Skip to content

Commit 7d74f34

Browse files
safchainsafchain
authored
[CWS] simplify a bit the model accessors (#32579)
1 parent e280a4f commit 7d74f34

File tree

15 files changed

+1797
-5370
lines changed

15 files changed

+1797
-5370
lines changed

‎pkg/security/events/token_limiter.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ func (tkl *TokenLimiter) genGetTokenFnc(fields []eval.Field) error {
3636
event := m.NewEvent()
3737

3838
for _, field := range fields {
39-
if _, err := event.GetFieldType(field); err != nil {
39+
if _, _, err := event.GetFieldMetadata(field); err != nil {
4040
return err
4141
}
4242
}

‎pkg/security/probe/discarders_linux.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,7 @@ func (id *inodeDiscarders) getParentDiscarderFnc(rs *rules.RuleSet, eventType mo
237237
return nil, nil
238238
}
239239

240-
if _, err := id.discarderEvent.GetFieldType(field); err != nil {
240+
if _, _, err := id.discarderEvent.GetFieldMetadata(field); err != nil {
241241
return nil, err
242242
}
243243

@@ -246,7 +246,7 @@ func (id *inodeDiscarders) getParentDiscarderFnc(rs *rules.RuleSet, eventType mo
246246
}
247247

248248
basenameField := strings.Replace(field, model.PathSuffix, model.NameSuffix, 1)
249-
if _, err := id.discarderEvent.GetFieldType(basenameField); err != nil {
249+
if _, _, err := id.discarderEvent.GetFieldMetadata(basenameField); err != nil {
250250
return nil, err
251251
}
252252

‎pkg/security/rules/filtermodel/os_only_filter.go

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -62,24 +62,19 @@ func (e *OSOnlyFilterEvent) GetFieldValue(field eval.Field) (interface{}, error)
6262
// Init inits the rule filter event
6363
func (e *OSOnlyFilterEvent) Init() {}
6464

65-
// GetFieldEventType returns the event type for the given field
66-
func (e *OSOnlyFilterEvent) GetFieldEventType(_ eval.Field) (string, error) {
67-
return "*", nil
68-
}
69-
7065
// SetFieldValue sets the value for the given field
7166
func (e *OSOnlyFilterEvent) SetFieldValue(field eval.Field, _ interface{}) error {
7267
return &eval.ErrFieldNotFound{Field: field}
7368
}
7469

75-
// GetFieldType get the type of the field
76-
func (e *OSOnlyFilterEvent) GetFieldType(field eval.Field) (reflect.Kind, error) {
70+
// GetFieldMetadata get the type of the field
71+
func (e *OSOnlyFilterEvent) GetFieldMetadata(field eval.Field) (eval.EventType, reflect.Kind, error) {
7772
switch field {
7873
case "os":
79-
return reflect.String, nil
74+
return "*", reflect.String, nil
8075
}
8176

82-
return reflect.Invalid, &eval.ErrFieldNotFound{Field: field}
77+
return "", reflect.Invalid, &eval.ErrFieldNotFound{Field: field}
8378
}
8479

8580
// GetType returns the type for this event

‎pkg/security/rules/filtermodel/rule_filters_model.go

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -16,30 +16,25 @@ import (
1616
// Init inits the rule filter event
1717
func (e *RuleFilterEvent) Init() {}
1818

19-
// GetFieldEventType returns the event type for the given field
20-
func (e *RuleFilterEvent) GetFieldEventType(_ eval.Field) (string, error) {
21-
return "*", nil
22-
}
23-
2419
// SetFieldValue sets the value for the given field
2520
func (e *RuleFilterEvent) SetFieldValue(field eval.Field, _ interface{}) error {
2621
return &eval.ErrFieldNotFound{Field: field}
2722
}
2823

29-
// GetFieldType get the type of the field
30-
func (e *RuleFilterEvent) GetFieldType(field eval.Field) (reflect.Kind, error) {
24+
// GetFieldMetadata get the type of the field
25+
func (e *RuleFilterEvent) GetFieldMetadata(field eval.Field) (eval.Field, reflect.Kind, error) {
3126
switch field {
3227
case "kernel.version.major", "kernel.version.minor", "kernel.version.patch", "kernel.version.abi":
33-
return reflect.Int, nil
28+
return "*", reflect.Int, nil
3429
case "kernel.version.flavor",
3530
"os", "os.id", "os.platform_id", "os.version_id", "envs", "origin", "hostname":
36-
return reflect.String, nil
31+
return "*", reflect.String, nil
3732
case "os.is_amazon_linux", "os.is_cos", "os.is_debian", "os.is_oracle", "os.is_rhel", "os.is_rhel7",
3833
"os.is_rhel8", "os.is_sles", "os.is_sles12", "os.is_sles15", "kernel.core.enabled":
39-
return reflect.Bool, nil
34+
return "*", reflect.Bool, nil
4035
}
4136

42-
return reflect.Invalid, &eval.ErrFieldNotFound{Field: field}
37+
return "", reflect.Invalid, &eval.ErrFieldNotFound{Field: field}
4338
}
4439

4540
// GetType returns the type for this event

‎pkg/security/secl/compiler/eval/event.go

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,12 @@ type Event interface {
1919
Init()
2020
// GetType returns the Type of the Event
2121
GetType() EventType
22-
// GetFieldEventType returns the Event Type for the given Field
23-
GetFieldEventType(field Field) (EventType, error)
22+
// GetFieldEventType returns the Event Field Metadata for the given Field
23+
GetFieldMetadata(field Field) (EventType, reflect.Kind, error)
2424
// SetFieldValue sets the value of the given Field
2525
SetFieldValue(field Field, value interface{}) error
2626
// GetFieldValue returns the value of the given Field
2727
GetFieldValue(field Field) (interface{}, error)
28-
// GetFieldType returns the Type of the Field
29-
GetFieldType(field Field) (reflect.Kind, error)
3028
// GetTags returns a list of tags
3129
GetTags() []string
3230
}
@@ -35,7 +33,7 @@ func eventTypeFromFields(model Model, state *State) (EventType, error) {
3533
var eventType EventType
3634

3735
for field := range state.fieldValues {
38-
evt, err := model.NewEvent().GetFieldEventType(field)
36+
evt, _, err := model.NewEvent().GetFieldMetadata(field)
3937
if err != nil {
4038
return "", err
4139
}

‎pkg/security/secl/compiler/eval/model_test.go

Lines changed: 28 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -650,116 +650,116 @@ func (e *testEvent) GetFieldValue(field Field) (interface{}, error) {
650650
return nil, &ErrFieldNotFound{Field: field}
651651
}
652652

653-
func (e *testEvent) GetFieldEventType(field Field) (string, error) {
653+
func (e *testEvent) GetFieldMetadata(field Field) (string, reflect.Kind, error) {
654654
switch field {
655655

656656
case "network.ip":
657657

658-
return "network", nil
658+
return "network", reflect.Struct, nil
659659

660660
case "network.ips":
661661

662-
return "network", nil
662+
return "network", reflect.Array, nil
663663

664664
case "network.cidr":
665665

666-
return "network", nil
666+
return "network", reflect.Struct, nil
667667

668668
case "network.cidrs":
669669

670-
return "network", nil
670+
return "network", reflect.Array, nil
671671

672672
case "process.name":
673673

674-
return "", nil
674+
return "", reflect.String, nil
675675

676676
case "process.argv0":
677677

678-
return "", nil
678+
return "", reflect.String, nil
679679

680680
case "process.uid":
681681

682-
return "", nil
682+
return "", reflect.Int, nil
683683

684684
case "process.gid":
685685

686-
return "", nil
686+
return "", reflect.Int, nil
687687

688688
case "process.pid":
689689

690-
return "", nil
690+
return "", reflect.Int, nil
691691

692692
case "process.is_root":
693693

694-
return "", nil
694+
return "", reflect.Bool, nil
695695

696696
case "process.list.key":
697697

698-
return "", nil
698+
return "", reflect.Int, nil
699699

700700
case "process.list.value":
701701

702-
return "", nil
702+
return "", reflect.String, nil
703703

704704
case "process.list.flag":
705705

706-
return "", nil
706+
return "", reflect.Bool, nil
707707

708708
case "process.array.key":
709709

710-
return "", nil
710+
return "", reflect.Int, nil
711711

712712
case "process.array.value":
713713

714-
return "", nil
714+
return "", reflect.String, nil
715715

716716
case "process.array.flag":
717717

718-
return "", nil
718+
return "", reflect.Bool, nil
719719

720720
case "process.created_at":
721721

722-
return "", nil
722+
return "", reflect.Int, nil
723723

724724
case "process.or_name":
725725

726-
return "", nil
726+
return "", reflect.String, nil
727727

728728
case "process.or_array.value":
729729

730-
return "", nil
730+
return "", reflect.String, nil
731731

732732
case "open.filename":
733733

734-
return "open", nil
734+
return "open", reflect.String, nil
735735

736736
case "retval":
737737

738-
return "", nil
738+
return "", reflect.Int, nil
739739

740740
case "open.flags":
741741

742-
return "open", nil
742+
return "open", reflect.Int, nil
743743

744744
case "open.mode":
745745

746-
return "open", nil
746+
return "open", reflect.Int, nil
747747

748748
case "open.opened_at":
749749

750-
return "open", nil
750+
return "open", reflect.Int, nil
751751

752752
case "mkdir.filename":
753753

754-
return "mkdir", nil
754+
return "mkdir", reflect.String, nil
755755

756756
case "mkdir.mode":
757757

758-
return "mkdir", nil
758+
return "mkdir", reflect.Int, nil
759759

760760
}
761761

762-
return "", &ErrFieldNotFound{Field: field}
762+
return "", reflect.Invalid, &ErrFieldNotFound{Field: field}
763763
}
764764

765765
func (e *testEvent) SetFieldValue(field Field, value interface{}) error {
@@ -859,96 +859,6 @@ func (e *testEvent) SetFieldValue(field Field, value interface{}) error {
859859
return &ErrFieldNotFound{Field: field}
860860
}
861861

862-
func (e *testEvent) GetFieldType(field Field) (reflect.Kind, error) {
863-
switch field {
864-
865-
case "network.ip":
866-
867-
return reflect.Struct, nil
868-
869-
case "network.ips":
870-
871-
return reflect.Array, nil
872-
873-
case "network.cidr":
874-
875-
return reflect.Struct, nil
876-
877-
case "network.cidrs":
878-
879-
return reflect.Array, nil
880-
881-
case "process.name":
882-
883-
return reflect.String, nil
884-
885-
case "process.argv0":
886-
887-
return reflect.String, nil
888-
889-
case "process.uid":
890-
891-
return reflect.Int, nil
892-
893-
case "process.gid":
894-
895-
return reflect.Int, nil
896-
897-
case "process.pid":
898-
899-
return reflect.Int, nil
900-
901-
case "process.is_root":
902-
903-
return reflect.Bool, nil
904-
905-
case "process.list.key":
906-
return reflect.Int, nil
907-
908-
case "process.list.value":
909-
return reflect.Int, nil
910-
911-
case "process.list.flag":
912-
return reflect.Bool, nil
913-
914-
case "process.array.key":
915-
return reflect.Int, nil
916-
917-
case "process.array.value":
918-
return reflect.String, nil
919-
920-
case "process.array.flag":
921-
return reflect.Bool, nil
922-
923-
case "open.filename":
924-
925-
return reflect.String, nil
926-
927-
case "retval":
928-
929-
return reflect.Int, nil
930-
931-
case "open.flags":
932-
933-
return reflect.Int, nil
934-
935-
case "open.mode":
936-
937-
return reflect.Int, nil
938-
939-
case "mkdir.filename":
940-
941-
return reflect.String, nil
942-
943-
case "mkdir.mode":
944-
945-
return reflect.Int, nil
946-
947-
}
948-
949-
return reflect.Invalid, &ErrFieldNotFound{Field: field}
950-
}
951-
952862
var testConstants = map[string]interface{}{
953863
// boolean
954864
"true": &BoolEvaluator{Value: true},

‎pkg/security/secl/compiler/generators/accessors/accessors.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -990,6 +990,20 @@ func getFieldRestrictions(field *common.StructField) string {
990990
return fmt.Sprintf(`[]eval.EventType{"%s"}`, strings.Join(field.RestrictedTo, `", "`))
991991
}
992992

993+
func getFieldReflectType(field *common.StructField) string {
994+
switch field.ReturnType {
995+
case "string":
996+
return "reflect.String"
997+
case "int":
998+
return "reflect.Int"
999+
case "bool":
1000+
return "reflect.Bool"
1001+
case "net.IPNet":
1002+
return "reflect.Struct"
1003+
}
1004+
return ""
1005+
}
1006+
9931007
var funcMap = map[string]interface{}{
9941008
"TrimPrefix": strings.TrimPrefix,
9951009
"TrimSuffix": strings.TrimSuffix,
@@ -1005,6 +1019,7 @@ var funcMap = map[string]interface{}{
10051019
"NeedScrubbed": needScrubbed,
10061020
"AddSuffixToFuncPrototype": addSuffixToFuncPrototype,
10071021
"GetFieldRestrictions": getFieldRestrictions,
1022+
"GetFieldReflectType": getFieldReflectType,
10081023
}
10091024

10101025
//go:embed accessors.tmpl

0 commit comments

Comments
 (0)