github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 15:17:50 +00:00
Code Issues Projects Releases Wiki Activity
2,830 Commits 121 Branches 172 Tags 104 MiB
a16eac221e
Commit Graph

2830 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason Dellaluce
a16eac221e refactor(userspace/engine): apply C++ best practices to newest engine classes 
This include making a coherent use of const, remove private inheritance, and adding virtual destructors.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-27 16:22:59 +02:00
Jason Dellaluce
be177795c2 refactor(userspace/engine): use supported_operators helper from libsinsp filter parser 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-27 16:22:59 +02:00
Jason Dellaluce
c36300a48c update(build): bump libs version to d6b75db133602dee81b4408902f2510275feae57 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-27 16:22:59 +02:00
Mark Stemm
120027dc2e Add constructor/destructor to stats_manager 
This ensures m_total is properly initialized.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
b89b3f82ee Falco main changes for app actions 
This involves moving the code in falco_init() into individual files
below app_actions/. falco_init() simply calls app.run() now. When
app.run() returns false, print any erorr. When app.run() sets restart
to true, falco_init() is called again.

app.run() is still inside a catch block to catch any uncaught
exception.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
1639e22462 Move most code from falco_init() to individual app actions 
Each file below app_actions/ defines some of the methods declared in
falco::app::application.

Any state that needs to be shared betweeen methods, or between the run
and teardown methods, resides in falco::app::application::state(), so
the moved code stays pretty much as-is, other than replacing stack
variables with member variables in app_state.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
e3b82c00e1 Copying falco.cpp to process_events.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
6e10d3d884 Copying falco.cpp to process_events.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
0daff8f829 Copying falco.cpp to open_inspector.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
5d7bed8d74 Copying falco.cpp to open_inspector.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
64b7092f56 Copying falco.cpp to daemonize.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
a9417d60df Copying falco.cpp to daemonize.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
365b97a9db Copying falco.cpp to validate_rules_files.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
70dc7360c9 Copying falco.cpp to validate_rules_files.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
b845fccc72 Copying falco.cpp to start_webserver.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
d4def892be Copying falco.cpp to start_webserver.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
6b9714eadc Copying falco.cpp to start_grpc_server.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
54ef2a2b1e Copying falco.cpp to start_grpc_server.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
5496741aae Copying falco.cpp to print_version.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
c975df57a0 Copying falco.cpp to print_version.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
8634d8b3a2 Copying falco.cpp to print_support.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
4ca13bc0f0 Copying falco.cpp to print_support.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
de58872b2e Copying falco.cpp to print_ignored_events.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
2963bbab98 Copying falco.cpp to print_ignored_events.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
f5c18399e1 Copying falco.cpp to print_help.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
35261c4a3a Copying falco.cpp to print_help.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
78a297ac62 Copying falco.cpp to load_rules_files.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
9325658d5b Copying falco.cpp to load_rules_files.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
2d53fecf4b Copying falco.cpp to load_plugins.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
0f8386326e Copying falco.cpp to load_plugins.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
2e8d3c6486 Copying falco.cpp to load_config.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
444daef2f0 Copying falco.cpp to load_config.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
88b951abe2 Copying falco.cpp to list_plugins.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
4a818eeeec Copying falco.cpp to list_plugins.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
8c40b18428 Copying falco.cpp to list_fields.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
91a7bcae86 Copying falco.cpp to list_fields.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
9d9fb2538d Copying falco.cpp to init_outputs.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
98a2224ee5 Copying falco.cpp to init_outputs.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
ccbc8ec196 Copying falco.cpp to init_inspector.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
344dc3930b Copying falco.cpp to init_inspector.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
431b8885b4 Copying falco.cpp to init_falco_engine.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
22674f6bf8 Copying falco.cpp to init_falco_engine.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
ae7c8190d3 Copying falco.cpp to create_signal_handlers.cpp to preserve history (step 2, restoring falco.cpp) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
da7efbc96e Copying falco.cpp to create_signal_handlers.cpp to preserve history (step 1, copying file) 
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
9de80b7b92 Application changes to support actions 
Changes to the falco::app::application object to support actions:

- All of the code that was in falco_init is now in methods of
  application. (A later commit actually moves the code from falco_init
  and into the split-up methods, this commit just declares them).
- Methods return an application::run_result object, which is a tuple
  of success/errstr/proceed. proceed=false is used to short circuit
  calling methods (think --help, --list, --support, etc.)
- application now has a run() method which runs the methods in an order
  that honors any implicit dependencies (e.g. you have to init an
  inspector before you open it, you have to do almost everything else
  before processing events, etc.)
- There are a few methods devoted to teardown, they are always called
  after the group of run methods are called.
- State that needs to be saved between methods, or saved between the
  run and teardown functions, is in a
  falco::app::application::state object.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
0a51f4f1f1 Convert direct pointer refs to shared_ptr 
Some objects used by falco (falco outputs, falco_formats, etc) were
using raw pointer references, which isn't great.

So convert use of raw pointers (originally passed from falco_init or
functions it called) with shared_ptr, as they are now held in
application state.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
531bc3eb5a Falco test changes (small output matches) for actions 
With the split of falco_init into application:: methods, including a
notion of a success/error/proceed result, there is a
more concrete line between runtime errors (e.g. things that throw
exceptions) and errors returned by methods that run the application.

Some of the plugins tests were expecting errors to be returned by
exceptions (e.g. with a leading "Runtime error: and a trailing "
Exiting.").

Now, the errors are just returned directly in application::run(), so
drop the leading and trailing bits in expected test outputs.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Mark Stemm
62d4fffcb2 Add missing pragma 
Without this, if webserver is included more than once you get
duplicate defined classes.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Leonardo Grasso
2c3c8b92e0 build: MUSL builds can't have plugins 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-22 09:41:56 +02:00
Leonardo Grasso
d443bcfe5f build: components opt-in mechanism for packages 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-04-22 09:41:56 +02:00