feat!: simplify scap-converter returned codes and stop propagating events by default to upper layers #2657
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Remove `EF_TMP_CONVERTER_MANAGED` flag for some some old enter events, and remove the related conversion instructions from the scap converter table. BREAKING CHANGE: some old enter events are not delivered anymore to sinsp Signed-off-by: Leonardo Di Giovanna <[email protected]>
Rename `C_ACTION_{SKIP,STORE_AND_SKIP}` to
`C_ACTION_{PASS,STORE_AND_PASS}` to make clearer the intention to pass
the event to the upper layers.
Signed-off-by: Leonardo Di Giovanna <[email protected]>
Signed-off-by: Leonardo Di Giovanna <[email protected]>
poiana
added
dco-signoff: yes
kind/cleanup
kind/test
|
Please double check driver/SCHEMA_VERSION file. See versioning. /hold |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ekoops The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
`C_ACTION_STORE` now stores the event in the internal scap converter event storage and returns `CONVERSION_DROP`, preventing the event being passed up to the upper layers. BREAKING CHANGE: all scap converter's internally-stored events are not propagated anymore to sinsp Signed-off-by: Leonardo Di Giovanna <[email protected]>
ekoops
force-pushed
the
ekoops/scap-drop
branch
from
5106f3a to
c56139a
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2657 +/- ##
==========================================
- Coverage 78.21% 78.18% -0.03%
==========================================
Files 292 292
Lines 31781 31781
Branches 4654 4656 +2
==========================================
- Hits 24856 24848 -8
- Misses 6925 6933 +8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
leogr
approved these changes
Sep 30, 2025
leogr
approved these changes
Sep 30, 2025
Member
|
/remove-hold |
89 tasks
gnosek
approved these changes
Sep 30, 2025
Perf diff from master - unit testsHeap diff from master - unit testsHeap diff from master - scap fileBenchmarks diff from master |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind cleanup
/kind test
/kind feature
Any specific area of the project related to this PR?
/area libscap-engine-savefile
/area libsinsp
/area tests
Does this PR require a change in the driver versions?
What this PR does / why we need it:
This PR performs three major tasks:
EF_TMP_CONVERTER_MANAGEDto some old enter events; since these enter events are not needed anymore by the upper layers, it is possible to leverage the new default scap converter logic dropping old enter events not having theEF_TMP_CONVERTER_MANAGEDflag to do the job; this also allows to remove the corresponding entries from the event tableCONVERSION_COMPLETEDandCONVERSION_SKIP; these two converter result are not distinguishable anymore, and there is no reason to keep them separate; the new resulting code is calledCONVERSION_PASS, which states clearly what is the intention (i.e.: passing the event to the upper layers)C_ACTION_STOREfrom "store a copy of the event and let the original one proceed to the upper layers" to "store a copy of the event and don't propagate anything to the upper layers"Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Not bumping the driver schema version is currently a practice we are following as we will bump it in a single shot once we are done with the #2068 proposal.
/milestone 0.22.0
Does this PR introduce a user-facing change?: