new(libsinsp): print LIST() in markdown format for list fields

Signed-off-by: Luca Guerra <[email protected]>
falcosecurity · Oct 1, 2024 · adaabe2 · adaabe2
1 parent aeb8793
commit adaabe2
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/userspace/libsinsp/filter.cpp b/userspace/libsinsp/filter.cpp
@@ -660,6 +660,10 @@ sinsp_filter_factory::check_infos_to_fieldclass_infos(
 				info.tags.insert("ARG_ALLOWED");
 			}
 
+			if(fld->m_flags & EPF_IS_LIST) {
+				info.tags.insert("EPF_IS_LIST");
+			}
+
 			cinfo.fields.emplace_back(std::move(info));
 		}
 
@@ -679,6 +683,10 @@ bool sinsp_filter_factory::filter_field_info::is_deprecated() const {
 	return (tags.find("EPF_DEPRECATED") != tags.end());
 }
 
+bool sinsp_filter_factory::filter_field_info::is_list() const {
+	return (tags.find("EPF_IS_LIST") != tags.end());
+}
+
 uint32_t sinsp_filter_factory::filter_fieldclass_info::s_rightblock_start = 30;
 uint32_t sinsp_filter_factory::filter_fieldclass_info::s_width = 120;
 
@@ -740,7 +748,12 @@ std::string sinsp_filter_factory::filter_fieldclass_info::as_markdown(
 			continue;
 		}
 
-		os << "`" << fld_info.name << "` | " << fld_info.data_type << " | " << fld_info.desc
+		std::string data_type = fld_info.data_type;
+		if(fld_info.is_list()) {
+			data_type = "LIST(" + data_type + ")";
+		}
+
+		os << "`" << fld_info.name << "` | " << data_type << " | " << fld_info.desc
 		   << std::endl;
 	}
 

diff --git a/userspace/libsinsp/filter.h b/userspace/libsinsp/filter.h
@@ -112,6 +112,7 @@ class sinsp_filter_factory {
 
 		bool is_skippable() const;
 		bool is_deprecated() const;
+		bool is_list() const;
 	};
 
 	// Describes a group of filtercheck fields ("ka")