();
m_state->source_infos.at(ctx.source)->inspector->close();
res = run_result::merge(res, ctx.res);
closed_count++;
}

2
userspace/falco/application.cpp
View File

@ -43,7 +43,7 @@ application::state::state()
terminate(false),
loaded_sources(),
enabled_sources(),
sources(),
source_infos(),
plugin_configs()
{
config = std::make_shared<falco_configuration>();

5
userspace/falco/application.h
View File

@ -100,8 +100,9 @@ private:
// this is also used to open the capture file and read its events
std::shared_ptr<sinsp> offline_inspector;
// List of all event source info indexed by source name
indexed_vector<source_info> sources;
// List of all the information mapped to each event source
// indexed by event source name
indexed_vector<source_info> source_infos;
// List of all plugin configurations indexed by plugin name as returned
// by their sinsp_plugin::name method