github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-25 12:19:56 +00:00
Code Issues Projects Releases Wiki Activity

new(unit_tests,userspace/falco): support loading and merging configs files when used from cmdline option.

Browse Source 
Also, moved core logic from yaml_helper to falco_configuration class.
Finally, updated tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro
2024-04-10 09:30:13 +02:00
committed by poiana
parent faabd41d9e
commit e840a4ada0
4 changed files with 237 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
userspace/falco/configuration.cpp
View File

@@ -93,9 +93,10 @@ void falco_configuration::init(const std::vector<std::string>& cmdline_options)
void falco_configuration::init(const std::string& conf_filename, std::vector<std::string>& loaded_conf_files,
const std::vector<std::string> &cmdline_options)
{
loaded_conf_files.clear();
try
{
config.load_from_file(conf_filename, loaded_conf_files);
config.load_from_file(conf_filename);
}
catch(const std::exception& e)
{
@@ -103,6 +104,7 @@ void falco_configuration::init(const std::string& conf_filename, std::vector<std
throw e;
}
init_cmdline_options(cmdline_options);
merge_configs_files(conf_filename, loaded_conf_files);
load_yaml(conf_filename);
}
@@ -111,6 +113,54 @@ std::string falco_configuration::dump()
return config.dump();
}
void falco_configuration::merge_configs_files(const std::string& config_name, std::vector<std::string>& loaded_config_files)
{
// Load configs files to be included and merge them into current config
loaded_config_files.push_back(config_name);
const auto ppath = std::filesystem::path(config_name);
// Parse files to be included
std::vector<std::string> include_files;
config.get_sequence<std::vector<std::string>>(include_files, yaml_helper::configs_key);
for(const std::string& include_file : include_files)
{
auto include_file_path = std::filesystem::path(include_file);
if (include_file_path == ppath)
{
throw std::logic_error(
"Config error: '" + yaml_helper::configs_key + "' directive tried to recursively include main config file: " + config_name + ".");
}
if (!std::filesystem::exists(include_file_path))
{
// Same we do for rules_file: just skip the entry.
continue;
}
if (std::filesystem::is_regular_file(include_file_path))
{
config.include_config_file(include_file_path.string());
loaded_config_files.push_back(include_file);
}
else if (std::filesystem::is_directory(include_file_path))
{
std::vector<std::string> v;
const auto it_options = std::filesystem::directory_options::follow_directory_symlink
| std::filesystem::directory_options::skip_permission_denied;
for (auto const& dir_entry : std::filesystem::directory_iterator(include_file_path, it_options))
{
if (std::filesystem::is_regular_file(dir_entry.path()))
{
v.push_back(dir_entry.path().string());
}
}
std::sort(v.begin(), v.end());
for (const auto &f : v)
{
config.include_config_file(f);
loaded_config_files.push_back(f);
}
}
}
}
void falco_configuration::load_engine_config(const std::string& config_name)
{
// Set driver mode if not already set.
@@ -608,12 +658,5 @@ void falco_configuration::set_cmdline_option(const std::string &opt)
throw std::logic_error("Error parsing config option \"" + opt + "\". Must be of the form key=val or key.subkey=val");
}
if (keyval.first.rfind(yaml_helper::configs_key, 0) == 0)
{
falco_logger::log(falco_logger::level::WARNING, "Ignoring '-o " + yaml_helper::configs_key + "' directive: cannot be overridden by cmdline.\n");
}
else
{
config.set_scalar(keyval.first, keyval.second);
}
config.set_scalar(keyval.first, keyval.second);
}

7
userspace/falco/configuration.h
View File

@@ -163,7 +163,12 @@ public:
replay_config m_replay = {};
gvisor_config m_gvisor = {};
// Needed by tests
yaml_helper config;
private:
void merge_configs_files(const std::string& config_name, std::vector<std::string>& loaded_config_files);
void load_yaml(const std::string& config_name);
void load_engine_config(const std::string& config_name);
@@ -177,8 +182,6 @@ private:
* are supported and only scalar values are supported.
*/
void set_cmdline_option(const std::string& spec);
yaml_helper config;
};
namespace YAML {

83
userspace/falco/yaml_helper.h
View File

@@ -92,50 +92,31 @@ public:
/**
* Load the YAML document from the given file path.
*/
void load_from_file(const std::string& path, std::vector<std::string>& loaded_config_files)
void load_from_file(const std::string& path)
{
loaded_config_files.clear();
m_root = load_from_file_int(path);
}
m_root = load_from_file_int(path, loaded_config_files);
const auto ppath = std::filesystem::path(path);
// Parse files to be included
std::vector<std::string> include_files;
get_sequence<std::vector<std::string>>(include_files, configs_key);
for(const std::string& include_file : include_files)
void include_config_file(const std::string& include_file_path)
{
auto loaded_nodes = load_from_file_int(include_file_path);
for(auto n : loaded_nodes)
{
auto include_file_path = std::filesystem::path(include_file);
if (include_file_path == ppath)
/*
* To avoid recursion hell,
* we don't support `configs_files` directives from included config files
* (that use load_from_file_int recursively).
*/
const auto &key = n.first.Scalar();
if (key == configs_key)
{
throw std::runtime_error(
"Config error: '" + configs_key + "' directive tried to recursively include main config file: " + path + ".");
}
if (!std::filesystem::exists(include_file_path))
{
throw std::runtime_error("Included config entry not existent: " + include_file_path.string());
}
if (std::filesystem::is_regular_file(include_file_path))
{
include_config_file(include_file_path.string(), loaded_config_files);
}
else if (std::filesystem::is_directory(include_file_path))
{
std::vector<std::string> v;
const auto it_options = std::filesystem::directory_options::follow_directory_symlink
| std::filesystem::directory_options::skip_permission_denied;
for (auto const& dir_entry : std::filesystem::directory_iterator(include_file_path, it_options))
{
if (std::filesystem::is_regular_file(dir_entry.path()))
{
v.push_back(dir_entry.path().string());
}
}
std::sort(v.begin(), v.end());
for (const auto &f : v)
{
include_config_file(f, loaded_config_files);
}
"Config error: '" + configs_key + "' directive in included config file " + include_file_path + ".");
}
// We allow to override keys.
// We don't need to use `get_node()` here,
// since key is a top-level one.
m_root[key] = n.second;
}
}
@@ -204,37 +185,13 @@ public:
private:
YAML::Node m_root;
YAML::Node load_from_file_int(const std::string& path, std::vector<std::string>& loaded_config_files)
YAML::Node load_from_file_int(const std::string& path)
{
auto root = YAML::LoadFile(path);
pre_process_env_vars(root);
loaded_config_files.push_back(path);
return root;
}
void include_config_file(const std::string& include_file_path, std::vector<std::string>& loaded_config_files)
{
auto loaded_nodes = load_from_file_int(include_file_path, loaded_config_files);
for(auto n : loaded_nodes)
{
/*
* To avoid recursion hell,
* we don't support `configs_files` directives from included config files
* (that use load_from_file_int recursively).
*/
const auto &key = n.first.Scalar();
if (key == configs_key)
{
throw std::runtime_error(
"Config error: '" + configs_key + "' directive in included config file " + include_file_path + ".");
}
// We allow to override keys.
// We don't need to use `get_node()` here,
// since key is a top-level one.
m_root[key] = n.second;
}
}
/*
* When loading a yaml file,
* we immediately pre process all scalar values through a visitor private API,