falco/userspace/engine/lua/sinsp_rule_utils.lua

-- Copyright (C) 2020 The Falco Authors.
--
-- Licensed under the Apache License, Version 2.0 (the "License");
-- you may not use this file except in compliance with the License.
-- You may obtain a copy of the License at
--
--     http://www.apache.org/licenses/LICENSE-2.0
--
-- Unless required by applicable law or agreed to in writing, software
-- distributed under the License is distributed on an "AS IS" BASIS,
-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-- See the License for the specific language governing permissions and
-- limitations under the License.
--
local parser = require("parser")
local sinsp_rule_utils = {}

function sinsp_rule_utils.check_for_ignored_syscalls_events(ast, filter_type, source)

    function check_syscall(val)
        if ignored_syscalls[val] then
            error("Ignored syscall \"" .. val .. "\" in " .. filter_type .. ": " .. source)
        end

    end

    function check_event(val)
        if ignored_events[val] then
            error("Ignored event \"" .. val .. "\" in " .. filter_type .. ": " .. source)
        end
    end

    function cb(node)
        if node.left.type == "FieldName" and (node.left.value == "evt.type" or node.left.value == "syscall.type") then

            if (node.operator == "in" or node.operator == "intersects" or node.operator == "pmatch") then
                for i, v in ipairs(node.right.elements) do
                    if v.type == "BareString" then
                        if node.left.value == "evt.type" then
                            check_event(v.value)
                        else
                            check_syscall(v.value)
                        end
                    end
                end
            else
                if node.right.type == "BareString" then
                    if node.left.value == "evt.type" then
                        check_event(node.right.value)
                    else
                        check_syscall(node.right.value)
                    end
                end
            end
        end
    end

    parser.traverse_ast(ast, {
        BinaryRelOp = 1
    }, cb)
end

-- Examine the ast and find the event types/syscalls for which the
-- rule should run. All evt.type references are added as event types
-- up until the first "!=" binary operator or unary not operator. If
-- no event type checks are found afterward in the rule, the rule is
-- considered optimized and is associated with the event type(s).
--
-- Otherwise, the rule is associated with a 'catchall' category and is
-- run for all event types/syscalls. (Also, a warning is printed).
--

function sinsp_rule_utils.get_evttypes_syscalls(name, ast, source, warn_evttypes, verbose)

    local evttypes = {}
    local syscallnums = {}
    local evtnames = {}
    local found_event = false
    local found_not = false
    local found_event_after_not = false

    function cb(node)
        if node.type == "UnaryBoolOp" then
            if node.operator == "not" then
                found_not = true
            end
        else
            if node.operator == "!=" then
                found_not = true
            end
            if node.left.type == "FieldName" and node.left.value == "evt.type" then
                found_event = true
                if found_not then
                    found_event_after_not = true
                end
                if (node.operator == "in" or node.operator == "intersects" or node.operator == "pmatch") then
                    for i, v in ipairs(node.right.elements) do
                        if v.type == "BareString" then

                            -- The event must be a known event
                            if events[v.value] == nil and syscalls[v.value] == nil then
                                error("Unknown event/syscall \"" .. v.value .. "\" in filter: " .. source)
                            end

                            evtnames[v.value] = 1
                            if events[v.value] ~= nil then
                                for id in string.gmatch(events[v.value], "%S+") do
                                    evttypes[id] = 1
                                end
                            end

                            if syscalls[v.value] ~= nil then
                                for id in string.gmatch(syscalls[v.value], "%S+") do
                                    syscallnums[id] = 1
                                end
                            end
                        end
                    end
                else
                    if node.right.type == "BareString" then

                        -- The event must be a known event
                        if events[node.right.value] == nil and syscalls[node.right.value] == nil then
                            error("Unknown event/syscall \"" .. node.right.value .. "\" in filter: " .. source)
                        end

                        evtnames[node.right.value] = 1
                        if events[node.right.value] ~= nil then
                            for id in string.gmatch(events[node.right.value], "%S+") do
                                evttypes[id] = 1
                            end
                        end

                        if syscalls[node.right.value] ~= nil then
                            for id in string.gmatch(syscalls[node.right.value], "%S+") do
                                syscallnums[id] = 1
                            end
                        end
                    end
                end
            end
        end
    end

    parser.traverse_ast(ast.filter.value, {
        BinaryRelOp = 1,
        UnaryBoolOp = 1
    }, cb)

    if not found_event then
        if warn_evttypes == true then
            io.stderr:write("Rule " .. name .. ": warning (no-evttype):\n")
            io.stderr:write(source .. "\n")
            io.stderr:write(
                "         did not contain any evt.type restriction, meaning it will run for all event types.\n")
            io.stderr:write(
                "         This has a significant performance penalty. Consider adding an evt.type restriction if possible.\n")
        end
        evttypes = {}
        syscallnums = {}
        evtnames = {}
    end

    if found_event_after_not then
        if warn_evttypes == true then
            io.stderr:write("Rule " .. name .. ": warning (trailing-evttype):\n")
            io.stderr:write(source .. "\n")
            io.stderr:write("         does not have all evt.type restrictions at the beginning of the condition,\n")
            io.stderr:write("         or uses a negative match (i.e. \"not\"/\"!=\") for some evt.type restriction.\n")
            io.stderr:write(
                "         This has a performance penalty, as the rule can not be limited to specific event types.\n")
            io.stderr:write("         Consider moving all evt.type restrictions to the beginning of the rule and/or\n")
            io.stderr:write("         replacing negative matches with positive matches if possible.\n")
        end
        evttypes = {}
        syscallnums = {}
        evtnames = {}
    end

    evtnames_only = {}
    local num_evtnames = 0
    for name, dummy in pairs(evtnames) do
        table.insert(evtnames_only, name)
        num_evtnames = num_evtnames + 1
    end

    if num_evtnames == 0 then
        table.insert(evtnames_only, "all")
    end

    table.sort(evtnames_only)

    if verbose then
        io.stderr:write("Event types/Syscalls for rule " .. name .. ": " .. table.concat(evtnames_only, ",") .. "\n")
    end

    return evttypes, syscallnums
end

return sinsp_rule_utils