| 63 | } |
| 64 | |
| 65 | func (c *compiler) compile() (map[*config.FilterConfig]filter.Filter, *config.RulesCompileResult, error) { |
| 66 | if err := c.config.Filters.LoadMacros(); err != nil { |
| 67 | return nil, nil, err |
| 68 | } |
| 69 | if err := c.config.Filters.LoadFilters(); err != nil { |
| 70 | return nil, nil, err |
| 71 | } |
| 72 | |
| 73 | filters := make(map[*config.FilterConfig]filter.Filter) |
| 74 | |
| 75 | for _, f := range c.config.GetFilters() { |
| 76 | if f.IsDisabled() { |
| 77 | log.Warnf("[%s] rule is disabled", f.Name) |
| 78 | continue |
| 79 | } |
| 80 | |
| 81 | filtersCount.Add(1) |
| 82 | |
| 83 | // compile the filter |
| 84 | fltr := filter.New(f.Condition, c.config, filter.WithPSnapshotter(c.psnap)) |
| 85 | err := fltr.Compile() |
| 86 | if err != nil { |
| 87 | return nil, nil, ErrInvalidFilter(f.Name, err) |
| 88 | } |
| 89 | // check version requirements |
| 90 | if !version.IsDev() { |
| 91 | minEngineVer, err := semver.NewSemver(f.MinEngineVersion) |
| 92 | if err != nil { |
| 93 | return nil, nil, ErrMalformedMinEngineVer(f.Name, f.MinEngineVersion, err) |
| 94 | } |
| 95 | if minEngineVer.GreaterThan(version.Sem()) { |
| 96 | return nil, nil, ErrIncompatibleFilter(f.Name, f.MinEngineVersion) |
| 97 | } |
| 98 | } |
| 99 | |
| 100 | // output warning for deprecated fields |
| 101 | for _, field := range fltr.GetFields() { |
| 102 | deprecated, d := fields.IsDeprecated(field.Name) |
| 103 | if deprecated { |
| 104 | log.Warnf("%s rule uses the [%s] field which "+ |
| 105 | "was deprecated starting from version %s. "+ |
| 106 | "Please consider migrating to %s field(s) "+ |
| 107 | "because [%s] will be removed in future versions.", |
| 108 | f.Name, field.Name, d.Since, d.Fields, field.Name) |
| 109 | } |
| 110 | } |
| 111 | |
| 112 | // validate the value of the event/category fields |
| 113 | for field, values := range fltr.GetStringFields() { |
| 114 | for _, v := range values { |
| 115 | switch field { |
| 116 | case fields.EvtName, fields.KevtName: |
| 117 | if !event.IsKnown(v) { |
| 118 | return nil, nil, ErrUnknownEventName(f.Name, v) |
| 119 | } |
| 120 | case fields.EvtCategory, fields.KevtCategory: |
| 121 | if !event.IsCategoryKnown(v) { |
| 122 | return nil, nil, ErrUnknownCategoryName(f.Name, v) |