new: extend SEND_X and SENDTO_X

[ekoops]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR is part of #2068. Besides extending the exit events, SEND_X now also exports the socktuple. Moreover, the PR also adds scap files conversion tests for events related to the accept syscall.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[github-actions]

Perf diff from master - unit tests

    11.29%     +0.70%  [.] sinsp::next
     5.43%     +0.54%  [.] next_event_from_file
    10.30%     +0.47%  [.] sinsp_parser::reset
     0.65%     +0.43%  [.] sinsp_fdtable::find
     2.17%     -0.42%  [.] std::_Hashtable<unsigned long, std::pair<unsigned long const, std::shared_ptr<ppm_evt_hdr> >, std::allocator<std::pair<unsigned long const, std::shared_ptr<ppm_evt_hdr> > >, std::__detail::_Select1st, std::equal_to<unsigned long>, std::hash<unsigned long>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_find_before_node
     1.55%     +0.32%  [.] next
     0.44%     +0.29%  [.] sinsp_evt::is_filtered_out
     0.64%     +0.29%  [.] libsinsp::events::is_unknown_event
     1.29%     -0.28%  [.] std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char const*>
     1.60%     -0.28%  [.] libsinsp::sinsp_suppress::process_event

Heap diff from master - unit tests

peak heap memory consumption: -9.22K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: -236B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0037         -0.0037           148           148           148           148
BM_sinsp_split_median                                          -0.0052         -0.0052           148           148           148           148
BM_sinsp_split_stddev                                          -0.0401         -0.0400             1             1             1             1
BM_sinsp_split_cv                                              -0.0366         -0.0365             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0174         -0.0174            57            56            57            56
BM_sinsp_concatenate_paths_relative_path_median                -0.0146         -0.0146            57            56            57            56
BM_sinsp_concatenate_paths_relative_path_stddev                -0.7421         -0.7419             1             0             1             0
BM_sinsp_concatenate_paths_relative_path_cv                    -0.7376         -0.7373             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0002         -0.0002            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_median                   -0.0028         -0.0028            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_stddev                   +1.0227         +1.0231             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +1.0231         +1.0236             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0359         -0.0359            58            56            58            56
BM_sinsp_concatenate_paths_absolute_path_median                -0.0532         -0.0532            58            55            58            55
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.3367         -0.3364             1             1             1             1
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.3120         -0.3117             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0065         +0.0065           390           392           390           392
BM_sinsp_split_container_image_median                          +0.0085         +0.0085           390           393           390           393
BM_sinsp_split_container_image_stddev                          +0.7436         +0.7427             2             3             2             3
BM_sinsp_split_container_image_cv                              +0.7323         +0.7314             0             0             0             0

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.49%. Comparing base (3476089) to head (60d75c5).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2221      +/-   ##
==========================================
+ Coverage   75.34%   75.49%   +0.14%     
==========================================
  Files         279      281       +2     
  Lines       34368    34466      +98     
  Branches     5872     5868       -4     
==========================================
+ Hits        25894    26019     +125     
+ Misses       8474     8447      -27     

Flag	Coverage Δ
libsinsp	75.49% <100.00%> (+0.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 1c4820b2df7acbfefd9ea14ef21eab9a9700f78c

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[FedeDP]

/hold
there are old bpf verifier issues.

[poiana]

New changes are detected. LGTM label has been removed.

[FedeDP]

I triggered kernel-testing workflow against this PR : https://github.com/falcosecurity/libs/actions/runs/13070126804
Let's wait for the results!

[FedeDP]

Arm64:

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-4.14	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

Amd64:

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-4.19	🟢	🟢	🟢	🟢	❌	🟡
amazonlinux2-5.10	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2023-6.1	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.0	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.7	🟢	🟢	🟢	🟢	🟢	🟢
centos-3.10	🟢	🟢	🟢	🟡	🟡	🟡
centos-4.18	🟢	🟢	🟢	🟢	🟢	🟢
centos-5.14	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.17	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.8	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-3.10	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-4.14	🟢	🟢	🟢	🟢	🟢	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-5.4	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-4.15	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-5.8	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

There is an issue with amazonlinux 4.19 bpf :/

-- BEGIN PROG LOAD LOG --

-- END PROG LOAD LOG --
libscap: bpf_load_program() event=raw_tracepoint/filler/sys_sendto_x: Operation not permitted (1)