Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ignore unknown sources rules macros #1920

Merged
merged 3 commits into from
Mar 18, 2022
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Check for unknown sources earlier (to handle exceptions)
If a rule has an unknown source, *and* has exceptions, loading the
rule will result in an error and not skipping the rule. This is
because exceptions are also validated for unknown fields, and that
occurs before the current check for unknown sources.

The fix is to move the check for unknown sources as soon as the rules
object is read.

Signed-off-by: Mark Stemm <[email protected]>
mstemm committed Mar 2, 2022
commit fe051bb78b7b35d2e32b803021ab203a7144269f
18 changes: 10 additions & 8 deletions userspace/engine/lua/rule_loader.lua
Original file line number Diff line number Diff line change
@@ -542,6 +542,14 @@ function load_rules_doc(rules_mgr, doc, load_state)
v['source'] = "syscall"
end

valid = falco_rules.is_source_valid(rules_mgr, v['source'])

if valid == false then
msg = "Rule "..v['rule']..": warning (unknown-source): unknown source "..v['source']..", skipping"
warnings[#warnings + 1] = msg
goto next_object
end

-- Add an empty exceptions property to the rule if not defined
if v['exceptions'] == nil then
v['exceptions'] = {}
@@ -735,6 +743,8 @@ function load_rules_doc(rules_mgr, doc, load_state)
arr = build_error_with_context(context, "Unknown top level object: "..table.tostring(v))
warnings[#warnings + 1] = arr[1]
end

::next_object::
end

return true, {}, warnings
@@ -1008,14 +1018,6 @@ function load_rules(rules_content,

if (filter_ast.type == "Rule") then

valid = falco_rules.is_source_valid(rules_mgr, v['source'])

if valid == false then
msg = "Rule "..v['rule']..": warning (unknown-source): unknown source "..v['source']..", skipping"
warnings[#warnings + 1] = msg
goto next_rule
end

state.n_rules = state.n_rules + 1

state.rules_by_idx[state.n_rules] = v