[CWS] do not resolve new fields in functional test field collector

pkg/security/secl/compiler/eval/context.go

@@ -35,6 +35,8 @@ type Context struct {
 	now time.Time
 
 	CachedAncestorsCount int
+
+	resolvedFields []string
 }
 
 // Now return and cache the `now` timestamp
@@ -61,6 +63,12 @@ func (c *Context) Reset() {
 	clear(c.Registers)
 	clear(c.RegisterCache)
 	c.CachedAncestorsCount = 0
+	clear(c.resolvedFields)
+}
+
+// GetResolvedFields returns the resolved fields, always empty outside of functional tests
+func (c *Context) GetResolvedFields() []string {
+	return c.resolvedFields
 }
 
 // NewContext return a new Context

pkg/security/secl/compiler/eval/context_functests.go

@@ -0,0 +1,18 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+//go:build functionaltests
+
+// Package eval holds eval related files
+package eval
+
+// AppendResolvedField instructs the context that this field has been resolved
+func (c *Context) AppendResolvedField(field string) {
+	if field == "" {
+		return
+	}
+
+	c.resolvedFields = append(c.resolvedFields, field)
+}

pkg/security/secl/compiler/eval/context_regular.go

@@ -0,0 +1,13 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2016-present Datadog, Inc.
+
+//go:build !functionaltests
+
+// Package eval holds eval related files
+package eval
+
+// AppendResolvedField is a no-op outside of functional tests
+func (c *Context) AppendResolvedField(_ string) {
+}

pkg/security/secl/compiler/eval/evaluators.go

@@ -18,7 +18,6 @@ type Evaluator interface {
 	IsDeterministicFor(field Field) bool
 	GetField() string
 	IsStatic() bool
-	GetWeight() int
 }
 
 // BoolEvaluator returns a bool as result of the evaluation
@@ -53,11 +52,6 @@ func (b *BoolEvaluator) IsStatic() bool {
 	return b.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (b *BoolEvaluator) GetWeight() int {
-	return b.Weight
-}
-
 // IntEvaluator returns an int as result of the evaluation
 type IntEvaluator struct {
 	EvalFnc     func(ctx *Context) int
@@ -92,11 +86,6 @@ func (i *IntEvaluator) IsStatic() bool {
 	return i.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (i *IntEvaluator) GetWeight() int {
-	return i.Weight
-}
-
 // StringEvaluator returns a string as result of the evaluation
 type StringEvaluator struct {
 	EvalFnc       func(ctx *Context) string
@@ -131,11 +120,6 @@ func (s *StringEvaluator) IsStatic() bool {
 	return s.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (s *StringEvaluator) GetWeight() int {
-	return s.Weight
-}
-
 // GetValue returns the evaluator value
 func (s *StringEvaluator) GetValue(ctx *Context) string {
 	if s.EvalFnc == nil {
@@ -190,11 +174,6 @@ func (s *StringArrayEvaluator) IsStatic() bool {
 	return s.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (s *StringArrayEvaluator) GetWeight() int {
-	return s.Weight
-}
-
 // AppendValue append the given value
 func (s *StringArrayEvaluator) AppendValue(value string) {
 	s.Values = append(s.Values, value)
@@ -230,11 +209,6 @@ func (s *StringValuesEvaluator) IsStatic() bool {
 	return s.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (s *StringValuesEvaluator) GetWeight() int {
-	return s.Weight
-}
-
 // Compile the underlying StringValues
 func (s *StringValuesEvaluator) Compile(opts StringCmpOpts) error {
 	return s.Values.Compile(opts)
@@ -301,11 +275,6 @@ func (i *IntArrayEvaluator) IsStatic() bool {
 	return i.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (i *IntArrayEvaluator) GetWeight() int {
-	return i.Weight
-}
-
 // AppendValues to the array evaluator
 func (i *IntArrayEvaluator) AppendValues(values ...int) {
 	i.Values = append(i.Values, values...)
@@ -343,11 +312,6 @@ func (b *BoolArrayEvaluator) IsStatic() bool {
 	return b.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (b *BoolArrayEvaluator) GetWeight() int {
-	return b.Weight
-}
-
 // AppendValues to the array evaluator
 func (b *BoolArrayEvaluator) AppendValues(values ...bool) {
 	b.Values = append(b.Values, values...)
@@ -386,11 +350,6 @@ func (s *CIDREvaluator) IsStatic() bool {
 	return s.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (s *CIDREvaluator) GetWeight() int {
-	return s.Weight
-}
-
 // CIDRValuesEvaluator returns a net.IP
 type CIDRValuesEvaluator struct {
 	EvalFnc   func(ctx *Context) *CIDRValues
@@ -422,11 +381,6 @@ func (s *CIDRValuesEvaluator) IsStatic() bool {
 	return s.EvalFnc == nil
 }
 
-// GetWeight returns the weight of the evaluator
-func (s *CIDRValuesEvaluator) GetWeight() int {
-	return s.Weight
-}
-
 // CIDRArrayEvaluator returns an array of net.IPNet
 type CIDRArrayEvaluator struct {
 	EvalFnc     func(ctx *Context) []net.IPNet
@@ -459,8 +413,3 @@ func (s *CIDRArrayEvaluator) GetField() string {
 func (s *CIDRArrayEvaluator) IsStatic() bool {
 	return s.EvalFnc == nil
 }
-
-// GetWeight returns the weight of the evaluator
-func (s *CIDRArrayEvaluator) GetWeight() int {
-	return s.Weight
-}

pkg/security/secl/compiler/generators/accessors/accessors.tmpl

@@ -67,6 +67,7 @@ func (m *Model) GetEvaluator(field eval.Field, regID eval.RegisterID) (eval.Eval
 			{{- end}}
 			{{- if and $Field.Iterator (not $Field.IsIterator) }}
 				EvalFnc: func(ctx *eval.Context) []{{$Field.ReturnType}} {
+					ctx.AppendResolvedField(field)
 					{{if $Field.Handler}}
 						ev := ctx.Event.(*Event)
 					{{end}}
@@ -181,6 +182,7 @@ func (m *Model) GetEvaluator(field eval.Field, regID eval.RegisterID) (eval.Eval
 			{{- else}}
 				{{- $ReturnType := $Field.ReturnType}}
 				EvalFnc: func(ctx *eval.Context) {{$Field.GetArrayPrefix}}{{$ReturnType}} {
+					ctx.AppendResolvedField(field)
 					{{- if not (and $Field.IsLength $Field.IsIterator)}}
 						ev := ctx.Event.(*Event)
 					{{end}}