mirror of
https://github.com/falcosecurity/falco.git
synced 2026-03-20 03:32:09 +00:00
98c1e3d3f1
The old version of rules_result assumed that all errors/warnings were related to a single file. That was generally correct for errors, as rules parsing always stopped at the first error, so there is only one relevant file. However, for warnings that was not the case. When reading multiple files A and B, you might get a warning from file A *only* after reading file B. For example, B might redefine a rule in such a way that you could get unused list/macro warnings from file A. To properly address this, make some changes to how contexts are managed: - Instead of creating snippets at the time the error/warning was generated, create snippets at the time the error/warning is converted into a string. This requires passing all rules contents to as_string()/as_json(), so define a falco::load_result::rules_contents_t map from filename to rules content (reference) and pass it in as_string/as_json(). Snippets are now generated from the rules content matching the filename in the context. - When creating warnings/errors, there's no need to pass along the rules content. This is only used when converting an error into a string/json. Also change snippet() to handle potentially very long lines. Instead of always printing the entire line matching a location, print up to snippet_width(param, with default 160 chars)/2 characters surrounding the column from the location. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
111 lines
3.5 KiB
C++
111 lines
3.5 KiB
C++
/*
|
|
Copyright (C) 2022 The Falco Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <functional>
|
|
#include <string>
|
|
#include <nlohmann/json.hpp>
|
|
|
|
namespace falco
|
|
{
|
|
|
|
// Represents the result of loading a rules file.
|
|
class load_result {
|
|
public:
|
|
|
|
enum error_code {
|
|
LOAD_ERR_FILE_READ = 0,
|
|
LOAD_ERR_YAML_PARSE,
|
|
LOAD_ERR_YAML_VALIDATE,
|
|
LOAD_ERR_COMPILE_CONDITION,
|
|
LOAD_ERR_COMPILE_OUTPUT,
|
|
LOAD_ERR_VALIDATE
|
|
};
|
|
|
|
// The error code as a string
|
|
static const std::string& error_code_str(error_code ec);
|
|
|
|
// A short string representation of the error
|
|
static const std::string& error_str(error_code ec);
|
|
|
|
// A longer description of what the error represents and the
|
|
// impact.
|
|
static const std::string& error_desc(error_code ec);
|
|
|
|
enum warning_code {
|
|
LOAD_UNKNOWN_SOURCE = 0,
|
|
LOAD_UNSAFE_NA_CHECK,
|
|
LOAD_NO_EVTTYPE,
|
|
LOAD_UNKNOWN_FIELD,
|
|
LOAD_UNUSED_MACRO,
|
|
LOAD_UNUSED_LIST,
|
|
LOAD_UNKNOWN_ITEM
|
|
};
|
|
|
|
// The warning code as a string
|
|
static const std::string& warning_code_str(warning_code ec);
|
|
|
|
// A short string representation of the warning
|
|
static const std::string& warning_str(warning_code ec);
|
|
|
|
// A longer description of what the warning represents and the
|
|
// impact.
|
|
static const std::string& warning_desc(warning_code ec);
|
|
|
|
// If true, the rules were loaded successfully and can be used
|
|
// against events. If false, there were one or more
|
|
// errors--use one of the as_xxx methods to return information
|
|
// about why the rules could not be loaded.
|
|
virtual bool successful() = 0;
|
|
|
|
// If true, there were one or more warnings. successful() and
|
|
// has_warnings() can both be true if there were only warnings.
|
|
virtual bool has_warnings() = 0;
|
|
|
|
// This represents a set of rules contents as a mapping from
|
|
// rules content name (usually filename) to rules content. The
|
|
// rules content is actually a reference to the actual string
|
|
// to avoid copies. Using reference_wrapper allows the
|
|
// reference to be held in the stl map (bare references can't
|
|
// be copied/assigned, but reference_wrappers can).
|
|
//
|
|
// It's used in the as_string/as_json() methods below.
|
|
typedef std::map<std::string, std::reference_wrapper<const std::string>> rules_contents_t;
|
|
|
|
// This contains a human-readable version of the result,
|
|
// suitable for display to end users.
|
|
//
|
|
// The provided rules_contents_t should map from content name
|
|
// to rules content (reference) for each rules_content that has
|
|
// been passed to rule_loader::compile() or
|
|
// rule_reader::load().
|
|
//
|
|
// When verbose is true, the returned value has full details
|
|
// on the result including document locations/context.
|
|
//
|
|
// When verbose is false, the returned value is a short string
|
|
// with the success value and a list of
|
|
// errors/warnings. Suitable for simple one-line display.
|
|
virtual const std::string& as_string(bool verbose, const rules_contents_t& contents) = 0;
|
|
|
|
// This contains the full result structure as json, suitable
|
|
// for automated parsing/interpretation downstream.
|
|
virtual const nlohmann::json& as_json(const rules_contents_t& contents) = 0;
|
|
};
|
|
|
|
} // namespace falco
|