github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-15 21:03:54 +00:00
Code Issues Projects Releases Wiki Activity
4,579 Commits 117 Branches 173 Tags 105 MiB
generalize-indexable-ruleset-polymorphic
Commit Graph

1527 Commits

Author SHA1 Message Date
Jason Dellaluce
4e8d1f025c fix(userspace/falco/app): skip unnecessary app steps 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Jason Dellaluce
9bfce8cfae update(userspace): make sure that async event is always matched in rules 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Jason Dellaluce
733ea88ab3 fix(userspace/falco): properly init configuration 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Jason Dellaluce
b2615de062 new(userspace/falco/app): print a warning if multiple plugins for same source are loaded 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Jason Dellaluce
0649be619b update(userspace/falco/app): support nodriver open mode and plugins sourcing system events 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Jason Dellaluce
301c4efeb7 update(userspace/falco): support new plugin API definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Jason Dellaluce
5175a04c6b update(userspace/engine): bump engine checksum 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Jason Dellaluce
3681cacda1 new(userspace/falco): add new --nodriver option 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-05-19 12:15:04 +02:00
Andrea Terzolo
696fa43dc2 cleanup(actions): now modern bpf support -A flag 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-05-17 12:19:00 +02:00
Andrea Terzolo
e83dbe85f7 cleanup(config): modern bpf is no more experimental 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-05-12 12:27:45 +02:00
Jason Dellaluce
1f4919bfe1 update: improve control and UX of ignored events 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-04-27 11:10:14 +02:00
Jason Dellaluce
4d24a02ad6 fix(userspace/falco): preserve config's plugin loading order 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-04-26 12:59:13 +02:00
Jason Dellaluce
8926022035 update: adapt Falco to new sinsp event source management 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-04-26 12:59:13 +02:00
Jason Dellaluce
95fa953398 update(cmake): bump libs and driver to ffcd702cf22e99d4d999c278be0cc3d713c6375c 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-04-26 12:59:13 +02:00
Jason Dellaluce
3b64052832 update(userspace/falco): leverage new sc_set_to_event_names API 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-04-04 19:39:53 +02:00
Leonardo Grasso
88b9537618 chore(userspace/falco): remove Mesos support 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-04-04 18:31:52 +02:00
Leonardo Grasso
5c0cd6a170 update!: remove --mesos-api,-pmesos, and -pm command-line flags 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-04-04 18:31:52 +02:00
Melissa Kilby
0b6e243582 cleanup(app_acions): fine-tune base_syscalls.repair behavior 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-03-30 19:08:33 +02:00
Melissa Kilby
78daafb56c cleanup(app_actions): finalize base_syscalls.repair option 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-03-30 19:08:33 +02:00
Jason Dellaluce
2b93a79521 refactor: apply review suggestions 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-30 19:08:33 +02:00
Melissa Kilby
e360175c15 fix(app_actions): enforce PPM_SC_SCHED_PROCESS_EXIT for base_syscalls.custom_set 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-03-30 19:08:33 +02:00
Melissa Kilby
692abf71eb new(app_actions): add base_syscalls.repair option 
See https://github.com/falcosecurity/falco/issues/2433

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-03-30 19:08:33 +02:00
Melissa Kilby
1d66eb4d6d cleanup(app_actions): add warnings for invalid syscalls in user base_syscalls set 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-03-30 19:08:33 +02:00
Aldo Lacuku
31335d3c3b new(falco/config): add new configuration for http_output 
Support for user provided CA certificate that can verify the remote server. Users
can provide path to the CA certiface store by providing a path to the dir or to the
CA store file. If needed users can decide to tell Falco to not verify the server.

Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2023-03-30 17:11:33 +02:00
Federico Di Pierro
0b7ca2823e chore(userspace): apply review suggestions. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Jason Dellaluca <jasondellaluce@gmail.com>
 2023-03-28 19:01:30 +02:00
Federico Di Pierro
b2e03b1938 chore(userspace): syscall_drop_failed -> syscall_drop_failed_exit. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-03-28 19:01:30 +02:00
Federico Di Pierro
70c6c93389 chore(userspace): improved wording. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-03-28 19:01:30 +02:00
Federico Di Pierro
bf5e340833 new(userspace/falco): added syscall_drop_failed option to drop failed syscalls exit events. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-03-28 19:01:30 +02:00
Federico Di Pierro
e6078c8d16 chore(userspace): updated fields checksum. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-03-22 11:17:07 +01:00
Federico Di Pierro
17b170b4f9 update(cmake,userspace): bumped to libs master. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-03-22 11:17:07 +01:00
rabbitstack
03285f4140 define Windows equivalent for srandom and random functions 
Signed-off-by: rabbitstack <nedim.sabic@sysdig.com>
 2023-03-17 10:23:26 +01:00
Jason Dellaluce
93ae6bb609 chore(userspace/falco): fix codespell typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
e07e3abfb5 update(userspace/falco): implement debouncing logic in restart handler 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
3f69d46f9a update(userspace/falco): minor compilation improvements 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
647441c06c fix(userspace/falco): solve gettid compilation issues 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
cd155ed6f5 refactor(userspace/falco): update actions to use new hot restarter utility with dry-run safetyc checks 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
561022ebb6 new(userspace/falco): add utility for handling hot app restarts 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
af46833ad3 update(userspace/falco): make cmdline options simpler and copyable 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
e40369648c fix(userspace/falco): solve minor compilation flaws 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
ee7fa1cb06 new(usersapce/falco): add an app option for dry-run 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-15 17:54:49 +01:00
Jason Dellaluce
e8b776a9cb update(userspace/engine): bump engine version to 17 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
09ab9db423 chore(userspace/falco): apply review suggestion 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
61a7f32982 chore(userspace/falco): apply review suggestions 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
2645f6640c chore(userspace/falco): rename source file using its action name 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
fb37d8f365 refactor(userspace/falco): adapt event set selection to only use ppm_sc and new engine features 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Jason Dellaluce
19ffadc763 update(userspace/engine): support searching ppm_sc events in rulesets 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-03-09 09:39:12 +01:00
Melissa Kilby
0de9af9ed0 fix(app_actions): base_syscalls check for empty string 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Melissa Kilby
58dc60e58d cleanup(app_actions): address reviewers comments 
* Plus minor adjustments to ensure correct state_event_set for all configurations
* Ensure valid check_for_rules_unsupported_events for all configurations
* Remove user input validation warning -> re-introduce in follow up PR

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Melissa Kilby
b6f6195725 cleanup(app_actions): include activated syscalls in LOG_DEBUG logs 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Melissa Kilby
76a3c8d7ee new(app_actions): introduce base_syscalls 
See https://github.com/falcosecurity/falco/issues/2373

Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-24 11:43:43 +01:00
Jason Dellaluce
7d67fbbfe7 chore(userspace/falco): apply review suggestions 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
5ed5c63202 refactor: adapt event set configuration changes to new libs definition 
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
4706cd8b4e cleanup: solve std namespace issues and remove unused imports 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
010f6c6a9e update(userspace/engine): bump fields checksum 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
1485dc5d68 refactor(userspace/falco): adapt app actions to new event definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
e7d76ca722 refactor(userspace/falco): use new event definitions in app state 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
6c38ecaf0e update(userspace/engine): adapt engine classes to new libsinsp event definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
34ea7a8245 cleanup(userspace/engine): drop filtr_evttype_resolver 
Its logic was ported into libsinsp in:
3d8550e70e

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
d89f4b4904 cleanup(app_actions): adjust ignored events 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
16aa36291a fix rebase 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
72439b2eed cleanup(app_actions): adjust configure_interesting_sets 
* address reviewers feedback
* improve clarity around new -A and -i behavior
* additional cleanup (e.g. use generic set operations only)
* extend unit tests

Note: sinsp ppm sc API is undergoing a refactor, therefore current lookups are interim
and will subsequently be refactored as well.

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
30fe065446 cleanup(app_actions): configure -A w/ new default behavior 
Define new -A behavior in configure_interesting_sets

* default: all syscalls in rules included, sinsp state enforcement without high volume I/O syscalls
* -A flag set: all syscalls in rules included, sinsp state enforcement and allowing high volume I/O syscalls

Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00
Melissa Kilby
91c185a178 cleanup(app_actions): include evttypes from rules in configure_interesting_sets 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-02-21 14:31:28 +01:00
Jason Dellaluce
34ed5a5fc9 chore: fix typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 11:09:29 +01:00
Jason Dellaluce
70c22c7d2e refactor(userspace/falco): adapt actions to new signal handler constructs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 11:09:29 +01:00
Jason Dellaluce
eb3bf7260d refactor(userspace/falco): add an ad-hoc concurrent object for signal handlers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 11:09:29 +01:00
Jason Dellaluce
5470a88b61 fix(userspace/falco): add missing constructors/methods on falco semaphore 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-21 11:09:29 +01:00
Jason Dellaluce
bf5b8f5c83 new(userspace/falco): add intermediate cmake target for falco app 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-15 10:51:35 +01:00
Jason Dellaluce
c45bf3eb17 chore(userspace/falco): rename falco_init into falco_run 
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
149544d7ab chore(userspace/falco): fix spacing and license 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
1eb915bf2f fix(userspace/falco): solve issues with minimal build 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
5d35dff2a7 refactor(userspace/falco/app): standalone sources for action helpers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
799557f7f7 refactor(userspace/falco/app): make run and teardown actions consistent 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
fe859bda2d refactor(userspace/engine): turn app methods into simple functions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
374136be18 refactor(userspace/engine): add standalone sources for app signals and options 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
623d27ef77 refactor(userspace/engine): create standalone sources for app state and run result 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
0f402d01d0 fix(userspace/falco): add missing pragma once 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Jason Dellaluce
ff68311629 fix(userspace/engine): add missing include 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 17:33:31 +01:00
Lorenzo Susini
88ac30650c fix(userspace/engine): correctly bump engine version after introduction of new fields 
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
 2023-02-14 13:03:06 +01:00
Jason Dellaluce
79b3f81a02 chore: fix typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 12:47:07 +01:00
Jason Dellaluce
2495827e0c fix(userspace/engine): correctly handle evttype indexing corner cases 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-14 12:47:07 +01:00
Federico Di Pierro
75dc8c050c new(userspace,tests): add proper support for generic events indexing. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-02-13 14:54:03 +01:00
Andrea Terzolo
dca76ba93c chore: fix building with njson 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-02-10 11:41:24 +01:00
Federico Di Pierro
7343bcf050 cleanup(uerspace/falco): do not enter dropping mode. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-02-09 14:16:31 +01:00
Jason Dellaluce
eaeec7c079 fix(userspace): avoid using std namespace in sources 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-08 15:30:29 +01:00
Jason Dellaluce
54f117141b update(userspace/engine): avoid relying on leaked std namespace 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-02-08 15:30:29 +01:00
Andrea Terzolo
1b11a041b5 update: change cpus_for_each_syscall_buffer default value 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-02-03 12:50:20 +01:00
Andrea Terzolo
8eb6fbf32d fix(userspace): use the right path for the cpus_for_each_syscall_buffer 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-01-26 11:44:44 +01:00
Andrea Terzolo
77686cb8b9 update: don't expose available CPU feature 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-01-24 12:41:34 +01:00
Andrea Terzolo
42670a50c7 new: support multiple buffer modes and online CPUs 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-01-24 12:41:34 +01:00
Federico Di Pierro
e64c14a947 fix(userspace/falco): fixed grpc server shutdown. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-01-24 11:59:34 +01:00
Federico Di Pierro
306f9ba468 fix(userspace/falco): fixed build. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2023-01-17 16:00:23 +01:00
Jason Dellaluce
55a6436ee8 new(userspace/falco): add webserver endpoint for retrieving internal versions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-16 17:24:54 +01:00
Jason Dellaluce
ea48ec70be refactor(userspace/falco): use new utility for printing versions and support 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-16 17:24:54 +01:00
Jason Dellaluce
7724ad940a new(userspace/falco): standaline utility for retrieving internal version numbers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-16 17:24:54 +01:00
Jason Dellaluce
c69b198777 chore(userspace/falco): cleanup error message when no output is configured 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
db2f5d5e9c fix(userspace/falco): solve tests issues 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
4aefb7fd7d fix(userspace/falco): require config file only when needed 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
149c95c3fb fix(userspace/falco): load config before every other action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
78312c8c15 update(userspace/falco): clean up configuration and allow re-initialization 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
d6bbf5d442 refactor(userspace/falco): isolate yaml helpers (2) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
2eac8f88cb refactor(userspace/falco): isolate yaml helpers (1) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
bc3ec30f3e chore(userspace/falco) remove unused var 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
42ef8db26f refactor(userspace/falco): deprecate version-json option and rely on json_output 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
09d9ae135b update(userspace/falco): load default config at app initialization 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
57cafcb65a refator(userspace/falco): allow loading default config with no file 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-15 18:30:15 +01:00
Jason Dellaluce
c1985a7c99 fix(userspace/engine): absolute rule condition position in validation context 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-10 12:55:43 +01:00
Jason Dellaluce
d79d7112a0 fix(userspace/engine): catch YAML parsing and validation errors with right context 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-10 12:55:43 +01:00
Luca Guerra
1b2c7ef7d9 new(falco): add --version-json to print version information in json format 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-01-10 12:35:43 +01:00
Leonardo Grasso
280fcfe5d3 update: deprecate Mesos support, --mesos-api, and -pm command-line flags 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2023-01-09 14:04:55 +01:00
Andrea Terzolo
609171fe14 doc: reword 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
 2022-12-21 14:56:02 +01:00
Andrea Terzolo
de6292ce09 doc(userspace): fix a warning message 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-12-21 14:56:02 +01:00
Luca Guerra
6ea233dd75 new(falco): add engine version to --version 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-12-16 12:09:24 +01:00
Luca Guerra
dde2fdd67c new(falco): add driver_api_version, driver_schema_version, default_driver_version, libs_version to support 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-12-16 12:09:24 +01:00
Jason Dellaluce
5552bcab76 chore: fix typo 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-12-13 15:06:10 +01:00
Jason Dellaluce
25ddc3c6a2 update(userspace/engine): broader err catching support in macro resolver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-12-13 15:06:10 +01:00
Jason Dellaluce
35dd0fc153 fix(userspace/engine): implement loop detection in macro resolver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-12-13 15:06:10 +01:00
Federico Di Pierro
4696948754 fix(cmake): properly fetch dev version by appending latest Falco tag, delta between master and tag, and hash. 
`describe` can no more be used as tags are now made on release branches.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-12-12 11:11:44 +01:00
Andrea Terzolo
52ee61b800 chore(userspace): add njson lib as a dependency for falco_engine 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-12-10 17:07:06 +01:00
Andrea Terzolo
94ed56df95 chore: bump libs 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-12-06 12:59:50 +01:00
Andrea Terzolo
6a972272c0 update: the capture will be stopped in the inspector destructor 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-12-06 12:59:50 +01:00
Andrea Terzolo
55deb452d8 update: start/stop capture inside do_inspect 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-12-06 12:59:50 +01:00
Federico Di Pierro
87371492c5 update(userspace/engine): updated checksum. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-12-06 12:59:50 +01:00
Federico Di Pierro
17dfe4f55d fix(userspace/falco): properly start/stop capture. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-12-06 12:59:50 +01:00
Mark Stemm
356a4a0749 Also copy ruleset when copying falco source 
In the copy constructor and assignment operator for falco_source, also
copy the ruleset along with factories/name.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-12-01 17:07:52 +01:00
Mark Stemm
910b8ff858 Fix(engine) Save parse positions when finding unresolved macros 
Now that ASTs contain parse positions, use them when reporting errors
about unknown macros.

When doing the first pass to find all macro references, save macros as
a map<macro name,parse position> instead of a set<macro name>. While
making that change, change the visitor struct to use references
instead of pointers.

In the second pass, when reporting any unresolved macro references,
also report the parse position.

The unit tests also check that the positions of macros are properly
returned in the resolved/unresolved maps.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-12-01 17:03:52 +01:00
Mark Stemm
83b12bab1d Fix(engine): include parse positions in compile errors 
Now that ASTs have parse positions and the compiler will return the
position of the last error, use that in falco rules to return errors
within condition strings instead of reporting the position as the
beginning of the condition.

This led to a change in the filter_ruleset interface--now, an ast is
compiled to a filter before being passed to the filter_ruleset
object. That avoids polluting the interface with a lot of details
about rule_loader contexts, errors, etc. The ast is still provided in
case the filter_ruleset wants to do indexing/analysis of the filter.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-12-01 17:03:52 +01:00
Jason Dellaluce
ba61706557 update(userspace/falco): enable using zlib with webserver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-30 19:24:47 +01:00
Jason Dellaluce
15b57bd972 fix: remove minor string view dependencies 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
68f4d5bb59 fix(userspace/engine): no need to use external deps 
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Leonardo Grasso
47fd90bb7f chore: remove not used dependency - string-view-lite 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-11-29 16:27:42 +01:00
Luca Guerra
f08a5b4067 update(cli): also add cg / kg container-gvisor / kubernetes-gvisor 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-23 13:03:57 +01:00
Luca Guerra
dea02f82e8 update(falco): add container-gvisor and kubernetes-gvisor print options 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-23 13:03:57 +01:00
Luca Guerra
e3dbae3259 fix(engine): fix warning about redundant std::move 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-11-11 16:19:11 +01:00
Aldo Lacuku
161246fe1a fix(output): do not print syscall_buffer_size when gvisor is enabled 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-11-10 10:32:05 +01:00
Jason Dellaluce
240c0b870d fix(userspace/falco): verify engine fields only for syscalls 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-11-07 15:37:25 +01:00
Mark Stemm
acf5c4ce5f fix(engine): save syscall source only when processing events 
The optimization in https://github.com/falcosecurity/falco/pull/2210
had a bug when the engine uses multiple sources at the same
time--m_syscall_source is a pointer to an entry in the indexed vector
m_sources, but if add_source is called multiple times, the vector is
resized, which copies the structs but invalidates any pointer to the
vector entries.

So instead of caching m_syscall_source in add_source(), cache it in
process_events(). m_sources won't change once processing events starts.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-10-27 18:23:25 +02:00
Yarden Shoham
4a4fa2592b fix(plugins): trim whitespace in open_params 
`open_params` is read from the falco YAML configuration file and parsed using Go's URL.

For example:
c349be6e84/plugins/k8saudit/pkg/k8saudit/source.go (L41-L42)

Go's URL parser does not handle whitespace, so if a user defines the `open_params` in the falco configuration file as follows

```yaml
open_params: >
/file/path
```

the parser returns an error. To avoid this, we now trim this parameter so no whitespace will be left for Go's URL parser to error out on.

For reference see #2262.

Signed-off-by: Yarden Shoham <hrsi88@gmail.com>
 2022-10-21 19:12:58 +02:00
Jason Dellaluce
10fe9fd84b fix(userspace/falco): avoid using CPU when main thread waits for parallel event sources 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
3d7677ce5b update(userspace/falco): create struct for sync parallel event sources parallelization 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
0fd765f7c3 new(userspace/falco): add simple semaphre implementation 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-14 13:12:22 +02:00
Jason Dellaluce
cca90b2f80 update(userspace/falco): move on from deprecated libs API for printing event list 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 17:00:18 +02:00
Jason Dellaluce
6c873418ce chore(userspace/falco): improve the CLI options helper 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Jason Dellaluce
f12531a153 chore(userspace/falco): log cli options with debug level 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-13 15:39:18 +02:00
Jason Dellaluce
9d8f130f47 fix(userspace/falco): make sure validation summary is populated even when json output is requested 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
9ee0298c4d fix(userspace/engine): avoid macro/list used checks if we encounter an error 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Jason Dellaluce
7da30ca661 chore(userspace/falco): make logging optional when terminating, restarting, and reopening outputs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 13:14:20 +02:00
Jason Dellaluce
57b26530b6 update(userspace) fix cppcheck warnings 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
3629c4dc4a update(userspace): solve cppcheck performance suggestions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 12:07:20 +02:00
Jason Dellaluce
5e531870a9 fix(userspace/engine): fix unit test segfault 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
f684e144be chore(userspace/falco): polish ignored event warning message 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
a4218a4b4f fix(userspace/falco): print right list in ignored events warning 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
48fbe0801d fix(userspace/falco): print right list of ignored events when in simple cons mode 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
c47492ab6d update(userspace/falco): populate list of interesting event types in app state 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
4cb556aed2 update(userspace/engine): use sinsp api to access event table information 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 11:17:20 +02:00
Jason Dellaluce
5f2bc6a2d3 fix(userspace/falco): properly handle termination at source opening failures 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
88c7202fdc fix(userspace/falco): check conditions in right order 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
a98a1b2c4c fix(userspace/falco/falco): allow output reopening to happen multiple times 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
77857a7236 fix(userspace/falco): solve warning 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
e011b3b5e5 chore(userspace/falco): fix typo 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
fd4d521a5f fix(userspace/falco): make multi-source termination condition more stable 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
3f3386cfe0 fix(userspace/falco): make signal handlers safe with multi-threading 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 19:23:17 +02:00
Jason Dellaluce
11160f8463 fix(userspace): safely check string bounded access 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-11 11:23:15 +02:00
Jason Dellaluce
3c02b40a21 chore(userspace/falco): make log message termination consistent 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
e85a8c914f chore(userspace/falco): move enabled sources list printout when capture is opened 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
21c2b1f472 update(userspace/falco): use unordered_set where possible for faster lookups 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
909f6d0961 chore(userspace/falco): make log messages formatting more consistent 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
83a83a5853 update(userspace): pass string as const refs when possible 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 21:27:06 +02:00
Jason Dellaluce
b4ea2f4da2 fix(userspace/falco): stabilize termination signal handler 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 18:21:05 +02:00
Jason Dellaluce
59ba2f9aab fix(userspace/falco): properly terminate threads 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-06 18:21:05 +02:00
Federico Di Pierro
e68151eb07 chore(test,userspace/falco): fixed tests after libs bump. 
Moreover, try to create grpc socket folder path only if grpc is actually enabled.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-10-05 19:38:21 +02:00
Andrea Terzolo
ec7ddbbaf8 chore: bump libs/driver to pre-release tag 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-05 19:38:21 +02:00
Jason Dellaluce
663c1d073a fix(userspace/falco): check plugin requirements when validating rule files 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-05 13:21:20 +02:00
Jason Dellaluce
bbb821fb8e refactor(userspace/falco): move rules plugin requirements check in an internal funcion 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-05 13:21:20 +02:00
Jason Dellaluce
5781c53ddc fix(userspace): add explicit constructors and initializations 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-03 13:04:15 +02:00
Andrea Terzolo
545b58ee14 update(open_inspector): use variable buffer dim in modern bpf 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-28 18:55:06 +02:00
Andrea Terzolo
8d8e7622e1 update(cmd_line): put modern bpf to false 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-28 18:55:06 +02:00
Andrea Terzolo
fd097e94d7 new(cmdline): add support for modern BPF probe 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-28 18:55:06 +02:00
Luca Guerra
6634c896b7 fix(falco): print container info and gvisor info in the same way 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-09-28 12:45:04 +02:00
Andrea Terzolo
3aa9267b48 fix(syscall_buffer): set dimension if page size not available 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-27 10:47:59 +02:00
Andrea Terzolo
725714726d update(configuration): define m_syscall_buf_size_preset as uint16_t 
improve also some logs for `m_syscall_buf_size_preset` configuration errors

Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:47:59 +02:00
Andrea Terzolo
c9fa585801 update: address some review comments 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-09-27 10:47:59 +02:00
Andrea Terzolo
90e4634a79 update(syscall_buffer_size): don't crash in case of getpagesize error 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-27 10:47:59 +02:00
Andrea Terzolo
b0b2f05eb5 new: configure syscall buffer dimension from Falco 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-27 10:47:59 +02:00
Jason Dellaluce
8aea0935c9 chore(userspace/engine): remove unused var 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
9c240198a0 refactor(userspace/engine): refactor falco_engine with new loader defs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
f6f763fe84 refactor(userspace/engine): clean up rule collector 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
9b5f3ee99e refactor(userspace/engine): clean up rule compiler 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
89e8f70de0 refactor(userspace/engine): clean up and rename rule reader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
b0f0105116 refactor(userspace/engine): clean up rule loader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
5f2267f716 update(userspace/engine): add new loader files to CMakeLists 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
b65157af5e refactor(userspace/engine): split rule loader git history (5) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
b2b1feb1f2 refactor(userspace/engine): split rule loader git history (4) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
b900e46dfe refactor(userspace/engine): split rule loader git history (3) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
a98c9cdd20 refactor(userspace/engine): split rule loader git history (2) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Jason Dellaluce
2a427925a0 refactor(userspace/engine): split rule loader git history (1) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-27 10:42:59 +02:00
Andrea Terzolo
c0c37d87f5 fix(process_events): check the return value of open_live_inspector 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-20 18:07:30 +02:00
Andrea Terzolo
f57c67cc96 docs(falco.yaml): fix a typo 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-09-20 11:35:28 +02:00
Andrea Terzolo
7686c03a36 update(app_actions): add a depraction comment for BPF 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-20 11:35:28 +02:00
Andrea Terzolo
a325086363 test(falco): fix broken tests 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-20 11:35:28 +02:00
Andrea Terzolo
7e37c72431 update: falco works with the latest libs commit 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-20 11:35:28 +02:00
Federico Di Pierro
e068df514c chore(userspace/engine,userspace/falco): upgraded to latest libs. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-20 11:35:28 +02:00
Federico Di Pierro
0274959981 update(userspace/falco, cmake): updated libs to latest master. 
Adapted API to sinsp::open API break, and simple consumer API break.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-20 11:35:28 +02:00
Mark Stemm
2d5fc0b647 Use the same falco_rule struct for every call to filter_ruleset 
Instead of using a falco_rule struct on the stack, use a single value
inside the falco_source struct. It's mutable as find_source returns a
const struct.

At very high event volumes (> 1M syscalls/second), even the tiny time
it takes to create/destroy the struct starts to add up, and this
switch has some small cpu savings.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-16 12:50:39 +02:00
Mark Stemm
e5cd5eacf5 Save syscall source separately and check explicitly in process_event 
When doing some testing of falco on very high event volumes (> 1.5M
events/second), I found that the time taken to look up a falco_source
struct had a non-negligible contribution to cpu usage.

So instead of looking up the source from the source_idx every time,
separately save the source for syscalls in the falco_engine object
directly. The separately saved copy is only used once someone calls
add_source with source="syscall".

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-16 12:50:39 +02:00
Leonardo Grasso
c0ea753262 update(userspace/falco): gVisor sock now defaults to /run/falco/gvisor.sock 
Co-authored-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-09-14 10:27:24 +02:00
Vicente JJ. Miras
e4008217b9 Replacing /tmp/gvisor.sock with /run/gvisor.sock 
According to the FHS 3.0 (https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch03s15.html), transient UNIX-domain sockets should be placed under the directory /run, so this commit updates the implicit value generated by the application.

Signed-off-by: Vicente J. Jiménez Miras <vjjmiras@gmail.com>
 2022-09-14 10:27:24 +02:00
Jason Dellaluce
9c184af2a1 fix(userspace/falco): adopt stricter memory order semantics 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
d11aec28d5 fix(userspace/falco): move stats collection in event success path 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
d17e173e35 chore(userspace/falco): rename sources app state list for more clarity 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
25e9bd1c91 chore(userspace/falco): fix codespell typo 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
4bc9fc74c8 update(userspace/falco)!: adapt stats writer for multiple parallel event sources 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
b65cc49221 update(userspace/falco): rename init_inspector action into init_inspectors 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
65993ad1ed refactor(userspace/falco): support multiple parallel event processing loops 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
f4c6a81ed8 update(userspace/falco): fix plugin list access in rule file loading action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
f9a152b24c refactor(userspace/falco): generalize responsibilities of init_inspector action 
Now, the action takes care of inizializing all app inspectors
(just one in capture mode, one for each evt source in live mode), and of
registering and initializing all loaded plugins in the right inspector as needed.
The plugin initialization logic, which also involves the filtercheck list
population and checks, was moved and refactored from the previous
implementation of the load_plugins action.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
ed025f1a86 refactor(userspace/falco): init all event sources in falco engine and in the right order 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
8ba779de8c refactor(userspace/falco): restrict load_plugins action responsibilities 
Now, the action is in charge of loading all plugins and initializing:
- the offline inspector
- the list of loaded event sources
- the list of loaded plugins and their config

After this action runs, plugins are loaded but not yet initialized.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
cf8b85ad86 refactor(userspace/falco): turn open inspector action into convenience private methods 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
9cf3d118f6 update(userspace/falco): restrict clients init action to syscall inspector only 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
63bdc1119f cleanup(userspace/falco): remove legacy hacks on source selection action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
9dc3eb2fc6 update(userspace/falco): reorder actions for their new semantics 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
7bb319b21e update(userspace/falco): add convenience method for merging app run results 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
3f7d61f150 refactor(userspace/falco): re-design application state and methods 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Jason Dellaluce
cf9baea624 fix(userspace/engine): avoid reading duplicate exception values 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 15:53:15 +02:00
Federico Di Pierro
ccd3c896de fix(userspace/engine): properly include stdexcept header to fix build. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-12 12:28:15 +02:00
Federico Di Pierro
11644ecafc chore(userspace/falco): be somewhat more portable, avoiding assuming that '/' is the path delim. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-09 09:59:06 +02:00
Federico Di Pierro
23df49a47f new(userspace/falco): create grpc unix socket and gvisor endpoint path automatically. 
It is also able to handle multipart paths, like /run/falco/falco/falco/falco.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-09-09 09:59:06 +02:00
Mark Stemm
0f45cf49db Use enums for rules content item type 
Use an enum instead of a string for the item_type aka "parts of a
rules file" field of contexts.

The set of values is mostly defined by the contexts that were already
created. There are a couple of forward-looking values for rule
outputs/macro conditions/etc. that may be useful for later.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-07 10:13:02 +02:00
Mark Stemm
7a5a4c32ee Support condition parse errors in rule loading results 
In #2098 and #2158, we reworked how rules loading errors/warnings were
returned to provide a richer set of information, including
locations/context for the errors/warnings.

That did *not* include locations within condition expressions,
though. When parsing a condition expression resulted in a
warning/error, the location simply pointed to the condition property
of the rule.

This commit improves this to handle parse errors:

- When libsinsp::filter::parser::parse() throws an exception, use
  get_pos() to get the position within the condition string.
- Add a new context() constructor that takes a filter pos_info instead
  of a YAML::Mark.

Now that positions aren't always related to the location of yaml
nodes, Make up a generic "position" struct for locations and convert
YAML::Mark and parser positions to a position struct.

Also allow a context to contain an alternate content string which is
used to build the snippet. For contexts related to condition strings,
the content is the condition.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-07 10:13:02 +02:00
VadimZy
af95455bab dropping fix for list parsing due to the absence of regex portability. 
reverting to the inefficient code.

Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
4b75f213c6 use <onigposix.h> instead of <regex.h> 
Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
0de617a7fb remove sinsp.h public dependencies 
Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
5745faeccc fix tests, remove dead code 
Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
VadimZy
f9ee45b38e Improve Falco engine performance when loading rules and creating the rule sets 
- replace std::set<uint16_t> with fixed size vector in event types propagation
- rework lists expansion by replacing repetitive string::find in constantly growing expansion string with regex tokenization
- improve json_event parsing by moving const initializations into static routines

Signed-off-by: VadimZy <vadim.zyarko@sysdig.com>
 2022-09-05 17:42:31 +02:00
Jason Dellaluce
7d2f82fddc update(usperspace/engine): bump engine version to 15 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
1b410ea2cc update(userspace/engine): consider plugin version requirements in engine checks 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
52402ac805 update(userspace/engine): support plugin version requirement alternatives in rule reader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
6e0971f1e1 update(userspace/engine): support plugin version requirement alternatives in rule loader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-05 14:40:31 +02:00
Jason Dellaluce
6c1f908ca5 cleanup(cmake): rename legacy cmake variables 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-29 15:42:33 +02:00
Jason Dellaluce
574a4b9f0a update(userspace/falco): fix copyright notice year 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
c05ad6fde4 update(userspace/falco): fix copyright notice year 
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
e361069092 chore(userspace/falco): fix typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
9c6ad6ce84 update(userspace/falco): use json lib in stats writer 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
2d8efee73e refactor(userspace/falco): improve design and docs of stats writer 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
28ff6ad3bd refactor(userspace/falco): rename stats writer source files 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
2f5461bed0 refactor(userspace/falco): use new stats writer in event processing action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
605dd2816d refactor(userspace/falco): re-implement stats writer 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
c5442ccb41 new(userspace/falco): introduce new refactored stats writer class 
This new model uses an async worker and a concurrent queue to handle
stats writing. This ensures better performance, because the live event
processing loop will just need to do a push on the queue instead of writing
to a file (only when the timer triggers), and should be thread-safe by design.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:48:18 +02:00
Jason Dellaluce
cc4ccc40d7 refactor(userspace/falco): implement complete event source selection 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-08-26 12:47:18 +02:00
Jason Dellaluce
0e2a053151 new(userspace/falco): add new cli option to selectively enable event sources 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:47:18 +02:00
Jason Dellaluce
97bf0338b9 refactor(userspace/falco): introduce standalone action for event source selection 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:47:18 +02:00
Jason Dellaluce
34ca78786a refactor(userspace/falco): make signal handlers thread-safe 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:31:18 +02:00
Jason Dellaluce
f2aba88a6c refactor(userspace/falco): ensure falco outputs are non-blocking and define exiting condition 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:31:18 +02:00
Jason Dellaluce
bc765f1b7d chore(userspace/falco): log in signal handlers instead than in event processing loop 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:31:18 +02:00
Jason Dellaluce
c2a8efc329 chore(userspace/engine): fix typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:26:18 +02:00
Jason Dellaluce
978f192c38 chore(userspace/engine): fix codespell typos 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:26:18 +02:00
Jason Dellaluce
1120fb2564 doc(userspace/engine): define thread-safety guarantees of falco_engine::process_event 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:26:18 +02:00
Jason Dellaluce
1b8847c06b refactor(userspace/engine): make stats manager thread-safe for on_event method 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:26:18 +02:00
Jason Dellaluce
3839fdca1e update(userspace/falco): avoid using zlib in webserver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:23:17 +02:00
Jason Dellaluce
2b7bcc87a7 update(userspace/falco): add configuration entry for webserver threadiness 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:23:17 +02:00
Jason Dellaluce
0eacd41cd5 refactor(userspace/falco): support zlib and custom threadiness in webserver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:23:17 +02:00
Jason Dellaluce
d9b6473db2 refactor(userspace/engine): increase const coherence of falco engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 11:04:18 +02:00
Jason Dellaluce
7d3dacc6d7 refactor(userspace/falco): cleanup actions order 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 17:02:15 +02:00
Jason Dellaluce
a9d185f5e1 refactor(userspace/falco): drop inspector dependency on print_plugin_info action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 17:02:15 +02:00
Jason Dellaluce
bd26bc09c2 refactor(userspace/falco): drop inspector dependency on print_ignored_events action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 17:02:15 +02:00
Jason Dellaluce
97e3209222 refactor(userspace/falco): drop inspector dependency on load_rule_files action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 17:02:15 +02:00
Jason Dellaluce
6d30061576 refactor(userspace/falco): drop inspector dependency on list_plugins action 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 17:02:15 +02:00
Jason Dellaluce
2caadd1af5 refactor(userspace/falco): add action for printing syscall events 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 17:02:15 +02:00
Jason Dellaluce
b307853e39 update(userspace/falco): use move semantics in falco logger 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 17:00:15 +02:00
Leonardo Grasso
3d61d3427e fix: correct env var name FALCO_HOSTNAME 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-08-25 16:59:15 +02:00
Leonardo Grasso
928e10f0ce fix(userspace/falco): print hostname when json formating is enabled 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-08-25 16:59:15 +02:00
Leonardo Grasso
34ad5c43fb update(userspace/engine): add support for hostname 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-08-25 16:59:15 +02:00
Jason Dellaluce
d35dba30ed update(userspace/engine): sync ast structs to new libs definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-25 16:32:15 +02:00
Jason Dellaluce
e7502431a2 update(userspace/falco): move rate limiter out of falco outputs framework 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-23 15:52:05 +02:00
Jason Dellaluce
6c74aa1a29 update(userspace/falco): enable per-event-source rate limiter 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-23 15:52:05 +02:00
Jason Dellaluce
af0b624a3a fix(userspace/falco): set alert throttling config defaults 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-23 15:52:05 +02:00
Jason Dellaluce
8760f04bf2 refactor(userspace/falco): make output framework explicitly thread-safe 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-23 15:52:05 +02:00
Mark Stemm
8e61e46016 Add an "Ok, with warnings" overall status. 
In outputs it could be confusing to see a line:

<filename>: Ok

followed by a set of warnings.

To differentiate this, add a top level status "Ok, with warnings" when
rule loading was successful but had warnings.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-19 11:55:43 +02:00
Mark Stemm
3c7b6e037a Falco engine changes to support multiple files in rule load results 
The methods that throw exceptions from stringified results need to
additionally pass a rules_contents_t struct. This also meant that they
need to call the filename + content version of load_rules.

To avoid some duplicate code between the two load_rules_file methods,
move the work of opening the file into a private method
read_file(). It can throw an exception, which is passed through for
the void return method and caught + converted into a load_result error
for the method that returns a load_result.

Also, to avoid duplicate code between the void load_rules and
load_rules_file methods, add a private method interpret_load_result()
which throws an exception if the result has an error and prints
warnings otherwise if verbose is true.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-19 11:55:43 +02:00
Mark Stemm
49b7f0474f Falco application changes to support multiple files in rules results 
Application changes to support multiple files when stringifying rules
results:

- In both validate_rules_files and load_rules_files, instead of
  loading each file individually and then calling load_rules(), add a
  separate step that loads all the files at once. The actual rules
  content strings are held in a vector. The map from filename to
  content (reference) points to entries in that vector.

- Both actions do the same work for this step, so put the
  implementation in a shared application template method read_files
  that works on iterators. It uses itertors because the load filenames
  are a list and the validate filenames are a vector.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-19 11:55:43 +02:00
Mark Stemm
98c1e3d3f1 Restructure rules result to properly support multiple files 
The old version of rules_result assumed that all errors/warnings were
related to a single file. That was generally correct for errors, as
rules parsing always stopped at the first error, so there is only one
relevant file.

However, for warnings that was not the case. When reading multiple
files A and B, you might get a warning from file A *only* after
reading file B. For example, B might redefine a rule in such a way
that you could get unused list/macro warnings from file A.

To properly address this, make some changes to how contexts are
managed:

- Instead of creating snippets at the time the error/warning was
  generated, create snippets at the time the error/warning is
  converted into a string. This requires passing all rules contents to
  as_string()/as_json(), so define a
  falco::load_result::rules_contents_t map from filename to rules
  content (reference) and pass it in as_string/as_json(). Snippets are
  now generated from the rules content matching the filename in the
  context.
- When creating warnings/errors, there's no need to pass along the
  rules content. This is only used when converting an error into a
  string/json.

Also change snippet() to handle potentially very long lines. Instead
of always printing the entire line matching a location, print up to
snippet_width(param, with default 160 chars)/2 characters surrounding
the column from the location.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-19 11:55:43 +02:00
Mark Stemm
fefd23f2f1 fix: print full rule load errors without verbose/-v 
The latest released falco always prints full details on errors when
used with -r (read rules)/-V (validate rules). However #2098 changed
this to only print full details when verbose is true.

Fix the regression by always printing errors when loading
rules. Warnings will be printed only with -v.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-10 14:39:17 +02:00
Melissa Kilby
0ab66c6fb5 update(userspace/falco): rename some buffer kernel side event drop metrics, add comments 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-08-08 10:28:42 +02:00
Melissa Kilby
1588f37788 update(userspace/falco): extend buffer kernel side event drop metrics 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2022-08-08 10:28:42 +02:00
incertum
66af8ad52b new(userspace/falco): extend ebpf buffer kernel side event drop metrics 
Signed-off-by: incertum <melissa.kilby.oss@gmail.com>
 2022-08-08 10:28:42 +02:00
Mark Stemm
550cdbd176 Falco application changes to support rule loading result struct 
Update the load_rules_files and validate_rules_files actions to use
the new falco_engine methods that return a rules result struct. The
app action interface is the same, returning ::fatal on error,
ok()/exit() otherwise. The difference is how any warnings/errors are
obtained--from the struct instead of an exception.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Mark Stemm
f7f6d72ac0 Rule loader changes to support result objects 
Changes to the rule loader to support result objects:

- Instead of throwing falco_exception on internal error, throw a
  rule_load_exception instead, which contains distinct
  error/message/context information.

- A context object contains a chain of location structs chaining from
  the document root to the object where the error occurred. Each
  location has a file position (as a YAML::Mark), an item
  type (e.g. "rule", "list", "exception"), and an item name (e.g. "Write
  Below Etc"). This will allow showing the exact location of an
  error (e.g. list item/exception field) while also remembering the item
  that contained it.

- All the _info structs now contain a context so errors that occur
  after yaml parsing can still point to the original location in the
  yaml file.

- rule_loader::result is an implementation of the abstract class
  defined in falco_load_result. The implementation keeps track of a
  list of errors/warnigns that used to be in the configuration object,

- Clean up compile_ methods to just throw rule_load_exceptions or
  return nothing, and ensure that all rule_load_exceptions are caught in
  compile(). When caught, errors are added to the result object.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Mark Stemm
cbe7cceb87 Modify rule reader to use a result struct 
Modify rule reader to use a result struct for errors and warnings:

- Instead of throwing a falco_exception to pass back errors, use a
  rule_load_exception, which contains distinct error codes, messages,
  and a context that points to the location of the error.

- The static method context_yaml_get_context() has moved to a method
  of the rule_loader context object + the result as_string() method.

- As objects are parsed, create relevant context objects as reading
  drills down into the contents of a rule/list/exception. This will
  enable for specific errors in, say, the middle of an exception/list
  while remembering the object that contains it.

- Modify decode_val()/decode_seq() to always return errors as
  exceptions. Previously, it was a mix of a bool return + some
  exceptions.

- decode_val()/decode_seq() are now more consistent about returning
  distinct errors for the property not existing, the property existing
  but not being a scalar/sequence value, and not being convertable to
  the templated value.

- Combine the two nearly identical decode_seq() functions into a
  single one that uses a lambda to perform the final step of adding to
  the vector/set.

- There are some item-specific decode_xxx functions for specific
  item properties like tags, exceptions fields/comps/values, etc.
  that call the above functions.

These changes simplify the calls to decode_seq()/decode_val() as they
don't need to add their own errors when returning false. Also some
calls weren't checking the return value.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Mark Stemm
bb44d992ab Change filter_warning_resolver to use warning codes 
Now that we have a result struct and set of warning codes, change the
filter_warning_resolver to use them. This involves populating a set of
warning codes instead of strings.

Also, the methods to format warnings into human-readable strings is
now in the falco_load_result static methods, so move the text there
and remove the methods here.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Mark Stemm
0066ba49ea Falco engine changes to support load_rules result class 
Add new load_rules methods that return a result object instead of
throwing exceptions on error. The existing load_rules methods call the
new methods internally and continue to throw exceptions on
error/return individual values on success.

The result is returned as a unique_ptr so it can be populated while
loading rules (as a part of the configuration object) and then move()d
to the return value.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Mark Stemm
8497f25a43 Add a load result interface for use in new load_rules methods 
Define a falco_load_result abstract class for use in new load_rules
methods. It's abstract so the implementation details in
rule_loader/rule_reader can be hidden from someone who wants to use
the API to load rules and work with a result.

The class defines a set of error codes/warning codes and has static
methods to get a short and long description of each error/warning.

There are virtual methods to access the important parts of a result:
 - successful or not
 - a string representation of the result, suitable for display to
   users. Takes a verbose argument. When verbose is true, the string is
   multi-line and has full details, including locations, item names,
   etc. When verbose is false, the string is single-line and just
   returns error codes.
 - a json representation of the result, suitable for automated
   parsing/interpretation later.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Andrea Terzolo
9d443685ea new(userspace): support SCAP_FILTERED_EVENT return code 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-08-04 11:47:22 +02:00
Jason Dellaluce
a46cbcffe8 fix(engine): index old version of events in rulesets 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
577ba5904b update(engine): bump version to 14 and update fields checksum 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Andrea Terzolo
c8bc5758c3 new(userspace): print architecture information 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-31 19:57:29 +02:00
Andrea Terzolo
b759e77fda new(userspace): print if the BPF probe is enabled 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-28 12:25:57 +02:00
Andrea Terzolo
74b6186f7d new(userspace): print enabled sources when falco starts 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-28 12:25:57 +02:00
Mark Stemm
baf5540c30 Remove required_engine_version from falco engine load_rules APIs 
The only use of it was to include in --support output, which is
redundant as the support output already includes the full contents of
each rules file.

Additionally, it wasn't even being updated after the switch from lua
rules loading to c++ rules
loading (https://github.com/falcosecurity/falco/pull/1966/ or
surrounding PRs).

This will simplify follow-on changes to add a real "result" to rules
loading methods, as there will be fewer API variants to support.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-07-25 17:57:42 +02:00
Andrea Terzolo
35db0b4a24 cleanup(userspace): remove unused logic 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-14 09:58:50 +02:00
Andrea Terzolo
4136a27de1 new(userspace): add exception management 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-14 09:58:50 +02:00
Andrea Terzolo
e73dbd4b42 new(userspace): add current drop_pct 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Shane Lawrence <shane@lawrence.dev>
 2022-07-14 09:58:50 +02:00
Andrea Terzolo
b57a2d5a5f update(userspace): introduce nlohmann json library 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-07-14 09:58:50 +02:00
Andrea Terzolo
a7153f2fd8 fix(userspace): compute the drop ratio in the right way 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Shane Lawrence <shane@lawrence.dev>
 2022-07-13 09:38:22 +02:00
Aldo Lacuku
46f625c449 chore(engine): remove trailing colon from logs when loading rule files 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-07-12 10:40:43 +02:00
Jason Dellaluce
62c1e875d5 update(userspace/falco): simplify sinsp logger sev decoding 
Co-authored-by: Luca Guerra <luca@guerra.sh>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-07 12:46:51 +02:00
Jason Dellaluce
7dade32688 refactor(userspace/falco): make sinsp logging part of the configuration (default to false) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-07 12:46:51 +02:00
Jason Dellaluce
bae68b37ee new(userspace/falco): enable attaching libsinsp logger to the falco one 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-07 12:46:51 +02:00
Luca Guerra
3cde70eda8 fix(falco): parameter ordering in initialization 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Luca Guerra
982e8663be update(gvisor): make gvisor_enable depend on config 
Signed-off-by: Luca Guerra <luca@guerra.sh>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-01 14:17:38 +02:00
Luca Guerra
993516f430 new(falco): add compile-time option to enable or disable gvisor support 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Luca Guerra
60b149709d fix(gvisor): formatting 
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-07-01 14:17:38 +02:00
Luca Guerra
698eda8680 new(gvisor): add option to generate gVisor configuration 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Luca Guerra
0b75433cee update(gvisor): update to the latest sinsp interface 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Luca Guerra
0ba492c280 new(falco): do not alert on syscall frequency when gvisor is enabled 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Luca Guerra
927c1c4126 new(falco): enable gVisor event collection 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-07-01 14:17:38 +02:00
Jason Dellaluce
3c2effb498 refactor(userspace/engine): remove source field from macros in rule loader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-28 11:33:08 +02:00
Leonardo Grasso
2f208b52fc fix(userspace/falco/app_actions/print_version.cpp): correct getter call for schema version 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-23 12:47:03 +02:00
Leonardo Grasso
f3bc178e40 fix(userspace/falco/app_actions/print_version.cpp): ensure destructor gets invoked 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-23 12:47:03 +02:00
Leonardo Grasso
fda9fb36de update(userspace/falco): add more info to --version output 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-06-23 12:47:03 +02:00
Leonardo Grasso
92fdbbcc52 update(userspace/falco): do not print driver version by default 
Since now each Falco version is compatible with a range of driver version and not just one.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-06-23 12:47:03 +02:00
Mark Stemm
85ca1eb3dd fix(app_actions): perform validate_rules before load_rules action 
Perform the validate_rules action before the load_rules action. This
ensures that *only* the rules files named with -V arguments are
validated.

This fixes https://github.com/falcosecurity/falco/issues/2087.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-06-23 12:24:03 +02:00
Jason Dellaluce
1e5ef912de chore: improve falco.yaml comments 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-14 22:13:37 +02:00
Jason Dellaluce
50039316ce update(userspace/falco): make plugin configuration more robust 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-14 22:13:37 +02:00
Jason Dellaluce
eb365f1a3e new(userspace/falco): add action and option to print detailed plugin info 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-14 22:13:37 +02:00
Aldo Lacuku
e6f99a61c9 chore(falco): fix indentation 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-09 12:50:39 +02:00
Aldo Lacuku
7b83943059 fix(falco): compilation issues with new libs version 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-09 12:50:39 +02:00
Aldo Lacuku
2111699a96 chore(engine): bump falco engine version number to 13 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-09 12:50:39 +02:00
Aldo Lacuku
7a774f6b2e chore(userpace/falco): do not print error code in process_events.cpp 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-06-01 13:35:38 +02:00
Aldo Lacuku
765ef5daaf chore(userspace/falco): fix punctuation typo in output message when loading plugins 
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
 2022-05-30 10:46:40 +02:00
Jason Dellaluce
3b462af58e fix(userspace/falco): enable k8s and mesos clients only when syscall source is enabled 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
09eae35f3a refactor(userspace/falco): create action for initializing k8s and mesos clients (step 2) 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
383b8f9660 refactor(userspace/falco): create action for initializing k8s and mesos clients 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 19:23:26 +02:00
Jason Dellaluce
13d70b65ae update(userspace/engine): rename ruleset.h in filter_ruleset.h 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
9fd10220a5 update(userspace/falco): sync falco with new engine definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
0abd7eaa28 refactor(userspace/engine): refactor engine interface and internals 
This updates the engine to comply and work properly with the newly-introduced
interface design.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
a1bdf95a0f refactor(userspace/engine): improve ruleset interface definitions 
The filter_ruleset interface its implementation evt_type_index_ruleset
have been modified as follows:
- Only keep track of ruleset ids and not names. The falco engine will take
care of mapping easy-to-remember ruleset names to ruleset ids.
To emphasize this, use ruleset_id everywhere and not ruleset.
Also, make it non-optional.
- Have explicit separate functions to enable/disable rules, instead of a single enable() method combined with a boolean flag.
This does *not* change the falco_engine interface, which has
similar methods, to avoid breaking API changes.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Mark Stemm <mark.stemm@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
833fec8537 refactor(userspace/engine): leverage falco_rule def in stats manager 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
50c2aa9c81 refactor(userspace/engine): update rule loader to use new filter_ruleset interface 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
f41f51f736 refactor(userspace/engine): update falco engine to use new ruleset interface and have one ruleset for each source 
This also fixes a couple of bugs. With the current implementation, the multi-ruleset feature is broken with multiple sources.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
3af8d1c0d2 refactor(userspace/engine): adapt existing ruleset implementation to new filter_ruleset interface 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Jason Dellaluce
bbbdb311e0 refactor(userspace/engine): introduce interface for rulesets and their factory 
This interface will allow us to use different ruleset implementations inside the same engine.
The goal is to define API boundaries that will allow swapping the current evttype-index
ruleset implementation more easily. Key benefits include: smaller component with less responsibilities,
easier substituibility, more testable design, opportunity to adopt different index strategies
depending on the ruleset implementation.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-25 09:16:45 +02:00
Andrea Terzolo
d860472987 update(userspace/falco): improve falco termination 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 18:35:18 +02:00
Andrea Terzolo
3a3d5dfdcd Update userspace/falco/app_actions/load_rules_files.cpp 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
46159b8de9 update(userspace/engine): introduce new check_plugin_requirements API 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:55:17 +02:00
Andrea Terzolo
e751bf79c3 fix(userspace/engine): improve rule loader source checks for macros and lists 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:54:17 +02:00
Federico Di Pierro
39f55f4b5c update(userspace): split filterchecks list for each source idx. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
5f00cea3c9 fix(userspace/falco): do not start webserver in capture mode. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Federico Di Pierro
acbbcf7481 Update userspace/falco/app_cmdline_options.h 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
3ba64d8a49 new(userspace/falco): new inotify watcher is now able to properly watch rules folders, when specified. 
This means that when starting Falco passing to it a folder for its rules, it will properly manage
changes to any file inside the folders, plus any created/deleted file inside it.

Unified list of rules parsing, instead of having it done twice inside cmdline_options and configuration.
Instead, it is done only once, inside load_rules_files.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
293a6c2b40 update(userspace/falco): moved to a config option. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
a9fe979071 chore(userspace/falco): small cleanup. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Federico Di Pierro
e32f5a66c5 new(userspace/falco): added an option to listen to changes on the config file and rules files, and trigger a Falco reload. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-12 14:26:34 +02:00
Milkshak3s
8c6cfae18f Include origin host in output json 
Signed-off-by: Milkshak3s <justchris.vantine@gmail.com>
 2022-05-09 12:16:50 +02:00
Leonardo Grasso
eae193ade0 build(userspace/engine): cleanup unused include dir 
`CURL_INCLUDE_DIR` is a leftover since now the correct include path is injected via libs.

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-05-04 16:12:30 +02:00
Jason Dellaluce
dbbc93f69d fix(userspace/falco): listen to proper host in webserver 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
63b7aabc81 chore: solve compilation issues and polish code 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
67d2fe45a5 refactor: add k8saudit plugin and adapt config, tests, and rulesets 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
b91ff34b97 refactor: drop civetweb dependency and implement healtz using cpp-httplib 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
42fcc7291f refactor(userspace/falco): remove k8s audit references from falco 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Federico Di Pierro
08ded97596 new(userspace/falco): use new plugin caps API. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-04-29 10:16:50 +02:00
Mark Stemm
86d632d343 fix: allow empty exceptions property 
This matches prior behavior before the lua-to-c++ switch.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-28 14:42:24 +02:00
Mark Stemm
e909babe20 fix: add implied exception comp to item for single item variant 
When adding an implied "in" comparison to an exception using the
single value form, add it to item, not items.

This fixes #1984.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-28 14:42:24 +02:00
Jason Dellaluce
a16eac221e refactor(userspace/engine): apply C++ best practices to newest engine classes 
This include making a coherent use of const, remove private inheritance, and adding virtual destructors.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-27 16:22:59 +02:00
Jason Dellaluce
be177795c2 refactor(userspace/engine): use supported_operators helper from libsinsp filter parser 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-27 16:22:59 +02:00
Mark Stemm
120027dc2e Add constructor/destructor to stats_manager 
This ensures m_total is properly initialized.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
b89b3f82ee Falco main changes for app actions 
This involves moving the code in falco_init() into individual files
below app_actions/. falco_init() simply calls app.run() now. When
app.run() returns false, print any erorr. When app.run() sets restart
to true, falco_init() is called again.

app.run() is still inside a catch block to catch any uncaught
exception.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
1639e22462 Move most code from falco_init() to individual app actions 
Each file below app_actions/ defines some of the methods declared in
falco::app::application.

Any state that needs to be shared betweeen methods, or between the run
and teardown methods, resides in falco::app::application::state(), so
the moved code stays pretty much as-is, other than replacing stack
variables with member variables in app_state.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
e3b82c00e1 Copying falco.cpp to process_events.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
6e10d3d884 Copying falco.cpp to process_events.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
0daff8f829 Copying falco.cpp to open_inspector.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
5d7bed8d74 Copying falco.cpp to open_inspector.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
64b7092f56 Copying falco.cpp to daemonize.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
a9417d60df Copying falco.cpp to daemonize.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
365b97a9db Copying falco.cpp to validate_rules_files.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
70dc7360c9 Copying falco.cpp to validate_rules_files.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
b845fccc72 Copying falco.cpp to start_webserver.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
d4def892be Copying falco.cpp to start_webserver.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
6b9714eadc Copying falco.cpp to start_grpc_server.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
54ef2a2b1e Copying falco.cpp to start_grpc_server.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
5496741aae Copying falco.cpp to print_version.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
c975df57a0 Copying falco.cpp to print_version.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
8634d8b3a2 Copying falco.cpp to print_support.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
4ca13bc0f0 Copying falco.cpp to print_support.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
de58872b2e Copying falco.cpp to print_ignored_events.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
2963bbab98 Copying falco.cpp to print_ignored_events.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
f5c18399e1 Copying falco.cpp to print_help.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
35261c4a3a Copying falco.cpp to print_help.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
78a297ac62 Copying falco.cpp to load_rules_files.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
9325658d5b Copying falco.cpp to load_rules_files.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
2d53fecf4b Copying falco.cpp to load_plugins.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
0f8386326e Copying falco.cpp to load_plugins.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
2e8d3c6486 Copying falco.cpp to load_config.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
444daef2f0 Copying falco.cpp to load_config.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
88b951abe2 Copying falco.cpp to list_plugins.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
4a818eeeec Copying falco.cpp to list_plugins.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
8c40b18428 Copying falco.cpp to list_fields.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
91a7bcae86 Copying falco.cpp to list_fields.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
9d9fb2538d Copying falco.cpp to init_outputs.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
98a2224ee5 Copying falco.cpp to init_outputs.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
ccbc8ec196 Copying falco.cpp to init_inspector.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
344dc3930b Copying falco.cpp to init_inspector.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
431b8885b4 Copying falco.cpp to init_falco_engine.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
22674f6bf8 Copying falco.cpp to init_falco_engine.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
ae7c8190d3 Copying falco.cpp to create_signal_handlers.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
da7efbc96e Copying falco.cpp to create_signal_handlers.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
9de80b7b92 Application changes to support actions 
Changes to the falco::app::application object to support actions:

- All of the code that was in falco_init is now in methods of
  application. (A later commit actually moves the code from falco_init
  and into the split-up methods, this commit just declares them).
- Methods return an application::run_result object, which is a tuple
  of success/errstr/proceed. proceed=false is used to short circuit
  calling methods (think --help, --list, --support, etc.)
- application now has a run() method which runs the methods in an order
  that honors any implicit dependencies (e.g. you have to init an
  inspector before you open it, you have to do almost everything else
  before processing events, etc.)
- There are a few methods devoted to teardown, they are always called
  after the group of run methods are called.
- State that needs to be saved between methods, or saved between the
  run and teardown functions, is in a
  falco::app::application::state object.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
0a51f4f1f1 Convert direct pointer refs to shared_ptr 
Some objects used by falco (falco outputs, falco_formats, etc) were
using raw pointer references, which isn't great.

So convert use of raw pointers (originally passed from falco_init or
functions it called) with shared_ptr, as they are now held in
application state.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
62d4fffcb2 Add missing pragma 
Without this, if webserver is included more than once you get
duplicate defined classes.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Leonardo Grasso
b4d9261ce2 build: define "falco" component 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-22 09:41:56 +02:00
Jason Dellaluce
0bf53f0f88 refactor(userspace/engine): restrict unsafe-na-check warning to k8s audit fields 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-21 18:50:58 +02:00
Jason Dellaluce
37d03cf7bc chore(userspace/engine): fix typo spotted with codespell 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-21 18:50:58 +02:00
Jason Dellaluce
95727b268f new(userspace/engine): add a resolver to generate warnings from a filter AST 
The first warnings we support involve the unsafe comparisons with <NA>, which were present
in the legacy regression tests for PSPs.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-21 18:50:58 +02:00
Mateusz Gozdek
1fdfbd3a3d Fix more typos 
Signed-off-by: Mateusz Gozdek <mgozdek@microsoft.com>
 2022-04-20 12:21:27 +02:00
Jason Dellaluce
13256fb7ef update(userspace/engine): bump engine version to 12 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-19 16:29:40 +02:00
Jason Dellaluce
d9d23cd31d update: bump libs version to b19f87e8aee663e4987a3db54570725e071ed105 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-19 16:29:40 +02:00
Jason Dellaluce
b8a95d262f refactor(userspace/engine): polish evttype resolver and use it in rule loader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-19 16:29:40 +02:00
Jason Dellaluce
dd3d235d7f refactor(tests): adapting test_rulesets to new method signatures 
At the same time, this also simplifies the unit test cases by using the SCENARIO construct of catch2,
which allows sharing a setup phases between different unit tests, and removes a bunch of repeated LOC in our case.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-19 16:29:40 +02:00
Jason Dellaluce
b5870a8656 new(userspace/engine): add a resolver class to search evttypes from filters and event names 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-19 16:29:40 +02:00
Jason Dellaluce
f638706ba3 chore(userspace/engine): renamings and code polishing in rule_loader and rule_reader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-15 10:54:58 +02:00
Jason Dellaluce
e1a5427874 update(userspace): add method to clear rule loader state 
Once all rule files have been loaded, and all the rules have been compiled into filters and inserted in the engine rulesets, the loader definitions are maintained in memory without really being used. This commit adds a convenience method to clear the loader state and free-up some memory when engine consumers do not require such information in memory anymore.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-15 10:54:58 +02:00
Jason Dellaluce
30fb58ed48 refactor(userspace/engine): update falco_engine to use new rule_reader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-15 10:54:58 +02:00
Jason Dellaluce
2c0e6d3b88 update(userspace/engine): introduce new rule_reader class 
The rule_reader class is responsible of parsing the YAML ruleset text and of using the rule_loader
to store the new definition in the internal state. This is a first step towards separating the YAML
reading logic from the rule parsing one. Potentially, this will allow us to read rulesets from another
YAML library or from something different than YAML files too.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-15 10:54:58 +02:00
Jason Dellaluce
9ed7d57838 refactor(userspace/engine): reduce responsibilities of rule_loader 
The rule_loader is now simply responsible of collecting list/macro/rule definitions and then compiling them as falco_rules. The ruleset file reading code will be moved to another class

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-15 10:54:58 +02:00
Jason Dellaluce
06b6565fa6 refactor(userspace): sync falco codebase to new falco_common definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 22:21:20 +02:00
Jason Dellaluce
55ec8c0e1b refactor(userspace/engine): polish falco_common and improve priority parsing/formatting 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 22:21:20 +02:00
Jason Dellaluce
2934ef29b9 chore(userspace/engine): fix indentations and use improve indexed_vector 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
47426fbe0d update(userspace/engine): minor improvements and bug fixes on engine and rule loader 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
e50d22f013 fix(userspace/engine): solve integration test errors 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
43020d8a7d refactor(userspace/engine): re-implement the rule loader in C++ 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
d483b897e7 new(userspace/engine): create stats_manager inside falco engine 
This is a porting of what we had inside the Lua codebase. This now handles the single responsibility
of gathering stats about rule-event matching, and of formatting them to print them to the user.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
9e93b7cd52 new(userspace/engine): add falco_rule struct to represent rule definitions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
6c9e6c5918 new(userspace/engine): add new indexed_vector class to achieve string-based O(1) access in vectors 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
c2cac5af92 refactor(userspace/engine): add run() overload in filter_macro_resolver to support shared_ptrs 
This change allows working with safety with AST nodes wrapped into shared pointers.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
cf83a91d4e refactor(userspace/engine): re-implement wrap_text() function in falco_utils 
The function implementation was removed, however it was still defined in the .h header. Moreover,
this will now be required in order to replace its lua equivalent.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
3201479392 refactor(userspace/engine): turn falco_common into a namespace containing common static utilities 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
b74dcbd851 cleanup(userspace/engine): remove lua files and lua-related code sections 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
7db9dd66ff refactor(build): drop dependencies to chisels, luajit, lyaml, and libyaml 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Angelo Puglisi
e8cb96a57b perf: change falco_engine::process_event to lookup sources by index 
falco_engine::process_event gets called for every inspector event.
Profiling showed that std::map::find takes about 10% of
falco_engine::process_event, and that can easily improved by accessing
the source by index.

Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
 2022-04-06 14:46:31 +02:00
Mateusz Gozdek
cb4cec6f57 Fix typos 
Found by running the following command:
codespell -f -H -L aks,creat,chage -S .git

Signed-off-by: Mateusz Gozdek <mgozdek@microsoft.com>
 2022-04-06 14:40:31 +02:00
Jason Dellaluce
a0a87e443f update(userspace/engine): support undefining macros 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
20c59970f5 update(engine): rename and improve sinsp filter macro resolvers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
b7db0f9b14 refactor(engine/lua): update lua rule loader to use new sinsp parser 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
2ee95122df refactor(engine): remove unused lua modules 
Both the parser.lua and compiler.lua modules are not necessary anymore, because all the logic related
to filter parsing and compilation is handled inside libsinsp now. Accordingly, they have been removed from
the lua-to-cpp.sh scripts. README.md and parse-smoke.sh have been removed since they are not needed anymore:
lpeg is not used by the project, and the smoke tests are implemented in libsisnsp unit test suite.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
911bd16556 update(engine): create a lua helper for rule filter manipulation 
The lua_filter_helper class is a simple Lua wrapper that can be used in the Lua rule loader to
parse/compile rule filters, and manipulate them to resolve/replace list and macro references.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
3879a283bf refactor(engine): remove dependency from lua parser 
The Lua parser grabbed from libs chisels is not used anymore, as the compilation logic happen inside the new
filter parser of libsinsp.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
c5818e6273 new(engine): add rule filter macro-resolver 
This is a first step towards porting the rule filter building logic that is currently implemented in Lua.
filter_macro_resolver uses the newly introduced AST constructs from libsinsp, and
allow manipulating filter ASTs to resolve/replace macro references. This is meant to be used
at boot time by the rule loader (which we still want to maintain implemented in Lua for now).

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
0a132f453a update(cmake): remove lpeg dependency 
The Lua PEG parser is not longer needed, since we now use the new filter parser implemented
in libsinsp.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
481e32cab9 update(build): bump libs version to caa0e4d0044fdaaebab086592a97f0c7f32aeaa9 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-18 23:20:01 +01:00
Mark Stemm
3fbc90e99e Skip macros with unknown sources 
Also skip macros with unknown sources. This matters primarily for
macros related to plugins that have a distinct event source.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-03-18 13:54:47 +01:00