4 Commits

Author	SHA1	Message	Date
Mark Stemm	2d5fc0b647	Use the same falco_rule struct for every call to filter_ruleset ... Instead of using a falco_rule struct on the stack, use a single value inside the falco_source struct. It's mutable as find_source returns a const struct. At very high event volumes (> 1M syscalls/second), even the tiny time it takes to create/destroy the struct starts to add up, and this switch has some small cpu savings. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-09-16 12:50:39 +02:00
Jason Dellaluce	13d70b65ae	update(userspace/engine): rename ruleset.h in filter_ruleset.h ... Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com> Co-authored-by: Leonardo Grasso <me@leonardograsso.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	0abd7eaa28	refactor(userspace/engine): refactor engine interface and internals ... This updates the engine to comply and work properly with the newly-introduced interface design. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	f41f51f736	refactor(userspace/engine): update falco engine to use new ruleset interface and have one ruleset for each source ... This also fixes a couple of bugs. With the current implementation, the multi-ruleset feature is broken with multiple sources. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00