Skip to content

Commit

Permalink
rule update: fix syntax error
Browse files Browse the repository at this point in the history
Signed-off-by: kaizhe <derek0405@gmail.com>
  • Loading branch information
Kaizhe committed Jun 28, 2019
1 parent 8a765e2 commit 35a5193
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions rules/falco_rules.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -313,15 +313,15 @@
# RFC1918 addresses were assigned for private network usage
- list: rfc_1918_addresses
items: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
items: ['"10.0.0.0/8"', '"172.16.0.0/12"', '"192.168.0.0/16"']

- macro: outbound
condition: >
(((evt.type = connect and evt.dir=<) or
(evt.type in (sendto,sendmsg) and evt.dir=< and
fd.l4proto != tcp and fd.connected=false and fd.name_changed=true)) and
(fd.typechar = 4 or fd.typechar = 6) and
(fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8" and (not fd.snet in rfc_1918_addresses) and
(fd.ip != "0.0.0.0" and fd.net != "127.0.0.0/8" and not fd.snet in (rfc_1918_addresses)) and
(evt.rawres >= 0 or evt.res = EINPROGRESS))
# Very similar to inbound/outbound, but combines the tests together
Expand Down

0 comments on commit 35a5193

Please sign in to comment.