github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-25 14:22:15 +00:00
Code Issues Projects Releases Wiki Activity
4,513 Commits 121 Branches 172 Tags 104 MiB
f18ea1e8b7
Commit Graph

4513 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Henri DF
0a294cd5e5 digwatch scaffolding 
basic cmake setup and digwatch binary, mostly pulled from sysdig
 2016-02-19 01:58:17 +00:00
Henri DF
ab52c42026 remove notes file 2016-02-18 09:37:45 -08:00
Henri DF
b97a1bfc1f Merge pull request #1 from draios/parser-hacking 
Digwatch compiler
 2016-02-15 16:04:51 -08:00
Henri DF
6e2d8679c4 Macro expansion 2016-02-15 15:19:43 -08:00
Henri DF
b3f7b1d765 Remove whitespace from token values in AST 2016-02-14 21:26:37 -08:00
Henri DF
c21e8207f8 Don't allow '=' in BareStrings 2016-02-14 21:22:20 -08:00
Henri DF
aeba0760db Scaffold basic line-oriented compiler API 2016-02-14 14:31:10 -08:00
Henri DF
0d10a3f39c Fix multi-line comments 2016-02-13 15:26:40 -08:00
Henri DF
79cdf31aa7 Expand in relational expressions 
For example, `a.b in [1, 2]` is expanded to `a.b = 1 or a.b = 2`.
This is done over the AST, not filter text.
 2016-02-13 15:23:03 -08:00
Henri DF
3dab9edc9d add a function to pretty-print ASTs 2016-02-13 15:23:03 -08:00
Henri DF
48685f4f2f Don't require quoting for non-alphanum characters 
This commit removes the one remaining (known) difference with the sysdig
c++ parser: relational expression right-hand sides now _only_ need to be
quoted if they contain a paren or a space.

So you can now do things like "fd.name contains (.log and event.dir = <"
without needing to quote "*.log" or "<".
 2016-02-13 15:23:03 -08:00
Henri DF
41ee6e49a5 Grammar for filters and macros 2016-02-13 15:23:03 -08:00
Henri DF
4bd8a9d401 Initial README 2016-01-20 14:47:56 -08:00