From e01d3d68a38c75c6044554a52025d39f8400a7dd Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Mon, 29 Jul 2019 10:44:00 -0700 Subject: [PATCH] Change enable_rule() to use substr match vs regex Change falco_engine::enable_rule to use substring matches instead of regex pattern matches. Only substrings were actually used in practice outside of tests and regex matches weren't even working, due to regex_match() not working properly with the default compiler we use. This is noted on the c++11 compatibility notes for gcc 4.8.2: https://gcc.gnu.org/onlinedocs/gcc-4.8.2/libstdc++/manual/manual/status.html#status.iso.2011. --- userspace/engine/falco_engine.cpp | 10 +++++----- userspace/engine/falco_engine.h | 8 ++++---- userspace/engine/rules.cpp | 15 +-------------- userspace/engine/ruleset.cpp | 24 ++++-------------------- userspace/engine/ruleset.h | 5 ++--- 5 files changed, 16 insertions(+), 46 deletions(-) diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp index dc8673b7..9b47f363 100644 --- a/userspace/engine/falco_engine.cpp +++ b/userspace/engine/falco_engine.cpp @@ -206,17 +206,17 @@ void falco_engine::load_rules_file(const string &rules_filename, bool verbose, b load_rules(rules_content, verbose, all_events, required_engine_version); } -void falco_engine::enable_rule(const string &pattern, bool enabled, const string &ruleset) +void falco_engine::enable_rule(const string &substring, bool enabled, const string &ruleset) { uint16_t ruleset_id = find_ruleset_id(ruleset); - m_sinsp_rules->enable(pattern, enabled, ruleset_id); - m_k8s_audit_rules->enable(pattern, enabled, ruleset_id); + m_sinsp_rules->enable(substring, enabled, ruleset_id); + m_k8s_audit_rules->enable(substring, enabled, ruleset_id); } -void falco_engine::enable_rule(const string &pattern, bool enabled) +void falco_engine::enable_rule(const string &substring, bool enabled) { - enable_rule(pattern, enabled, m_default_ruleset); + enable_rule(substring, enabled, m_default_ruleset); } void falco_engine::enable_rule_by_tag(const set &tags, bool enabled, const string &ruleset) diff --git a/userspace/engine/falco_engine.h b/userspace/engine/falco_engine.h index d77b83eb..051f0b65 100644 --- a/userspace/engine/falco_engine.h +++ b/userspace/engine/falco_engine.h @@ -76,16 +76,16 @@ public: void load_rules(const std::string &rules_content, bool verbose, bool all_events, uint64_t &required_engine_version); // - // Enable/Disable any rules matching the provided pattern - // (regex). When provided, enable/disable these rules in the + // Enable/Disable any rules matching the provided substring. + // When provided, enable/disable these rules in the // context of the provided ruleset. The ruleset (id) can later // be passed as an argument to process_event(). This allows // for different sets of rules being active at once. // - void enable_rule(const std::string &pattern, bool enabled, const std::string &ruleset); + void enable_rule(const std::string &substring, bool enabled, const std::string &ruleset); // Wrapper that assumes the default ruleset - void enable_rule(const std::string &pattern, bool enabled); + void enable_rule(const std::string &substring, bool enabled); // // Enable/Disable any rules with any of the provided tags (set, exact matches only) diff --git a/userspace/engine/rules.cpp b/userspace/engine/rules.cpp index bf148ff0..516d533e 100644 --- a/userspace/engine/rules.cpp +++ b/userspace/engine/rules.cpp @@ -196,20 +196,7 @@ int falco_rules::enable_rule(lua_State *ls) std::string rule = rulec; bool enabled = (lua_tonumber(ls, -1) ? true : false); - // Escape any regex special characters in the rule name - std::string sanitized = rule; - - std::string escape_chars = R"($\.*+?()[]{}|^)"; - - size_t pos = sanitized.find_first_of(escape_chars); - - while (pos != std::string::npos) - { - sanitized.insert(pos, "\\"); - pos = sanitized.find_first_of(escape_chars, pos+2); - } - - rules->enable_rule(sanitized, enabled); + rules->enable_rule(rule, enabled); return 0; } diff --git a/userspace/engine/ruleset.cpp b/userspace/engine/ruleset.cpp index 642d4ba5..47d593c3 100644 --- a/userspace/engine/ruleset.cpp +++ b/userspace/engine/ruleset.cpp @@ -202,19 +202,8 @@ void falco_ruleset::add(string &name, } } -void falco_ruleset::enable(const string &pattern, bool enabled, uint16_t ruleset) +void falco_ruleset::enable(const string &substring, bool enabled, uint16_t ruleset) { - regex re; - bool match_using_regex = true; - - try { - re.assign(pattern); - } - catch (std::regex_error e) - { - match_using_regex = false; - } - while (m_rulesets.size() < (size_t) ruleset + 1) { m_rulesets.push_back(new ruleset_filters()); @@ -223,14 +212,9 @@ void falco_ruleset::enable(const string &pattern, bool enabled, uint16_t ruleset for(const auto &val : m_filters) { bool matches; - if(match_using_regex) - { - matches = regex_match(val.first, re); - } - else - { - matches = (val.first.find(pattern) != string::npos); - } + + matches = (val.first.find(substring) != string::npos); + if (matches) { if(enabled) diff --git a/userspace/engine/ruleset.h b/userspace/engine/ruleset.h index 51891332..0a9f1a59 100644 --- a/userspace/engine/ruleset.h +++ b/userspace/engine/ruleset.h @@ -24,7 +24,6 @@ limitations under the License. #include #include #include -#include #include "sinsp.h" #include "filter.h" @@ -48,9 +47,9 @@ public: // specifying unnecessarily large rulesets will result in // unnecessarily large vectors. - // Find those rules matching the provided pattern and set + // Find those rules matching the provided substring and set // their enabled status to enabled. - void enable(const std::string &pattern, bool enabled, uint16_t ruleset = 0); + void enable(const std::string &substring, bool enabled, uint16_t ruleset = 0); // Find those rules that have a tag in the set of tags and set // their enabled status to enabled. Note that the enabled