github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-11 19:12:12 +00:00
Code Issues Projects Releases Wiki Activity

chore(userspace/falco): rename sources app state list for more clarity

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2022-08-30 16:11:49 +00:00 committed by poiana
parent 25e9bd1c91
commit d17e173e35
7 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
userspace/falco/app_actions/init_clients.cpp
View File

@ -27,7 +27,7 @@ application::run_result application::init_clients()
return run_result::ok(); return run_result::ok();
} }
auto inspector = m_state->sources.at(falco_common::syscall_source)->inspector; auto inspector = m_state->source_infos.at(falco_common::syscall_source)->inspector;
falco_logger::log(LOG_DEBUG, "Setting metadata download max size to " + to_string(m_state->config->m_metadata_download_max_mb) + " MB\n"); falco_logger::log(LOG_DEBUG, "Setting metadata download max size to " + to_string(m_state->config->m_metadata_download_max_mb) + " MB\n");
falco_logger::log(LOG_DEBUG, "Setting metadata download chunk wait time to " + to_string(m_state->config->m_metadata_download_chunk_wait_us) + " μs\n"); falco_logger::log(LOG_DEBUG, "Setting metadata download chunk wait time to " + to_string(m_state->config->m_metadata_download_chunk_wait_us) + " μs\n");

6
userspace/falco/app_actions/init_falco_engine.cpp
View File

@ -58,7 +58,7 @@ void application::configure_output_format()
void application::add_source_to_engine(const std::string& src) void application::add_source_to_engine(const std::string& src)
{ {
auto src_info = m_state->sources.at(src); auto src_info = m_state->source_infos.at(src);
std::shared_ptr<gen_event_filter_factory> filter_factory = nullptr; std::shared_ptr<gen_event_filter_factory> filter_factory = nullptr;
std::shared_ptr<gen_event_formatter_factory> formatter_factory = nullptr; std::shared_ptr<gen_event_formatter_factory> formatter_factory = nullptr;
@ -71,7 +71,7 @@ void application::add_source_to_engine(const std::string& src)
} }
else else
{ {
auto &filterchecks = m_state->sources.at(src)->filterchecks; auto &filterchecks = m_state->source_infos.at(src)->filterchecks;
filter_factory = std::shared_ptr<gen_event_filter_factory>( filter_factory = std::shared_ptr<gen_event_filter_factory>(
new sinsp_filter_factory(src_info->inspector.get(), filterchecks)); new sinsp_filter_factory(src_info->inspector.get(), filterchecks));
formatter_factory = std::shared_ptr<gen_event_formatter_factory>( formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
@ -120,7 +120,7 @@ application::run_result application::init_falco_engine()
{ {
bool added = false; bool added = false;
auto source_idx = manager->source_idx_by_plugin_id(p->id(), added); auto source_idx = manager->source_idx_by_plugin_id(p->id(), added);
auto engine_idx = m_state->sources.at(p->event_source())->engine_idx; auto engine_idx = m_state->source_infos.at(p->event_source())->engine_idx;
if (!added || source_idx != engine_idx) if (!added || source_idx != engine_idx)
{ {
return run_result::fatal("Could not add event source in the engine: " + p->event_source()); return run_result::fatal("Could not add event source in the engine: " + p->event_source());

2
userspace/falco/app_actions/init_inspectors.cpp
View File

@ -112,7 +112,7 @@ application::run_result application::init_inspectors()
for (const auto &src : m_state->loaded_sources) for (const auto &src : m_state->loaded_sources)
{ {
auto src_info = m_state->sources.at(src); auto src_info = m_state->source_infos.at(src);
// in capture mode, every event source uses the offline inspector. // in capture mode, every event source uses the offline inspector.
// in live mode, we create a new inspector for each event source // in live mode, we create a new inspector for each event source

8
userspace/falco/app_actions/load_plugins.cpp
View File

@ -27,12 +27,12 @@ application::run_result application::load_plugins()
return run_result::fatal("Can not load/use plugins with musl optimized build"); return run_result::fatal("Can not load/use plugins with musl optimized build");
} }
#endif #endif
auto empty_src = state::source_info{}; auto empty_src_info = state::source_info{};
// Initialize the set of loaded event sources. // Initialize the set of loaded event sources.
// By default, the set includes the 'syscall' event source // By default, the set includes the 'syscall' event source
m_state->sources.clear(); m_state->source_infos.clear();
m_state->sources.insert(empty_src, falco_common::syscall_source); m_state->source_infos.insert(empty_src_info, falco_common::syscall_source);
m_state->loaded_sources = { falco_common::syscall_source }; m_state->loaded_sources = { falco_common::syscall_source };
// Initialize map of plugin configs // Initialize map of plugin configs
@ -53,7 +53,7 @@ application::run_result application::load_plugins()
if(plugin->caps() & CAP_SOURCING) if(plugin->caps() & CAP_SOURCING)
{ {
auto sname = plugin->event_source(); auto sname = plugin->event_source();
m_state->sources.insert(empty_src, sname); m_state->source_infos.insert(empty_src_info, sname);
m_state->loaded_sources.insert(sname); m_state->loaded_sources.insert(sname);
} }
} }

8
userspace/falco/app_actions/process_events.cpp
View File

@ -58,13 +58,13 @@ application::run_result application::do_inspect(
bool rate_limiter_enabled = m_state->config->m_notifications_rate > 0; bool rate_limiter_enabled = m_state->config->m_notifications_rate > 0;
bool source_engine_idx_found = false; bool source_engine_idx_found = false;
bool is_capture_mode = source.empty(); bool is_capture_mode = source.empty();
bool syscall_source_engine_idx = m_state->sources.at(falco_common::syscall_source)->engine_idx; bool syscall_source_engine_idx = m_state->source_infos.at(falco_common::syscall_source)->engine_idx;
std::size_t source_engine_idx = 0; std::size_t source_engine_idx = 0;
std::vector<std::string> source_names = inspector->get_plugin_manager()->sources(); std::vector<std::string> source_names = inspector->get_plugin_manager()->sources();
source_names.push_back(falco_common::syscall_source); source_names.push_back(falco_common::syscall_source);
if (!is_capture_mode) if (!is_capture_mode)
{ {
source_engine_idx = m_state->sources.at(source)->engine_idx; source_engine_idx = m_state->source_infos.at(source)->engine_idx;
} }
// if enabled, init rate limiter // if enabled, init rate limiter
@ -333,7 +333,7 @@ application::run_result application::process_events()
ctxs.reserve(m_state->enabled_sources.size()); ctxs.reserve(m_state->enabled_sources.size());
for (auto source : m_state->enabled_sources) for (auto source : m_state->enabled_sources)
{ {
auto src_info = m_state->sources.at(source); auto src_info = m_state->source_infos.at(source);
auto ctx_idx = ctxs.size(); auto ctx_idx = ctxs.size();
ctxs.emplace_back(); ctxs.emplace_back();
ctxs[ctx_idx].source = source; ctxs[ctx_idx].source = source;
@ -385,7 +385,7 @@ application::run_result application::process_events()
ctx.thread = nullptr; ctx.thread = nullptr;
} }
falco_logger::log(LOG_DEBUG, "Closing event source '" + ctx.source + "'\n"); falco_logger::log(LOG_DEBUG, "Closing event source '" + ctx.source + "'\n");
m_state->sources.at(ctx.source)->inspector->close(); m_state->source_infos.at(ctx.source)->inspector->close();
res = run_result::merge(res, ctx.res); res = run_result::merge(res, ctx.res);
closed_count++; closed_count++;
} }

2
userspace/falco/application.cpp
View File

@ -43,7 +43,7 @@ application::state::state()
terminate(false), terminate(false),
loaded_sources(), loaded_sources(),
enabled_sources(), enabled_sources(),
sources(), source_infos(),
plugin_configs() plugin_configs()
{ {
config = std::make_shared<falco_configuration>(); config = std::make_shared<falco_configuration>();

5
userspace/falco/application.h
View File

@ -100,8 +100,9 @@ private:
// this is also used to open the capture file and read its events // this is also used to open the capture file and read its events
std::shared_ptr<sinsp> offline_inspector; std::shared_ptr<sinsp> offline_inspector;
// List of all event source info indexed by source name // List of all the information mapped to each event source
indexed_vector<source_info> sources; // indexed by event source name
indexed_vector<source_info> source_infos;
// List of all plugin configurations indexed by plugin name as returned // List of all plugin configurations indexed by plugin name as returned
// by their sinsp_plugin::name method // by their sinsp_plugin::name method