github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-21 12:29:19 +00:00
Code Issues Projects Releases Wiki Activity

update(userspace/engine): support tranformers in exception fields

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2024-03-27 12:31:57 +00:00 committed by poiana
parent fa8e780b07
commit f18ea1e8b7
2 changed files with 24 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
userspace/engine/falco_source.h
View File

@ -56,12 +56,30 @@ struct falco_source
// matches an event.
mutable std::vector<falco_rule> m_rules;
inline bool is_field_defined(const std::string& field) const
inline bool is_valid_lhs_field(const std::string& field) const
{
if (filter_factory->new_filtercheck(field.c_str()) != nullptr)
// if there's at least one parenthesis we may be parsing a field
// wrapped inside one or more transformers. In those cases, the most
// rigorous analysis we can do is compiling a simple filter using
// the field as left-hand side of a comparison, and see if any error
// occurs.
if (field.find('(') != std::string::npos)
{
try
{
auto filter = field;
filter.append(" exists");
sinsp_filter_compiler(filter_factory, filter).compile();
return true;
}
catch (...)
{
return false;
}
}
// otherwise, simply attempt creating a filtercheck with the given
// field name and see if we succeed
return filter_factory->new_filtercheck(field.c_str()) != nullptr;
}
};

4
userspace/engine/rule_loader_collector.cpp
View File

@ -88,7 +88,7 @@ static void validate_exception_info(
{
for (const auto &v : ex.fields.items)
{
THROW(!source->is_field_defined(v.item),
THROW(!source->is_valid_lhs_field(v.item),
std::string("'") + v.item + "' is not a supported filter field",
ex.ctx);
}
@ -109,7 +109,7 @@ static void validate_exception_info(
ex.ctx);
if (source)
{
THROW(!source->is_field_defined(ex.fields.item),
THROW(!source->is_valid_lhs_field(ex.fields.item),
std::string("'") + ex.fields.item + "' is not a supported filter field",
ex.ctx);
}