refactor(userspace/engine): increase const coherence of falco engine

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2022-06-22 08:50:36 +00:00 committed by poiana
parent a6137e9475
commit d9b6473db2
4 changed files with 35 additions and 35 deletions

View File

@ -67,7 +67,7 @@ uint32_t falco_engine::engine_version()
return (uint32_t) FALCO_ENGINE_VERSION; return (uint32_t) FALCO_ENGINE_VERSION;
} }
falco_source* falco_engine::find_source(const std::string& name) const falco_source* falco_engine::find_source(const std::string& name) const
{ {
auto ret = m_sources.at(name); auto ret = m_sources.at(name);
if(!ret) if(!ret)
@ -77,7 +77,7 @@ falco_source* falco_engine::find_source(const std::string& name)
return ret; return ret;
} }
falco_source* falco_engine::find_source(std::size_t index) const falco_source* falco_engine::find_source(std::size_t index) const
{ {
auto ret = m_sources.at(index); auto ret = m_sources.at(index);
if(!ret) if(!ret)
@ -94,7 +94,7 @@ static std::string fieldclass_key(const gen_event_filter_factory::filter_fieldcl
return fld_info.name + fld_info.shortdesc; return fld_info.name + fld_info.shortdesc;
} }
void falco_engine::list_fields(std::string &source, bool verbose, bool names_only, bool markdown) void falco_engine::list_fields(std::string &source, bool verbose, bool names_only, bool markdown) const
{ {
// Maps from field class name + short desc to list of event // Maps from field class name + short desc to list of event
// sources for which this field class can be used. // sources for which this field class can be used.
@ -102,14 +102,14 @@ void falco_engine::list_fields(std::string &source, bool verbose, bool names_onl
// Do a first pass to group together classes that are // Do a first pass to group together classes that are
// applicable to multiple event sources. // applicable to multiple event sources.
for(auto &it : m_sources) for(const auto &it : m_sources)
{ {
if(source != "" && source != it.name) if(source != "" && source != it.name)
{ {
continue; continue;
} }
for(auto &fld_class : it.filter_factory->get_fields()) for(const auto &fld_class : it.filter_factory->get_fields())
{ {
fieldclass_event_sources[fieldclass_key(fld_class)].insert(it.name); fieldclass_event_sources[fieldclass_key(fld_class)].insert(it.name);
} }
@ -121,7 +121,7 @@ void falco_engine::list_fields(std::string &source, bool verbose, bool names_onl
// In the second pass, actually print info, skipping duplicate // In the second pass, actually print info, skipping duplicate
// field classes and also printing info on supported sources. // field classes and also printing info on supported sources.
for(auto &it : m_sources) for(const auto &it : m_sources)
{ {
if(source != "" && source != it.name) if(source != "" && source != it.name)
{ {
@ -234,7 +234,7 @@ void falco_engine::enable_rule(const string &substring, bool enabled, const stri
uint16_t ruleset_id = find_ruleset_id(ruleset); uint16_t ruleset_id = find_ruleset_id(ruleset);
bool match_exact = false; bool match_exact = false;
for(auto &it : m_sources) for(const auto &it : m_sources)
{ {
if(enabled) if(enabled)
{ {
@ -252,7 +252,7 @@ void falco_engine::enable_rule_exact(const string &rule_name, bool enabled, cons
uint16_t ruleset_id = find_ruleset_id(ruleset); uint16_t ruleset_id = find_ruleset_id(ruleset);
bool match_exact = true; bool match_exact = true;
for(auto &it : m_sources) for(const auto &it : m_sources)
{ {
if(enabled) if(enabled)
{ {
@ -269,7 +269,7 @@ void falco_engine::enable_rule_by_tag(const set<string> &tags, bool enabled, con
{ {
uint16_t ruleset_id = find_ruleset_id(ruleset); uint16_t ruleset_id = find_ruleset_id(ruleset);
for(auto &it : m_sources) for(const auto &it : m_sources)
{ {
if(enabled) if(enabled)
{ {
@ -302,7 +302,7 @@ uint64_t falco_engine::num_rules_for_ruleset(const std::string &ruleset)
{ {
uint16_t ruleset_id = find_ruleset_id(ruleset); uint16_t ruleset_id = find_ruleset_id(ruleset);
uint64_t ret = 0; uint64_t ret = 0;
for (auto &src : m_sources) for (const auto &src : m_sources)
{ {
ret += src.ruleset->enabled_count(ruleset_id); ret += src.ruleset->enabled_count(ruleset_id);
} }
@ -315,7 +315,7 @@ void falco_engine::evttypes_for_ruleset(std::string &source, std::set<uint16_t>
} }
std::shared_ptr<gen_event_formatter> falco_engine::create_formatter(const std::string &source, std::shared_ptr<gen_event_formatter> falco_engine::create_formatter(const std::string &source,
const std::string &output) const std::string &output) const
{ {
return find_source(source)->formatter_factory->create_formatter(output); return find_source(source)->formatter_factory->create_formatter(output);
} }
@ -369,7 +369,7 @@ std::size_t falco_engine::add_source(const std::string &source,
return m_sources.insert(src, source); return m_sources.insert(src, source);
} }
void falco_engine::describe_rule(string *rule) void falco_engine::describe_rule(string *rule) const
{ {
static const char* rule_fmt = "%-50s %s\n"; static const char* rule_fmt = "%-50s %s\n";
fprintf(stdout, rule_fmt, "Rule", "Description"); fprintf(stdout, rule_fmt, "Rule", "Description");
@ -390,7 +390,7 @@ void falco_engine::describe_rule(string *rule)
} }
} }
void falco_engine::print_stats() void falco_engine::print_stats() const
{ {
string out; string out;
m_rule_stats_manager.format(m_rules, out); m_rule_stats_manager.format(m_rules, out);
@ -398,7 +398,7 @@ void falco_engine::print_stats()
fprintf(stdout, "%s", out.c_str()); fprintf(stdout, "%s", out.c_str());
} }
bool falco_engine::is_source_valid(const std::string &source) bool falco_engine::is_source_valid(const std::string &source) const
{ {
return m_sources.at(source) != nullptr; return m_sources.at(source) != nullptr;
} }
@ -443,7 +443,7 @@ void falco_engine::interpret_load_result(std::unique_ptr<load_result>& res,
bool falco_engine::check_plugin_requirements( bool falco_engine::check_plugin_requirements(
const std::vector<plugin_version_requirement>& plugins, const std::vector<plugin_version_requirement>& plugins,
std::string& err) std::string& err) const
{ {
for (const auto &req : m_rule_loader.required_plugin_versions()) for (const auto &req : m_rule_loader.required_plugin_versions())
{ {
@ -484,9 +484,9 @@ bool falco_engine::check_plugin_requirements(
return true; return true;
} }
void falco_engine::complete_rule_loading() void falco_engine::complete_rule_loading() const
{ {
for (auto &src : m_sources) for (const auto &src : m_sources)
{ {
src.ruleset->on_loading_complete(); src.ruleset->on_loading_complete();
} }
@ -508,7 +508,7 @@ void falco_engine::set_extra(string &extra, bool replace_container_info)
m_replace_container_info = replace_container_info; m_replace_container_info = replace_container_info;
} }
inline bool falco_engine::should_drop_evt() inline bool falco_engine::should_drop_evt() const
{ {
if(m_sampling_multiplier == 0) if(m_sampling_multiplier == 0)
{ {

View File

@ -56,7 +56,7 @@ public:
// Print to stdout (using printf) a description of each field supported by this engine. // Print to stdout (using printf) a description of each field supported by this engine.
// If source is non-empty, only fields for the provided source are printed. // If source is non-empty, only fields for the provided source are printed.
void list_fields(std::string &source, bool verbose, bool names_only, bool markdown); void list_fields(std::string &source, bool verbose, bool names_only, bool markdown) const;
// //
// Load rules either directly or from a filename. // Load rules either directly or from a filename.
@ -98,7 +98,7 @@ public:
// Internally, this can be used to release unused resources before starting // Internally, this can be used to release unused resources before starting
// processing events with process_event(). // processing events with process_event().
// //
void complete_rule_loading(); void complete_rule_loading() const;
// Only load rules having this priority or more severe. // Only load rules having this priority or more severe.
void set_min_priority(falco_common::priority_type priority); void set_min_priority(falco_common::priority_type priority);
@ -121,12 +121,12 @@ public:
// Print details on the given rule. If rule is NULL, print // Print details on the given rule. If rule is NULL, print
// details on all rules. // details on all rules.
// //
void describe_rule(std::string *rule); void describe_rule(std::string *rule) const;
// //
// Print statistics on how many events matched each rule. // Print statistics on how many events matched each rule.
// //
void print_stats(); void print_stats() const;
// //
// Set the sampling ratio, which can affect which events are // Set the sampling ratio, which can affect which events are
@ -200,7 +200,7 @@ public:
// Return whether or not there is a valid filter/formatter // Return whether or not there is a valid filter/formatter
// factory for this source. // factory for this source.
bool is_source_valid(const std::string &source); bool is_source_valid(const std::string &source) const;
// //
// Given an event source and ruleset, fill in a bitset // Given an event source and ruleset, fill in a bitset
@ -216,7 +216,7 @@ public:
// event. // event.
// //
std::shared_ptr<gen_event_formatter> create_formatter(const std::string &source, std::shared_ptr<gen_event_formatter> create_formatter(const std::string &source,
const std::string &output); const std::string &output) const;
// The rule loader definition is aliased as it is exactly what we need // The rule loader definition is aliased as it is exactly what we need
typedef rule_loader::plugin_version_info plugin_version_requirement; typedef rule_loader::plugin_version_info plugin_version_requirement;
@ -230,7 +230,7 @@ public:
// //
bool check_plugin_requirements( bool check_plugin_requirements(
const std::vector<plugin_version_requirement>& plugins, const std::vector<plugin_version_requirement>& plugins,
std::string& err); std::string& err) const;
private: private:
@ -246,15 +246,15 @@ private:
indexed_vector<falco_source> m_sources; indexed_vector<falco_source> m_sources;
falco_source* find_source(std::size_t index); const falco_source* find_source(std::size_t index) const;
falco_source* find_source(const std::string& name); const falco_source* find_source(const std::string& name) const;
// //
// Determine whether the given event should be matched at all // Determine whether the given event should be matched at all
// against the set of rules, given the current sampling // against the set of rules, given the current sampling
// ratio/multiplier. // ratio/multiplier.
// //
inline bool should_drop_evt(); inline bool should_drop_evt() const;
rule_loader m_rule_loader; rule_loader m_rule_loader;
indexed_vector<falco_rule> m_rules; indexed_vector<falco_rule> m_rules;

View File

@ -20,7 +20,7 @@ limitations under the License.
#include "falco_engine.h" #include "falco_engine.h"
#include "banned.h" // This raises a compilation error when certain functions are used #include "banned.h" // This raises a compilation error when certain functions are used
falco_formats::falco_formats(std::shared_ptr<falco_engine> engine, falco_formats::falco_formats(std::shared_ptr<const falco_engine> engine,
bool json_include_output_property, bool json_include_output_property,
bool json_include_tags_property) bool json_include_tags_property)
: m_falco_engine(engine), : m_falco_engine(engine),
@ -35,7 +35,7 @@ falco_formats::~falco_formats()
string falco_formats::format_event(gen_event *evt, const std::string &rule, const std::string &source, string falco_formats::format_event(gen_event *evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format, std::set<std::string> &tags, const std::string &level, const std::string &format, std::set<std::string> &tags,
const std::string &hostname) const std::string &hostname) const
{ {
string line; string line;
@ -132,7 +132,7 @@ string falco_formats::format_event(gen_event *evt, const std::string &rule, cons
} }
map<string, string> falco_formats::get_field_values(gen_event *evt, const std::string &source, map<string, string> falco_formats::get_field_values(gen_event *evt, const std::string &source,
const std::string &format) const std::string &format) const
{ {
std::shared_ptr<gen_event_formatter> formatter; std::shared_ptr<gen_event_formatter> formatter;

View File

@ -24,20 +24,20 @@ limitations under the License.
class falco_formats class falco_formats
{ {
public: public:
falco_formats(std::shared_ptr<falco_engine> engine, falco_formats(std::shared_ptr<const falco_engine> engine,
bool json_include_output_property, bool json_include_output_property,
bool json_include_tags_property); bool json_include_tags_property);
virtual ~falco_formats(); virtual ~falco_formats();
std::string format_event(gen_event *evt, const std::string &rule, const std::string &source, std::string format_event(gen_event *evt, const std::string &rule, const std::string &source,
const std::string &level, const std::string &format, std::set<std::string> &tags, const std::string &level, const std::string &format, std::set<std::string> &tags,
const std::string &hostname); const std::string &hostname) const;
map<string, string> get_field_values(gen_event *evt, const std::string &source, map<string, string> get_field_values(gen_event *evt, const std::string &source,
const std::string &format); const std::string &format) const ;
protected: protected:
std::shared_ptr<falco_engine> m_falco_engine; std::shared_ptr<const falco_engine> m_falco_engine;
bool m_json_include_output_property; bool m_json_include_output_property;
bool m_json_include_tags_property; bool m_json_include_tags_property;
}; };