Skip to content

Commit

Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
new(engine): add selective overrides
Browse files Browse the repository at this point in the history
Signed-off-by: Luca Guerra <luca@guerra.sh>
LucaGuerra committed Dec 19, 2023
1 parent 13991f1 commit 9510569
Showing 6 changed files with 662 additions and 47 deletions.
233 changes: 233 additions & 0 deletions unit_tests/engine/test_rule_loader.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,233 @@
#include <gtest/gtest.h>

#include "falco_engine.h"
#include "rule_loader_reader.h"
#include "rule_loader_compiler.h"

class engine_loader_test : public ::testing::Test {
protected:
void SetUp() override
{
m_sample_ruleset = "sample-ruleset";
m_sample_source = falco_common::syscall_source;

// create a falco engine ready to load the ruleset
m_engine.reset(new falco_engine());
m_filter_factory = std::shared_ptr<gen_event_filter_factory>(
new sinsp_filter_factory(nullptr, m_filterlist));
m_formatter_factory = std::shared_ptr<gen_event_formatter_factory>(
new sinsp_evt_formatter_factory(nullptr, m_filterlist));
m_engine->add_source(m_sample_source, m_filter_factory, m_formatter_factory);
}

void TearDown() override
{

}

bool load_rules(std::string rules_content, std::string rules_filename)
{
bool ret = false;
falco::load_result::rules_contents_t rc = {{rules_filename, rules_content}};
m_load_result = m_engine->load_rules(rules_content, rules_filename);
m_load_result_string = m_load_result->as_string(true, rc);
ret = m_load_result->successful();

if (ret)
{
m_engine->enable_rule("", true, m_sample_ruleset);
}

return ret;
}

std::string m_sample_ruleset;
std::string m_sample_source;
sinsp_filter_check_list m_filterlist;
std::shared_ptr<gen_event_filter_factory> m_filter_factory;
std::shared_ptr<gen_event_formatter_factory> m_formatter_factory;
std::unique_ptr<falco_engine> m_engine;
std::unique_ptr<falco::load_result> m_load_result;
std::string m_load_result_string;
};

std::string s_sample_ruleset = "sample-ruleset";
std::string s_sample_source = falco_common::syscall_source;

TEST_F(engine_loader_test, list_append)
{
std::string rules_content = R"END(
- list: shell_binaries
items: [ash, bash, csh, ksh, sh, tcsh, zsh, dash]
- rule: legit_rule
desc: legit rule description
condition: evt.type=open and proc.name in (shell_binaries)
output: user=%user.name command=%proc.cmdline file=%fd.name
priority: INFO
- list: shell_binaries
items: [pwsh]
override:
items: append
)END";

std::string rule_name = "legit_rule";
ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;

auto rule_description = m_engine->describe_rule(&rule_name, {});
ASSERT_EQ(rule_description["rules"][0]["details"]["condition_compiled"].template get<std::string>(),
"(evt.type = open and proc.name in (ash, bash, csh, ksh, sh, tcsh, zsh, dash, pwsh))");
}

TEST_F(engine_loader_test, condition_append)
{
std::string rules_content = R"END(
- macro: interactive
condition: >
((proc.aname=sshd and proc.name != sshd) or
proc.name=systemd-logind or proc.name=login)
- rule: legit_rule
desc: legit rule description
condition: evt.type=open and interactive
output: user=%user.name command=%proc.cmdline file=%fd.name
priority: INFO
- macro: interactive
condition: or proc.name = ssh
override:
condition: append
)END";

std::string rule_name = "legit_rule";
ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;

auto rule_description = m_engine->describe_rule(&rule_name, {});
ASSERT_EQ(rule_description["rules"][0]["details"]["condition_compiled"].template get<std::string>(),
"(evt.type = open and (((proc.aname = sshd and proc.name != sshd) or proc.name = systemd-logind or proc.name = login) or proc.name = ssh))");
}

TEST_F(engine_loader_test, rule_override_append)
{
std::string rules_content = R"END(
- rule: legit_rule
desc: legit rule description
condition: evt.type=open
output: user=%user.name command=%proc.cmdline file=%fd.name
priority: INFO
- rule: legit_rule
desc: with append
condition: and proc.name = cat
output: proc=%proc.name
override:
desc: append
condition: append
output: append
)END";

std::string rule_name = "legit_rule";
ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;

auto rule_description = m_engine->describe_rule(&rule_name, {});
ASSERT_EQ(rule_description["rules"][0]["info"]["condition"].template get<std::string>(),
"evt.type=open and proc.name = cat");

ASSERT_EQ(rule_description["rules"][0]["info"]["output"].template get<std::string>(),
"user=%user.name command=%proc.cmdline file=%fd.name proc=%proc.name");

ASSERT_EQ(rule_description["rules"][0]["info"]["description"].template get<std::string>(),
"legit rule description with append");
}


TEST_F(engine_loader_test, rule_append)
{
std::string rules_content = R"END(
- rule: legit_rule
desc: legit rule description
condition: evt.type=open
output: user=%user.name command=%proc.cmdline file=%fd.name
priority: INFO
- rule: legit_rule
condition: and proc.name = cat
append: true
)END";

std::string rule_name = "legit_rule";
ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;

auto rule_description = m_engine->describe_rule(&rule_name, {});
ASSERT_EQ(rule_description["rules"][0]["details"]["condition_compiled"].template get<std::string>(),
"(evt.type = open and proc.name = cat)");
}


TEST_F(engine_loader_test, rule_override_replace)
{
std::string rules_content = R"END(
- rule: legit_rule
desc: legit rule description
condition: evt.type=open
output: user=%user.name command=%proc.cmdline file=%fd.name
priority: INFO
- rule: legit_rule
desc: a replaced legit description
condition: evt.type = close
override:
desc: replace
condition: replace
)END";

std::string rule_name = "legit_rule";
ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;

auto rule_description = m_engine->describe_rule(&rule_name, {});
ASSERT_EQ(rule_description["rules"][0]["info"]["condition"].template get<std::string>(),
"evt.type = close");

ASSERT_EQ(rule_description["rules"][0]["info"]["output"].template get<std::string>(),
"user=%user.name command=%proc.cmdline file=%fd.name");

ASSERT_EQ(rule_description["rules"][0]["info"]["description"].template get<std::string>(),
"a replaced legit description");
}

TEST_F(engine_loader_test, rule_override_append_replace)
{
std::string rules_content = R"END(
- rule: legit_rule
desc: legit rule description
condition: evt.type = close
output: user=%user.name command=%proc.cmdline file=%fd.name
priority: INFO
- rule: legit_rule
desc: a replaced legit description
condition: and proc.name = cat
priority: WARNING
override:
desc: replace
condition: append
priority: replace
)END";

std::string rule_name = "legit_rule";
ASSERT_TRUE(load_rules(rules_content, "legit_rules.yaml")) << m_load_result_string;

auto rule_description = m_engine->describe_rule(&rule_name, {});
ASSERT_EQ(rule_description["rules"][0]["info"]["condition"].template get<std::string>(),
"evt.type = close and proc.name = cat");

ASSERT_EQ(rule_description["rules"][0]["info"]["output"].template get<std::string>(),
"user=%user.name command=%proc.cmdline file=%fd.name");

ASSERT_EQ(rule_description["rules"][0]["info"]["description"].template get<std::string>(),
"a replaced legit description");

ASSERT_EQ(rule_description["rules"][0]["info"]["priority"].template get<std::string>(),
"Warning");
}
8 changes: 7 additions & 1 deletion userspace/engine/rule_loader.cpp
Original file line number Diff line number Diff line change
@@ -41,7 +41,8 @@ static const std::string item_type_strings[] = {
"condition expression",
"rule output",
"rule output expression",
"rule priority"
"rule priority",
"overrides"
};

const std::string& rule_loader::context::item_type_as_string(enum item_type it)
@@ -553,6 +554,11 @@ rule_loader::rule_info::rule_info(context &ctx)
{
}

rule_loader::rule_update_info::rule_update_info(context &ctx)
: ctx(ctx), cond_ctx(ctx)
{
}

rule_loader::rule_load_exception::rule_load_exception(falco::load_result::error_code ec, const std::string& msg, const context& ctx)
: ec(ec), msg(msg), ctx(ctx)
{
38 changes: 37 additions & 1 deletion userspace/engine/rule_loader.h
Original file line number Diff line number Diff line change
@@ -19,6 +19,7 @@ limitations under the License.

#include <string>
#include <vector>
#include <optional>
#include <yaml-cpp/yaml.h>
#include <nlohmann/json.hpp>
#include "falco_source.h"
@@ -56,7 +57,8 @@ namespace rule_loader
CONDITION_EXPRESSION,
RULE_OUTPUT,
RULE_OUTPUT_EXPRESSION,
RULE_PRIORITY
RULE_PRIORITY,
OVERRIDE
};

static const std::string& item_type_as_string(enum item_type it);
@@ -461,4 +463,38 @@ namespace rule_loader
bool warn_evttypes;
bool skip_if_unknown_filter;
};

/*!
\brief Represents infos about a rule update (append or replace) request
*/

struct rule_update_info
{
rule_update_info(context &ctx);
~rule_update_info() = default;
rule_update_info(rule_update_info&&) = default;
rule_update_info& operator = (rule_update_info&&) = default;
rule_update_info(const rule_update_info&) = default;
rule_update_info& operator = (const rule_update_info&) = default;

bool has_any_value()
{
return cond.has_value() || output.has_value() || desc.has_value() || tags.has_value() ||
exceptions.has_value() || priority.has_value() || enabled.has_value() ||
warn_evttypes.has_value() || skip_if_unknown_filter.has_value();
}

context ctx;
context cond_ctx;
std::string name;
std::optional<std::string> cond;
std::optional<std::string> output;
std::optional<std::string> desc;
std::optional<std::set<std::string>> tags;
std::optional<std::vector<rule_exception_info>> exceptions;
std::optional<falco_common::priority_type> priority;
std::optional<bool> enabled;
std::optional<bool> warn_evttypes;
std::optional<bool> skip_if_unknown_filter;
};
};
163 changes: 132 additions & 31 deletions userspace/engine/rule_loader_collector.cpp
Original file line number Diff line number Diff line change
@@ -48,8 +48,14 @@ static inline void define_info(indexed_vector<T>& infos, T& info, uint32_t id)
}
}

template <typename T>
static inline void append_info(T* prev, T& info, uint32_t id)
template <typename T, typename U>
static inline void append_info(T* prev, U& info, uint32_t id)
{
prev->visibility = id;
}

template <typename T, typename U>
static inline void replace_info(T* prev, U& info, uint32_t id)
{
prev->visibility = id;
}
@@ -185,7 +191,7 @@ void rule_loader::collector::append(configuration& cfg, list_info& info)
{
auto prev = m_list_infos.at(info.name);
THROW(!prev,
"List has 'append' key but no list by that name already exists",
"List has 'append' key or 'override: append' key but no list by that name already exists",
info.ctx);
prev->items.insert(prev->items.end(), info.items.begin(), info.items.end());
append_info(prev, info, m_cur_index++);
@@ -233,15 +239,15 @@ void rule_loader::collector::define(configuration& cfg, rule_info& info)
define_info(m_rule_infos, info, m_cur_index++);
}

void rule_loader::collector::append(configuration& cfg, rule_info& info)
void rule_loader::collector::append(configuration& cfg, rule_update_info& info)
{
auto prev = m_rule_infos.at(info.name);

THROW(!prev,
"Rule has 'append' key but no rule by that name already exists",
"An append to a rule was requested but no rule by that name already exists",
info.ctx);
THROW(info.cond.empty() && info.exceptions.empty(),
"Appended rule must have exceptions or condition property",
THROW(!info.has_any_value(),
"Appended rule must have at least one field that can be appended to",
info.ctx);

// note: source can be nullptr in case we've collected a
@@ -256,43 +262,138 @@ void rule_loader::collector::append(configuration& cfg, rule_info& info)
info.ctx);
}

if (!info.cond.empty())
if (info.cond.has_value() && !info.cond->empty())
{
prev->cond += " ";
prev->cond += info.cond;
prev->cond += *info.cond;
}

for (auto &ex : info.exceptions)
if (info.output.has_value() && !info.output->empty())
{
prev->output += " ";
prev->output += *info.output;
}

if (info.desc.has_value() && !info.desc->empty())
{
auto prev_ex = find_if(prev->exceptions.begin(), prev->exceptions.end(),
[&ex](const rule_loader::rule_exception_info& i)
{ return i.name == ex.name; });
if (prev_ex == prev->exceptions.end())
prev->desc += " ";
prev->desc += *info.desc;
}

if (info.tags.has_value())
{
for (auto &tag: *info.tags)
{
THROW(!ex.fields.is_valid(),
"Rule exception must have fields property with a list of fields",
ex.ctx);
THROW(ex.values.empty(),
"Rule exception must have values property with a list of values",
ex.ctx);
validate_exception_info(source, ex);
prev->exceptions.push_back(ex);
prev->tags.insert(tag);
}
else
}

if (info.exceptions.has_value())
{
for (auto &ex : *info.exceptions)
{
THROW(ex.fields.is_valid(),
"Can not append exception fields to existing exception, only values",
ex.ctx);
THROW(ex.comps.is_valid(),
"Can not append exception comps to existing exception, only values",
ex.ctx);
prev_ex->values.insert(
prev_ex->values.end(), ex.values.begin(), ex.values.end());
auto prev_ex = find_if(prev->exceptions.begin(), prev->exceptions.end(),
[&ex](const rule_loader::rule_exception_info& i)
{ return i.name == ex.name; });
if (prev_ex == prev->exceptions.end())
{
THROW(!ex.fields.is_valid(),
"Rule exception must have fields property with a list of fields",
ex.ctx);
THROW(ex.values.empty(),
"Rule exception must have values property with a list of values",
ex.ctx);
validate_exception_info(source, ex);
prev->exceptions.push_back(ex);
}
else
{
THROW(ex.fields.is_valid(),
"Can not append exception fields to existing exception, only values",
ex.ctx);
THROW(ex.comps.is_valid(),
"Can not append exception comps to existing exception, only values",
ex.ctx);
prev_ex->values.insert(
prev_ex->values.end(), ex.values.begin(), ex.values.end());
}
}
}

append_info(prev, info, m_cur_index++);
}

void rule_loader::collector::selective_replace(configuration& cfg, rule_update_info& info)
{
auto prev = m_rule_infos.at(info.name);

THROW(!prev,
"An replace to a rule was requested but no rule by that name already exists",
info.ctx);
THROW(!info.has_any_value(),
"The rule must have at least one field that can be replaced",
info.ctx);

// note: source can be nullptr in case we've collected a
// rule for which the source is unknown
falco_source* source = nullptr;
if (!prev->unknown_source)
{
// note: if the source is not unknown, this should not return nullptr
source = cfg.sources.at(prev->source);
THROW(!source,
std::string("Unknown source ") + prev->source,
info.ctx);
}

if (info.cond.has_value())
{
prev->cond = *info.cond;
}

if (info.output.has_value())
{
prev->output = *info.output;
}

if (info.desc.has_value())
{
prev->desc = *info.desc;
}

if (info.tags.has_value())
{
prev->tags = *info.tags;
}

if (info.exceptions.has_value())
{
prev->exceptions = *info.exceptions;
}

if (info.priority.has_value())
{
prev->priority = *info.priority;
}

if (info.enabled.has_value())
{
prev->enabled = *info.enabled;
}

if (info.warn_evttypes.has_value())
{
prev->warn_evttypes = *info.warn_evttypes;
}

if (info.skip_if_unknown_filter.has_value())
{
prev->skip_if_unknown_filter = *info.skip_if_unknown_filter;
}

replace_info(prev, info, m_cur_index++);
}

void rule_loader::collector::enable(configuration& cfg, rule_info& info)
{
auto prev = m_rule_infos.at(info.name);
7 changes: 6 additions & 1 deletion userspace/engine/rule_loader_collector.h
Original file line number Diff line number Diff line change
@@ -85,13 +85,18 @@ class collector
*/
virtual void append(configuration& cfg, list_info& info);
virtual void append(configuration& cfg, macro_info& info);
virtual void append(configuration& cfg, rule_info& info);
virtual void append(configuration& cfg, rule_update_info& info);

/*!
\brief Updates the 'enabled' flag of an existing definition
*/
virtual void enable(configuration& cfg, rule_info& info);

/*!
\brief Selectively replaces some fields of an existing definition
*/
virtual void selective_replace(configuration& cfg, rule_update_info& info);

private:
uint32_t m_cur_index;
indexed_vector<rule_info> m_rule_infos;
260 changes: 247 additions & 13 deletions userspace/engine/rule_loader_reader.cpp
Original file line number Diff line number Diff line change
@@ -17,6 +17,8 @@ limitations under the License.

#include <string>
#include <vector>
#include <set>
#include <sstream>

#include "rule_loader_reader.h"
#include "falco_engine_version.h"
@@ -115,6 +117,64 @@ static void decode_tags(const YAML::Node& item, std::set<T>& out,
decode_seq(item, "tags", inserter, ctx, optional);
}

static void decode_overrides(const YAML::Node& item,
std::set<std::string>& overridable_append,
std::set<std::string>& overridable_replace,
std::set<std::string>& out_append,
std::set<std::string>& out_replace,
const rule_loader::context& ctx)
{
const YAML::Node& val = item["override"];

if(!val.IsDefined())
{
return;
}

rule_loader::context overridectx(item, rule_loader::context::OVERRIDE, "", ctx);

for(YAML::const_iterator it=val.begin();it!=val.end();++it)
{
std::string key = it->first.as<std::string>();
std::string operation = it->second.as<std::string>();

bool is_overridable_append = overridable_append.find(it->first.as<std::string>()) != overridable_append.end();
bool is_overridable_replace = overridable_replace.find(it->first.as<std::string>()) != overridable_replace.end();

if (operation == "append")
{
rule_loader::context keyctx(it->first, rule_loader::context::OVERRIDE, key, overridectx);
THROW(!is_overridable_append, std::string("Key '") + key + std::string("' cannot be appended to"), keyctx);

out_append.insert(key);
}
else if (operation == "replace")
{
rule_loader::context keyctx(it->first, rule_loader::context::OVERRIDE, key, overridectx);
THROW(!is_overridable_replace, std::string("Key '") + key + std::string("' cannot be replaced"), keyctx);

out_replace.insert(key);
}
else
{
rule_loader::context operationctx(it->second, rule_loader::context::VALUE_FOR, key, overridectx);
std::stringstream err_ss;
err_ss << "Invalid override operation for key '" << key << "': '" << operation << "'. "
<< "Allowed values are: ";
if (is_overridable_append)
{
err_ss << "append ";
}
if (is_overridable_replace)
{
err_ss << "replace ";
}

THROW(true, err_ss.str(), operationctx);
}
}
}

// Don't call this directly, call decode_exception_{fields,comps,values} instead
static void decode_exception_info_entry(
const YAML::Node& item,
@@ -187,7 +247,7 @@ static void decode_exception_values(

static void read_rule_exceptions(
const YAML::Node& item,
rule_loader::rule_info& v,
std::vector<rule_loader::rule_exception_info>& exceptions,
const rule_loader::context& parent,
bool append)
{
@@ -239,10 +299,15 @@ static void read_rule_exceptions(
v_ex.values.push_back(v_ex_val);
}
}
v.exceptions.push_back(v_ex);
exceptions.push_back(v_ex);
}
}

inline static void throw_if_override_undefined(const YAML::Node& item, const std::string& override_type, const std::string& key, const rule_loader::context& ctx)
{
THROW(!item[key].IsDefined(), std::string("An ") + override_type + " override for '" + key + "' was specified but '" + key + "' is not defined", ctx);
}

static void read_item(
rule_loader::configuration& cfg,
rule_loader::collector& collector,
@@ -337,6 +402,19 @@ static void read_item(
decode_items(item, v.items, ctx);

decode_optional_val(item, "append", append, ctx);

std::set<std::string> override_append, override_replace;
std::set<std::string> overridable {"items"};
decode_overrides(item, overridable, overridable, override_append, override_replace, ctx);

if(append == true && !override_replace.empty())
{
THROW(true, "Cannot specify a replace override when 'append: true' is set", ctx);
}

// Since a list only has items, if we have chosen to append them we can append the entire object
// otherwise we just want to redefine the list.
append |= override_append.find("items") != override_append.end();

if(append)
{
@@ -366,6 +444,19 @@ static void read_item(

decode_optional_val(item, "append", append, ctx);

std::set<std::string> override_append, override_replace;
std::set<std::string> overridable {"condition"};
decode_overrides(item, overridable, overridable, override_append, override_replace, ctx);

if(append == true && !override_replace.empty())
{
THROW(true, "Cannot specify a replace override when 'append: true' is set", ctx);
}

// Since a macro only has a condition, if we have chosen to append to it we can append the entire object
// otherwise we just want to redefine the macro.
append |= override_append.find("condition") != override_append.end();

if(append)
{
collector.append(cfg, v);
@@ -384,28 +475,171 @@ static void read_item(
decode_val(item, "rule", name, tmp);

rule_loader::context ctx(item, rule_loader::context::RULE, name, parent);
rule_loader::rule_info v(ctx);
v.name = name;

bool append = false;
v.enabled = true;
v.warn_evttypes = true;
v.skip_if_unknown_filter = false;
bool has_append_flag = false;
decode_optional_val(item, "append", has_append_flag, ctx);

decode_optional_val(item, "append", append, ctx);
std::set<std::string> override_append, override_replace;
std::set<std::string> overridable_append {"condition", "output", "desc", "tags", "exceptions"};
std::set<std::string> overridable_replace {
"condition", "output", "desc", "priority", "tags", "exceptions", "enabled", "warn_evttypes", "skip-if-unknown-filter"};
decode_overrides(item, overridable_append, overridable_replace, override_append, override_replace, ctx);
bool has_overrides_append = !override_append.empty();
bool has_overrides_replace = !override_replace.empty();
bool has_overrides = has_overrides_append || has_overrides_replace;

if(append)
THROW((has_append_flag && has_overrides), "Keys 'override' and 'append' cannot be used together.", ctx);

if(has_overrides)
{
decode_optional_val(item, "condition", v.cond, ctx);
if (has_overrides_append)
{
rule_loader::rule_update_info v(ctx);
v.name = name;
if (override_append.find("condition") != override_append.end())
{
throw_if_override_undefined(item, "append", "condition", ctx);
v.cond = "";
decode_val(item, "condition", *v.cond, ctx);
}

if (override_append.find("exceptions") != override_append.end())
{
throw_if_override_undefined(item, "append", "exceptions", ctx);
v.exceptions = std::vector<rule_loader::rule_exception_info>();
read_rule_exceptions(item, *v.exceptions, ctx, true);
}

if (override_append.find("output") != override_append.end())
{
throw_if_override_undefined(item, "append", "output", ctx);
v.output = "";
decode_val(item, "output", *v.output, ctx);
}

if (override_append.find("desc") != override_append.end())
{
throw_if_override_undefined(item, "append", "desc", ctx);
v.desc = "";
decode_val(item, "desc", *v.desc, ctx);
}

if (override_append.find("tags") != override_append.end())
{
throw_if_override_undefined(item, "append", "tags", ctx);
v.tags = std::set<std::string>();
decode_tags(item, *v.tags, ctx);
}

collector.append(cfg, v);
}

if (has_overrides_replace)
{
rule_loader::rule_update_info v(ctx);
v.name = name;
if (override_replace.find("condition") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "condition", ctx);
v.cond = "";
decode_val(item, "condition", *v.cond, ctx);
}

if (override_replace.find("exceptions") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "exceptions", ctx);
v.exceptions = std::vector<rule_loader::rule_exception_info>();
read_rule_exceptions(item, *v.exceptions, ctx, true);
}

if (override_replace.find("output") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "output", ctx);
v.output = "";
decode_val(item, "output", *v.output, ctx);
}

if (override_replace.find("desc") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "desc", ctx);
v.desc = "";
decode_val(item, "desc", *v.desc, ctx);
}

if (override_replace.find("tags") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "tags", ctx);
v.tags = std::set<std::string>();
decode_tags(item, *v.tags, ctx);
}

if (override_replace.find("priority") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "priority", ctx);

std::string priority;
decode_val(item, "priority", priority, ctx);
rule_loader::context prictx(item["priority"], rule_loader::context::RULE_PRIORITY, "", ctx);
v.priority = falco_common::priority_type::PRIORITY_DEBUG;
THROW(!falco_common::parse_priority(priority, *v.priority), "Invalid priority", prictx);
}

if (override_replace.find("enabled") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "enabled", ctx);
v.enabled = false;
decode_val(item, "enabled", *v.enabled, ctx);
}

if (override_replace.find("warn_evttypes") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "warn_evttypes", ctx);
v.warn_evttypes = false;
decode_val(item, "warn_evttypes", *v.warn_evttypes, ctx);
}

if (override_replace.find("skip-if-unknown-filter") != override_replace.end())
{
throw_if_override_undefined(item, "replace", "skip-if-unknown-filter", ctx);
v.skip_if_unknown_filter= false;
decode_val(item, "skip-if-unknown-filter", *v.skip_if_unknown_filter, ctx);
}

collector.selective_replace(cfg, v);
}
}
else if(has_append_flag)
{
rule_loader::rule_update_info v(ctx);
v.name = name;

if(item["condition"].IsDefined())
{
v.cond_ctx = rule_loader::context(item["condition"], rule_loader::context::RULE_CONDITION, "", ctx);
v.cond = "";
decode_val(item, "condition", *v.cond, ctx);
}
read_rule_exceptions(item, v, ctx, append);

if(item["exceptions"].IsDefined())
{
v.exceptions = std::vector<rule_loader::rule_exception_info>();
read_rule_exceptions(item, *v.exceptions, ctx, true);
}

THROW((!v.cond.has_value() && !v.exceptions.has_value()),
"Appended rule must have exceptions or condition property",
v.ctx);

collector.append(cfg, v);
}
else
{
rule_loader::rule_info v(ctx);
v.name = name;
v.enabled = true;
v.warn_evttypes = true;
v.skip_if_unknown_filter = false;

// If the rule does *not* have any of
// condition/output/desc/priority, it *must*
// have an enabled property. Use the enabled
@@ -443,7 +677,7 @@ static void read_item(
decode_optional_val(item, "warn_evttypes", v.warn_evttypes, ctx);
decode_optional_val(item, "skip-if-unknown-filter", v.skip_if_unknown_filter, ctx);
decode_tags(item, v.tags, ctx);
read_rule_exceptions(item, v, ctx, append);
read_rule_exceptions(item, v.exceptions, ctx, has_append_flag);
collector.define(cfg, v);
}
}

0 comments on commit 9510569

Please sign in to comment.