github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-21 12:29:19 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): support tranformers in exception fields

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2024-03-27 12:31:57 +00:00 committed by poiana
parent fa8e780b07
commit f18ea1e8b7
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
userspace/engine/falco_source.h
View File

@ -56,12 +56,30 @@ struct falco_source
// matches an event. // matches an event.
mutable std::vector<falco_rule> m_rules; mutable std::vector<falco_rule> m_rules;
inline bool is_field_defined(const std::string& field) const inline bool is_valid_lhs_field(const std::string& field) const
{ {
if (filter_factory->new_filtercheck(field.c_str()) != nullptr) // if there's at least one parenthesis we may be parsing a field
// wrapped inside one or more transformers. In those cases, the most
// rigorous analysis we can do is compiling a simple filter using
// the field as left-hand side of a comparison, and see if any error
// occurs.
if (field.find('(') != std::string::npos)
{ {
try
{
auto filter = field;
filter.append(" exists");
sinsp_filter_compiler(filter_factory, filter).compile();
return true; return true;
} }
catch (...)
{
return false; return false;
} }
}
// otherwise, simply attempt creating a filtercheck with the given
// field name and see if we succeed
return filter_factory->new_filtercheck(field.c_str()) != nullptr;
}
}; };

4
userspace/engine/rule_loader_collector.cpp
View File

@ -88,7 +88,7 @@ static void validate_exception_info(
{ {
for (const auto &v : ex.fields.items) for (const auto &v : ex.fields.items)
{ {
THROW(!source->is_field_defined(v.item), THROW(!source->is_valid_lhs_field(v.item),
std::string("'") + v.item + "' is not a supported filter field", std::string("'") + v.item + "' is not a supported filter field",
ex.ctx); ex.ctx);
} }
@ -109,7 +109,7 @@ static void validate_exception_info(
ex.ctx); ex.ctx);
if (source) if (source)
{ {
THROW(!source->is_field_defined(ex.fields.item), THROW(!source->is_valid_lhs_field(ex.fields.item),
std::string("'") + ex.fields.item + "' is not a supported filter field", std::string("'") + ex.fields.item + "' is not a supported filter field",
ex.ctx); ex.ctx);
} }