From 17ebbecec924f3459ab5a8d9ccbaf713c8a6b251 Mon Sep 17 00:00:00 2001 From: irozzo-1A Date: Tue, 10 Feb 2026 15:32:11 +0100 Subject: [PATCH] feat(userspace/engine): update libs ref and adapt to transformer AST changes - Bump default falcosecurity/libs to latest main (8f6b914) with transformer_list_expr and field_transformer_expr (values) support - Add visit(transformer_list_expr*) to filter_details_resolver and filter_macro_resolver visitors - Fix field_transformer_expr handling to use e->values instead of e->value Signed-off-by: irozzo-1A --- cmake/modules/driver.cmake | 4 ++-- cmake/modules/falcosecurity-libs.cmake | 8 ++++++-- userspace/engine/falco_engine_version.h | 4 ++-- userspace/engine/filter_details_resolver.cpp | 10 +++++++++- userspace/engine/filter_details_resolver.h | 1 + userspace/engine/filter_macro_resolver.cpp | 4 ++++ userspace/engine/filter_macro_resolver.h | 1 + 7 files changed, 25 insertions(+), 7 deletions(-) diff --git a/cmake/modules/driver.cmake b/cmake/modules/driver.cmake index fe56a806..fd437549 100644 --- a/cmake/modules/driver.cmake +++ b/cmake/modules/driver.cmake @@ -35,9 +35,9 @@ else() # FALCOSECURITY_LIBS_VERSION. In case you want to test against another driver version (or # branch, or commit) just pass the variable - ie., `cmake -DDRIVER_VERSION=dev ..` if(NOT DRIVER_VERSION) - set(DRIVER_VERSION "9.1.0+driver") + set(DRIVER_VERSION "863a274f78f59086063c34363c9b37e30cfc89b1") set(DRIVER_CHECKSUM - "SHA256=14cba5b610bf48cd0a0a94b1156ed86bfb552c7ed24b68b1028360fa3af18cbb" + "SHA256=bcd2b8c61e5d100fa0f6005e3a8ba22bef4c438bc5d4aea4b0aff344cafcbd4b" ) endif() diff --git a/cmake/modules/falcosecurity-libs.cmake b/cmake/modules/falcosecurity-libs.cmake index 4941587e..fa5d55d0 100644 --- a/cmake/modules/falcosecurity-libs.cmake +++ b/cmake/modules/falcosecurity-libs.cmake @@ -42,9 +42,9 @@ else() # version (or branch, or commit) just pass the variable - ie., `cmake # -DFALCOSECURITY_LIBS_VERSION=dev ..` if(NOT FALCOSECURITY_LIBS_VERSION) - set(FALCOSECURITY_LIBS_VERSION "0.23.1") + set(FALCOSECURITY_LIBS_VERSION "863a274f78f59086063c34363c9b37e30cfc89b1") set(FALCOSECURITY_LIBS_CHECKSUM - "SHA256=38c580626b072ed24518e8285a629923c8c4c6d6794b91b3b93474db7fd85cf7" + "SHA256=bcd2b8c61e5d100fa0f6005e3a8ba22bef4c438bc5d4aea4b0aff344cafcbd4b" ) endif() @@ -105,6 +105,10 @@ set(BUILD_LIBSCAP_EXAMPLES OFF CACHE BOOL "" ) +set(BUILD_LIBSINSP_EXAMPLES + OFF + CACHE BOOL "" +) set(USE_BUNDLED_TBB ON diff --git a/userspace/engine/falco_engine_version.h b/userspace/engine/falco_engine_version.h index c478d083..7fdf92e1 100644 --- a/userspace/engine/falco_engine_version.h +++ b/userspace/engine/falco_engine_version.h @@ -20,7 +20,7 @@ limitations under the License. // The version of this Falco engine #define FALCO_ENGINE_VERSION_MAJOR 0 -#define FALCO_ENGINE_VERSION_MINOR 58 +#define FALCO_ENGINE_VERSION_MINOR 59 #define FALCO_ENGINE_VERSION_PATCH 0 #define FALCO_ENGINE_VERSION \ @@ -36,4 +36,4 @@ limitations under the License. // It represents the fields supported by this version of Falco, // the event types, and the underlying driverevent schema. It's used to // detetect changes in engine version in our CI jobs. -#define FALCO_ENGINE_CHECKSUM "952fa3356bfd266419810be51ae659eab48093a66da26fff3897022a9de2c08c" +#define FALCO_ENGINE_CHECKSUM "2f050d44bbe902c4ca41cde1bf9f94a46705f56f38ee3a88b80c1daefa8b06b5" diff --git a/userspace/engine/filter_details_resolver.cpp b/userspace/engine/filter_details_resolver.cpp index 97b4700b..fc7eb9a2 100644 --- a/userspace/engine/filter_details_resolver.cpp +++ b/userspace/engine/filter_details_resolver.cpp @@ -125,5 +125,13 @@ void filter_details_resolver::visitor::visit(ast::field_expr* e) { void filter_details_resolver::visitor::visit(ast::field_transformer_expr* e) { m_details.transformers.insert(e->transformer); - e->value->accept(this); + for(auto& value : e->values) { + value->accept(this); + } +} + +void filter_details_resolver::visitor::visit(ast::transformer_list_expr* e) { + for(auto& child : e->children) { + child->accept(this); + } } diff --git a/userspace/engine/filter_details_resolver.h b/userspace/engine/filter_details_resolver.h index 9ddea163..e4d07e2d 100644 --- a/userspace/engine/filter_details_resolver.h +++ b/userspace/engine/filter_details_resolver.h @@ -72,6 +72,7 @@ private: void visit(libsinsp::filter::ast::binary_check_expr* e) override; void visit(libsinsp::filter::ast::field_expr* e) override; void visit(libsinsp::filter::ast::field_transformer_expr* e) override; + void visit(libsinsp::filter::ast::transformer_list_expr* e) override; filter_details& m_details; bool m_expect_list; diff --git a/userspace/engine/filter_macro_resolver.cpp b/userspace/engine/filter_macro_resolver.cpp index 56b75efb..12459ed6 100644 --- a/userspace/engine/filter_macro_resolver.cpp +++ b/userspace/engine/filter_macro_resolver.cpp @@ -105,6 +105,10 @@ void filter_macro_resolver::visitor::visit(ast::field_transformer_expr* e) { m_node_substitute = nullptr; } +void filter_macro_resolver::visitor::visit(ast::transformer_list_expr* e) { + m_node_substitute = nullptr; +} + void filter_macro_resolver::visitor::visit(ast::identifier_expr* e) { const auto& macro = m_macros.find(e->identifier); if(macro != m_macros.end() && macro->second) // skip null-ptr macros diff --git a/userspace/engine/filter_macro_resolver.h b/userspace/engine/filter_macro_resolver.h index f293715e..c64bd81a 100644 --- a/userspace/engine/filter_macro_resolver.h +++ b/userspace/engine/filter_macro_resolver.h @@ -121,6 +121,7 @@ private: void visit(libsinsp::filter::ast::binary_check_expr* e) override; void visit(libsinsp::filter::ast::field_expr* e) override; void visit(libsinsp::filter::ast::field_transformer_expr* e) override; + void visit(libsinsp::filter::ast::transformer_list_expr* e) override; }; std::vector m_errors;