Commit Graph

10 Commits

Author SHA1 Message Date
Josh Soref
d8cfaee242 spelling: syntactic
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
2022-03-01 16:30:24 +01:00
Josh Soref
d55cd79ebd spelling: parentheses
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
2022-03-01 16:30:24 +01:00
Josh Soref
f5dab2eb5a spelling: implicit
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
2022-03-01 16:30:24 +01:00
Leonardo Grasso
581d67fa08 docs(proposals/20200828-structured-exception-handling): indentation
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2021-01-08 17:53:08 +01:00
Leonardo Grasso
b7bda6d892 docs(proposals/20200828-structured-exception-handling): highlight syntax
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2021-01-08 17:53:08 +01:00
Mark Stemm
5eec26976d Add notes on single-field exceptions
If an exception item has a single value for fields, all the values are
combined together into a single set to build an expression field
cmp (val1, val2, ...)

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2021-01-08 17:53:08 +01:00
Mark Stemm
1916314583 Use well-defined object keys
Instead of oveloading the exception item name as the key of the object,
just have a flat array of object with a name property.

A bit more verbose, but makes it easier to understand what the schema is.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2021-01-08 17:53:08 +01:00
Mark Stemm
8831c7f3c7 Add notion of exception operators
A rule exception can now have a comps property that allows fields to be
matched against items using an operator of =. If not defined, equality
is implied.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2021-01-08 17:53:08 +01:00
Mark Stemm
2cebe052a1 Address feedback
- Clean up npm examples so they are valid.
- Small punctuation changes.
- Emphasize that the strings related to field values are arbitrary.
- Emphasize that exceptions only use equality matching.
- Emphasize that you'll need to upgrade falco to use these new features.
- Capitalize Falco everywhere.
- Change language related to backwards compatibility.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2021-01-08 17:53:08 +01:00
Mark Stemm
05282f3976 Proposal on better exception handling
This proposes adding exceptions as a first class object to falco rules
files.

It adds a new key "exceptions" to rule objects that allows a rule
writer to define tuples of field names that comprise an exception, and a
new top level object "exception" that contains lists of tuples of field
values that define exceptions to rules.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2021-01-08 17:53:08 +01:00