Support enabled flag for rules.

If a rule has a enabled attribute, and if the value is false, call the
engine's enable_rule() method to disable the rule. Like add_filter,
there's a static method which takes the object as the first argument and
a non-static method that calls the engine.

This fixes #72.
This commit is contained in:
Mark Stemm
2016-09-03 08:37:35 -07:00
parent 897df28036
commit f68fba103e
3 changed files with 36 additions and 0 deletions

View File

@@ -188,6 +188,15 @@ function load_rules(rules_content, rules_mgr, verbose, all_events)
else
state.filter_ast = { type = "BinaryBoolOp", operator = "or", left = state.filter_ast, right = filter_ast.filter.value }
end
-- Enable/disable the rule
if (v['enabled'] == nil) then
v['enabled'] = true
end
if (v['enabled'] == false) then
falco_rules.enable_rule(rules_mgr, v['rule'], 0)
end
else
error ("Unexpected type in load_rule: "..filter_ast.type)
end