update(userspace/engine): address jasondellaluce comments

Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
falcosecurity · May 29, 2023 · bdeb313 · bdeb313
1 parent 6863fa7
commit bdeb313
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 12 deletions.
diff --git a/cmake/modules/falcosecurity-libs.cmake b/cmake/modules/falcosecurity-libs.cmake
@@ -27,8 +27,8 @@ else()
   # In case you want to test against another falcosecurity/libs version (or branch, or commit) just pass the variable -
   # ie., `cmake -DFALCOSECURITY_LIBS_VERSION=dev ..` 
   if(NOT FALCOSECURITY_LIBS_VERSION)
-    set(FALCOSECURITY_LIBS_VERSION "0.11.0-rc3")
-    set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=92d78d64dbbdcbf08256be91e1b74f4d99caaea35f27324219fc6a5c195c99b8")
+    set(FALCOSECURITY_LIBS_VERSION "0.11.0-rc4")
+    set(FALCOSECURITY_LIBS_CHECKSUM "SHA256=4c2ce49b12e480b22e780ba31a33b7c109d84aee385e21a2aace452aef842ccb")
   endif()
 
   # cd /path/to/build && cmake /path/to/source

diff --git a/userspace/engine/falco_engine.cpp b/userspace/engine/falco_engine.cpp
@@ -578,9 +578,9 @@ void falco_engine::get_json_details(const falco_rule &r,
 	rule["details"] = json_details;
 
 	// Get fields from output string
-	sinsp_evt_formatter fmt(insp, r.output);
+	auto fmt = create_formatter(r.source, r.output);
 	std::vector<std::string> out_fields;
-	fmt.get_field_names(out_fields);
+	fmt->get_field_names(out_fields);
 	Json::Value outputFields = Json::arrayValue;
 	for(const auto &of : out_fields)
 	{
@@ -736,15 +736,12 @@ void falco_engine::get_json_evt_types(libsinsp::filter::ast::expr* ast,
 {
 	output = Json::arrayValue;
 	auto evtcodes = libsinsp::filter::ast::ppm_event_codes(ast);
-	if(evtcodes.size() != libsinsp::events::all_event_set().size())
+	auto syscodes = libsinsp::filter::ast::ppm_sc_codes(ast);
+	auto syscodes_to_evt_names = libsinsp::events::sc_set_to_event_names(syscodes);
+	auto evtcodes_to_evt_names = libsinsp::events::event_set_to_names(evtcodes, false);
+	for (const auto& n : unordered_set_union(syscodes_to_evt_names, evtcodes_to_evt_names))
 	{
-		auto syscodes = libsinsp::filter::ast::ppm_sc_codes(ast);
-		auto syscodes_to_evt_names = libsinsp::events::sc_set_to_event_names(syscodes);
-		auto evtcodes_to_evt_names = libsinsp::events::event_set_to_names(evtcodes, false);
-		for (const auto& n : unordered_set_union(syscodes_to_evt_names, evtcodes_to_evt_names))
-		{
-			output.append(n);
-		}
+		output.append(n);
 	}
 }
 

diff --git a/userspace/engine/json_evt.h b/userspace/engine/json_evt.h
@@ -26,6 +26,7 @@ limitations under the License.
 
 #include <nlohmann/json.hpp>
 
+#include "falco_common.h"
 #include "prefix_search.h"
 #include <sinsp.h>
 
@@ -435,6 +436,10 @@ class json_event_formatter : public gen_event_formatter
 	bool tostring(gen_event *evt, std::string &output) override;
 	bool tostring_withformat(gen_event *evt, std::string &output, gen_event_formatter::output_format of) override;
 	bool get_field_values(gen_event *evt, std::map<std::string, std::string> &fields) override;
+	void get_field_names(std::vector<std::string> &fields) override 
+	{
+		throw falco_exception("json_event_formatter::get_field_names operation not supported");
+	}
 	output_format get_output_format() override;
 
 	std::string tojson(json_event *ev);