falco

mirror of https://github.com/falcosecurity/falco.git synced 2025-08-15 12:53:42 +00:00

Author	SHA1	Message	Date
Federico Di Pierro	f7e15ca282	chore(userspace): cleanup old code. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-06-22 10:08:55 +02:00
Federico Di Pierro	c0ea9b3618	fix(userspace): switch to `timer_settime` API in stats writer. It seems like `setitimer` is not correctly working when built from CI; perhaps a gcc/glibc bug? Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-06-22 10:08:55 +02:00
Jason Dellaluce	7c387069af	chore(userspace/falco): make source matching error more expressive Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-06-21 15:41:52 +02:00
Lorenzo Susini	0034d01a50	update(userspace): change description of snaplen option Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-06-12 14:45:09 +02:00
Daniel Wright	9097d2c359	fix: unquote quoted URL's to avoid libcurl errors This commit will unquote URL's allowing them to be supported by libcurl and eliminate any errors when a valid (quoted) URL is supplied by a user. Closes #2579 Signed-off-by: Daniel Wright danielwright@bitgo.com	2023-06-05 11:09:32 +02:00
Lorenzo Susini	9fda7dfb93	fix(userspace/engine): store alternatives as array in -L json output Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-31 16:16:31 +02:00
Melissa Kilby	aa8c13b4e4	cleanup(userspace): adjust stats n_drops_perc Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-31 15:48:32 +02:00
Melissa Kilby	efd0c7421e	cleanup(userspace,config): apply reviewers suggestions Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-31 15:48:32 +02:00
Melissa Kilby	e775fc6f5b	cleanup(userspace): improve metrics UX add send_numeric_zero_values config to allow users to save space when using metrics option, while still also allowing to send all keys (especially because we don't document the schema) Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-31 15:48:32 +02:00
Lorenzo Susini	79b9d0ff21	fix(userspace/engine): store required engine version as string in -L json output Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-30 12:09:30 +02:00
Lorenzo Susini	6e12b95dd2	update(userspace/engine): address jasondellaluce comments Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-30 10:45:30 +02:00
Lorenzo Susini	0bd609d5a4	update(userspace/falco): update description of -l and -L flags Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-30 10:45:30 +02:00
Lorenzo Susini	cfb96d0562	update(userspace/engine): adding required_engine_version, required_plugin_versions and exception names to -L output Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-30 10:45:30 +02:00
Lorenzo Susini	75f556e3b7	update(userspace/engine): add required_engine_version to rule collector Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-30 10:45:30 +02:00
Jason Dellaluce	1263c67ac6	chore: apply codespell suggestions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-29 12:26:24 +02:00
Jason Dellaluce	a9ea18b99a	fix(userspace/falco): report plugin deps rules issues in any case Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-29 12:26:24 +02:00
Jason Dellaluce	b58a373835	chore(userspace/falco): always print invalid syscalls from custom set Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-25 14:14:11 +02:00
Roberto Scolaro	2dadb05af6	fix(userspace/falco/app/actions): hotreload on wrong metrics Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-25 14:09:10 +02:00
Andrea Terzolo	1098b6f7ca	cleanup: rename a file Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-05-25 10:23:10 +02:00
Andrea Terzolo	1a359f5806	fix: add a check on online CPUs Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-05-25 10:23:10 +02:00
Jason Dellaluce	0943456ffe	fix(userspace/falco): don't hang on terminating error when multi sourcing Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-24 19:12:06 +02:00
Jason Dellaluce	b40a6bc703	fix(userspace/falco): right boundary checks for strncat Co-authored-by: Federico Di Pierro <nierro92@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-23 16:53:35 +02:00
Jason Dellaluce	75720534d7	fix(userspace/falco): solve escape issues in grpc output Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-23 16:53:35 +02:00
Jason Dellaluce	00acd17ba1	fix(userspace/faclco): output drop perc metric only if drops are present Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-23 16:53:35 +02:00
Jason Dellaluce	d550552fc1	fix(userspace/falco): properly format numeric values in metrics Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-23 16:53:35 +02:00
Melissa Kilby	eaa4354ddf	cleanup(userspace/falco): new consistent metrics output fields classes falco. and scap. * Ensure each metric field name more consistently adheres to the grammar used in Falco rules: * `falco.`: new field class representing userspace counters, statistics, resource utilization, or necessary information fields * `scap.`: new field class represents counters and statistics mostly obtained from Falco's kernel instrumentation before events are sent to userspace, but can include scap userspace stats as well * minor cleanup Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	8e0c89d3b4	cleanup(userspace/engine): prometheus compliant regex parsing for metrics interval Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	fcecde845d	cleanup(userspace): move parse_prometheus_interval to falco_utils Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	f2318a9ac5	cleanup(userspace/falco): address reviewers comments + cleanup * prefix counters and stats belonging to kernel space w/ `k.` else `u.` for userspace * add n_drops_perc from old stats writer schema * revert one change: file output shall reflect exact same "output_fields" key as rule output, note that src is already part of the "output_fields" schema. Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Jason Dellaluce	5d35cda8dc	update(userspace): minor polishing Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-23 09:58:34 +02:00
Jason Dellaluce	f117d5273c	update(userspace): refactor metrics data flow and fix bugs Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	f0ac327f98	cleanup(userspace/falco): add more fields to metrics Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	e37027a1d0	cleanup(userspace/falco): address reviewers comments * renaming to `metrics` for technical clarity * adopt Prometheus like metrics interval settings Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	134d2630e9	new(userspace/falco): stats v2 config option to convert memory metrics to MB Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	78dbfab48f	feat(userspace/falco)!: use new resource_utilization metrics / stats v2 schema for stats file ouput logs These changes break the old stats file output schema and consolidates them with the new schema. Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	4d24bcdd2f	new(userspace/falco)!: introduce native support for resource_utilization metrics / stats v2 Intended to phase out previous stats writer settings and log schema. Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Melissa Kilby	44d9f99c72	new(userspace/falco)!: new stats v2 configs Intended to phase out previous stats writer settings and log schema. Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-05-23 09:58:34 +02:00
Jason Dellaluce	7248284b12	chore(userspace/falco/app): print all supported plugin caps Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-22 15:23:32 +02:00
Lorenzo Susini	e47ece4de9	update(userspace/engine): address jasondellaluce comments - avoiding inspector to be allocated for each rule - use two boolean values for expecting macros and lists - move items of lists alongside name, under info - use snake case for json output, like we do for e.g alerts - correctly retrieve evt names - consider two levels of lists for exception operators Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	1195b1e7f0	update(userspace/engine): better modularize the code for getting json details Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	e11b4c4430	update(userspace/engine): add event codes to json output Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	46cbc3c589	update(userspace/engine): add info about all macros and lists in -L option Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	e30729555b	update(userspace/engine): add enabled information to json output Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	727aed0c03	update(userspace/engine): avoid solving macros AST at each cycle when getting details of all rules Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	c1623771d8	update(userspace/engine): correctly use describe rule based on config Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	9947962cb8	update(userspace/engine): let describe_rule function print out json details when requested Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Lorenzo Susini	a6542a6487	new(userspace/engine): introduce new class to get details about rules Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-05-19 15:56:05 +02:00
Jason Dellaluce	c603055acf	fix(userspace/engine): don't count async event for evttype warning Co-authored-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	bb04892baf	fix(userspace/falco): avoid double plugin initializations Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	9df72e0f2a	fix(userspace/falco/app): properly populate filtercheck lists Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	4e8d1f025c	fix(userspace/falco/app): skip unnecessary app steps Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	9bfce8cfae	update(userspace): make sure that async event is always matched in rules Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	733ea88ab3	fix(userspace/falco): properly init configuration Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	b2615de062	new(userspace/falco/app): print a warning if multiple plugins for same source are loaded Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	0649be619b	update(userspace/falco/app): support nodriver open mode and plugins sourcing system events Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	301c4efeb7	update(userspace/falco): support new plugin API definitions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	5175a04c6b	update(userspace/engine): bump engine checksum Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Jason Dellaluce	3681cacda1	new(userspace/falco): add new --nodriver option Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-05-19 12:15:04 +02:00
Andrea Terzolo	696fa43dc2	cleanup(actions): now modern bpf support `-A` flag Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-05-17 12:19:00 +02:00
Andrea Terzolo	e83dbe85f7	cleanup(config): modern bpf is no more experimental Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-05-12 12:27:45 +02:00
Jason Dellaluce	1f4919bfe1	update: improve control and UX of ignored events Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-27 11:10:14 +02:00
Jason Dellaluce	4d24a02ad6	fix(userspace/falco): preserve config's plugin loading order Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-26 12:59:13 +02:00
Jason Dellaluce	8926022035	update: adapt Falco to new sinsp event source management Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-26 12:59:13 +02:00
Jason Dellaluce	95fa953398	update(cmake): bump libs and driver to ffcd702cf22e99d4d999c278be0cc3d713c6375c Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-26 12:59:13 +02:00
Jason Dellaluce	3b64052832	update(userspace/falco): leverage new sc_set_to_event_names API Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-04-04 19:39:53 +02:00
Leonardo Grasso	88b9537618	chore(userspace/falco): remove Mesos support Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2023-04-04 18:31:52 +02:00
Leonardo Grasso	5c0cd6a170	update!: remove `--mesos-api`,`-pmesos`, and `-pm` command-line flags Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2023-04-04 18:31:52 +02:00
Melissa Kilby	0b6e243582	cleanup(app_acions): fine-tune base_syscalls.repair behavior Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-03-30 19:08:33 +02:00
Melissa Kilby	78daafb56c	cleanup(app_actions): finalize base_syscalls.repair option Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-03-30 19:08:33 +02:00
Jason Dellaluce	2b93a79521	refactor: apply review suggestions Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-30 19:08:33 +02:00
Melissa Kilby	e360175c15	fix(app_actions): enforce PPM_SC_SCHED_PROCESS_EXIT for base_syscalls.custom_set Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-03-30 19:08:33 +02:00
Melissa Kilby	692abf71eb	new(app_actions): add base_syscalls.repair option See https://github.com/falcosecurity/falco/issues/2433 Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-03-30 19:08:33 +02:00
Melissa Kilby	1d66eb4d6d	cleanup(app_actions): add warnings for invalid syscalls in user base_syscalls set Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-03-30 19:08:33 +02:00
Aldo Lacuku	31335d3c3b	new(falco/config): add new configuration for http_output Support for user provided CA certificate that can verify the remote server. Users can provide path to the CA certiface store by providing a path to the dir or to the CA store file. If needed users can decide to tell Falco to not verify the server. Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2023-03-30 17:11:33 +02:00
Federico Di Pierro	0b7ca2823e	chore(userspace): apply review suggestions. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Jason Dellaluca <jasondellaluce@gmail.com>	2023-03-28 19:01:30 +02:00
Federico Di Pierro	b2e03b1938	chore(userspace): `syscall_drop_failed` -> `syscall_drop_failed_exit`. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-03-28 19:01:30 +02:00
Federico Di Pierro	70c6c93389	chore(userspace): improved wording. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-03-28 19:01:30 +02:00
Federico Di Pierro	bf5e340833	new(userspace/falco): added `syscall_drop_failed` option to drop failed syscalls exit events. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-03-28 19:01:30 +02:00
Federico Di Pierro	e6078c8d16	chore(userspace): updated fields checksum. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-03-22 11:17:07 +01:00
Federico Di Pierro	17b170b4f9	update(cmake,userspace): bumped to libs master. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-03-22 11:17:07 +01:00
rabbitstack	03285f4140	define Windows equivalent for srandom and random functions Signed-off-by: rabbitstack <nedim.sabic@sysdig.com>	2023-03-17 10:23:26 +01:00
Jason Dellaluce	93ae6bb609	chore(userspace/falco): fix codespell typos Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	e07e3abfb5	update(userspace/falco): implement debouncing logic in restart handler Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	3f69d46f9a	update(userspace/falco): minor compilation improvements Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	647441c06c	fix(userspace/falco): solve gettid compilation issues Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	cd155ed6f5	refactor(userspace/falco): update actions to use new hot restarter utility with dry-run safetyc checks Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	561022ebb6	new(userspace/falco): add utility for handling hot app restarts Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	af46833ad3	update(userspace/falco): make cmdline options simpler and copyable Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	e40369648c	fix(userspace/falco): solve minor compilation flaws Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	ee7fa1cb06	new(usersapce/falco): add an app option for dry-run Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-15 17:54:49 +01:00
Jason Dellaluce	e8b776a9cb	update(userspace/engine): bump engine version to 17 Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-09 09:39:12 +01:00
Jason Dellaluce	09ab9db423	chore(userspace/falco): apply review suggestion Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-09 09:39:12 +01:00
Jason Dellaluce	61a7f32982	chore(userspace/falco): apply review suggestions Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-09 09:39:12 +01:00
Jason Dellaluce	2645f6640c	chore(userspace/falco): rename source file using its action name Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-09 09:39:12 +01:00
Jason Dellaluce	fb37d8f365	refactor(userspace/falco): adapt event set selection to only use ppm_sc and new engine features Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-09 09:39:12 +01:00
Jason Dellaluce	19ffadc763	update(userspace/engine): support searching ppm_sc events in rulesets Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-03-09 09:39:12 +01:00
Melissa Kilby	0de9af9ed0	fix(app_actions): base_syscalls check for empty string Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-24 11:43:43 +01:00
Melissa Kilby	58dc60e58d	cleanup(app_actions): address reviewers comments * Plus minor adjustments to ensure correct state_event_set for all configurations * Ensure valid check_for_rules_unsupported_events for all configurations * Remove user input validation warning -> re-introduce in follow up PR Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-24 11:43:43 +01:00
Melissa Kilby	b6f6195725	cleanup(app_actions): include activated syscalls in LOG_DEBUG logs Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-24 11:43:43 +01:00
Melissa Kilby	76a3c8d7ee	new(app_actions): introduce base_syscalls See https://github.com/falcosecurity/falco/issues/2373 Co-authored-by: Federico Di Pierro <nierro92@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-24 11:43:43 +01:00
Jason Dellaluce	7d67fbbfe7	chore(userspace/falco): apply review suggestions Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	5ed5c63202	refactor: adapt event set configuration changes to new libs definition Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	4706cd8b4e	cleanup: solve std namespace issues and remove unused imports Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	010f6c6a9e	update(userspace/engine): bump fields checksum Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	1485dc5d68	refactor(userspace/falco): adapt app actions to new event definitions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	e7d76ca722	refactor(userspace/falco): use new event definitions in app state Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	6c38ecaf0e	update(userspace/engine): adapt engine classes to new libsinsp event definitions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	34ea7a8245	cleanup(userspace/engine): drop filtr_evttype_resolver Its logic was ported into libsinsp in: `3d8550e70e` Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 14:31:28 +01:00
Melissa Kilby	d89f4b4904	cleanup(app_actions): adjust ignored events Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-21 14:31:28 +01:00
Melissa Kilby	16aa36291a	fix rebase Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-21 14:31:28 +01:00
Melissa Kilby	72439b2eed	cleanup(app_actions): adjust configure_interesting_sets * address reviewers feedback * improve clarity around new -A and -i behavior * additional cleanup (e.g. use generic set operations only) * extend unit tests Note: sinsp ppm sc API is undergoing a refactor, therefore current lookups are interim and will subsequently be refactored as well. Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-21 14:31:28 +01:00
Melissa Kilby	30fe065446	cleanup(app_actions): configure -A w/ new default behavior Define new -A behavior in configure_interesting_sets * default: all syscalls in rules included, sinsp state enforcement without high volume I/O syscalls * -A flag set: all syscalls in rules included, sinsp state enforcement and allowing high volume I/O syscalls Co-authored-by: Federico Di Pierro <nierro92@gmail.com> Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-21 14:31:28 +01:00
Melissa Kilby	91c185a178	cleanup(app_actions): include evttypes from rules in configure_interesting_sets Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2023-02-21 14:31:28 +01:00
Jason Dellaluce	34ed5a5fc9	chore: fix typos Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 11:09:29 +01:00
Jason Dellaluce	70c22c7d2e	refactor(userspace/falco): adapt actions to new signal handler constructs Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 11:09:29 +01:00
Jason Dellaluce	eb3bf7260d	refactor(userspace/falco): add an ad-hoc concurrent object for signal handlers Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 11:09:29 +01:00
Jason Dellaluce	5470a88b61	fix(userspace/falco): add missing constructors/methods on falco semaphore Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-21 11:09:29 +01:00
Jason Dellaluce	bf5b8f5c83	new(userspace/falco): add intermediate cmake target for falco app Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-15 10:51:35 +01:00
Jason Dellaluce	c45bf3eb17	chore(userspace/falco): rename falco_init into falco_run Co-authored-by: Federico Di Pierro <nierro92@gmail.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	149544d7ab	chore(userspace/falco): fix spacing and license Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	1eb915bf2f	fix(userspace/falco): solve issues with minimal build Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	5d35dff2a7	refactor(userspace/falco/app): standalone sources for action helpers Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	799557f7f7	refactor(userspace/falco/app): make run and teardown actions consistent Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	fe859bda2d	refactor(userspace/engine): turn app methods into simple functions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	374136be18	refactor(userspace/engine): add standalone sources for app signals and options Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	623d27ef77	refactor(userspace/engine): create standalone sources for app state and run result Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	0f402d01d0	fix(userspace/falco): add missing pragma once Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Jason Dellaluce	ff68311629	fix(userspace/engine): add missing include Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 17:33:31 +01:00
Lorenzo Susini	88ac30650c	fix(userspace/engine): correctly bump engine version after introduction of new fields Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>	2023-02-14 13:03:06 +01:00
Jason Dellaluce	79b3f81a02	chore: fix typos Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 12:47:07 +01:00
Jason Dellaluce	2495827e0c	fix(userspace/engine): correctly handle evttype indexing corner cases Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-14 12:47:07 +01:00
Federico Di Pierro	75dc8c050c	new(userspace,tests): add proper support for generic events indexing. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-02-13 14:54:03 +01:00
Andrea Terzolo	dca76ba93c	chore: fix building with njson Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-02-10 11:41:24 +01:00
Federico Di Pierro	7343bcf050	cleanup(uerspace/falco): do not enter dropping mode. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-02-09 14:16:31 +01:00
Jason Dellaluce	eaeec7c079	fix(userspace): avoid using std namespace in sources Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-08 15:30:29 +01:00
Jason Dellaluce	54f117141b	update(userspace/engine): avoid relying on leaked std namespace Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-02-08 15:30:29 +01:00
Andrea Terzolo	1b11a041b5	update: change `cpus_for_each_syscall_buffer` default value Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-02-03 12:50:20 +01:00
Andrea Terzolo	8eb6fbf32d	fix(userspace): use the right path for the `cpus_for_each_syscall_buffer` Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-01-26 11:44:44 +01:00
Andrea Terzolo	77686cb8b9	update: don't expose available CPU feature Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-01-24 12:41:34 +01:00
Andrea Terzolo	42670a50c7	new: support multiple buffer modes and online CPUs Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2023-01-24 12:41:34 +01:00
Federico Di Pierro	e64c14a947	fix(userspace/falco): fixed grpc server shutdown. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-01-24 11:59:34 +01:00
Federico Di Pierro	306f9ba468	fix(userspace/falco): fixed build. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2023-01-17 16:00:23 +01:00
Jason Dellaluce	55a6436ee8	new(userspace/falco): add webserver endpoint for retrieving internal versions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-16 17:24:54 +01:00
Jason Dellaluce	ea48ec70be	refactor(userspace/falco): use new utility for printing versions and support Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-16 17:24:54 +01:00
Jason Dellaluce	7724ad940a	new(userspace/falco): standaline utility for retrieving internal version numbers Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-16 17:24:54 +01:00
Jason Dellaluce	c69b198777	chore(userspace/falco): cleanup error message when no output is configured Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	db2f5d5e9c	fix(userspace/falco): solve tests issues Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	4aefb7fd7d	fix(userspace/falco): require config file only when needed Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	149c95c3fb	fix(userspace/falco): load config before every other action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	78312c8c15	update(userspace/falco): clean up configuration and allow re-initialization Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	d6bbf5d442	refactor(userspace/falco): isolate yaml helpers (2) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	2eac8f88cb	refactor(userspace/falco): isolate yaml helpers (1) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	bc3ec30f3e	chore(userspace/falco) remove unused var Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	42ef8db26f	refactor(userspace/falco): deprecate version-json option and rely on json_output Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	09d9ae135b	update(userspace/falco): load default config at app initialization Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	57cafcb65a	refator(userspace/falco): allow loading default config with no file Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-15 18:30:15 +01:00
Jason Dellaluce	c1985a7c99	fix(userspace/engine): absolute rule condition position in validation context Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-10 12:55:43 +01:00
Jason Dellaluce	d79d7112a0	fix(userspace/engine): catch YAML parsing and validation errors with right context Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2023-01-10 12:55:43 +01:00
Luca Guerra	1b2c7ef7d9	new(falco): add --version-json to print version information in json format Signed-off-by: Luca Guerra <luca@guerra.sh>	2023-01-10 12:35:43 +01:00
Leonardo Grasso	280fcfe5d3	update: deprecate Mesos support, `--mesos-api`, and `-pm` command-line flags Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2023-01-09 14:04:55 +01:00
Andrea Terzolo	609171fe14	doc: reword Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Federico Di Pierro <nierro92@gmail.com>	2022-12-21 14:56:02 +01:00
Andrea Terzolo	de6292ce09	doc(userspace): fix a warning message Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-12-21 14:56:02 +01:00
Luca Guerra	6ea233dd75	new(falco): add engine version to --version Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-12-16 12:09:24 +01:00
Luca Guerra	dde2fdd67c	new(falco): add driver_api_version, driver_schema_version, default_driver_version, libs_version to support Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-12-16 12:09:24 +01:00
Jason Dellaluce	5552bcab76	chore: fix typo Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-12-13 15:06:10 +01:00
Jason Dellaluce	25ddc3c6a2	update(userspace/engine): broader err catching support in macro resolver Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-12-13 15:06:10 +01:00
Jason Dellaluce	35dd0fc153	fix(userspace/engine): implement loop detection in macro resolver Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-12-13 15:06:10 +01:00
Federico Di Pierro	4696948754	fix(cmake): properly fetch dev version by appending latest Falco tag, delta between master and tag, and hash. `describe` can no more be used as tags are now made on release branches. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-12-12 11:11:44 +01:00
Andrea Terzolo	52ee61b800	chore(userspace): add `njson` lib as a dependency for `falco_engine` Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-12-10 17:07:06 +01:00
Andrea Terzolo	94ed56df95	chore: bump libs Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-12-06 12:59:50 +01:00
Andrea Terzolo	6a972272c0	update: the capture will be stopped in the inspector destructor Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-12-06 12:59:50 +01:00
Andrea Terzolo	55deb452d8	update: start/stop capture inside `do_inspect` Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-12-06 12:59:50 +01:00
Federico Di Pierro	87371492c5	update(userspace/engine): updated checksum. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-12-06 12:59:50 +01:00
Federico Di Pierro	17dfe4f55d	fix(userspace/falco): properly start/stop capture. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-12-06 12:59:50 +01:00
Mark Stemm	356a4a0749	Also copy ruleset when copying falco source In the copy constructor and assignment operator for falco_source, also copy the ruleset along with factories/name. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-12-01 17:07:52 +01:00
Mark Stemm	910b8ff858	Fix(engine) Save parse positions when finding unresolved macros Now that ASTs contain parse positions, use them when reporting errors about unknown macros. When doing the first pass to find all macro references, save macros as a map<macro name,parse position> instead of a set<macro name>. While making that change, change the visitor struct to use references instead of pointers. In the second pass, when reporting any unresolved macro references, also report the parse position. The unit tests also check that the positions of macros are properly returned in the resolved/unresolved maps. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-12-01 17:03:52 +01:00
Mark Stemm	83b12bab1d	Fix(engine): include parse positions in compile errors Now that ASTs have parse positions and the compiler will return the position of the last error, use that in falco rules to return errors within condition strings instead of reporting the position as the beginning of the condition. This led to a change in the filter_ruleset interface--now, an ast is compiled to a filter before being passed to the filter_ruleset object. That avoids polluting the interface with a lot of details about rule_loader contexts, errors, etc. The ast is still provided in case the filter_ruleset wants to do indexing/analysis of the filter. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-12-01 17:03:52 +01:00
Jason Dellaluce	ba61706557	update(userspace/falco): enable using zlib with webserver Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-11-30 19:24:47 +01:00
Jason Dellaluce	15b57bd972	fix: remove minor string view dependencies Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-11-29 16:27:42 +01:00
Leonardo Grasso	68f4d5bb59	fix(userspace/engine): no need to use external deps Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-11-29 16:27:42 +01:00
Leonardo Grasso	47fd90bb7f	chore: remove not used dependency - string-view-lite Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-11-29 16:27:42 +01:00
Luca Guerra	f08a5b4067	update(cli): also add cg / kg container-gvisor / kubernetes-gvisor Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-11-23 13:03:57 +01:00
Luca Guerra	dea02f82e8	update(falco): add container-gvisor and kubernetes-gvisor print options Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-11-23 13:03:57 +01:00
Luca Guerra	e3dbae3259	fix(engine): fix warning about redundant std::move Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-11-11 16:19:11 +01:00
Aldo Lacuku	161246fe1a	fix(output): do not print syscall_buffer_size when gvisor is enabled Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2022-11-10 10:32:05 +01:00
Jason Dellaluce	240c0b870d	fix(userspace/falco): verify engine fields only for syscalls Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-11-07 15:37:25 +01:00
Mark Stemm	acf5c4ce5f	fix(engine): save syscall source only when processing events The optimization in https://github.com/falcosecurity/falco/pull/2210 had a bug when the engine uses multiple sources at the same time--m_syscall_source is a pointer to an entry in the indexed vector m_sources, but if add_source is called multiple times, the vector is resized, which copies the structs but invalidates any pointer to the vector entries. So instead of caching m_syscall_source in add_source(), cache it in process_events(). m_sources won't change once processing events starts. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-10-27 18:23:25 +02:00
Yarden Shoham	4a4fa2592b	fix(plugins): trim whitespace in `open_params` `open_params` is read from the falco YAML configuration file and parsed using Go's URL. For example: `c349be6e84/plugins/k8saudit/pkg/k8saudit/source.go (L41-L42)` Go's URL parser does not handle whitespace, so if a user defines the `open_params` in the falco configuration file as follows ```yaml open_params: > /file/path ``` the parser returns an error. To avoid this, we now trim this parameter so no whitespace will be left for Go's URL parser to error out on. For reference see #2262. Signed-off-by: Yarden Shoham <hrsi88@gmail.com>	2022-10-21 19:12:58 +02:00
Jason Dellaluce	10fe9fd84b	fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-14 13:12:22 +02:00
Jason Dellaluce	3d7677ce5b	update(userspace/falco): create struct for sync parallel event sources parallelization Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-14 13:12:22 +02:00
Jason Dellaluce	0fd765f7c3	new(userspace/falco): add simple semaphre implementation Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-14 13:12:22 +02:00
Jason Dellaluce	cca90b2f80	update(userspace/falco): move on from deprecated libs API for printing event list Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-13 17:00:18 +02:00
Jason Dellaluce	6c873418ce	chore(userspace/falco): improve the CLI options helper Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-13 15:39:18 +02:00
Jason Dellaluce	f12531a153	chore(userspace/falco): log cli options with debug level Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-13 15:39:18 +02:00
Jason Dellaluce	9d8f130f47	fix(userspace/falco): make sure validation summary is populated even when json output is requested Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 14:03:20 +02:00
Jason Dellaluce	9ee0298c4d	fix(userspace/engine): avoid macro/list used checks if we encounter an error Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 14:03:20 +02:00
Jason Dellaluce	7da30ca661	chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 13:14:20 +02:00
Jason Dellaluce	57b26530b6	update(userspace) fix cppcheck warnings Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 12:07:20 +02:00
Jason Dellaluce	3629c4dc4a	update(userspace): solve cppcheck performance suggestions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 12:07:20 +02:00
Jason Dellaluce	5e531870a9	fix(userspace/engine): fix unit test segfault Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 11:17:20 +02:00
Jason Dellaluce	f684e144be	chore(userspace/falco): polish ignored event warning message Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 11:17:20 +02:00
Jason Dellaluce	a4218a4b4f	fix(userspace/falco): print right list in ignored events warning Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 11:17:20 +02:00
Jason Dellaluce	48fbe0801d	fix(userspace/falco): print right list of ignored events when in simple cons mode Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 11:17:20 +02:00
Jason Dellaluce	c47492ab6d	update(userspace/falco): populate list of interesting event types in app state Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 11:17:20 +02:00
Jason Dellaluce	4cb556aed2	update(userspace/engine): use sinsp api to access event table information Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-12 11:17:20 +02:00
Jason Dellaluce	5f2bc6a2d3	fix(userspace/falco): properly handle termination at source opening failures Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 19:23:17 +02:00
Jason Dellaluce	88c7202fdc	fix(userspace/falco): check conditions in right order Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 19:23:17 +02:00
Jason Dellaluce	a98a1b2c4c	fix(userspace/falco/falco): allow output reopening to happen multiple times Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 19:23:17 +02:00
Jason Dellaluce	77857a7236	fix(userspace/falco): solve warning Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 19:23:17 +02:00
Jason Dellaluce	e011b3b5e5	chore(userspace/falco): fix typo Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 19:23:17 +02:00
Jason Dellaluce	fd4d521a5f	fix(userspace/falco): make multi-source termination condition more stable Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 19:23:17 +02:00
Jason Dellaluce	3f3386cfe0	fix(userspace/falco): make signal handlers safe with multi-threading Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 19:23:17 +02:00
Jason Dellaluce	11160f8463	fix(userspace): safely check string bounded access Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-11 11:23:15 +02:00
Jason Dellaluce	3c02b40a21	chore(userspace/falco): make log message termination consistent Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-06 21:27:06 +02:00
Jason Dellaluce	e85a8c914f	chore(userspace/falco): move enabled sources list printout when capture is opened Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-06 21:27:06 +02:00
Jason Dellaluce	21c2b1f472	update(userspace/falco): use unordered_set where possible for faster lookups Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-06 21:27:06 +02:00
Jason Dellaluce	909f6d0961	chore(userspace/falco): make log messages formatting more consistent Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-06 21:27:06 +02:00
Jason Dellaluce	83a83a5853	update(userspace): pass string as const refs when possible Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-06 21:27:06 +02:00
Jason Dellaluce	b4ea2f4da2	fix(userspace/falco): stabilize termination signal handler Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-06 18:21:05 +02:00
Jason Dellaluce	59ba2f9aab	fix(userspace/falco): properly terminate threads Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-06 18:21:05 +02:00
Federico Di Pierro	e68151eb07	chore(test,userspace/falco): fixed tests after libs bump. Moreover, try to create grpc socket folder path only if grpc is actually enabled. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-10-05 19:38:21 +02:00
Andrea Terzolo	ec7ddbbaf8	chore: bump libs/driver to pre-release tag Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-10-05 19:38:21 +02:00
Jason Dellaluce	663c1d073a	fix(userspace/falco): check plugin requirements when validating rule files Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-05 13:21:20 +02:00
Jason Dellaluce	bbb821fb8e	refactor(userspace/falco): move rules plugin requirements check in an internal funcion Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-05 13:21:20 +02:00
Jason Dellaluce	5781c53ddc	fix(userspace): add explicit constructors and initializations Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-10-03 13:04:15 +02:00
Andrea Terzolo	545b58ee14	update(open_inspector): use variable buffer dim in modern bpf Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-28 18:55:06 +02:00
Andrea Terzolo	8d8e7622e1	update(cmd_line): put modern bpf to `false` Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-28 18:55:06 +02:00
Andrea Terzolo	fd097e94d7	new(cmdline): add support for modern BPF probe Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-28 18:55:06 +02:00
Luca Guerra	6634c896b7	fix(falco): print container info and gvisor info in the same way Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-09-28 12:45:04 +02:00
Andrea Terzolo	3aa9267b48	fix(syscall_buffer): set dimension if page size not available Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-27 10:47:59 +02:00
Andrea Terzolo	725714726d	update(configuration): define `m_syscall_buf_size_preset` as `uint16_t` improve also some logs for `m_syscall_buf_size_preset` configuration errors Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:47:59 +02:00
Andrea Terzolo	c9fa585801	update: address some review comments Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Leonardo Grasso <me@leonardograsso.com> Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2022-09-27 10:47:59 +02:00
Andrea Terzolo	90e4634a79	update(syscall_buffer_size): don't crash in case of `getpagesize` error Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Federico Di Pierro <nierro92@gmail.com>	2022-09-27 10:47:59 +02:00
Andrea Terzolo	b0b2f05eb5	new: configure syscall buffer dimension from Falco Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-27 10:47:59 +02:00
Jason Dellaluce	8aea0935c9	chore(userspace/engine): remove unused var Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	9c240198a0	refactor(userspace/engine): refactor falco_engine with new loader defs Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	f6f763fe84	refactor(userspace/engine): clean up rule collector Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	9b5f3ee99e	refactor(userspace/engine): clean up rule compiler Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	89e8f70de0	refactor(userspace/engine): clean up and rename rule reader Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	b0f0105116	refactor(userspace/engine): clean up rule loader Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	5f2267f716	update(userspace/engine): add new loader files to CMakeLists Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	b65157af5e	refactor(userspace/engine): split rule loader git history (5) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	b2b1feb1f2	refactor(userspace/engine): split rule loader git history (4) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	b900e46dfe	refactor(userspace/engine): split rule loader git history (3) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	a98c9cdd20	refactor(userspace/engine): split rule loader git history (2) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Jason Dellaluce	2a427925a0	refactor(userspace/engine): split rule loader git history (1) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-27 10:42:59 +02:00
Andrea Terzolo	c0c37d87f5	fix(process_events): check the return value of `open_live_inspector` Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-20 18:07:30 +02:00
Andrea Terzolo	f57c67cc96	docs(falco.yaml): fix a typo Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Co-authored-by: Leonardo Grasso <me@leonardograsso.com>	2022-09-20 11:35:28 +02:00
Andrea Terzolo	7686c03a36	update(app_actions): add a depraction comment for BPF Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-20 11:35:28 +02:00
Andrea Terzolo	a325086363	test(falco): fix broken tests Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-20 11:35:28 +02:00
Andrea Terzolo	7e37c72431	update: falco works with the latest libs commit Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-20 11:35:28 +02:00
Federico Di Pierro	e068df514c	chore(userspace/engine,userspace/falco): upgraded to latest libs. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-09-20 11:35:28 +02:00
Federico Di Pierro	0274959981	update(userspace/falco, cmake): updated libs to latest master. Adapted API to sinsp::open API break, and simple consumer API break. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-09-20 11:35:28 +02:00
Mark Stemm	2d5fc0b647	Use the same falco_rule struct for every call to filter_ruleset Instead of using a falco_rule struct on the stack, use a single value inside the falco_source struct. It's mutable as find_source returns a const struct. At very high event volumes (> 1M syscalls/second), even the tiny time it takes to create/destroy the struct starts to add up, and this switch has some small cpu savings. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-09-16 12:50:39 +02:00
Mark Stemm	e5cd5eacf5	Save syscall source separately and check explicitly in process_event When doing some testing of falco on very high event volumes (> 1.5M events/second), I found that the time taken to look up a falco_source struct had a non-negligible contribution to cpu usage. So instead of looking up the source from the source_idx every time, separately save the source for syscalls in the falco_engine object directly. The separately saved copy is only used once someone calls add_source with source="syscall". Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-09-16 12:50:39 +02:00
Leonardo Grasso	c0ea753262	update(userspace/falco): gVisor sock now defaults to `/run/falco/gvisor.sock` Co-authored-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com> Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-09-14 10:27:24 +02:00
Vicente JJ. Miras	e4008217b9	Replacing /tmp/gvisor.sock with /run/gvisor.sock According to the FHS 3.0 (https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s15.html), transient UNIX-domain sockets should be placed under the directory /run, so this commit updates the implicit value generated by the application. Signed-off-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>	2022-09-14 10:27:24 +02:00
Jason Dellaluce	9c184af2a1	fix(userspace/falco): adopt stricter memory order semantics Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	d11aec28d5	fix(userspace/falco): move stats collection in event success path Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	d17e173e35	chore(userspace/falco): rename `sources` app state list for more clarity Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	25e9bd1c91	chore(userspace/falco): fix codespell typo Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	4bc9fc74c8	update(userspace/falco)!: adapt stats writer for multiple parallel event sources Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	b65cc49221	update(userspace/falco): rename init_inspector action into init_inspectors Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	65993ad1ed	refactor(userspace/falco): support multiple parallel event processing loops Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	f4c6a81ed8	update(userspace/falco): fix plugin list access in rule file loading action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	f9a152b24c	refactor(userspace/falco): generalize responsibilities of init_inspector action Now, the action takes care of inizializing all app inspectors (just one in capture mode, one for each evt source in live mode), and of registering and initializing all loaded plugins in the right inspector as needed. The plugin initialization logic, which also involves the filtercheck list population and checks, was moved and refactored from the previous implementation of the load_plugins action. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	ed025f1a86	refactor(userspace/falco): init all event sources in falco engine and in the right order Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	8ba779de8c	refactor(userspace/falco): restrict load_plugins action responsibilities Now, the action is in charge of loading all plugins and initializing: - the offline inspector - the list of loaded event sources - the list of loaded plugins and their config After this action runs, plugins are loaded but not yet initialized. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	cf8b85ad86	refactor(userspace/falco): turn open inspector action into convenience private methods Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	9cf3d118f6	update(userspace/falco): restrict clients init action to syscall inspector only Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	63bdc1119f	cleanup(userspace/falco): remove legacy hacks on source selection action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	9dc3eb2fc6	update(userspace/falco): reorder actions for their new semantics Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	7bb319b21e	update(userspace/falco): add convenience method for merging app run results Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	3f7d61f150	refactor(userspace/falco): re-design application state and methods Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 16:14:15 +02:00
Jason Dellaluce	cf9baea624	fix(userspace/engine): avoid reading duplicate exception values Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-12 15:53:15 +02:00
Federico Di Pierro	ccd3c896de	fix(userspace/engine): properly include stdexcept header to fix build. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-09-12 12:28:15 +02:00
Federico Di Pierro	11644ecafc	chore(userspace/falco): be somewhat more portable, avoiding assuming that '/' is the path delim. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-09-09 09:59:06 +02:00
Federico Di Pierro	23df49a47f	new(userspace/falco): create grpc unix socket and gvisor endpoint path automatically. It is also able to handle multipart paths, like /run/falco/falco/falco/falco. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-09-09 09:59:06 +02:00
Mark Stemm	0f45cf49db	Use enums for rules content item type Use an enum instead of a string for the item_type aka "parts of a rules file" field of contexts. The set of values is mostly defined by the contexts that were already created. There are a couple of forward-looking values for rule outputs/macro conditions/etc. that may be useful for later. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-09-07 10:13:02 +02:00
Mark Stemm	7a5a4c32ee	Support condition parse errors in rule loading results In #2098 and #2158, we reworked how rules loading errors/warnings were returned to provide a richer set of information, including locations/context for the errors/warnings. That did not include locations within condition expressions, though. When parsing a condition expression resulted in a warning/error, the location simply pointed to the condition property of the rule. This commit improves this to handle parse errors: - When libsinsp::filter::parser::parse() throws an exception, use get_pos() to get the position within the condition string. - Add a new context() constructor that takes a filter pos_info instead of a YAML::Mark. Now that positions aren't always related to the location of yaml nodes, Make up a generic "position" struct for locations and convert YAML::Mark and parser positions to a position struct. Also allow a context to contain an alternate content string which is used to build the snippet. For contexts related to condition strings, the content is the condition. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-09-07 10:13:02 +02:00
VadimZy	af95455bab	dropping fix for list parsing due to the absence of regex portability. reverting to the inefficient code. Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>	2022-09-05 17:42:31 +02:00
VadimZy	4b75f213c6	use <onigposix.h> instead of <regex.h> Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>	2022-09-05 17:42:31 +02:00
VadimZy	0de617a7fb	remove sinsp.h public dependencies Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>	2022-09-05 17:42:31 +02:00
VadimZy	5745faeccc	fix tests, remove dead code Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>	2022-09-05 17:42:31 +02:00
VadimZy	f9ee45b38e	Improve Falco engine performance when loading rules and creating the rule sets - replace std::set<uint16_t> with fixed size vector in event types propagation - rework lists expansion by replacing repetitive string::find in constantly growing expansion string with regex tokenization - improve json_event parsing by moving const initializations into static routines Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>	2022-09-05 17:42:31 +02:00
Jason Dellaluce	7d2f82fddc	update(usperspace/engine): bump engine version to 15 Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-05 14:40:31 +02:00
Jason Dellaluce	1b410ea2cc	update(userspace/engine): consider plugin version requirements in engine checks Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-05 14:40:31 +02:00
Jason Dellaluce	52402ac805	update(userspace/engine): support plugin version requirement alternatives in rule reader Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-05 14:40:31 +02:00
Jason Dellaluce	6e0971f1e1	update(userspace/engine): support plugin version requirement alternatives in rule loader Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-09-05 14:40:31 +02:00
Jason Dellaluce	6c1f908ca5	cleanup(cmake): rename legacy cmake variables Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-29 15:42:33 +02:00
Jason Dellaluce	574a4b9f0a	update(userspace/falco): fix copyright notice year Co-authored-by: Leonardo Grasso <me@leonardograsso.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	c05ad6fde4	update(userspace/falco): fix copyright notice year Co-authored-by: Leonardo Grasso <me@leonardograsso.com> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	e361069092	chore(userspace/falco): fix typos Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	9c6ad6ce84	update(userspace/falco): use json lib in stats writer Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	2d8efee73e	refactor(userspace/falco): improve design and docs of stats writer Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	28ff6ad3bd	refactor(userspace/falco): rename stats writer source files Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	2f5461bed0	refactor(userspace/falco): use new stats writer in event processing action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	605dd2816d	refactor(userspace/falco): re-implement stats writer Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	c5442ccb41	new(userspace/falco): introduce new refactored stats writer class This new model uses an async worker and a concurrent queue to handle stats writing. This ensures better performance, because the live event processing loop will just need to do a push on the queue instead of writing to a file (only when the timer triggers), and should be thread-safe by design. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:48:18 +02:00
Jason Dellaluce	cc4ccc40d7	refactor(userspace/falco): implement complete event source selection Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com> Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-08-26 12:47:18 +02:00
Jason Dellaluce	0e2a053151	new(userspace/falco): add new cli option to selectively enable event sources Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:47:18 +02:00
Jason Dellaluce	97bf0338b9	refactor(userspace/falco): introduce standalone action for event source selection Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 12:47:18 +02:00
Jason Dellaluce	34ca78786a	refactor(userspace/falco): make signal handlers thread-safe Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:31:18 +02:00
Jason Dellaluce	f2aba88a6c	refactor(userspace/falco): ensure falco outputs are non-blocking and define exiting condition Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:31:18 +02:00
Jason Dellaluce	bc765f1b7d	chore(userspace/falco): log in signal handlers instead than in event processing loop Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:31:18 +02:00
Jason Dellaluce	c2a8efc329	chore(userspace/engine): fix typos Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:26:18 +02:00
Jason Dellaluce	978f192c38	chore(userspace/engine): fix codespell typos Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:26:18 +02:00
Jason Dellaluce	1120fb2564	doc(userspace/engine): define thread-safety guarantees of falco_engine::process_event Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:26:18 +02:00
Jason Dellaluce	1b8847c06b	refactor(userspace/engine): make stats manager thread-safe for on_event method Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:26:18 +02:00
Jason Dellaluce	3839fdca1e	update(userspace/falco): avoid using zlib in webserver Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:23:17 +02:00
Jason Dellaluce	2b7bcc87a7	update(userspace/falco): add configuration entry for webserver threadiness Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:23:17 +02:00
Jason Dellaluce	0eacd41cd5	refactor(userspace/falco): support zlib and custom threadiness in webserver Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:23:17 +02:00
Jason Dellaluce	d9b6473db2	refactor(userspace/engine): increase const coherence of falco engine Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-26 11:04:18 +02:00
Jason Dellaluce	7d3dacc6d7	refactor(userspace/falco): cleanup actions order Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 17:02:15 +02:00
Jason Dellaluce	a9d185f5e1	refactor(userspace/falco): drop inspector dependency on print_plugin_info action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 17:02:15 +02:00
Jason Dellaluce	bd26bc09c2	refactor(userspace/falco): drop inspector dependency on print_ignored_events action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 17:02:15 +02:00
Jason Dellaluce	97e3209222	refactor(userspace/falco): drop inspector dependency on load_rule_files action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 17:02:15 +02:00
Jason Dellaluce	6d30061576	refactor(userspace/falco): drop inspector dependency on list_plugins action Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 17:02:15 +02:00
Jason Dellaluce	2caadd1af5	refactor(userspace/falco): add action for printing syscall events Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 17:02:15 +02:00
Jason Dellaluce	b307853e39	update(userspace/falco): use move semantics in falco logger Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 17:00:15 +02:00
Leonardo Grasso	3d61d3427e	fix: correct env var name `FALCO_HOSTNAME` Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-08-25 16:59:15 +02:00
Leonardo Grasso	928e10f0ce	fix(userspace/falco): print `hostname` when json formating is enabled Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-08-25 16:59:15 +02:00
Leonardo Grasso	34ad5c43fb	update(userspace/engine): add support for hostname Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-08-25 16:59:15 +02:00
Jason Dellaluce	d35dba30ed	update(userspace/engine): sync ast structs to new libs definitions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-25 16:32:15 +02:00
Jason Dellaluce	e7502431a2	update(userspace/falco): move rate limiter out of falco outputs framework Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-23 15:52:05 +02:00
Jason Dellaluce	6c74aa1a29	update(userspace/falco): enable per-event-source rate limiter Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-23 15:52:05 +02:00
Jason Dellaluce	af0b624a3a	fix(userspace/falco): set alert throttling config defaults Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-23 15:52:05 +02:00
Jason Dellaluce	8760f04bf2	refactor(userspace/falco): make output framework explicitly thread-safe Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-23 15:52:05 +02:00
Mark Stemm	8e61e46016	Add an "Ok, with warnings" overall status. In outputs it could be confusing to see a line: <filename>: Ok followed by a set of warnings. To differentiate this, add a top level status "Ok, with warnings" when rule loading was successful but had warnings. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-19 11:55:43 +02:00
Mark Stemm	3c7b6e037a	Falco engine changes to support multiple files in rule load results The methods that throw exceptions from stringified results need to additionally pass a rules_contents_t struct. This also meant that they need to call the filename + content version of load_rules. To avoid some duplicate code between the two load_rules_file methods, move the work of opening the file into a private method read_file(). It can throw an exception, which is passed through for the void return method and caught + converted into a load_result error for the method that returns a load_result. Also, to avoid duplicate code between the void load_rules and load_rules_file methods, add a private method interpret_load_result() which throws an exception if the result has an error and prints warnings otherwise if verbose is true. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-19 11:55:43 +02:00
Mark Stemm	49b7f0474f	Falco application changes to support multiple files in rules results Application changes to support multiple files when stringifying rules results: - In both validate_rules_files and load_rules_files, instead of loading each file individually and then calling load_rules(), add a separate step that loads all the files at once. The actual rules content strings are held in a vector. The map from filename to content (reference) points to entries in that vector. - Both actions do the same work for this step, so put the implementation in a shared application template method read_files that works on iterators. It uses itertors because the load filenames are a list and the validate filenames are a vector. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-19 11:55:43 +02:00
Mark Stemm	98c1e3d3f1	Restructure rules result to properly support multiple files The old version of rules_result assumed that all errors/warnings were related to a single file. That was generally correct for errors, as rules parsing always stopped at the first error, so there is only one relevant file. However, for warnings that was not the case. When reading multiple files A and B, you might get a warning from file A only after reading file B. For example, B might redefine a rule in such a way that you could get unused list/macro warnings from file A. To properly address this, make some changes to how contexts are managed: - Instead of creating snippets at the time the error/warning was generated, create snippets at the time the error/warning is converted into a string. This requires passing all rules contents to as_string()/as_json(), so define a falco::load_result::rules_contents_t map from filename to rules content (reference) and pass it in as_string/as_json(). Snippets are now generated from the rules content matching the filename in the context. - When creating warnings/errors, there's no need to pass along the rules content. This is only used when converting an error into a string/json. Also change snippet() to handle potentially very long lines. Instead of always printing the entire line matching a location, print up to snippet_width(param, with default 160 chars)/2 characters surrounding the column from the location. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-19 11:55:43 +02:00
Mark Stemm	fefd23f2f1	fix: print full rule load errors without verbose/-v The latest released falco always prints full details on errors when used with -r (read rules)/-V (validate rules). However #2098 changed this to only print full details when verbose is true. Fix the regression by always printing errors when loading rules. Warnings will be printed only with -v. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-10 14:39:17 +02:00
Melissa Kilby	0ab66c6fb5	update(userspace/falco): rename some buffer kernel side event drop metrics, add comments Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2022-08-08 10:28:42 +02:00
Melissa Kilby	1588f37788	update(userspace/falco): extend buffer kernel side event drop metrics Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>	2022-08-08 10:28:42 +02:00
incertum	66af8ad52b	new(userspace/falco): extend ebpf buffer kernel side event drop metrics Signed-off-by: incertum <melissa.kilby.oss@gmail.com>	2022-08-08 10:28:42 +02:00
Mark Stemm	550cdbd176	Falco application changes to support rule loading result struct Update the load_rules_files and validate_rules_files actions to use the new falco_engine methods that return a rules result struct. The app action interface is the same, returning ::fatal on error, ok()/exit() otherwise. The difference is how any warnings/errors are obtained--from the struct instead of an exception. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-04 14:49:23 +02:00
Mark Stemm	f7f6d72ac0	Rule loader changes to support result objects Changes to the rule loader to support result objects: - Instead of throwing falco_exception on internal error, throw a rule_load_exception instead, which contains distinct error/message/context information. - A context object contains a chain of location structs chaining from the document root to the object where the error occurred. Each location has a file position (as a YAML::Mark), an item type (e.g. "rule", "list", "exception"), and an item name (e.g. "Write Below Etc"). This will allow showing the exact location of an error (e.g. list item/exception field) while also remembering the item that contained it. - All the _info structs now contain a context so errors that occur after yaml parsing can still point to the original location in the yaml file. - rule_loader::result is an implementation of the abstract class defined in falco_load_result. The implementation keeps track of a list of errors/warnigns that used to be in the configuration object, - Clean up compile_ methods to just throw rule_load_exceptions or return nothing, and ensure that all rule_load_exceptions are caught in compile(). When caught, errors are added to the result object. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-04 14:49:23 +02:00
Mark Stemm	cbe7cceb87	Modify rule reader to use a result struct Modify rule reader to use a result struct for errors and warnings: - Instead of throwing a falco_exception to pass back errors, use a rule_load_exception, which contains distinct error codes, messages, and a context that points to the location of the error. - The static method context_yaml_get_context() has moved to a method of the rule_loader context object + the result as_string() method. - As objects are parsed, create relevant context objects as reading drills down into the contents of a rule/list/exception. This will enable for specific errors in, say, the middle of an exception/list while remembering the object that contains it. - Modify decode_val()/decode_seq() to always return errors as exceptions. Previously, it was a mix of a bool return + some exceptions. - decode_val()/decode_seq() are now more consistent about returning distinct errors for the property not existing, the property existing but not being a scalar/sequence value, and not being convertable to the templated value. - Combine the two nearly identical decode_seq() functions into a single one that uses a lambda to perform the final step of adding to the vector/set. - There are some item-specific decode_xxx functions for specific item properties like tags, exceptions fields/comps/values, etc. that call the above functions. These changes simplify the calls to decode_seq()/decode_val() as they don't need to add their own errors when returning false. Also some calls weren't checking the return value. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-04 14:49:23 +02:00
Mark Stemm	bb44d992ab	Change filter_warning_resolver to use warning codes Now that we have a result struct and set of warning codes, change the filter_warning_resolver to use them. This involves populating a set of warning codes instead of strings. Also, the methods to format warnings into human-readable strings is now in the falco_load_result static methods, so move the text there and remove the methods here. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-04 14:49:23 +02:00
Mark Stemm	0066ba49ea	Falco engine changes to support load_rules result class Add new load_rules methods that return a result object instead of throwing exceptions on error. The existing load_rules methods call the new methods internally and continue to throw exceptions on error/return individual values on success. The result is returned as a unique_ptr so it can be populated while loading rules (as a part of the configuration object) and then move()d to the return value. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-04 14:49:23 +02:00
Mark Stemm	8497f25a43	Add a load result interface for use in new load_rules methods Define a falco_load_result abstract class for use in new load_rules methods. It's abstract so the implementation details in rule_loader/rule_reader can be hidden from someone who wants to use the API to load rules and work with a result. The class defines a set of error codes/warning codes and has static methods to get a short and long description of each error/warning. There are virtual methods to access the important parts of a result: - successful or not - a string representation of the result, suitable for display to users. Takes a verbose argument. When verbose is true, the string is multi-line and has full details, including locations, item names, etc. When verbose is false, the string is single-line and just returns error codes. - a json representation of the result, suitable for automated parsing/interpretation later. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-08-04 14:49:23 +02:00
Andrea Terzolo	9d443685ea	new(userspace): support `SCAP_FILTERED_EVENT` return code Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-08-04 11:47:22 +02:00
Jason Dellaluce	a46cbcffe8	fix(engine): index old version of events in rulesets Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-03 15:58:21 +02:00
Jason Dellaluce	577ba5904b	update(engine): bump version to 14 and update fields checksum Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-08-03 15:58:21 +02:00
Andrea Terzolo	c8bc5758c3	new(userspace): print architecture information Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-07-31 19:57:29 +02:00
Andrea Terzolo	b759e77fda	new(userspace): print if the BPF probe is enabled Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-07-28 12:25:57 +02:00
Andrea Terzolo	74b6186f7d	new(userspace): print enabled sources when falco starts Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-07-28 12:25:57 +02:00
Mark Stemm	baf5540c30	Remove required_engine_version from falco engine load_rules APIs The only use of it was to include in --support output, which is redundant as the support output already includes the full contents of each rules file. Additionally, it wasn't even being updated after the switch from lua rules loading to c++ rules loading (https://github.com/falcosecurity/falco/pull/1966/ or surrounding PRs). This will simplify follow-on changes to add a real "result" to rules loading methods, as there will be fewer API variants to support. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-07-25 17:57:42 +02:00
Andrea Terzolo	35db0b4a24	cleanup(userspace): remove unused logic Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-07-14 09:58:50 +02:00
Andrea Terzolo	4136a27de1	new(userspace): add exception management Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-07-14 09:58:50 +02:00
Andrea Terzolo	e73dbd4b42	new(userspace): add current `drop_pct` Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Shane Lawrence <shane@lawrence.dev>	2022-07-14 09:58:50 +02:00
Andrea Terzolo	b57a2d5a5f	update(userspace): introduce nlohmann json library Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-07-14 09:58:50 +02:00
Andrea Terzolo	a7153f2fd8	fix(userspace): compute the `drop ratio` in the right way Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Shane Lawrence <shane@lawrence.dev>	2022-07-13 09:38:22 +02:00
Aldo Lacuku	46f625c449	chore(engine): remove trailing colon from logs when loading rule files Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2022-07-12 10:40:43 +02:00
Jason Dellaluce	62c1e875d5	update(userspace/falco): simplify sinsp logger sev decoding Co-authored-by: Luca Guerra <luca@guerra.sh> Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-07-07 12:46:51 +02:00
Jason Dellaluce	7dade32688	refactor(userspace/falco): make sinsp logging part of the configuration (default to false) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-07-07 12:46:51 +02:00
Jason Dellaluce	bae68b37ee	new(userspace/falco): enable attaching libsinsp logger to the falco one Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-07-07 12:46:51 +02:00
Luca Guerra	3cde70eda8	fix(falco): parameter ordering in initialization Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-07-01 14:17:38 +02:00
Luca Guerra	982e8663be	update(gvisor): make gvisor_enable depend on config Signed-off-by: Luca Guerra <luca@guerra.sh> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-07-01 14:17:38 +02:00
Luca Guerra	993516f430	new(falco): add compile-time option to enable or disable gvisor support Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-07-01 14:17:38 +02:00
Luca Guerra	60b149709d	fix(gvisor): formatting Signed-off-by: Luca Guerra <luca@guerra.sh> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-07-01 14:17:38 +02:00
Luca Guerra	698eda8680	new(gvisor): add option to generate gVisor configuration Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-07-01 14:17:38 +02:00
Luca Guerra	0b75433cee	update(gvisor): update to the latest sinsp interface Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-07-01 14:17:38 +02:00
Luca Guerra	0ba492c280	new(falco): do not alert on syscall frequency when gvisor is enabled Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-07-01 14:17:38 +02:00
Luca Guerra	927c1c4126	new(falco): enable gVisor event collection Signed-off-by: Luca Guerra <luca@guerra.sh>	2022-07-01 14:17:38 +02:00
Jason Dellaluce	3c2effb498	refactor(userspace/engine): remove source field from macros in rule loader Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-06-28 11:33:08 +02:00
Leonardo Grasso	2f208b52fc	fix(userspace/falco/app_actions/print_version.cpp): correct getter call for schema version Signed-off-by: Leonardo Grasso <me@leonardograsso.com> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-06-23 12:47:03 +02:00
Leonardo Grasso	f3bc178e40	fix(userspace/falco/app_actions/print_version.cpp): ensure destructor gets invoked Signed-off-by: Leonardo Grasso <me@leonardograsso.com> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-06-23 12:47:03 +02:00
Leonardo Grasso	fda9fb36de	update(userspace/falco): add more info to `--version` output Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-06-23 12:47:03 +02:00
Leonardo Grasso	92fdbbcc52	update(userspace/falco): do not print driver version by default Since now each Falco version is compatible with a range of driver version and not just one. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>	2022-06-23 12:47:03 +02:00
Mark Stemm	85ca1eb3dd	fix(app_actions): perform validate_rules before load_rules action Perform the validate_rules action before the load_rules action. This ensures that only the rules files named with -V arguments are validated. This fixes https://github.com/falcosecurity/falco/issues/2087. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-06-23 12:24:03 +02:00
Jason Dellaluce	1e5ef912de	chore: improve falco.yaml comments Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-06-14 22:13:37 +02:00
Jason Dellaluce	50039316ce	update(userspace/falco): make plugin configuration more robust Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-06-14 22:13:37 +02:00
Jason Dellaluce	eb365f1a3e	new(userspace/falco): add action and option to print detailed plugin info Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-06-14 22:13:37 +02:00
Aldo Lacuku	e6f99a61c9	chore(falco): fix indentation Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2022-06-09 12:50:39 +02:00
Aldo Lacuku	7b83943059	fix(falco): compilation issues with new libs version Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2022-06-09 12:50:39 +02:00
Aldo Lacuku	2111699a96	chore(engine): bump falco engine version number to 13 Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2022-06-09 12:50:39 +02:00
Aldo Lacuku	7a774f6b2e	chore(userpace/falco): do not print error code in process_events.cpp Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2022-06-01 13:35:38 +02:00
Aldo Lacuku	765ef5daaf	chore(userspace/falco): fix punctuation typo in output message when loading plugins Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>	2022-05-30 10:46:40 +02:00
Jason Dellaluce	3b462af58e	fix(userspace/falco): enable k8s and mesos clients only when syscall source is enabled Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 19:23:26 +02:00
Jason Dellaluce	09eae35f3a	refactor(userspace/falco): create action for initializing k8s and mesos clients (step 2) Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 19:23:26 +02:00
Jason Dellaluce	383b8f9660	refactor(userspace/falco): create action for initializing k8s and mesos clients Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 19:23:26 +02:00
Jason Dellaluce	13d70b65ae	update(userspace/engine): rename ruleset.h in filter_ruleset.h Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com> Co-authored-by: Leonardo Grasso <me@leonardograsso.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	9fd10220a5	update(userspace/falco): sync falco with new engine definitions Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	0abd7eaa28	refactor(userspace/engine): refactor engine interface and internals This updates the engine to comply and work properly with the newly-introduced interface design. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	a1bdf95a0f	refactor(userspace/engine): improve ruleset interface definitions The filter_ruleset interface its implementation evt_type_index_ruleset have been modified as follows: - Only keep track of ruleset ids and not names. The falco engine will take care of mapping easy-to-remember ruleset names to ruleset ids. To emphasize this, use ruleset_id everywhere and not ruleset. Also, make it non-optional. - Have explicit separate functions to enable/disable rules, instead of a single enable() method combined with a boolean flag. This does not change the falco_engine interface, which has similar methods, to avoid breaking API changes. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com> Co-authored-by: Mark Stemm <mark.stemm@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	833fec8537	refactor(userspace/engine): leverage falco_rule def in stats manager Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	50c2aa9c81	refactor(userspace/engine): update rule loader to use new filter_ruleset interface Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	f41f51f736	refactor(userspace/engine): update falco engine to use new ruleset interface and have one ruleset for each source This also fixes a couple of bugs. With the current implementation, the multi-ruleset feature is broken with multiple sources. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	3af8d1c0d2	refactor(userspace/engine): adapt existing ruleset implementation to new filter_ruleset interface Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Jason Dellaluce	bbbdb311e0	refactor(userspace/engine): introduce interface for rulesets and their factory This interface will allow us to use different ruleset implementations inside the same engine. The goal is to define API boundaries that will allow swapping the current evttype-index ruleset implementation more easily. Key benefits include: smaller component with less responsibilities, easier substituibility, more testable design, opportunity to adopt different index strategies depending on the ruleset implementation. Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-25 09:16:45 +02:00
Andrea Terzolo	d860472987	update(userspace/falco): improve falco termination Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-05-24 18:35:18 +02:00
Andrea Terzolo	3a3d5dfdcd	Update userspace/falco/app_actions/load_rules_files.cpp Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>	2022-05-24 15:55:17 +02:00
Andrea Terzolo	46159b8de9	update(userspace/engine): introduce new `check_plugin_requirements` API Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-05-24 15:55:17 +02:00
Andrea Terzolo	e751bf79c3	fix(userspace/engine): improve rule loader source checks for macros and lists Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>	2022-05-24 15:54:17 +02:00
Federico Di Pierro	39f55f4b5c	update(userspace): split filterchecks list for each source idx. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-05-21 16:33:38 +02:00
Federico Di Pierro	5f00cea3c9	fix(userspace/falco): do not start webserver in capture mode. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-05-21 16:33:38 +02:00
Federico Di Pierro	acbbcf7481	Update userspace/falco/app_cmdline_options.h Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Leonardo Grasso <me@leonardograsso.com>	2022-05-12 14:26:34 +02:00
Federico Di Pierro	3ba64d8a49	new(userspace/falco): new inotify watcher is now able to properly watch rules folders, when specified. This means that when starting Falco passing to it a folder for its rules, it will properly manage changes to any file inside the folders, plus any created/deleted file inside it. Unified list of rules parsing, instead of having it done twice inside cmdline_options and configuration. Instead, it is done only once, inside load_rules_files. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>	2022-05-12 14:26:34 +02:00

... 6 7 8 9 10 ...

1527 Commits