mirror of
https://github.com/falcosecurity/falco.git
synced 2026-03-19 19:22:05 +00:00
512a36dfe1
* Add ability to skip rules for unknown filters Add the ability to skip a rule if its condition refers to a filtercheck that doesn't exist. This allows defining a rules file that contains new conditions that can still has limited backward compatibility with older falco versions. When compiling a filter, return a list of filtercheck names that are present in the ast (which also includes filterchecks from any macros). This set of filtercheck names is matched against the set of filterchecks known to sinsp, expressed as lua patterns, and in the global table defined_filters. If no match is found, the rule loader throws an error. The pattern changes slightly depending on whether the filter has arguments or not. Two filters (proc.apid/proc.aname) can work with or without arguments, so both styles of patterns are used. If the rule has an attribute "skip-if-unknown-filter", the rule will be skipped instead. * Unit tests for skipping unknown filter New unit test for skipping unknown filter. Test cases: - A rule that refers to an unknown filter results in an error. - A rule that refers to an unknown filter, but has "skip-if-unknown-filter: true", can be read, but doesn't match any events. - A rule that refers to an unknown filter, but has "skip-if-unknown-filter: false", returns an error. Also test the case of a filtercheck like evt.arg.xxx working properly with the embedded patterns as well as proc.aname/apid which work both ways.
64 lines
1.8 KiB
C++
64 lines
1.8 KiB
C++
/*
|
|
Copyright (C) 2016 Draios inc.
|
|
|
|
This file is part of falco.
|
|
|
|
falco is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License version 2 as
|
|
published by the Free Software Foundation.
|
|
|
|
falco is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with falco. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#pragma once
|
|
|
|
#include <set>
|
|
|
|
#include "sinsp.h"
|
|
|
|
#include "lua_parser.h"
|
|
|
|
#include "falco_common.h"
|
|
|
|
class falco_engine;
|
|
|
|
class falco_rules
|
|
{
|
|
public:
|
|
falco_rules(sinsp* inspector, falco_engine *engine, lua_State *ls);
|
|
~falco_rules();
|
|
void load_rules(const string &rules_content, bool verbose, bool all_events,
|
|
std::string &extra, bool replace_container_info,
|
|
falco_common::priority_type min_priority);
|
|
void describe_rule(string *rule);
|
|
|
|
static void init(lua_State *ls);
|
|
static int clear_filters(lua_State *ls);
|
|
static int add_filter(lua_State *ls);
|
|
static int enable_rule(lua_State *ls);
|
|
|
|
private:
|
|
void clear_filters();
|
|
void add_filter(string &rule, std::set<uint32_t> &evttypes, std::set<uint32_t> &syscalls, std::set<string> &tags);
|
|
void enable_rule(string &rule, bool enabled);
|
|
|
|
lua_parser* m_lua_parser;
|
|
sinsp* m_inspector;
|
|
falco_engine *m_engine;
|
|
lua_State* m_ls;
|
|
|
|
string m_lua_load_rules = "load_rules";
|
|
string m_lua_ignored_syscalls = "ignored_syscalls";
|
|
string m_lua_ignored_events = "ignored_events";
|
|
string m_lua_defined_filters = "defined_filters";
|
|
string m_lua_events = "events";
|
|
string m_lua_syscalls = "syscalls";
|
|
string m_lua_describe_rule = "describe_rule";
|
|
};
|