From 5b53681d2fd6bbb39096bdd8b8d3caf3ab384fab Mon Sep 17 00:00:00 2001 From: irozzo-1A Date: Tue, 25 Nov 2025 16:46:24 +0100 Subject: [PATCH] chore(engine): add deprecation warning for evt.latency when used in conditions Emit a deprecation warning when `evt.latency` is detected in a rule condition. Signed-off-by: irozzo-1A --- userspace/engine/falco_load_result.cpp | 18 ++++++++++++++++-- userspace/engine/falco_load_result.h | 10 +++++++++- userspace/engine/rule_loader.h | 3 +-- 3 files changed, 26 insertions(+), 5 deletions(-) diff --git a/userspace/engine/falco_load_result.cpp b/userspace/engine/falco_load_result.cpp index 86bb6e39..496b28ec 100644 --- a/userspace/engine/falco_load_result.cpp +++ b/userspace/engine/falco_load_result.cpp @@ -143,7 +143,12 @@ const std::string& falco::load_result::warning_desc(warning_code wc) { return warning_descs[static_cast(wc)]; } -static const std::string deprecated_fields[] = {"evt.dir"}; +static const std::string deprecated_fields[] = {"evt.dir", + "evt.latency", + "evt.latency.s", + "evt.latency.ns", + "evt.latency.human", + "evt.wait_latency"}; // Compile-time check to ensure deprecated_fields array has the correct size static_assert( @@ -155,10 +160,19 @@ const std::string& falco::load_result::deprecated_field_str(deprecated_field df) return deprecated_fields[static_cast(df)]; } +// Shared description suffix for latency fields +static const std::string latency_field_desc_suffix = + "field is not available due to the drop of enter events."; + static const std::string deprecated_field_descs[] = { "due to the drop of enter events, 'evt.dir = <' always evaluates to true, and 'evt.dir = " ">' always evaluates to false. The rule expression can be simplified by removing the " - "condition on 'evt.dir'"}; + "condition on 'evt.dir'", + latency_field_desc_suffix, + latency_field_desc_suffix, + latency_field_desc_suffix, + latency_field_desc_suffix, + latency_field_desc_suffix}; // Compile-time check to ensure deprecated_field_descs array has the correct size static_assert( diff --git a/userspace/engine/falco_load_result.h b/userspace/engine/falco_load_result.h index 25c4fe84..733f44e8 100644 --- a/userspace/engine/falco_load_result.h +++ b/userspace/engine/falco_load_result.h @@ -75,7 +75,15 @@ public: // impact. static const std::string& warning_desc(warning_code ec); - enum class deprecated_field { DEPRECATED_FIELD_EVT_DIR, DEPRECATED_FIELD_NOT_FOUND }; + enum class deprecated_field { + DEPRECATED_FIELD_EVT_DIR, + DEPRECATED_FIELD_EVT_LATENCY, + DEPRECATED_FIELD_EVT_LATENCY_S, + DEPRECATED_FIELD_EVT_LATENCY_NS, + DEPRECATED_FIELD_EVT_LATENCY_HUMAN, + DEPRECATED_FIELD_EVT_WAIT_LATENCY, + DEPRECATED_FIELD_NOT_FOUND + }; // The deprecated field as a string static const std::string& deprecated_field_str(deprecated_field df); diff --git a/userspace/engine/rule_loader.h b/userspace/engine/rule_loader.h index 9d77d097..dec16321 100644 --- a/userspace/engine/rule_loader.h +++ b/userspace/engine/rule_loader.h @@ -215,8 +215,7 @@ struct deprecated_field_warning : warning { df(df) {} std::string as_string() const override { - return warning::as_string() + ": field '" + falco::load_result::deprecated_field_str(df) + - "' is deprecated"; + return warning::as_string() + ": field '" + falco::load_result::deprecated_field_str(df); }; std::string description() const override { return warning::description() + ": " + falco::load_result::deprecated_field_desc(df);