Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

new(engine): enforce unique exceptions names #3134

Merged
merged 3 commits into from
Apr 3, 2024

Conversation

mrgian
Copy link
Contributor

@mrgian mrgian commented Mar 8, 2024

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind release

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area tests

/area proposals

/area CI

What this PR does / why we need it:
Does't allow multiple exceptions definitions in the same rule object.
Example:

- rule: test_rule
  desc: test rule
  condition: proc.cmdline contains curl
  output: command=%proc.cmdline
  priority: INFO
  exceptions:
    - name: test_exception
      fields: [proc.cmdline]
      comps: [contains]
      values:
        - [curl 127.0.0.1]
    - name: test_exception
      fields: [proc.cmdline]
      comps: [endswith]
      values:
        - [curl 127.0.0.1]

- rule: test_rule
  exceptions:
    - name: test_exception
      values:
        - [curl 1.1.1.1]
  append: true

In this example it's not clear where the new values are appended.
Which issue(s) this PR fixes: #2279

Fixes #2279

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new(engine): enforce unique exceptions names

Copy link

github-actions bot commented Mar 8, 2024

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

@poiana poiana requested review from jasondellaluce and Kaizhe March 8, 2024 10:41
@mrgian mrgian force-pushed the unique-exception-name branch from 5f9ff50 to 5319505 Compare March 11, 2024 13:10
@Andreagit97 Andreagit97 added this to the 0.38.0 milestone Mar 13, 2024
jasondellaluce
jasondellaluce previously approved these changes Mar 25, 2024
@poiana
Copy link
Contributor

poiana commented Mar 25, 2024

LGTM label has been added.

Git tree hash: 244d440edb2e293be72260047f16d6273885de0a

@leogr
Copy link
Member

leogr commented Mar 26, 2024

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

Already bumped.
/unhold

@FedeDP
Copy link
Contributor

FedeDP commented Apr 3, 2024

@mrgian can you rebase to fix conflicts?

Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Apr 3, 2024

LGTM label has been added.

Git tree hash: a16401be9b2826992037d6a0adb403aecb895751

@poiana poiana added the approved label Apr 3, 2024
@mrgian
Copy link
Contributor Author

mrgian commented Apr 3, 2024

@mrgian can you rebase to fix conflicts?

Rebased!

@poiana
Copy link
Contributor

poiana commented Apr 3, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, leogr, mrgian

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 7234bc5 into falcosecurity:master Apr 3, 2024
29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

Duplicate exception names for the same rule are allowed
6 participants