Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow json arrays k8s audit #967

Merged
merged 2 commits into from
Dec 17, 2019
Merged

Allow json arrays k8s audit #967

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cda21d6
Also allow json arrays of k8s audit evts
mstemm Dec 10, 2019
9c89484
Don't rethrow exceptions in parse_k8s_audit_json
mstemm Dec 10, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions userspace/engine/falco_engine.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -364,11 +364,34 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_k8s_audit_event(json
return res;
}

bool falco_engine::parse_k8s_audit_json(nlohmann::json &j, std::list<json_event> &evts)
bool falco_engine::parse_k8s_audit_json(nlohmann::json &j, std::list<json_event> &evts, bool top)
{
// Note that nlohmann::basic_json::value can throw nlohmann::basic_json::type_error (302, 306)
try
{
// If the object is an array, call parse_k8s_audit_json again for each item.
if(j.is_array())
{
if(top)
{
for(auto &item : j)
{
// Note we only handle a single top level array, to
// avoid excessive recursion.
if(! parse_k8s_audit_json(item, evts, false))
{
return false;
}
}

return true;
}
else
{
return false;
}
}

// If the kind is EventList, split it into individual events
if(j.value("kind", "<NA>") == "EventList")
{
Expand Down Expand Up @@ -410,8 +433,6 @@ bool falco_engine::parse_k8s_audit_json(nlohmann::json &j, std::list<json_event>
}
catch(exception &e)
{
// Propagate the exception
rethrow_exception(current_exception());
return false;
}
}
Expand Down
2 changes: 1 addition & 1 deletion userspace/engine/falco_engine.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,7 @@ class falco_engine : public falco_common
// Returns true if the json object was recognized as a k8s
// audit event(s), false otherwise.
//
bool parse_k8s_audit_json(nlohmann::json &j, std::list<json_event> &evts);
bool parse_k8s_audit_json(nlohmann::json &j, std::list<json_event> &evts, bool top=true);

//
// Given an event, check it against the set of rules in the
Expand Down