feat(engine): emit warning when a condition uses deprecated "evt.dir"

unit_tests/engine/test_filter_warning_resolver.cpp

@@ -15,6 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+#include <string>
 #include <gtest/gtest.h>
 #include <engine/filter_warning_resolver.h>
 
@@ -38,4 +39,8 @@ TEST(WarningResolver, warnings_in_filtering_conditions) {
 	ASSERT_TRUE(warns("ka.field intersects (otherval, <NA>)"));
 	ASSERT_TRUE(warns("ka.field pmatch (<NA>)"));
 	ASSERT_TRUE(warns("ka.field pmatch (otherval, <NA>)"));
+	ASSERT_TRUE(warns("evt.dir = <"));
+	ASSERT_TRUE(warns("evt.dir = >"));
+	ASSERT_TRUE(warns("proc.name=test and evt.dir = <"));
+	ASSERT_TRUE(warns("evt.dir = < and proc.name=test"));
 }

userspace/engine/falco_load_result.cpp

@@ -73,7 +73,8 @@ static const std::string warning_codes[] = {"LOAD_UNKNOWN_SOURCE",
                                             "LOAD_EXCEPTION_NAME_NOT_UNIQUE",
                                             "LOAD_INVALID_MACRO_NAME",
                                             "LOAD_INVALID_LIST_NAME",
-                                            "LOAD_COMPILE_CONDITION"};
+                                            "LOAD_COMPILE_CONDITION",
+                                            "LOAD_DEPRECATED_DIR_FIELD"};
 
 const std::string& falco::load_result::warning_code_str(warning_code wc) {
 	return warning_codes[wc];
@@ -92,7 +93,8 @@ static const std::string warning_strings[] = {"Unknown event source",
                                               "Multiple exceptions defined with the same name",
                                               "Invalid macro name",
                                               "Invalid list name",
-                                              "Warning in rule condition"};
+                                              "Warning in rule condition",
+                                              "Deprecated evt.dir field usage"};
 
 const std::string& falco::load_result::warning_str(warning_code wc) {
 	return warning_strings[wc];
@@ -119,7 +121,10 @@ static const std::string warning_descs[] = {
         "A rule is defining multiple exceptions with the same name",
         "A macro is defined with an invalid name",
         "A list is defined with an invalid name",
-        "A rule condition or output have been parsed with a warning"};
+        "A rule condition or output have been parsed with a warning",
+        "A rule condition uses the deprecated 'evt.dir' field. Due to the drop of enter events, "
+        "'evt.dir = <' always evaluates to true, and 'evt.dir = >' always evaluates to false. The "
+        "rule expression can be simplified by removing the condition on 'evt.dir'."};
 
 const std::string& falco::load_result::warning_desc(warning_code wc) {
 	return warning_descs[wc];

userspace/engine/falco_load_result.h

@@ -60,7 +60,8 @@ class load_result {
 		LOAD_EXCEPTION_NAME_NOT_UNIQUE,
 		LOAD_INVALID_MACRO_NAME,
 		LOAD_INVALID_LIST_NAME,
-		LOAD_COMPILE_CONDITION
+		LOAD_COMPILE_CONDITION,
+		LOAD_DEPRECATED_DIR_FIELD
 	};
 
 	virtual ~load_result() = default;

userspace/engine/filter_warning_resolver.cpp

@@ -15,6 +15,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
+#include <string>
 #include <libsinsp/sinsp.h>
 #include "filter_warning_resolver.h"
 
@@ -27,6 +28,10 @@ static inline bool is_unsafe_field(const std::string& f) {
 	       !strncmp(f.c_str(), "jevt.", strlen("jevt."));
 }
 
+static inline bool is_deprecated_dir_field(const std::string& f) {
+	return f == "evt.dir";
+}
+
 static inline bool is_equality_operator(const std::string& op) {
 	return op == "==" || op == "=" || op == "!=" || op == "in" || op == "intersects" ||
 	       op == "pmatch";
@@ -54,6 +59,11 @@ void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::binary_check
 
 void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::field_expr* e) {
 	m_last_node_is_unsafe_field = is_unsafe_field(e->field);
+
+	// Check for deprecated dir field usage
+	if(is_deprecated_dir_field(e->field)) {
+		m_warnings->insert(load_result::LOAD_DEPRECATED_DIR_FIELD);
+	}
 }
 
 void filter_warning_resolver::visitor::visit(libsinsp::filter::ast::value_expr* e) {

userspace/engine/rule_loader_compiler.cpp

@@ -19,7 +19,6 @@ limitations under the License.
 #include <memory>
 #include <set>
 #include <vector>
-#include <functional>
 
 #include "rule_loader_compiler.h"
 #include "filter_warning_resolver.h"