Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Container info in engine #151

Merged
merged 4 commits into from
Dec 1, 2016
Merged

Container info in engine #151

merged 4 commits into from
Dec 1, 2016

Commits on Nov 29, 2016

  1. Move container.info handling to falco engine.

    container.info handling used to be handled by the the falco_outputs
    object. However, this caused problems for applications that only used
    the falco engine, doing their own output formatting for matching events.
    
    Fix this by moving output formatting into the falco engine itself. The
    part that replaces %container.info/adds extra formatting to the end of a
    rule's output now happens while loading the rule.
    mstemm committed Nov 29, 2016
    Configuration menu
    Copy the full SHA
    dd6b51f View commit details
    Browse the repository at this point in the history
  2. Validate rule outputs when loading rules.

    Validate rule outputs when loading rules by attempting to create a
    formatter based on the rule's output field. If there's an error, it will
    propagate up through load_rules and cause falco to exit rather than
    discover the problem only when trying to format the event and the rule's
    output field.
    
    This required moving formats.{cpp,h} into the falco engine directory
    from the falco general directory. Note that these functions are loaded
    twice in the two lua states used by falco (engine and outputs).
    
    There's also a couple of minor cleanups:
    
     - falco_formats had a private instance variable that was unused, remove
       it.
     - rename the package for the falco_formats functions to formats instead
       of falco so it's more standalone.
     - don't throw a c++ exception in falco_formats::formatter. Instead
       generate a lua error, which is handled more cleanly.
     - free_formatter doesn't return any values, so set the return value of
       the function to 0.
    mstemm committed Nov 29, 2016
    Configuration menu
    Copy the full SHA
    96a40c5 View commit details
    Browse the repository at this point in the history
  3. Add unit test for rule with invalid output.

    Add the ability to check falco's return code with exit_status and to
    generally match stderr with stderr_contains in a test.
    
    Use those to create a test that has an invalid output expression using
    %not_a_real_field. It expects falco to exit with 1 and the output to
    contain a message about the invalid output.
    mstemm committed Nov 29, 2016
    Configuration menu
    Copy the full SHA
    72b955d View commit details
    Browse the repository at this point in the history

Commits on Dec 1, 2016

  1. Prevent rule_result from leaking on error.

    Change falco_engine::process_event to return a unique_ptr that wraps the
    rule result, so it won't be leaked if this method throws an exception.
    
    This means that callers don't need to create their own.
    mstemm committed Dec 1, 2016
    Configuration menu
    Copy the full SHA
    9570379 View commit details
    Browse the repository at this point in the history