More ef drop falco

userspace/libsinsp/event.cpp

@@ -2474,3 +2474,19 @@ scap_dump_flags sinsp_evt::get_dump_flags(OUT bool* should_drop)
 	return (scap_dump_flags)dflags;
 }
 #endif
+
+bool sinsp_evt::falco_consider()
+{
+	uint16_t etype = get_type();
+
+	if(etype == PPME_GENERIC_E || etype == PPME_GENERIC_X)
+	{
+		sinsp_evt_param *parinfo = get_param(0);
+		ASSERT(parinfo->m_len == sizeof(uint16_t));
+		uint16_t scid = *(uint16_t *)parinfo->m_val;
+
+		return sinsp::falco_consider_syscallid(scid);
+	}
+
+	return sinsp::falco_consider_evtnum(etype);
+}

userspace/libsinsp/event.h

@@ -325,6 +325,14 @@ class SINSP_PUBLIC sinsp_evt
 	scap_dump_flags get_dump_flags(OUT bool* should_drop);
 #endif
 
+	/*!
+	  \brief Return whether or not falco should consider this
+	  event. (Generally, these events are automatically filtered
+	  out, but some events related to internal tracking are returned by next() anyway).
+	*/
+
+	bool falco_consider();
+
 // Doxygen doesn't understand VISIBILITY_PRIVATE
 #ifdef _DOXYGEN
 private:

userspace/libsinsp/sinsp.cpp

@@ -45,7 +45,6 @@ along with sysdig.  If not, see <http://www.gnu.org/licenses/>.
 #include "analyzer.h"
 #endif
 
-extern sinsp_evttables g_infotables;
 #ifdef HAS_CHISELS
 extern vector<chiseldir_info>* g_chisel_dirs;
 #endif

userspace/libsinsp/sinsp.h

@@ -829,8 +829,27 @@ class SINSP_PUBLIC sinsp
 		return scap_get_wmi_handle(m_h);
 	}
 #endif
+
+	static inline bool falco_consider_evtnum(uint16_t etype)
+	{
+		enum ppm_event_flags flags = g_infotables.m_event_info[etype].flags;
+
+		return ! (flags & sinsp::falco_skip_flags());
+	}
+
+	static inline bool falco_consider_syscallid(uint16_t scid)
+	{
+		enum ppm_event_flags flags = g_infotables.m_syscall_info_table[scid].flags;
+
+		return ! (flags & sinsp::falco_skip_flags());
+	}
+
 VISIBILITY_PRIVATE
 
+        static inline ppm_event_flags falco_skip_flags()
+        {
+		return (ppm_event_flags) (EF_SKIPPARSERESET | EF_UNUSED | EF_OLD_VERSION | EF_DROP_FALCO);
+        }
 // Doxygen doesn't understand VISIBILITY_PRIVATE
 #ifdef _DOXYGEN
 private:

userspace/libsinsp/utils.h

@@ -37,6 +37,8 @@ typedef struct ipv4serverinfo ipv4serverinfo;
 typedef struct ipv6serverinfo ipv6serverinfo;
 class filter_check_info;
 
+extern sinsp_evttables g_infotables;
+
 ///////////////////////////////////////////////////////////////////////////////
 // Initializer class.
 // An instance of this class is created when the library is loaded.