Describe the bug
The current implementation doesn't support the evaluation of evt.rawarg.* filterchecks for parameters having specific underlying types. Specifically, it throws an exception for the followings:
How to reproduce it
Use the latest available Falco version and configure it with a rule like the following:
- rule: Connect
desc: >
Something
condition: >
evt.type = connect and evt.dir='<'
output: Connect raw arg | socktuple=%evt.rawarg.tuple
priority: NOTICEUpon the reception of the first connect exit event, it'll crash and report the following message:
...
Error: wrong param type 13
Expected behaviour
Falco doesn't crash and correctly handles the parameter type.
Screenshots
Environment
Falco version: 0.41.3
Libs version: 0.21.0
Plugin API: 3.11.0
Engine: 0.50.0
Driver:
API version: 8.0.0
Schema version: 3.6.0
Default driver: 8.1.0+driver
{
"machine": "x86_64",
"nodename": "ekoops-XPS-15-9530",
"release": "6.8.0-64-generic",
"sysname": "Linux",
"version": "#67~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Jun 24 15:19:46 UTC 2"
}
- Cloud provider or hardware configuration:
- OS: pop-os
- Installation method: source
Additional context
Describe the bug
The current implementation doesn't support the evaluation of
evt.rawarg.*filterchecks for parameters having specific underlying types. Specifically, it throws an exception for the followings:PT_PIDevt.rawarg.*raw val eval for pids, uids, gids and socktuples #2552PT_UIDevt.rawarg.*raw val eval for pids, uids, gids and socktuples #2552PT_GIDevt.rawarg.*raw val eval for pids, uids, gids and socktuples #2552PT_BYTEBUFPT_SOCKTUPLEevt.rawarg.*raw val eval for pids, uids, gids and socktuples #2552PT_FDLISTPT_SYSCALLIDPT_SIGTYPEPT_DYNPT_SIGSETPT_CHARBUFARRAYPT_CHARBUF_PAIR_ARRAYHow to reproduce it
Use the latest available Falco version and configure it with a rule like the following:
Upon the reception of the first connect exit event, it'll crash and report the following message:
Expected behaviour
Falco doesn't crash and correctly handles the parameter type.
Screenshots
Environment
Additional context