From 5cbff1761ada583d8b16a43e533691d507c5bd69 Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Wed, 5 Jul 2023 20:35:04 +0000 Subject: [PATCH] cleanup(load-rules): add support for output and tags in rules append mode Signed-off-by: Melissa Kilby --- userspace/engine/rule_loader_collector.cpp | 18 ++++++++++++++++-- userspace/engine/rule_loader_reader.cpp | 15 +++++++++++++++ 2 files changed, 31 insertions(+), 2 deletions(-) diff --git a/userspace/engine/rule_loader_collector.cpp b/userspace/engine/rule_loader_collector.cpp index 3a87fcf7697..a565c850bc8 100644 --- a/userspace/engine/rule_loader_collector.cpp +++ b/userspace/engine/rule_loader_collector.cpp @@ -232,8 +232,8 @@ void rule_loader::collector::append(configuration& cfg, rule_info& info) THROW(!prev, "Rule has 'append' key but no rule by that name already exists", info.ctx); - THROW(info.cond.empty() && info.exceptions.empty(), - "Appended rule must have exceptions or condition property", + THROW(info.cond.empty() && info.exceptions.empty() && info.output.empty() && info.tags.empty(), + "Appended rule must have exceptions or condition or output or tags property", info.ctx); auto source = cfg.sources.at(prev->source); @@ -248,6 +248,20 @@ void rule_loader::collector::append(configuration& cfg, rule_info& info) prev->cond += info.cond; } + if (!info.output.empty()) + { + prev->output += " "; + prev->output += info.output; + } + + if (!info.tags.empty()) + { + for (auto itr : info.tags) + { + prev->tags.insert(itr); + } + } + for (auto &ex : info.exceptions) { auto prev_ex = find_if(prev->exceptions.begin(), prev->exceptions.end(), diff --git a/userspace/engine/rule_loader_reader.cpp b/userspace/engine/rule_loader_reader.cpp index 71ebfde4d76..c59525b6870 100644 --- a/userspace/engine/rule_loader_reader.cpp +++ b/userspace/engine/rule_loader_reader.cpp @@ -374,12 +374,27 @@ static void read_item( if(append) { + // option to append to condition property decode_optional_val(item, "condition", v.cond, ctx); if(item["condition"].IsDefined()) { v.cond_ctx = rule_loader::context(item["condition"], rule_loader::context::RULE_CONDITION, "", ctx); } read_rule_exceptions(item, v, ctx, append); + + // option to append to output property + decode_optional_val(item, "output", v.output, ctx); + if(item["output"].IsDefined()) + { + v.output_ctx = rule_loader::context(item["output"], rule_loader::context::RULE_OUTPUT, "", ctx); + } + v.output = trim(v.output); + read_rule_exceptions(item, v, ctx, append); + + // option to append to tags property + decode_tags(item, v.tags, ctx); + read_rule_exceptions(item, v, ctx, append); + collector.append(cfg, v); } else