Repository navigation
Tags: falcosecurity/libs
Tags
test(libsinsp): cover proc.ppid.duration when the ancestor has no clo… …ne time The case sets the clone time of the ancestor process to zero and asserts that proc.ppid.duration has no value. Without the return statement added in this branch, control falls through to case TYPE_FDOPENCOUNT and the field reports the open descriptor count of the current thread, so the assertion fails. Signed-off-by: suselz <suselz@mail.ru>
test(libsinsp): cover proc.ppid.duration when the ancestor has no clo… …ne time The case sets the clone time of the ancestor process to zero and asserts that proc.ppid.duration has no value. Without the return statement added in this branch, control falls through to case TYPE_FDOPENCOUNT and the field reports the open descriptor count of the current thread, so the assertion fails. Signed-off-by: suselz <suselz@mail.ru>
fix(libsinsp): sanitize UTF-8 before JSON serialization Sanitize JSON string values before FastWriter processes malformed input, including values inside arrays and objects. Preserve both extraction calls to retain the existing behavior of stateful fields. Add UTF-8 regression tests and deltatime compatibility coverage. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
fix(libsinsp): sanitize UTF-8 before JSON serialization Sanitize JSON string values before FastWriter processes malformed input, including values inside arrays and objects. Preserve both extraction calls to retain the existing behavior of stateful fields. Add UTF-8 regression tests and deltatime compatibility coverage. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
chore(cmake/modules): bump container plugin to v0.7.4 Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
test(libsinsp): update the converted fcntl event expectation Expect the fourth argument added by the savefile converter. Older captures receive the default value of zero. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
test(libsinsp): update the converted fcntl event expectation Expect the fourth argument added by the savefile converter. Older captures receive the default value of zero. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
perf(userspace/libpman): don't try to collect iter stats if disabled If the support for BPF iterators is disabled, don't try to collect corresponding stats. Moreover, rename `disable_iterators` to `iterators_disabled`. Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
fix(userspace/libsinsp): fix op modifiers semantic and impl logic The current operator modifiers implementation has some inconsistencies related to the `oneof` modifier and the `!=` operator coupled with `anyof`. The new implementation patches these inconsistency and makes modifiers logic clear. `oneof`, `anyof` and `allof` has to be intended as syntactic sugars. With the help of the expression `field <op> <mod> (e0, e1, e2)`, the logic applied for these modifiers can be described as follows - `oneof` - matches iff exactly one among the set of expressions `field <op> e0`, `field <op> e1` and `field <op> e2` matches - `anyof` matches iff the expression `field <op> e0 or field <op> e1 or field <op> e2` matches; this means that will return true if there is at least 1 match among all sub-expressions. - `allof` matches iff the expression `field <op> e0 and field <op> e1 and field <op> e2` matches; this means that will return true iff all sub-expressions match. Notice that the previous implementation applied the custom logic "not in the list" for `!= anyof`: this is wrong and inconsistent with the previous model, as sub-expressions must be ORed, not ANDed. The current patch also adds a runtime check regarding the number of values that are produced at runtime by a LHS filtercheck that claims not to produce a list: it can only return 1 value. This makes all tests using the `c.multi` filtercheck wrong, because this ones is declared as a non-`EPS_IS_LIST` filtercheck that can produce multiple values. Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
PreviousNext