Umbrella: Adding support for new field types in plugins

therealbobo commented 1 year ago

Motivation

Currently, the plugin API only supports uint64 and charbuf field types. However, could be a good idea to add support for additional types to align with the libsinsp library.

Feature

The following types need to be added:

[ ] none
[ ] int8
[ ] int16
[ ] int32
[ ] int64
[ ] uint8
[ ] uint16
[ ] uint32
[x] uint64
[x] bytebuf
[ ] errno
[ ] sockaddr
[ ] socktuple
[ ] fd
[ ] pid
[ ] fdlist
[ ] fspath
[ ] syscallid
[ ] sigtype
[x] reltime
[x] abstime
[ ] port
[ ] l4proto
[ ] sockfamily
[x] bool
[ ] ipv4addr
[ ] dyn
[ ] flags8
[ ] flags16
[ ] flags32
[ ] uid
[ ] gid
[ ] double
[ ] sigset
[ ] charbufarray
[ ] pt_charbuf_pair_array
[ ] ipv4addr
[ ] ipv4net
[ ] ipv6addr
[ ] ipv6net
[x] ipaddr
[x] ipnet
[ ] mode
[ ] fsrelpath
[ ] enumflags8
[ ] enumflags16
[ ] enumflags32
[ ] max

Probably not all these types are useful. Additionally adding all these types, maybe, could result in performance penalties.

Tasks

[ ] Add support for new filtercheck types.
[ ] Test the new filtercheck types.
[ ] Ensure compatibility with driver/ppm_events_public.h.
[ ] Update documentation to reflect the changes.

Additional context

These types should be compatible with the types declared in the driver/ppm_events_public.h in the libs repository.

This issue will be used only for tracking.

Andreagit97 commented 1 year ago

I will add milestone 0.11.0 just to track it :) Feel free to change it /milestone 0.11.0

LucaGuerra commented 1 year ago

Hey @therealbobo , I don't think we need all of them :) Also because perhaps the types that sinsp supports are a bit too many :)

I think it makes sense to start from a minimal list and add more when necessary

therealbobo commented 1 year ago

You are right! I already started to work on it and implemented some basic types! 😄

therealbobo commented 1 year ago

/assign

FedeDP commented 1 year ago

/milestone 0.12.0

leogr commented 1 year ago

/milestone 0.13.0 assuming this is a long-term task

poiana commented 1 year ago

@leogr: The provided milestone is not valid for this repository. Milestones in this repository: [0.11.0, 0.12.0, 0.13.0, 5.0.0+driver, next-driver]

Use /milestone clear to clear the milestone.

In response to [this](https://github.com/falcosecurity/libs/issues/990#issuecomment-1532804454): >/milestone 0.13.0 assuming this is a long-term task Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.

poiana commented 10 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 9 months ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

Andreagit97 commented 9 months ago

/remove-lifecycle stale

poiana commented 8 months ago

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana commented 8 months ago

@poiana: Closing this issue.

In response to [this](https://github.com/falcosecurity/libs/issues/990#issuecomment-1793772856): >Rotten issues close after 30d of inactivity. > >Reopen the issue with `/reopen`. > >Mark the issue as fresh with `/remove-lifecycle rotten`. > >Provide feedback via https://github.com/falcosecurity/community. >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.

jasondellaluce commented 8 months ago

/remove-lifecycle rotten

poiana commented 5 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Andreagit97 commented 5 months ago

/remove-lifecycle stale

poiana commented 2 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Andreagit97 commented 2 months ago

/remove-lifecycle stale

falcosecurity / libs

Umbrella: Adding support for new field types in plugins #990