Add CEL filter to the CLI, fixes cilium#3112

Signed-off-by: Kevin Conner <[email protected]>
knrc · Nov 15, 2024 · 192ee0f · 192ee0f
1 parent 93fb03c
commit 192ee0f
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/pkg/filters/filters.go b/pkg/filters/filters.go
@@ -95,6 +95,7 @@ var Filters = []OnBuildFilter{
 	&PodRegexFilter{},
 	&PolicyNamesFilter{},
 	&CapsFilter{},
+	&CELExpressionFilter{},
 }
 
 func GetProcess(event *v1.Event) *tetragon.Process {

diff --git a/pkg/filters/filters_test.go b/pkg/filters/filters_test.go
@@ -33,7 +33,8 @@ func TestParseFilterList(t *testing.T) {
 {"pid_set":[1]}
 {"event_set":["PROCESS_EXEC", "PROCESS_EXIT", "PROCESS_KPROBE", "PROCESS_TRACEPOINT"]}
 {"arguments_regex":["^--version$","^-a -b -c$"]}
-{"capabilities": {"effective": {"all": ["CAP_BPF", "CAP_SYS_ADMIN"]}}}`
+{"capabilities": {"effective": {"all": ["CAP_BPF", "CAP_SYS_ADMIN"]}}}
+{"cel_expression": ["process_exec.process.bad_field_name == 'curl'"]}`
 	filterProto, err := ParseFilterList(f, true)
 	assert.NoError(t, err)
 	if diff := cmp.Diff(
@@ -50,6 +51,7 @@ func TestParseFilterList(t *testing.T) {
 					All: []tetragon.CapabilitiesType{tetragon.CapabilitiesType_CAP_BPF, tetragon.CapabilitiesType_CAP_SYS_ADMIN},
 				},
 			}},
+			{CelExpression: []string{"process_exec.process.bad_field_name == 'curl'"}},
 		},
 		filterProto,
 		cmpopts.IgnoreUnexported(tetragon.Filter{}),