github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-04-04 19:15:26 +00:00
Code Issues Projects Releases Wiki Activity
5,095 Commits 127 Branches 184 Tags
6087cd90aec6865ed9429aff388b3595a1e39e2a
Commit Graph

177 Commits

Author SHA1 Message Date
Leonardo Grasso
6087cd90ae chore(unit_tests/falco): add unit tests for yaml_helper::is_node_truthy 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2026-03-26 12:48:08 +01:00
Leonardo Grasso
bb404863b4 chore(unit_tests): test validation for unknown-key in rules 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2026-03-17 12:03:34 +01:00
Leonardo Di Giovanna
33a2ce53fd chore!: drop gVisor engine support 
Falco 0.43.0 deprecated the gVisor engine support. Drop its support as
well as any reference to it.

BREAKING CHANGE: drop gVisor engine support

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2026-02-05 15:29:54 +01:00
Leonardo Di Giovanna
387499546f chore!: drop legacy BPF probe 
Falco 0.43.0 deprecated the legacy eBPF probe. Drop it as well as any
reference to it.

BREAKING CHANGE: drop legacy eBPF probe

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
 2026-02-05 13:15:54 +01:00
Iacopo Rozzo
1717a98749 feat(engine): emit warning when a rule output uses deprecated "evt.dir" 
Emit a warning when a rule uses the deprecated "evt.dir" field in output.

Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>
 2025-10-14 09:46:43 +02:00
Iacopo Rozzo
8c4e5aa854 Use generic DEPRECATED_ITEM warning code 
Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>
 2025-10-09 14:06:12 +02:00
Iacopo Rozzo
42085c9d7a feat(engine): emit warning when a condition uses deprecated "evt.dir" 
Emit a warning when a rule with a condition using "evt.dir" field is
encountered.
The direction have been deprecated in the scope of enter event
suppression initiative.

Signed-off-by: Iacopo Rozzo <iacopo.rozzo@iacopo.rozzo>
 2025-10-09 14:06:12 +02:00
Samuel Gaist
7c7196f1f0 chore: pre-commit cleanup 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2025-09-16 09:38:29 +02:00
Samuel Gaist
01d2976b0a refactor(unit_tests): move initialization to initialization list 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2025-09-16 09:38:29 +02:00
Samuel Gaist
9a65ef220c refactor(unit_tests): remove unused variable 
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
 2025-09-16 09:38:29 +02:00
Leonardo Grasso
7cb23e0191 feat(unit_tests): add test for capture feature 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2025-08-12 11:25:43 +02:00
Federico Di Pierro
fb292e6fbb fix(unit_tests): fixed extra format unit tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-05-06 10:06:43 +02:00
Federico Di Pierro
08a00609a1 new(userspace,unit_tests): port merge-strategy to be a yaml map. 
Merge-strategy for included config files must now be
specified as yaml map of the form:
- path: foo
  strategy: bar

If `strategy` is omitted, or the old `string-only` form is used,
`append` strategy is enforced.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-04-29 16:17:06 +02:00
Federico Di Pierro
630167d9ad new(userspace,unit_tests)!: add a way to specify merge-strategy for config_files. 
By default we now use the `append` merge-strategy:
* existing sequence keys will be appended
* existing scalar keys will be overridden
* non-existing keys will be added

We also have an `override` merge-strategy:
* existing keys will be overridden
* non-existing keys will be added

Finally, there is an `add-only` merge-strategy:
* existing keys will be ignored
* non-existing keys will be added

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-04-29 16:17:06 +02:00
Federico Di Pierro
fafeddaf35 chore(userspace,unit_tests): include thread.h where needed. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-02-26 13:08:26 +01:00
Federico Di Pierro
ad99ab514f fix(unit_tests): fixed unit tests after CLI options drop. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-02-19 14:24:43 +01:00
Federico Di Pierro
ef5b45c05a chore(unit_tests): update Configuration.configuration_config_files_cmdline test to avoid future issues. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-02-13 13:21:10 +01:00
Federico Di Pierro
913e1b91ef chore(unit_tests/falco): fix test. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2025-01-15 14:49:50 +01:00
Mark Stemm
09a9fd4c26 Add tests for mismatched sources and append 
Add additional unit tests to verify that rule loading fails when a
second rules object has a different source but the name of an existing
rules object.

Also add tests for additional rules having an empty source.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-10-24 08:45:12 +02:00
Luca Guerra
3b28450171 new(falco): add base_syscalls.all option to falco.yaml 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-10-10 10:26:16 +02:00
Mark Stemm
80b7de6d90 Add a test for compile_output::clone() for derived type 
Add a test for checking that compile_output::clone() returns equal
values, specifically in the case of derived values.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2024-10-10 09:20:17 +02:00
Luca Guerra
a754601cb6 update(tests): add tests for plugin init_config 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-10-08 12:06:08 +02:00
Poiana
50b98b30e5 chore(falco): apply code formatting 
Signed-off-by: Poiana <poiana.bot@gmail.com>
 2024-09-30 13:25:31 +02:00
Luca Guerra
50f4bc172d update(tests): add test for plugin init_config map 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-09-20 09:55:49 +02:00
Luca Guerra
7005983409 update(engine): modify append_output format 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-09-13 15:58:36 +02:00
Melissa Kilby
9669a4a0bb update(falco_metrics): rearrange evts and drops prometheus metrics 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-09-12 15:26:33 +02:00
Federico Di Pierro
468037151a chore(userspace,unit_tests): properly report all schema validation warnings from yaml_helper::validate_node(). 
`-V` option will print all warnings, while normal run will only print foremost warning.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-09-11 13:20:31 +02:00
Federico Di Pierro
5bd2d5a63e cleanup(userspace,unit_tests): moved rule schema under engine. 
Also, moved yaml_helper under engine/ folder.
Ported rule json schema validation in the engine.

Also, updated rule_loader tests to check for validation.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-09-11 13:20:31 +02:00
Luca Guerra
df072dace7 update(libsinsp/tests): add CLI options test for append output 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-09-09 15:31:24 +02:00
Luca Guerra
8a19f1b135 update(tests): add message for failing configuration schema test 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-09-09 15:31:24 +02:00
Luca Guerra
d210ed2e4f new(app): add append_output configuration option with fields and format 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-09-09 15:31:24 +02:00
Luca Guerra
36d6951e77 new(falco): add test for object cli configuration, minor test fix 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-09-06 09:25:11 +02:00
Melissa Kilby
1caece2cf9 update(metrics): use new libs addr_to_string methods for host_ifinfo_json 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-08-27 10:18:26 +02:00
Melissa Kilby
23b412ea3c new(metrics): add host_ifinfo metric 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-08-27 10:18:26 +02:00
Federico Di Pierro
05bbe74d69 fix(unit_tests): skip Configuration.schema_validate_config test if Falco config is not present. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-08-26 18:06:25 +02:00
Federico Di Pierro
d1c715e7a8 chore(unit_tests,userspace): use nlhomann json instead of jsoncpp. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-08-26 18:06:25 +02:00
Federico Di Pierro
be927edfe8 new(userspace/falco,unit_tests): added new tests around schema validation feature. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-08-26 18:06:25 +02:00
Federico Di Pierro
94dc7da986 cleanup(unit_tests,userspace/falco): moved all config validation logic to be more testable. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-08-26 18:06:25 +02:00
Federico Di Pierro
6dfdfdd649 chore(unit_tests): moved config_files and env vars config tests to their own source file. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-08-26 18:06:25 +02:00
Jason Dellaluce
6783cc7055 fix(unit_tests): adapt tests to new engine warning formats 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-08-26 15:51:25 +02:00
Jason Dellaluce
cd1c5f911c refactor(userspace): move falco logger under falco engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-23 09:29:23 +02:00
Federico Di Pierro
a48965a00c chore(userspace,falco.yaml,unit_tests): configs_files -> config_files. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2024-05-20 16:33:11 +02:00
Melissa Kilby
b0f352e7b9 cleanup(test): add test cases for sanitize_metric_name 
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
 2024-05-17 14:54:58 +02:00
Jason Dellaluce
64039196ad chore(unit_tests): fix linting issue 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-17 14:38:57 +02:00
Jason Dellaluce
ec9f148e0b test(engine): cover case of replaced or appended exceptions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-17 14:38:57 +02:00
Luca Guerra
abf82f6373 update(config): split init_from_content from init_from_file 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-14 12:47:46 +02:00
Luca Guerra
35bd348e21 new(falco): implement rule selection configuration in falco.yaml 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2024-05-14 12:47:46 +02:00
Jason Dellaluce
c6e3cfd115 test(engine): cover transformers and field-to-field checks in exceptions 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-08 20:23:55 +02:00
Jason Dellaluce
ed22e94292 refactor(userspace/libsinsp): support new filter ast structure in falco engine 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2024-05-08 20:23:55 +02:00
Federico Aponte
62d1c4fc4d refactor: smart pointer usage 
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
 2024-05-06 11:10:44 +02:00