Mark Stemm 9014153d7b Support exceptions properties on rules ...

Support exceptions properties on rules as described in
https://github.com/falcosecurity/falco/pull/1376.

- When parsing rules, add an empty exceptions table if not specified.
- If exceptions are specified, they must contain names and lists of
  fields, and optionally can contain lists of comps and lists of lists of
  values.
- If comps are not specified, = is used.
- If a rule has exceptions and append:true, add values to the original rule's
  exception values with the matching name.
- It's a warning but not an error to have exception values with a name
  not matching any fields.
- After loading all rules, iterate through each rule's exception
  values, finding the matching field names (field1, field2, ...) and
  comp operators (cmp1, cmp2, ...), then
  iterating over the list of field values (val1a, val1b, ...), (val2a,
  val2b, ...), building up a string of the form:
    and not ((field1 cmp1 val1a and field2 cmp2 val1b and ...) or
              (field1 cmp1 val2a and field2 cmp2 val2b and ...)...
	     )"
- If a value is not already quoted, quote it in the string

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

2020-10-09 13:20:10 -07:00

..

engine

Support exceptions properties on rules

2020-10-09 13:20:10 -07:00

falco

Pass back warnings when loading rules

2020-10-05 09:03:23 -07:00