mirror of
https://github.com/falcosecurity/falco.git
synced 2025-11-03 18:59:53 +00:00
f547dc97ab
Move the c++ and lua code implementing falco engine/falco common to its own directory userspace/engine. It's compiled as a static library libfalco_engine.a, and has its own CMakeLists.txt so it can be included by other projects. The engine's CMakeLists.txt has a add_subdirectory for the falco rules directory, so including the engine also builds the rules. The variables you need to set to use the engine's CMakeLists.txt are: - CMAKE_INSTALL_PREFIX: the root directory below which everything is installed. - FALCO_ETC_DIR: where to install the rules file. - FALCO_SHARE_DIR: where to install lua code, relative to the - install/package root. - LUAJIT_INCLUDE: where to find header files for lua. - FALCO_SINSP_LIBRARY: the library containing sinsp code. It will be - considered a dependency of the engine. - LPEG_LIB/LYAML_LIB/LIBYAML_LIB: locations for third-party libraries. - FALCO_COMPONENT: if set, will be included as a part of any install() commands. Instead of specifying /usr/share/falco in config_falco_*.h.in, use CMAKE_INSTALL_PREFIX and FALCO_SHARE_DIR. The lua code for the engine has also moved, so the two lua source directories (userspace/engine/lua and userspace/falco/lua) need to be available separately via falco_common, so make it an argument to falco_common::init. As a part of making it easy to include in another project, also clean up LPEG build/defs. Modify build-lpeg to add a PREFIX argument to allow for object files/libraries being in an alternate location, and when building lpeg, put object files in a build/ subdirectory.
71 lines
1.2 KiB
Bash
Executable File
71 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
function error_exit_good
|
|
{
|
|
echo "Error: '$1' did not compiler" 1>&2
|
|
exit 1
|
|
}
|
|
|
|
function error_exit_bad
|
|
{
|
|
echo "Error: incorrect filter '$1' compiler ok" 1>&2
|
|
exit 1
|
|
}
|
|
|
|
|
|
function good
|
|
{
|
|
lua5.1 test.lua "$1" 2> /dev/null || error_exit_good "$1"
|
|
}
|
|
|
|
function bad
|
|
{
|
|
lua5.1 test.lua "$1" 2> /dev/null && error_exit_bad "$1"
|
|
}
|
|
|
|
# Filters
|
|
good " a"
|
|
good "a and b"
|
|
good "#a and b; a and b"
|
|
good "#a and b; # ; ; a and b"
|
|
good "(a)"
|
|
good "(a and b)"
|
|
good "(a.a exists and b)"
|
|
good "(a.a exists) and (b)"
|
|
good "a.a exists and b"
|
|
good "a.a=1 or b.b=2 and c"
|
|
good "not (a)"
|
|
good "not (not (a))"
|
|
good "not (a.b=1)"
|
|
good "not (a.a exists)"
|
|
good "not a"
|
|
good "a.b = 1 and not a"
|
|
good "not not a"
|
|
good "(not not a)"
|
|
good "not a.b=1"
|
|
good "not a.a exists"
|
|
good "notz and a and b"
|
|
good "a.b = bla"
|
|
good "a.b = 'bla'"
|
|
good "a.b = not"
|
|
good "a.b contains bla"
|
|
good "a.b icontains 'bla'"
|
|
good "a.g in (1, 'a', b)"
|
|
good "a.g in ( 1 ,, , b)"
|
|
good "evt.dir=> and fd.name=*.log"
|
|
good "evt.dir=> and fd.name=/var/log/httpd.log"
|
|
good "a.g in (1, 'a', b.c)"
|
|
good "a.b = a.a"
|
|
|
|
good "evt.arg[0] contains /bin"
|
|
bad "evt.arg[a] contains /bin"
|
|
bad "evt.arg[] contains /bin"
|
|
|
|
bad "a.b = b = 1"
|
|
bad "(a.b = 1"
|
|
|
|
|
|
echo
|
|
echo "All tests passed."
|
|
exit 0
|