Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(userspace/engine): cache latest rules compilation output #2900

Merged
merged 1 commit into from
Nov 2, 2023
Merged

fix(userspace/engine): cache latest rules compilation output #2900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 13 additions & 17 deletions userspace/engine/falco_engine.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,8 +197,8 @@ std::unique_ptr<load_result> falco_engine::load_rules(const std::string &rules_c
if (reader.read(cfg, m_rule_collector))
{
// compile the definitions (resolve macro/list refs, exceptions, ...)
rule_loader::compiler::compile_output out;
rule_loader::compiler().compile(cfg, m_rule_collector, out);
m_last_compile_output = std::make_unique<rule_loader::compiler::compile_output>();
rule_loader::compiler().compile(cfg, m_rule_collector, *m_last_compile_output.get());

// clear the rules known by the engine and each ruleset
m_rules.clear();
Expand All @@ -208,7 +208,7 @@ std::unique_ptr<load_result> falco_engine::load_rules(const std::string &rules_c
}

// add rules to the engine and the rulesets
for (const auto& rule : out.rules)
for (const auto& rule : m_last_compile_output->rules)
{
// skip the rule if below the minimum priority
if (rule.priority > m_min_priority)
Expand Down Expand Up @@ -517,6 +517,13 @@ template <typename T> inline Json::Value sequence_to_json_array(const T& seq)

void falco_engine::describe_rule(std::string *rule, const std::vector<std::shared_ptr<sinsp_plugin>>& plugins, bool json) const
{
// use previously-loaded collector definitions and the compiled
// output of rules, macros, and lists.
if (m_last_compile_output == nullptr)
{
throw falco_exception("rules most be loaded before describing them");
}

if(!json)
{
static const char *rule_fmt = "%-50s %s\n";
Expand Down Expand Up @@ -544,17 +551,6 @@ void falco_engine::describe_rule(std::string *rule, const std::vector<std::share
return;
}

// use previously-loaded collector definitions to obtain a compiled
// output of rules, macros, and lists.
// note: we ignore the loading result (errors, warnings), as they should have
// already been checked when previously-loading the rules files. Thus, we
// assume that the definitions will give no compilation error.
rule_loader::configuration cfg("", m_sources, "");
cfg.output_extra = m_extra;
cfg.replace_output_container_info = m_replace_container_info;
rule_loader::compiler::compile_output compiled;
rule_loader::compiler().compile(cfg, m_rule_collector, compiled);

// use collected and compiled info to print a json output
Json::FastWriter writer;
std::string json_str;
Expand Down Expand Up @@ -593,7 +589,7 @@ void falco_engine::describe_rule(std::string *rule, const std::vector<std::share

// Store information about rules
Json::Value rules_array = Json::arrayValue;
for(const auto& r : compiled.rules)
for(const auto& r : m_last_compile_output->rules)
{
auto info = m_rule_collector.rules().at(r.name);
Json::Value rule;
Expand All @@ -604,7 +600,7 @@ void falco_engine::describe_rule(std::string *rule, const std::vector<std::share

// Store information about macros
Json::Value macros_array = Json::arrayValue;
for(const auto &m : compiled.macros)
for(const auto &m : m_last_compile_output->macros)
{
auto info = m_rule_collector.macros().at(m.name);
Json::Value macro;
Expand All @@ -615,7 +611,7 @@ void falco_engine::describe_rule(std::string *rule, const std::vector<std::share

// Store information about lists
Json::Value lists_array = Json::arrayValue;
for(const auto &l : compiled.lists)
for(const auto &l : m_last_compile_output->lists)
{
auto info = m_rule_collector.lists().at(l.name);
Json::Value list;
Expand Down
3 changes: 3 additions & 0 deletions userspace/engine/falco_engine.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ limitations under the License.
#include "falco_load_result.h"
#include "filter_details_resolver.h"
#include "rule_loader_reader.h"
#include "rule_loader_compiler.h"

//
// This class acts as the primary interface between a program and the
Expand Down Expand Up @@ -347,6 +348,8 @@ class falco_engine
std::map<std::string, uint16_t> m_known_rulesets;
falco_common::priority_type m_min_priority;

std::unique_ptr<rule_loader::compiler::compile_output> m_last_compile_output;

//
// Here's how the sampling ratio and multiplier influence
// whether or not an event is dropped in
Expand Down