github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-07-19 00:57:48 +00:00
Code Issues Projects Releases Wiki Activity
4,906 Commits 119 Branches 173 Tags 104 MiB
new/add_mimalloc
Commit Graph

596 Commits

Author SHA1 Message Date
Gianmatteo Palmieri
1c66b640f2 Revert "fix(engine): apply output substitutions for all sources" 
This reverts commit 4ef7c9553a.

Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-06-05 12:43:19 +02:00
Jason Dellaluce
cd1c5f911c refactor(userspace): move falco logger under falco engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-23 09:29:23 +02:00
Melissa Kilby
c15a309781 clenaup: add sanitize_metric_name helper 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Melissa Kilby
0195dba889 cleanup: add getter functions to stats_manager 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Melissa Kilby
b7adcd251d new(metrics): add rules_counters_enabled option 
Intended to replace https://github.com/falcosecurity/falco-exporter
when used with Prometheus output

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Jason Dellaluce
e211e97e2a fix(userspace/engine): make sure exception fields are not optional in replace mode 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-17 14:38:57 +02:00
Melissa Kilby
6057c1553e cleanup(engine): print total number of enabled rules 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-16 10:29:53 +02:00
Melissa Kilby
77341cbd2e new(engine): add print_enabled_rules_falco_logger when log_level debug 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-16 10:29:53 +02:00
Luca Guerra
35bd348e21 new(falco): implement rule selection configuration in falco.yaml 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-14 12:47:46 +02:00
Melissa Kilby
91b58c43f1 chore: fix non linux build metrics 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-14 10:08:51 +02:00
Melissa Kilby
67a5015be7 cleanup(metrics): use filesystem lib to derive file names + build fix 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-14 10:08:51 +02:00
Melissa Kilby
2b80cf85ac new(utils): add new helper to calculate file sha256sum 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-14 10:08:51 +02:00
Jason Dellaluce
f18ea1e8b7 update(userspace/engine): support tranformers in exception fields 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-08 20:23:55 +02:00
Jason Dellaluce
fa8e780b07 update(userspace/engine): propagate compiler warnings 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-08 20:23:55 +02:00
Jason Dellaluce
bc078f1f63 update(userspace/engine): support comparins with right-hand fields 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-08 20:23:55 +02:00
Jason Dellaluce
ed22e94292 refactor(userspace/libsinsp): support new filter ast structure in falco engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-08 20:23:55 +02:00
Federico Aponte
62d1c4fc4d refactor: smart pointer usage 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-05-06 11:10:44 +02:00
Federico Di Pierro
6954a4028e chore(userspace/engine): bump version and checksum. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-03 12:12:02 +02:00
Gianmatteo Palmieri
eb04b1c66f fix(test): expect warning instead of error on invalid macro/list name 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-17 11:27:52 +02:00
Gianmatteo Palmieri
dd59c48034 new(engine): raise warning instead of error on invalid macro/list name 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-17 11:27:52 +02:00
Gianmatteo Palmieri
83910be726 new(engine): raise warning instead of error on not-unique exceptions names 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-11 17:22:28 +02:00
Gianmatteo Palmieri
7234bc5bee chore(engine): bump engine version 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-03 18:23:53 +02:00
Gianmatteo Palmieri
05c434ed89 new(engine): enforce unique exceptions names 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-04-03 18:23:53 +02:00
Luca Guerra
1aae10fe84 update(engine): bump engine checksum and version 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-03-29 10:16:23 +01:00
Gianmatteo Palmieri
7086f35eba new(engine): add warning when appending an exception with no values 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-27 09:15:13 +01:00
Gianmatteo Palmieri
d1707bef63 fix(engine): apply output substitutions for all sources 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-25 19:33:06 +01:00
Andrea Terzolo
0ce2b95b89 chore: bump falco engine version 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-03-12 16:29:17 +01:00
Federico Aponte
8dbec6c779 refactor: Use FetchContent for integrating bundled yaml-cpp lib 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-03-11 13:57:15 +01:00
Federico Aponte
bc499e191d refactor: Use FetchContent for integrating bundled nlohman-json lib 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-03-11 13:57:15 +01:00
Gianmatteo Palmieri
517b79ee13 chore(engine): bump engine version 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
7265190e66 new(engine): don't expose details in error message 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
f00926b8af new(engine): error on invalid macro/list name 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-03-08 00:02:01 +01:00
Melissa Kilby
5185f152c5 new(config): add falco_libs.thread_table_size 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-03-05 11:36:51 +01:00
Samuel Gaist
f9b17b67f8 refactor(engine): fix variable / function shadowing 
Improve variable names in the code surrounding the changes.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-29 16:20:34 +01:00
Gianmatteo Palmieri
ea781477d6 fix(engine): logical issue in exceptions condition 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
 2024-02-28 08:28:26 +01:00
Federico Aponte
f6af72fe76 cleanup: too many includes and useless defines 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Federico Aponte
4d66a50d5b fix: pessimizing move warning 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Federico Aponte
59c14f46a2 refactor: shared_ptr construction 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-26 14:59:22 +01:00
Jason Dellaluce
c13cf79aab update(engine): bump engine version 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-23 11:39:07 +01:00
Jason Dellaluce
0ec2a6c708 refactor(userspace): reduce usage of raw pointers 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-23 11:39:07 +01:00
Jason Dellaluce
b515f0a079 refactor(usersapace): adapt to changes libs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-23 11:39:07 +01:00
Federico Aponte
745d18ba38 refactor: test AtomicSignalHandler.handle_once_wait_consistency 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-20 15:19:56 +01:00
Samuel Gaist
5e497a4119 fix(c++): improve const correctness 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-15 22:16:33 +01:00
Federico Aponte
7a18795ca5 cleanup: falco_engine deps and include paths 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-02-15 10:08:30 +01:00
Samuel Gaist
42f90817ad refactor: make falco_exception a std::runtime_error 
The implementation provides more or less the same implementation
and thus it makes more sense to base it on std::runtime_error.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-12 18:45:18 +01:00
Samuel Gaist
f6498cd8bd fix(c++): refactor member initialization in constructor initialization list 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>

# Conflicts:
#	userspace/engine/falco_common.h
 2024-02-12 18:45:18 +01:00
Samuel Gaist
08f62200b1 fix(c++): add missing explicit to single argument constructors 
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2024-02-12 16:59:17 +01:00
Jason Dellaluce
0cc1c5b44f refactor(userspace/engine): reduce allocations during rules loading 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-09 14:50:05 +01:00
Federico Di Pierro
7879920570 chore(userspace/engine): introduce proper check to avoid future issues throwing an exception. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-02-08 15:13:59 +01:00
Federico Di Pierro
7bcbc08b52 fix(userspace/engine): always consider all rules (even the ones below min_prio) in m_rule_stats_manager. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-02-08 15:13:59 +01:00
Jason Dellaluce
039069d0e1 update(engine): bump engine version and checksum 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-06 10:25:53 +01:00
Jason Dellaluce
4cffcedba1 refactor: remove refs to gen_event class family 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-02-06 10:25:53 +01:00
Luca Guerra
7d9cfd02e3 chore(falco): update engine checksum 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-02-02 19:57:40 +01:00
Roberto Scolaro
40f4ce008a chore(engine): bump engine version 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2024-01-31 11:53:35 +01:00
Roberto Scolaro
3d06b77de5 chore(engine): update falco engine checksum 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2024-01-31 11:53:35 +01:00
Roberto Scolaro
ce87f2a014 refactor(userspace): remove libs relative imports 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
 2024-01-31 11:51:37 +01:00
Mark Stemm
1e0430dff9 Make compile_condition() a protected method for use in subclasses 
Move the part of compile_rule_infos that actually compiled a condition
string into a sinsp_filter into a standalone method
compile_condition(). That way it can be used by classes that derive
from rule_loader::compiler() and want to compile condition strings.

This implementation also saves the compiled filter as a part of the
falco_rule object so it does not need to be compiled again wihin the
falco engine after rules loading.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-01-30 20:24:33 +01:00
Mark Stemm
88a57bfd1a Add ability for rulesets to access falco engine state 
Some rulesets may need information which is held by the falco_engine
that created this ruleset. So define a set of functions in a struct
and have setters/getters for those functions in the base class.

Derived classes can use the struct's functions to obtain the falco
engine information.

The only function so far is to obtain the filter_ruleset for a given
event source.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-01-30 20:24:33 +01:00
Mark Stemm
ce5a50cbb5 Add addl support for rules reader/compiler subclasses 
To support subclasses that may extend the falco rules format, add
additional error/warning/item types for an extension item.

When subclasses report errors and warnings, they can use these
codes/item types in context objects and still provide an exact
line/column context.

Also make some previously static functions in rules reader protected
methods so they can be used in sub-classes.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-01-30 20:24:33 +01:00
Mark Stemm
eed5b906a8 Provide the entire compile output to ruleset vs individual add()s 
In order to support external rules loaders that may extend the falco
rules format with new top level objects, move away from providing
individual filter objects to the filter_ruleset via calls to add().

Instead, pass the entire compile output returned by the compiler to
the ruleset using a new method add_compile_output(). Custom users can
then cast back the compile output to the appropriate derived class for
use in the ruleset.

Move the declaration of the compile output to a standalone class so it
can be used by rulesets without including the entire rules loader
header files, and add a new factory method new_compile_output() to the
compiler so it can create a derived class if necessary.

This change is
backwards-compatible with existing rulesets, as the default
implementation of add_compile_output() simply iterates over rules and
calls add() for each rule.

This change also speeds up rule loading. Previously, each rule
condition was compiled twice:

1. First, in the compiler, to see if it was valid.
2. Second, in the falco engine before providing each rule to the
ruleset.

Add the compiled filter to the falco_rule object instead of throwing
it away in the compiler.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-01-30 20:24:33 +01:00
Mark Stemm
2d0159ae05 Add ability to provide external rules reader/collector/compiler 
In some cases, a user of the falco engine may want to extend the falco
rules format to provide additional objects to the rules file.

To support that, add a new method set_rule_loader() that allows a user
to provide classes that derive from
rule_loader::{reader,collector,compiler} and read those additional
objects from the rules file.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-01-30 20:24:33 +01:00
Federico Aponte
8143a194d2 fix: nlohmann_json lib include path 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-01-24 09:38:13 +01:00
Jason Dellaluce
ccf62a3745 fix(userspace/engine): avoid storing escaped strings in engine defs 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-01-23 11:58:09 +01:00
Andrea Terzolo
a6a1a9769f cleanup: restore the name of a variable 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Co-authored-by: Luca Guerra <luca.guerra@sysdig.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
c308f5c7e2 cleanup: rename some error messages 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
ee78c862ad tests: add some new tests on override replace 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
8ebdbe3e6f cleanup: use macros for default error messages 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
5192921732 doc: typo in the exception 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
56de6e6786 update(rule_loader): remove the warning on the required_engine_version 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
b318c165da cleanup(falco_engine): remove unused methods 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
5ac005bd4d update(rule_loader): deprecate all non-SemVer compatible values 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
95e4c58e7f update(rule_loader): deprecate enabled usage 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
4aebee684a update(rule_loader): deprecate append key and add a warning 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
63736563a2 cleanup(rule_loader): remove useless include 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Andrea Terzolo
7cac2833b2 cleanup(rule_loader): add a common log message 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2024-01-11 15:37:38 +01:00
Mark Stemm
14d1ca3c97 Add methods to look up the factories provided in add_source() 
Add methods that allow looking up the factories provided to
add_source(). This allows not having to keep track of the factories
outside of the engine.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-01-08 12:00:27 +01:00
Mark Stemm
07d7b9a57a Inline find_source() as it can be called in the event path 
Inline find_source as it can be called in the event processing path.

Also take the cached variant that assigns/uses m_syscall_source_idx
and put it in find_source() instead of process_event().

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-01-08 12:00:27 +01:00
Luca Guerra
728c8d7d0e fix(engine): clarify error message for invalid append 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-12-22 21:49:21 +01:00
Luca Guerra
4c023b0d93 update(engine): temporary replace for error messages 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-12-22 21:49:21 +01:00
Luca Guerra
8a7ef687b1 update(engine): throw an error if an unexpected top level key is found in an override 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-12-22 21:49:21 +01:00
Luca Guerra
21c629dc4d chore(engine): bump engine version 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-12-22 21:49:21 +01:00
Luca Guerra
2db29af0e8 update(engine): clarify override error messages 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-12-22 21:49:21 +01:00
Luca Guerra
bc072502cc new(engine): add selective overrides 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-12-22 21:49:21 +01:00
Andrea Terzolo
8ff1ef752d chore: bump falco engine version 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-12-18 19:01:01 +01:00
Mark Stemm
334302e525 Allow enabling rules by ruleset id in addition to name 
Add alternate enable_* methods that allow enabling rulesets by ruleset
id in addition to name. This might be used by some filter_rulesets to
enable/disable rules on the fly via the falco engine.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2023-12-18 15:58:04 +01:00
Andrea Terzolo
ed346e90cd update(falco): bump engine version and checksum 
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
 2023-12-13 16:59:46 +01:00
Federico Aponte
e427c800f3 chore(build): fix error using find_package with ExternalProject_Add 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2023-12-11 16:52:39 +01:00
Federico Aponte
5e17ba6c23 chore(build): allow usage of non-bundled nlohmann-json 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2023-12-11 16:52:39 +01:00
Federico Aponte
44b7352180 cleanup: fix several warnings from a Clang build 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2023-12-06 16:40:26 +01:00
Jason Dellaluce
390a13bd40 update(userspace): optimizations in validation and description steps 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-12-02 09:38:15 +01:00
Jason Dellaluce
e3943ccac3 refactor(userspace/engine): uniform json lib in rules description and not print from engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-12-02 09:38:15 +01:00
Luca Guerra
6411eed4a7 cleanup(falco): remove decode_uri as it is no longer used 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-11-29 17:42:06 +01:00
Melissa Kilby
3b068919d0 update(cmake): bump libs and driver to c2fd308 plus bump falco engine version 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2023-11-28 12:57:04 +01:00
Jason Dellaluce
66a122d4ce update(userspace/engine): bump engine version 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-16 09:26:19 +01:00
Jason Dellaluce
04e2f19915 refactor: solve compilation issues with latest libs changes 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-16 09:26:19 +01:00
Jason Dellaluce
359bd6e593 cleanup(userspace/engine): remove legacy k8saudit implementation 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-15 16:05:15 +01:00
Luca Guerra
8bf40cdf88 update(engine): port decode_uri in falco engine 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-11-14 20:36:15 +01:00
Jason Dellaluce
f5985720f1 fix(userspace/engine): cache latest rules compilation output 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-02 20:32:07 +01:00
Jason Dellaluce
2e7cacb4e0 fix(userspace/engine): solve description of macro-only rules 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-11-02 16:16:06 +01:00
Luca Guerra
1e38967b18 update(engine): remove banned.h 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2023-10-19 17:41:22 +02:00