Commit Graph

1555 Commits

Author SHA1 Message Date
Melissa Kilby
6057c1553e cleanup(engine): print total number of enabled rules
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-16 10:29:53 +02:00
Melissa Kilby
77341cbd2e new(engine): add print_enabled_rules_falco_logger when log_level debug
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-16 10:29:53 +02:00
Luca Guerra
eb3ee5d2b2 update(falco): add deprecation warning messages
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-15 10:33:50 +02:00
Luca Guerra
f9a56d9c9d update(falco): add deprecation notice for -T, -t and -D
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-05-15 10:33:50 +02:00
Luca Guerra
abf82f6373 update(config): split init_from_content from init_from_file
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-05-14 12:47:46 +02:00
Luca Guerra
35bd348e21 new(falco): implement rule selection configuration in falco.yaml
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-05-14 12:47:46 +02:00
Melissa Kilby
60e6798f9b cleanup(metrics): use map for config and rules filenames sha256 tracking
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
91b58c43f1 chore: fix non linux build metrics
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
67a5015be7 cleanup(metrics): use filesystem lib to derive file names + build fix
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
34ecd39113 new(metrics): add file sha256sum metrics for loaded config and rules files
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Melissa Kilby
2b80cf85ac new(utils): add new helper to calculate file sha256sum
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-05-14 10:08:51 +02:00
Federico Di Pierro
dd9163c6f4 fix(userspace/falco): fix state inizialization.
This fixes an ugly segfault happening during hot reload.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-05-09 10:43:58 +02:00
Jason Dellaluce
b2e4cddcdf fix(userspace/falco): inizialize options variables
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
f18ea1e8b7 update(userspace/engine): support tranformers in exception fields
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
fa8e780b07 update(userspace/engine): propagate compiler warnings
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
bc078f1f63 update(userspace/engine): support comparins with right-hand fields
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Jason Dellaluce
ed22e94292 refactor(userspace/libsinsp): support new filter ast structure in falco engine
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-05-08 20:23:55 +02:00
Federico Aponte
62d1c4fc4d refactor: smart pointer usage
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-05-06 11:10:44 +02:00
Federico Di Pierro
6954a4028e chore(userspace/engine): bump version and checksum.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-05-03 12:12:02 +02:00
Samuel Gaist
cbfe77d1a0 fix(falco_metrics): remove falco_ prefix for version
The textual content was fixed but not the metrics name.

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
66d1970952 fix(falco_metrics): make duration_sec and outputs_queue_num_drops monotonic
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
82c914c11d fix(falco_metrics): make duration_sec a count and not a timestamp
The output will thus be a total which is what this metrics is.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
2ae6103ab6 fix(falco_metrics): remove redundant falco in version metrics
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
65331c0f20 feat(falco_metrics): add event sources
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
1ba35c911a feat(falco_metrics): add duration_sec
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
5ef8f1c311 feat(falco_metrics): add outputs_queue_num_drops
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
f90dbf9b77 refactor(metrics): use prometheus_metrics_enabled for configuration
As agreed upon during review, use this name to get started. If more
backends were to be added, the configuration structure will be updated.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
5c237a07dc refactor(metrics): make to_text get the application state
As falco may update its state at any time and thus its inspectors objects,
keeping pointers to them may end up in using dangling values.

Therefore, use the state of the application when requesting metrics.

Optimizations such as caching of mostly static values will be done in
a follow up patch.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
a0c109fcff refactor(falco_metrics): put content type in documented constant
This will keep things clearer and also allow for easir update in
the future.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
9cc44c0eb7 doc(falco_metrics): add basic documentation
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
de7a70ea54 fix(metrics): correct hostname metrics name and namespace
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
53722a26bf fix(metrics): correct static metrics
Things to fix:
- type
- name
- unit

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
59c290dc80 fix(metrics): correct metrics namespace
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
daf7efde67 refactor(metrics): move metrics handling to its own class
This will keep the details out of the webserver itself and make
it easier to manage metrics.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
e50d647dc9 refactor(configuration): move webserver items in own struct
This makes things easier to pass around like when starting the
web server.

This has the added benefit of simplifying further extension such as
making the metrics endpoint name configurable without adding yet another
parameter to the start function.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
968a403cba refactor(webserver): move metrics endpoint activation under webserver
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
cd073a033a fix(webserver): use falcosecurity as metric namespace
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
4819877b9f fix(webserver): remove extra line return
The converter already provides properly formatted text.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
3a251beea7 fix(webserver): correct enabled check
It was checking twice for prometheus configuration rather than metrics and then prometheus.

Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Samuel Gaist
8f1b2dc909 feat(webserver): implement metrics endpoint
This endpoint currently returns only prometheus metrics.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-05-03 11:23:02 +02:00
Luca Guerra
814c510d7e update(app): close inspectors at teardown time
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-04-17 18:39:54 +02:00
Gianmatteo Palmieri
eb04b1c66f fix(test): expect warning instead of error on invalid macro/list name
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-17 11:27:52 +02:00
Gianmatteo Palmieri
dd59c48034 new(engine): raise warning instead of error on invalid macro/list name
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-17 11:27:52 +02:00
Federico Di Pierro
e21a3a5e58 chore(userspace/falco): make it clear singular vs plural.
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-16 16:39:47 +02:00
Federico Di Pierro
a2a8c6c3d4 chore(userspace/falco): deprecate old 'rules_file' config key.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-16 16:39:47 +02:00
Gianmatteo Palmieri
83910be726 new(engine): raise warning instead of error on not-unique exceptions names
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-11 17:22:28 +02:00
Federico Di Pierro
8b340d3903 chore(userspace/falco): watch all configs files.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 15:57:20 +02:00
Federico Di Pierro
e840a4ada0 new(unit_tests,userspace/falco): support loading and merging configs files when used from cmdline option.
Also, moved core logic from yaml_helper to falco_configuration class.
Finally, updated tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
a8345327d4 chore(unit_tests,userspace/falco): throw an exception when included config file is not present.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
de9efcbec7 new(userspace/falco): allow --support to print expanded configuration file.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
74034213a2 chore(unit_test,userspace): better log management.
Also, warnings are now returned so that yaml_helper class does not need to log anything.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
aac9b550d3 new(userspace,unit_tests): return loaded config filenames in config::load_from_file.
Add a debug log with the list of loaded config files.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
df220e3c3b chore(userspace,unit_tests): support loading config files from directories.
The files inside the folder will be loaded in lexicographic order,
like we do for rules_file.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
d3bf3a7560 chore(userspace/falco,unit_tests): renamed includes to configs_files.
Moreover, split single huge test into multiple smaller ones.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
1deafee5f7 chore(userspace/falco): print a warn message if -o includes= is passed to cmdline.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
45754fda9f new(userspace,unit_tests): deny main config to include itself.
Moreover, added a couple more tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
8112f6210b chore(userspace,unit_tests): enable override of main config from secondary config files.
Moreover, do not trigger an exception when an included file is not present; just print a warning.
Finally, add more tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
b3ebf9f57e new(userspace,unit_tests): introduce the possibility to split main config file into multiple config files.
The PR introduces a `includes` keyword in the config file,
that points to a list of strings (paths to other config files).

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Gianmatteo Palmieri
7234bc5bee chore(engine): bump engine version
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-03 18:23:53 +02:00
Gianmatteo Palmieri
05c434ed89 new(engine): enforce unique exceptions names
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-03 18:23:53 +02:00
Luca Guerra
1aae10fe84 update(engine): bump engine checksum and version
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-03-29 10:16:23 +01:00
Luca Guerra
13c8e37a41 cleanup(falco): consolidate falco::grpc::server in one class
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-03-28 10:16:15 +01:00
Gianmatteo Palmieri
7086f35eba new(engine): add warning when appending an exception with no values
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-27 09:15:13 +01:00
Gianmatteo Palmieri
d1707bef63 fix(engine): apply output substitutions for all sources
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-25 19:33:06 +01:00
Melissa Kilby
3b7b3439ec cleanup(metrics): fix build for non linux
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-03-14 10:55:24 +01:00
Melissa Kilby
09d813b22d feat(metrics): sync libs metrics collector refactor
Includes a handful of naming changes. A notice to
https://falco.org/docs/metrics/falco-metrics/ will be added well
in advance of Falco 0.38.0

falco.hostname -> evt.hostname to be consistent with the newer evt.hostname filtercheck
cpu_usage_perc_total_host -> host_cpu_usage_perc
memory_used_host -> host_memory_used_kb (or host_memory_used_mb)
procs_running_host -> host_procs_running
open_fds_host -> host_open_fds

memory_rss -> memory_rss_kb (or memory_rss_mb)
memory_pss -> memory_pss_kb (or memory_pss_mb)
memory_vsz -> memory_vsz_kb (or memory_vsz_mb)
container_memory_used -> container_memory_used_bytes (or container_memory_used_mb)

Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-03-14 10:55:24 +01:00
Andrea Terzolo
0ce2b95b89 chore: bump falco engine version
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-03-12 16:29:17 +01:00
Federico Aponte
8dbec6c779 refactor: Use FetchContent for integrating bundled yaml-cpp lib
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-03-11 13:57:15 +01:00
Federico Aponte
c32b7c1246 refactor: Use FetchContent for integrating bundled cpp-httplib
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-03-11 13:57:15 +01:00
Federico Aponte
bc499e191d refactor: Use FetchContent for integrating bundled nlohman-json lib
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-03-11 13:57:15 +01:00
Gianmatteo Palmieri
517b79ee13 chore(engine): bump engine version
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
7265190e66 new(engine): don't expose details in error message
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
f00926b8af new(engine): error on invalid macro/list name
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-08 00:02:01 +01:00
Melissa Kilby
5185f152c5 new(config): add falco_libs.thread_table_size
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-03-05 11:36:51 +01:00
Samuel Gaist
8f87b117c4 fix(userspace): correct directory iteration options
The original code was using follow_directory_symlink twice, this patch
fixes that.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-03-05 10:29:51 +01:00
Samuel Gaist
f9b17b67f8 refactor(engine): fix variable / function shadowing
Improve variable names in the code surrounding the changes.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-29 16:20:34 +01:00
Samuel Gaist
8a7361c8ab refactor(app): fix variable / function shadowing
Improve variable names in the code surrounding the changes.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-29 16:20:34 +01:00
Gianmatteo Palmieri
ea781477d6 fix(engine): logical issue in exceptions condition
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-02-28 08:28:26 +01:00
Federico Aponte
f6af72fe76 cleanup: too many includes and useless defines
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
4d66a50d5b fix: pessimizing move warning
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
59c14f46a2 refactor: shared_ptr construction
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
557929a82a refactor: use object rather than unique_ptr
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Federico Aponte
9a2b58c6f7 refactor: very minor improvement
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-26 14:59:22 +01:00
Gianmatteo Palmieri
91e74b1b19 cleanup(build): remove bundled dep check
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-02-23 15:43:08 +01:00
Jason Dellaluce
3b06fb2cbb fix(userspace): solve compilation issues
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Jason Dellaluce
c13cf79aab update(engine): bump engine version
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Jason Dellaluce
0ec2a6c708 refactor(userspace): reduce usage of raw pointers
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Jason Dellaluce
b515f0a079 refactor(usersapace): adapt to changes libs
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-23 11:39:07 +01:00
Federico Aponte
745d18ba38 refactor: test AtomicSignalHandler.handle_once_wait_consistency
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-20 15:19:56 +01:00
Samuel Gaist
05e796723f fix(userspace): remove unread variable in restart_handler
When hitting that part, the restart signal is triggered and the code
leaves the loop, hence setting should_restart as false makes no sense
in this context.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-19 18:01:48 +01:00
Samuel Gaist
ad585cd46b fix(actions): remove unused variable in print_support
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-19 18:01:48 +01:00
Andrea Terzolo
a44bee57d9 fix(CI): fix windows CI
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-16 18:30:38 +01:00
Andrea Terzolo
d49b21ab22 cleanup: move ebpf default value logic
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-16 18:30:38 +01:00
Andrea Terzolo
99781f7936 cleanup(configuration): cleanup deprecated code
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-16 18:30:38 +01:00
Samuel Gaist
5e497a4119 fix(c++): improve const correctness
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-15 22:16:33 +01:00
Luca Guerra
5564d3da11 cleanup(app): ensure unbuffered_outputs is initialized
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-15 11:03:30 +01:00
Samuel Gaist
e18acc361e fix(c++): don't throw outside of the try catch block in nothrow function
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-15 10:19:30 +01:00
Samuel Gaist
f3491d62c9 fix(c++): re-throw original exception rather than copy
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-15 10:19:30 +01:00
Federico Aponte
7a18795ca5 cleanup: falco_engine deps and include paths
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-15 10:08:30 +01:00
Samuel Gaist
8c98ca5e8d fix(c++): add missing member initialisation to grpc server
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-12 18:45:18 +01:00