diff --git a/userspace/libscap/engine/bpf/scap_bpf.c b/userspace/libscap/engine/bpf/scap_bpf.c index 60d794f39e..c0638efd9c 100644 --- a/userspace/libscap/engine/bpf/scap_bpf.c +++ b/userspace/libscap/engine/bpf/scap_bpf.c @@ -1661,7 +1661,7 @@ int32_t scap_bpf_load( return SCAP_SUCCESS; } -int32_t scap_bpf_get_stats(struct scap_engine_handle engine, OUT scap_stats* stats) +int32_t scap_bpf_get_stats(struct scap_engine_handle engine, scap_stats* stats) { struct bpf_engine *handle = engine.m_handle; int j; @@ -1703,7 +1703,7 @@ int32_t scap_bpf_get_stats(struct scap_engine_handle engine, OUT scap_stats* sta return SCAP_SUCCESS; } -const struct metrics_v2* scap_bpf_get_stats_v2(struct scap_engine_handle engine, uint32_t flags, OUT uint32_t* nstats, OUT int32_t* rc) +const struct metrics_v2* scap_bpf_get_stats_v2(struct scap_engine_handle engine, uint32_t flags, uint32_t* nstats, int32_t* rc) { struct bpf_engine *handle = engine.m_handle; int ret; @@ -1879,7 +1879,7 @@ int32_t scap_bpf_get_n_tracepoint_hit(struct scap_engine_handle engine, long* re return SCAP_SUCCESS; } -static int32_t next(struct scap_engine_handle engine, OUT scap_evt **pevent, OUT uint16_t *pdevid, OUT uint32_t *pflags) +static int32_t next(struct scap_engine_handle engine, scap_evt **pevent, uint16_t *pdevid, uint32_t *pflags) { return ringbuffer_next(&engine.m_handle->m_dev_set, pevent, pdevid, pflags); } diff --git a/userspace/libscap/engine/kmod/scap_kmod.c b/userspace/libscap/engine/kmod/scap_kmod.c index aa2cdde46a..b280093307 100644 --- a/userspace/libscap/engine/kmod/scap_kmod.c +++ b/userspace/libscap/engine/kmod/scap_kmod.c @@ -526,8 +526,8 @@ int32_t scap_kmod_close(struct scap_engine_handle engine) return SCAP_SUCCESS; } -int32_t scap_kmod_next(struct scap_engine_handle engine, OUT scap_evt **pevent, OUT uint16_t *pdevid, - OUT uint32_t *pflags) +int32_t scap_kmod_next(struct scap_engine_handle engine, scap_evt **pevent, uint16_t *pdevid, + uint32_t *pflags) { return ringbuffer_next(&engine.m_handle->m_dev_set, pevent, pdevid, pflags); } @@ -578,7 +578,7 @@ int32_t scap_kmod_get_stats(struct scap_engine_handle engine, scap_stats* stats) return SCAP_SUCCESS; } -const struct metrics_v2* scap_kmod_get_stats_v2(struct scap_engine_handle engine, uint32_t flags, OUT uint32_t* nstats, OUT int32_t* rc) +const struct metrics_v2* scap_kmod_get_stats_v2(struct scap_engine_handle engine, uint32_t flags, uint32_t* nstats, int32_t* rc) { struct kmod_engine *handle = engine.m_handle; struct scap_device_set *devset = &handle->m_dev_set; diff --git a/userspace/libscap/engine/modern_bpf/scap_modern_bpf.c b/userspace/libscap/engine/modern_bpf/scap_modern_bpf.c index 50826401e5..cc338de9b9 100644 --- a/userspace/libscap/engine/modern_bpf/scap_modern_bpf.c +++ b/userspace/libscap/engine/modern_bpf/scap_modern_bpf.c @@ -49,8 +49,8 @@ static void scap_modern_bpf__free_engine(struct scap_engine_handle engine) /* The third parameter is not the CPU number from which we extract the event but the ring buffer number. * For the old BPF probe and the kernel module the number of CPUs is equal to the number of buffers since we always use a per-CPU approach. */ -static int32_t scap_modern_bpf__next(struct scap_engine_handle engine, OUT scap_evt** pevent, OUT uint16_t* buffer_id, - OUT uint32_t* pflags) +static int32_t scap_modern_bpf__next(struct scap_engine_handle engine, scap_evt** pevent, uint16_t* buffer_id, + uint32_t* pflags) { pman_consume_first_event((void**)pevent, (int16_t*)buffer_id); @@ -250,7 +250,7 @@ static uint32_t scap_modern_bpf__get_n_devs(struct scap_engine_handle engine) return pman_get_required_buffers(); } -int32_t scap_modern_bpf__get_stats(struct scap_engine_handle engine, OUT scap_stats* stats) +int32_t scap_modern_bpf__get_stats(struct scap_engine_handle engine, scap_stats* stats) { if(pman_get_scap_stats(stats)) { @@ -259,7 +259,7 @@ int32_t scap_modern_bpf__get_stats(struct scap_engine_handle engine, OUT scap_st return SCAP_SUCCESS; } -const struct metrics_v2* scap_modern_bpf__get_stats_v2(struct scap_engine_handle engine, uint32_t flags, OUT uint32_t* nstats, OUT int32_t* rc) +const struct metrics_v2* scap_modern_bpf__get_stats_v2(struct scap_engine_handle engine, uint32_t flags, uint32_t* nstats, int32_t* rc) { struct modern_bpf_engine* handle = engine.m_handle; if (!(handle->m_flags & ENGINE_FLAG_BPF_STATS_ENABLED)) @@ -270,7 +270,7 @@ const struct metrics_v2* scap_modern_bpf__get_stats_v2(struct scap_engine_handle return pman_get_metrics_v2(flags, nstats, rc); } -int32_t scap_modern_bpf__get_n_tracepoint_hit(struct scap_engine_handle engine, OUT long* ret) +int32_t scap_modern_bpf__get_n_tracepoint_hit(struct scap_engine_handle engine, long* ret) { if(pman_get_n_tracepoint_hit(ret)) { diff --git a/userspace/libscap/engine/source_plugin/source_plugin.c b/userspace/libscap/engine/source_plugin/source_plugin.c index 760c7645fb..7e15857de5 100644 --- a/userspace/libscap/engine/source_plugin/source_plugin.c +++ b/userspace/libscap/engine/source_plugin/source_plugin.c @@ -156,7 +156,7 @@ static int close_engine(struct scap_engine_handle engine) return SCAP_SUCCESS; } -static int32_t next(struct scap_engine_handle engine, OUT scap_evt** pevent, OUT uint16_t* pdevid, OUT uint32_t* pflags) +static int32_t next(struct scap_engine_handle engine, scap_evt** pevent, uint16_t* pdevid, uint32_t* pflags) { struct source_plugin_engine *handle = engine.m_handle; char *lasterr = engine.m_handle->m_lasterr; @@ -267,14 +267,14 @@ static int32_t next(struct scap_engine_handle engine, OUT scap_evt** pevent, OUT return SCAP_SUCCESS; } -static int32_t get_stats(struct scap_engine_handle engine, OUT scap_stats* stats) +static int32_t get_stats(struct scap_engine_handle engine, scap_stats* stats) { struct source_plugin_engine *handle = engine.m_handle; stats->n_evts = handle->m_nevts; return SCAP_SUCCESS; } -const struct metrics_v2* get_source_plugin_stats_v2(struct scap_engine_handle engine, uint32_t flags, OUT uint32_t* nstats, OUT int32_t* rc) +const struct metrics_v2* get_source_plugin_stats_v2(struct scap_engine_handle engine, uint32_t flags, uint32_t* nstats, int32_t* rc) { struct source_plugin_engine *handle = engine.m_handle; *nstats = MAX_SOURCE_PLUGIN_COUNTERS_STATS; diff --git a/userspace/libscap/examples/02-validatebuffer/test.c b/userspace/libscap/examples/02-validatebuffer/test.c index 0f88b68f1e..bc2fec556e 100644 --- a/userspace/libscap/examples/02-validatebuffer/test.c +++ b/userspace/libscap/examples/02-validatebuffer/test.c @@ -46,7 +46,7 @@ size_t g_get_event_size(ppm_event_code event_type, uint16_t* lens) #endif } -int32_t g_check_integrity(uint32_t* cur_event, char* copy_buffer, int buf_len, OUT uint32_t* nevents) +int32_t g_check_integrity(uint32_t* cur_event, char* copy_buffer, int buf_len, uint32_t* nevents) { uint32_t offset = 0; *nevents = 0; diff --git a/userspace/libscap/linux/scap_ppm_sc.c b/userspace/libscap/linux/scap_ppm_sc.c index cc391610b2..edd25edcd0 100644 --- a/userspace/libscap/linux/scap_ppm_sc.c +++ b/userspace/libscap/linux/scap_ppm_sc.c @@ -462,7 +462,7 @@ static const ppm_sc_code *g_events_to_sc_map[] = { _Static_assert(sizeof(g_events_to_sc_map) / sizeof(*g_events_to_sc_map) == PPM_EVENT_MAX, "Missing entries in g_events_to_sc_map table."); #endif -int scap_get_modifies_state_ppm_sc(OUT uint8_t ppm_sc_array[PPM_SC_MAX]) +int scap_get_modifies_state_ppm_sc(uint8_t ppm_sc_array[PPM_SC_MAX]) { if(ppm_sc_array == NULL) { @@ -500,7 +500,7 @@ int scap_get_modifies_state_ppm_sc(OUT uint8_t ppm_sc_array[PPM_SC_MAX]) return SCAP_SUCCESS; } -int scap_get_events_from_ppm_sc(IN const uint8_t ppm_sc_array[PPM_SC_MAX], OUT uint8_t events_array[PPM_EVENT_MAX]) +int scap_get_events_from_ppm_sc(const uint8_t ppm_sc_array[PPM_SC_MAX], uint8_t events_array[PPM_EVENT_MAX]) { if(ppm_sc_array == NULL || events_array == NULL) { @@ -531,7 +531,7 @@ int scap_get_events_from_ppm_sc(IN const uint8_t ppm_sc_array[PPM_SC_MAX], OUT u return SCAP_SUCCESS; } -int scap_get_ppm_sc_from_events(IN const uint8_t events_array[PPM_EVENT_MAX], OUT uint8_t ppm_sc_array[PPM_SC_MAX]) +int scap_get_ppm_sc_from_events(const uint8_t events_array[PPM_EVENT_MAX], uint8_t ppm_sc_array[PPM_SC_MAX]) { if (events_array == NULL || ppm_sc_array == NULL) { diff --git a/userspace/libscap/ringbuffer/ringbuffer.h b/userspace/libscap/ringbuffer/ringbuffer.h index baa488ae0b..a4beef5d11 100644 --- a/userspace/libscap/ringbuffer/ringbuffer.h +++ b/userspace/libscap/ringbuffer/ringbuffer.h @@ -86,7 +86,11 @@ static inline void ringbuffer_advance_tail(struct scap_device* dev) #ifndef READBUF #define READBUF ringbuffer_readbuf -static inline int32_t ringbuffer_readbuf(struct scap_device *dev, OUT char** buf, OUT uint32_t* len) +/** + * \param buf [out] buffer holding the returned data + * \param len [out] number of bytes read into buf + */ +static inline int32_t ringbuffer_readbuf(struct scap_device *dev, char** buf, uint32_t* len) { uint64_t thead; uint64_t ttail; @@ -197,22 +201,30 @@ static inline void ringbuffer_advance_to_evt(scap_device* dev, scap_evt *event) } #endif -/* The flow here is: +/** + * \brief Get next event in the ringbuffer + * + * The flow here is: * - For every buffer, read how many data are available and save the pointer + its length. (this is what we call a block) * - Consume from all these blocks the event with the lowest timestamp. (repeat until all the blocks are empty!) * When we have read all the data from a buffer block, update the consumer position for that buffer, and wait * for all the other buffer blocks to be read. * - When we have consumed all the blocks we are ready to read again a new block for every buffer - * + * * Possible pain points: * - if the buffers are not full enough we sleep and this could be dangerous in this situation! * - we increase the consumer position only when we have consumed the entire block, but if the block * is huge we could cause several drops. * - before refilling a buffer we have to consume all the others! * - we perform a lot of cycles but we have to be super fast here! + * + * \param pevent [out] where the pointer to the next event gets stored + * \param pdevid [out] where the device on which the event was received + * gets stored + * \param pflags [out] where the flags for the event get stored */ -static inline int32_t ringbuffer_next(struct scap_device_set* devset, OUT scap_evt** pevent, OUT uint16_t* pdevid, - OUT uint32_t* pflags) +static inline int32_t ringbuffer_next(struct scap_device_set* devset, scap_evt** pevent, uint16_t* pdevid, + uint32_t* pflags) { uint32_t j; uint64_t min_ts = 0xffffffffffffffffLL; diff --git a/userspace/libscap/scap.c b/userspace/libscap/scap.c index 5c430128b5..04a83aeaca 100644 --- a/userspace/libscap/scap.c +++ b/userspace/libscap/scap.c @@ -211,7 +211,7 @@ uint32_t scap_get_ndevs(scap_t* handle) return 1; } -int32_t scap_readbuf(scap_t* handle, uint32_t cpuid, OUT char** buf, OUT uint32_t* len) +int32_t scap_readbuf(scap_t* handle, uint32_t cpuid, char** buf, uint32_t* len) { // engines do not even necessarily have a concept of a buffer // that you read events from @@ -227,7 +227,7 @@ uint64_t scap_max_buf_used(scap_t* handle) return 0; } -int32_t scap_next(scap_t* handle, OUT scap_evt** pevent, OUT uint16_t* pdevid, OUT uint32_t* pflags) +int32_t scap_next(scap_t* handle, scap_evt** pevent, uint16_t* pdevid, uint32_t* pflags) { // Note: devid is like cpuid but not 1:1, e.g. consider CPU1 offline: // CPU0 CPU1 CPU2 CPU3 @@ -254,7 +254,7 @@ int32_t scap_next(scap_t* handle, OUT scap_evt** pevent, OUT uint16_t* pdevid, O // // Return the number of dropped events for the given handle. // -int32_t scap_get_stats(scap_t* handle, OUT scap_stats* stats) +int32_t scap_get_stats(scap_t* handle, scap_stats* stats) { if(!handle || stats == NULL) { @@ -297,7 +297,7 @@ int32_t scap_get_stats(scap_t* handle, OUT scap_stats* stats) // // Return engine statistics (including counters and `bpftool prog show` like stats) // -const struct metrics_v2* scap_get_stats_v2(scap_t* handle, uint32_t flags, OUT uint32_t* nstats, OUT int32_t* rc) +const struct metrics_v2* scap_get_stats_v2(scap_t* handle, uint32_t flags, uint32_t* nstats, int32_t* rc) { if(handle && handle->m_vtable) { diff --git a/userspace/libscap/scap.h b/userspace/libscap/scap.h index ea513f4140..56be5c1d70 100644 --- a/userspace/libscap/scap.h +++ b/userspace/libscap/scap.h @@ -459,13 +459,6 @@ typedef struct scap_const_sized_buffer scap_const_sized_buffer; /*@}*/ -/////////////////////////////////////////////////////////////////////////////// -// Structs and defines used internally -/////////////////////////////////////////////////////////////////////////////// - -#define IN -#define OUT - /////////////////////////////////////////////////////////////////////////////// // API functions /////////////////////////////////////////////////////////////////////////////// @@ -566,17 +559,17 @@ uint64_t scap_max_buf_used(scap_t* handle); \brief Get the next event from the from the given capture instance \param handle Handle to the capture instance. - \param pevent User-provided event pointer that will be initialized with address of the event. - \param pdevid User-provided event pointer that will be initialized with the ID of the device + \param pevent [out] User-provided event pointer that will be initialized with address of the event. + \param pdevid [out] User-provided event pointer that will be initialized with the ID of the device where the event was captured. - \param pflags User-provided event pointer that will be initialized with the flags of the event. + \param pflags [out] User-provided event pointer that will be initialized with the flags of the event. \return SCAP_SUCCESS if the call is successful and pevent, pcpuid and pflags contain valid data. SCAP_TIMEOUT in case the read timeout expired and no event is available. SCAP_EOF when the end of an offline capture is reached. On Failure, SCAP_FAILURE is returned and scap_getlasterr() can be used to obtain the cause of the error. */ -int32_t scap_next(scap_t* handle, OUT scap_evt** pevent, OUT uint16_t* pcpuid, OUT uint32_t* pflags); +int32_t scap_next(scap_t* handle, scap_evt** pevent, uint16_t* pcpuid, uint32_t* pflags); /*! \brief Get the length of an event @@ -636,41 +629,49 @@ int64_t scap_get_readfile_offset(scap_t* handle); \brief Return the capture statistics for the given capture handle. \param handle Handle to the capture instance. - \param stats Pointer to a \ref scap_stats structure that will be filled with the + \param stats [out] Pointer to a \ref scap_stats structure that will be filled with the statistics. \return SCAP_SECCESS if the call is successful. On Failure, SCAP_FAILURE is returned and scap_getlasterr() can be used to obtain the cause of the error. */ -int32_t scap_get_stats(scap_t* handle, OUT scap_stats* stats); +int32_t scap_get_stats(scap_t* handle, scap_stats* stats); /*! \brief Get engine statistics (including counters and `bpftool prog show` like stats) \param handle Handle to the capture instance. \param flags holding statistics category flags. - \param nstats Pointer reflecting number of statistics in returned buffer. - \param rc Pointer to return code. + \param nstats [out] Pointer reflecting number of statistics in returned buffer. + \param rc [out] Pointer to return code. \return Pointer to a \ref metrics_v2 structure filled with the statistics. */ -const struct metrics_v2* scap_get_stats_v2(scap_t* handle, uint32_t flags, OUT uint32_t* nstats, OUT int32_t* rc); +const struct metrics_v2* scap_get_stats_v2(scap_t* handle, uint32_t flags, uint32_t* nstats, int32_t* rc); /*! \brief Returns the set of ppm_sc whose events have EF_MODIFIES_STATE flag or whose syscall have UF_NEVER_DROP flag. + + \param ppm_sc_array [out] the array of ppm_sc that had their state modified */ -int scap_get_modifies_state_ppm_sc(OUT uint8_t ppm_sc_array[PPM_SC_MAX]); +int scap_get_modifies_state_ppm_sc(uint8_t ppm_sc_array[PPM_SC_MAX]); /*! \brief Take an array of `ppm_sc` as input and provide the associated array of events as output. + + \param ppm_sc_array [in] the `ppm_sc` to look for + \param events_array [out] the array of events associated to the provided `ppm_sc`s */ -int scap_get_events_from_ppm_sc(IN const uint8_t ppm_sc_array[PPM_SC_MAX], OUT uint8_t events_array[PPM_EVENT_MAX]); +int scap_get_events_from_ppm_sc(const uint8_t ppm_sc_array[PPM_SC_MAX], uint8_t events_array[PPM_EVENT_MAX]); /*! \brief Take an array of `ppm_event_code` as input and provide the associated array of ppm_sc as output. + + \param events_array [in] the array of events to look for + \param ppm_sc_array [out] the array of `ppm_sc`s associated to the provided events */ -int scap_get_ppm_sc_from_events(IN const uint8_t events_array[PPM_EVENT_MAX], OUT uint8_t ppm_sc_array[PPM_SC_MAX]); +int scap_get_ppm_sc_from_events(const uint8_t events_array[PPM_EVENT_MAX], uint8_t ppm_sc_array[PPM_SC_MAX]); /*! \brief Given a name, returns associated ppm_sc. @@ -856,8 +857,13 @@ uint64_t scap_get_engine_flags(scap_t* handle); // uint32_t scap_get_ndevs(scap_t* handle); -// Retrieve a buffer of events from one of the cpus -extern int32_t scap_readbuf(scap_t* handle, uint32_t cpuid, OUT char** buf, OUT uint32_t* len); +/* + * \brief Retrieve a buffer of events from one of the cpus + * + * \param buf [out] buffer holding the returned events + * \param len [out] number of bytes read into buf + */ +extern int32_t scap_readbuf(scap_t* handle, uint32_t cpuid, char** buf, uint32_t* len); #ifdef PPM_ENABLE_SENTINEL // Get the sentinel at the beginning of the event diff --git a/userspace/libscap/scap_vtable.h b/userspace/libscap/scap_vtable.h index 07cfd8cf41..c69373222f 100644 --- a/userspace/libscap/scap_vtable.h +++ b/userspace/libscap/scap_vtable.h @@ -208,7 +208,7 @@ struct scap_vtable { /** * @brief get engine statistics * @param engine wraps the pointer to the engine-specific handle - * @param stats the stats struct to be filled + * @param stats [out] the stats struct to be filled * @return SCAP_SUCCESS or a failure code */ int32_t (*get_stats)(struct scap_engine_handle engine, struct scap_stats *stats); @@ -216,8 +216,8 @@ struct scap_vtable { /** * @brief get engine statistics (including counters and `bpftool prog show` like stats) * @param flags holding statistics category flags - * @param nstats Pointer reflecting number of statistics in returned buffer - * @param rc Pointer to return code + * @param nstats [out] Pointer reflecting number of statistics in returned buffer + * @param rc [out] Pointer to return code * @return Pointer to a \ref metrics_v2 structure filled with the statistics */ const struct metrics_v2* (*get_stats_v2)(struct scap_engine_handle engine, uint32_t flags, uint32_t* nstats, int32_t* rc); diff --git a/userspace/libsinsp/event.cpp b/userspace/libsinsp/event.cpp index d36ffb3ed7..6b66e041b6 100644 --- a/userspace/libsinsp/event.cpp +++ b/userspace/libsinsp/event.cpp @@ -825,7 +825,7 @@ std::string sinsp_evt::get_base_dir(uint32_t id, sinsp_threadinfo *tinfo) return rel_path_base; } -const char* sinsp_evt::get_param_as_str(uint32_t id, OUT const char** resolved_str, sinsp_evt::param_fmt fmt) +const char* sinsp_evt::get_param_as_str(uint32_t id, const char** resolved_str, sinsp_evt::param_fmt fmt) { char* prfmt = NULL; const ppm_param_info* param_info = NULL; @@ -1852,7 +1852,7 @@ std::string sinsp_evt::get_param_value_str(uint32_t i, bool resolved) } } -const char* sinsp_evt::get_param_value_str(std::string_view name, OUT const char** resolved_str, param_fmt fmt) +const char* sinsp_evt::get_param_value_str(std::string_view name, const char** resolved_str, param_fmt fmt) { for(uint32_t i = 0; i < get_num_params(); i++) { @@ -1866,7 +1866,7 @@ const char* sinsp_evt::get_param_value_str(std::string_view name, OUT const char return NULL; } -void sinsp_evt::get_category(OUT sinsp_evt::category* cat) const +void sinsp_evt::get_category(sinsp_evt::category* cat) const { /* We always search the category inside the event table */ cat->m_category = get_category(); @@ -1940,7 +1940,7 @@ bool sinsp_evt::is_filtered_out() const return m_filtered_out; } -scap_dump_flags sinsp_evt::get_dump_flags(OUT bool* should_drop) const +scap_dump_flags sinsp_evt::get_dump_flags(bool* should_drop) const { uint32_t dflags = SCAP_DF_NONE; *should_drop = false; diff --git a/userspace/libsinsp/event.h b/userspace/libsinsp/event.h index e8d6ff0c15..cfcbaf819d 100644 --- a/userspace/libsinsp/event.h +++ b/userspace/libsinsp/event.h @@ -476,14 +476,20 @@ class SINSP_PUBLIC sinsp_evt /*! \brief Return the event's category, based on the event type and the FD on which the event operates. + + \param cat [out] the category for the event */ - void get_category(OUT sinsp_evt::category* cat) const; + void get_category(sinsp_evt::category* cat) const; /*! \brief Return true if the event has been rejected by the filtering system. */ bool is_filtered_out() const; - scap_dump_flags get_dump_flags(OUT bool* should_drop) const; + + /*! + \param should_drop [out] flag indicating if the event should be dropped + */ + scap_dump_flags get_dump_flags(bool* should_drop) const; /*! \brief Returns true if this event represents a system call error, @@ -522,9 +528,15 @@ class SINSP_PUBLIC sinsp_evt std::string get_base_dir(uint32_t id, sinsp_threadinfo*); - const char* get_param_as_str(uint32_t id, OUT const char** resolved_str, param_fmt fmt = PF_NORMAL); + /*! + \param resolved_str [out] the string representation of the parameter + */ + const char* get_param_as_str(uint32_t id, const char** resolved_str, param_fmt fmt = PF_NORMAL); - const char* get_param_value_str(std::string_view name, OUT const char** resolved_str, param_fmt fmt = PF_NORMAL); + /*! + \param resolved_str [out] the string representation of the parameter + */ + const char* get_param_value_str(std::string_view name, const char** resolved_str, param_fmt fmt = PF_NORMAL); inline void init_keep_threadinfo() { diff --git a/userspace/libsinsp/eventformatter.cpp b/userspace/libsinsp/eventformatter.cpp index 9f347e9127..d1a2132ff6 100644 --- a/userspace/libsinsp/eventformatter.cpp +++ b/userspace/libsinsp/eventformatter.cpp @@ -187,7 +187,7 @@ void sinsp_evt_formatter::set_format(output_format of, const std::string& fmt) // apply all transformers and pop back their ')' enclosing token // note: we apply transformers in reserve order to preserve their semantics - for (auto rit = transformers.rbegin(); rit != transformers.rend(); ++rit) + for (auto rit = transformers.rbegin(); rit != transformers.rend(); ++rit) { chk->add_transformer(*rit); @@ -199,7 +199,7 @@ void sinsp_evt_formatter::set_format(output_format of, const std::string& fmt) j++; msize++; // count ')' } - + // when requested to do so, we'll resolve the field with transformers // in addition to the non-transformed version m_resolution_tokens.emplace_back(std::string(tstart, fsize + msize), chk, true); diff --git a/userspace/libsinsp/eventformatter.h b/userspace/libsinsp/eventformatter.h index 213c3dc8f7..001e4eef99 100644 --- a/userspace/libsinsp/eventformatter.h +++ b/userspace/libsinsp/eventformatter.h @@ -83,12 +83,12 @@ class SINSP_PUBLIC sinsp_evt_formatter \brief Fills res with the string rendering of the event. \param evt Pointer to the event to be converted into string. - \param res Pointer to the string that will be filled with the result. + \param res [out] Pointer to the string that will be filled with the result. \return true if the string should be shown (based on the initial *), false otherwise. */ - inline bool tostring(sinsp_evt* evt, OUT std::string* res) + inline bool tostring(sinsp_evt* evt, std::string* res) { if (!res) { diff --git a/userspace/libsinsp/plugin_filtercheck.cpp b/userspace/libsinsp/plugin_filtercheck.cpp index 83fb636e76..0d46ee4c9d 100755 --- a/userspace/libsinsp/plugin_filtercheck.cpp +++ b/userspace/libsinsp/plugin_filtercheck.cpp @@ -126,7 +126,7 @@ std::unique_ptr sinsp_filter_check_plugin::allocate_new() return std::make_unique(*this); } -bool sinsp_filter_check_plugin::extract(sinsp_evt *evt, OUT std::vector& values, bool sanitize_strings) +bool sinsp_filter_check_plugin::extract(sinsp_evt *evt, std::vector& values, bool sanitize_strings) { // reject the event if it comes from an unknown event source if (evt->get_source_idx() == sinsp_no_event_source_idx) diff --git a/userspace/libsinsp/plugin_filtercheck.h b/userspace/libsinsp/plugin_filtercheck.h index 83ab7e5b4d..ce77ac63c5 100755 --- a/userspace/libsinsp/plugin_filtercheck.h +++ b/userspace/libsinsp/plugin_filtercheck.h @@ -50,7 +50,7 @@ class sinsp_filter_check_plugin : public sinsp_filter_check bool extract( sinsp_evt *evt, - OUT std::vector& values, + std::vector& values, bool sanitize_strings = true) override; private: diff --git a/userspace/libsinsp/sinsp.cpp b/userspace/libsinsp/sinsp.cpp index ceed2ba1ec..59068466a5 100644 --- a/userspace/libsinsp/sinsp.cpp +++ b/userspace/libsinsp/sinsp.cpp @@ -1155,7 +1155,7 @@ int32_t sinsp::fetch_next_event(sinsp_evt*& evt) return res; } -int32_t sinsp::next(OUT sinsp_evt **puevt) +int32_t sinsp::next(sinsp_evt **puevt) { *puevt = NULL; sinsp_evt* evt = &m_evt; @@ -1895,7 +1895,7 @@ double sinsp::get_read_progress_file() const return (double)fpos * 100 / m_filesize; } -void sinsp::get_read_progress_plugin(OUT double* nres, std::string* sres) const +void sinsp::get_read_progress_plugin(double* nres, std::string* sres) const { ASSERT(nres != NULL); ASSERT(sres != NULL); @@ -1932,7 +1932,7 @@ double sinsp::get_read_progress() const } } -double sinsp::get_read_progress_with_str(OUT std::string* progress_str) const +double sinsp::get_read_progress_with_str(std::string* progress_str) const { if(is_plugin()) { diff --git a/userspace/libsinsp/sinsp.h b/userspace/libsinsp/sinsp.h index 2f470d8b6e..36ab305060 100644 --- a/userspace/libsinsp/sinsp.h +++ b/userspace/libsinsp/sinsp.h @@ -196,7 +196,7 @@ class SINSP_PUBLIC sinsp : public capture_stats_source /*! \brief Get the next event from the open capture source - \param evt a \ref sinsp_evt pointer that will be initialized to point to + \param evt [out] a \ref sinsp_evt pointer that will be initialized to point to the next available event. \return SCAP_SUCCESS if the call is successful and pevent and pcpuid contain @@ -208,7 +208,7 @@ class SINSP_PUBLIC sinsp : public capture_stats_source \note: the returned event can be considered valid only until the next call to \ref) */ - virtual int32_t next(OUT sinsp_evt **evt); + virtual int32_t next(sinsp_evt **evt); /*! \brief Get the maximum number of bytes currently in use by any CPU buffer @@ -842,8 +842,10 @@ class SINSP_PUBLIC sinsp : public capture_stats_source \brief When reading events from a trace file or a plugin, this function returns the read progress as a number and as a string, giving the plugins flexibility on the format. + + \param progress_str [out] a string representation of progress for plugins */ - double get_read_progress_with_str(OUT std::string* progress_str) const; + double get_read_progress_with_str(std::string* progress_str) const; /*! \brief Make the amount of data gathered for a syscall to be @@ -1140,7 +1142,7 @@ class SINSP_PUBLIC sinsp : public capture_stats_source } double get_read_progress_file() const; - void get_read_progress_plugin(OUT double* nres, std::string* sres) const; + void get_read_progress_plugin(double* nres, std::string* sres) const; void get_procs_cpu_from_driver(uint64_t ts); diff --git a/userspace/libsinsp/sinsp_filtercheck.cpp b/userspace/libsinsp/sinsp_filtercheck.cpp index bcda243dea..5bbd85b626 100644 --- a/userspace/libsinsp/sinsp_filtercheck.cpp +++ b/userspace/libsinsp/sinsp_filtercheck.cpp @@ -1657,7 +1657,7 @@ bool sinsp_filter_check::compare_rhs(cmpop op, ppm_param_type type, const void* } } -bool sinsp_filter_check::extract_nocache(sinsp_evt *evt, OUT std::vector& values, bool sanitize_strings) +bool sinsp_filter_check::extract_nocache(sinsp_evt *evt, std::vector& values, bool sanitize_strings) { values.clear(); extract_value_t val; @@ -1670,12 +1670,12 @@ bool sinsp_filter_check::extract_nocache(sinsp_evt *evt, OUT std::vector& values, bool sanitize_strings) +bool sinsp_filter_check::extract(sinsp_evt *evt, std::vector& values, bool sanitize_strings) { if(m_cache_metrics != NULL) { diff --git a/userspace/libsinsp/sinsp_filtercheck.h b/userspace/libsinsp/sinsp_filtercheck.h index 0695172437..c39a7b7db2 100644 --- a/userspace/libsinsp/sinsp_filtercheck.h +++ b/userspace/libsinsp/sinsp_filtercheck.h @@ -292,13 +292,15 @@ class sinsp_filter_check } // - // Extract the field from the event. In sanitize_strings is true, any + // Extract the field from the event. If sanitize_strings is true, any // string values are sanitized to remove nonprintable characters. // By default, this fills the vector with only one value, retireved by calling the single-result // extract method. // If a NULL value is returned by extract, the vector is emptied. // Subclasses are meant to either override this, or the single-valued extract method. - virtual bool extract(sinsp_evt*, OUT std::vector& values, bool sanitize_strings = true); + // + // \param values [out] the values extracted from the filter check + virtual bool extract(sinsp_evt*, std::vector& values, bool sanitize_strings = true); // // Compare the field with the constant value obtained from parse_filter_value() @@ -333,7 +335,7 @@ class sinsp_filter_check protected: virtual bool compare_nocache(sinsp_evt*); - virtual Json::Value extract_as_js(sinsp_evt*, OUT uint32_t* len) + virtual Json::Value extract_as_js(sinsp_evt*, uint32_t* len) { return Json::nullValue; } @@ -349,8 +351,11 @@ class sinsp_filter_check // This is a single-value version of extract for subclasses non supporting extracting // multiple values. By default, this returns NULL. // Subclasses are meant to either override this, or the multi-valued extract method. - bool extract_nocache(sinsp_evt *evt, OUT std::vector& values, bool sanitize_strings = true); - virtual uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true); + // + // \param values [out] the values extracted from the filter check + bool extract_nocache(sinsp_evt *evt, std::vector& values, bool sanitize_strings = true); + // \param len [out] length in bytes for the returned value + virtual uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true); bool compare_rhs(cmpop op, ppm_param_type type, const void* operand1, uint32_t op1_len = 0); bool compare_rhs(cmpop op, ppm_param_type type, std::vector& values); diff --git a/userspace/libsinsp/sinsp_filtercheck_container.cpp b/userspace/libsinsp/sinsp_filtercheck_container.cpp index ec7178e9a8..87635a3bcc 100644 --- a/userspace/libsinsp/sinsp_filtercheck_container.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_container.cpp @@ -173,7 +173,7 @@ int32_t sinsp_filter_check_container::parse_field_name(std::string_view val, boo } -uint8_t* sinsp_filter_check_container::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_container::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; sinsp_threadinfo* tinfo = evt->get_thread_info(); diff --git a/userspace/libsinsp/sinsp_filtercheck_container.h b/userspace/libsinsp/sinsp_filtercheck_container.h index 075d1d4019..35263b549b 100644 --- a/userspace/libsinsp/sinsp_filtercheck_container.h +++ b/userspace/libsinsp/sinsp_filtercheck_container.h @@ -61,7 +61,7 @@ class sinsp_filter_check_container : public sinsp_filter_check const std::string& get_argstr() const; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: int32_t extract_arg(std::string_view val, size_t basename); diff --git a/userspace/libsinsp/sinsp_filtercheck_event.cpp b/userspace/libsinsp/sinsp_filtercheck_event.cpp index 9341095115..f7096f48f1 100644 --- a/userspace/libsinsp/sinsp_filtercheck_event.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_event.cpp @@ -144,7 +144,7 @@ std::unique_ptr sinsp_filter_check_event::allocate_new() return std::make_unique(); } -int32_t sinsp_filter_check_event::extract_arg(string_view fldname, string_view val, OUT const ppm_param_info** parinfo) +int32_t sinsp_filter_check_event::extract_arg(string_view fldname, string_view val, const ppm_param_info** parinfo) { uint32_t parsed_len = 0; @@ -204,7 +204,7 @@ int32_t sinsp_filter_check_event::extract_arg(string_view fldname, string_view v return parsed_len; } -int32_t sinsp_filter_check_event::extract_type(string_view fldname, string_view val, OUT const ppm_param_info** parinfo) +int32_t sinsp_filter_check_event::extract_type(string_view fldname, string_view val, const ppm_param_info** parinfo) { uint32_t parsed_len = 0; @@ -391,7 +391,7 @@ void sinsp_filter_check_event::validate_filter_value(const char* str, uint32_t l } } -uint8_t* extract_argraw(sinsp_evt *evt, OUT uint32_t* len, const char *argname) +uint8_t* extract_argraw(sinsp_evt *evt, uint32_t* len, const char *argname) { const sinsp_evt_param* pi = evt->get_param_by_name(argname); @@ -406,7 +406,7 @@ uint8_t* extract_argraw(sinsp_evt *evt, OUT uint32_t* len, const char *argname) } } -uint8_t *sinsp_filter_check_event::extract_abspath(sinsp_evt *evt, OUT uint32_t *len) +uint8_t *sinsp_filter_check_event::extract_abspath(sinsp_evt *evt, uint32_t *len) { std::string spath; @@ -568,7 +568,7 @@ uint8_t *sinsp_filter_check_event::extract_abspath(sinsp_evt *evt, OUT uint32_t RETURN_EXTRACT_STRING(m_strstorage); } -inline uint8_t* sinsp_filter_check_event::extract_buflen(sinsp_evt *evt, OUT uint32_t* len) +inline uint8_t* sinsp_filter_check_event::extract_buflen(sinsp_evt *evt, uint32_t* len) { if(evt->get_direction() == SCAP_ED_OUT) { @@ -586,7 +586,7 @@ inline uint8_t* sinsp_filter_check_event::extract_buflen(sinsp_evt *evt, OUT uin return NULL; } -Json::Value sinsp_filter_check_event::extract_as_js(sinsp_evt *evt, OUT uint32_t* len) +Json::Value sinsp_filter_check_event::extract_as_js(sinsp_evt *evt, uint32_t* len) { switch(m_field_id) { @@ -611,7 +611,7 @@ Json::Value sinsp_filter_check_event::extract_as_js(sinsp_evt *evt, OUT uint32_t return Json::nullValue; } -uint8_t* sinsp_filter_check_event::extract_error_count(sinsp_evt *evt, OUT uint32_t* len) +uint8_t* sinsp_filter_check_event::extract_error_count(sinsp_evt *evt, uint32_t* len) { const sinsp_evt_param* pi = evt->get_param_by_name("res"); @@ -647,7 +647,7 @@ uint8_t* sinsp_filter_check_event::extract_error_count(sinsp_evt *evt, OUT uint3 return NULL; } -uint8_t* sinsp_filter_check_event::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_event::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; switch(m_field_id) diff --git a/userspace/libsinsp/sinsp_filtercheck_event.h b/userspace/libsinsp/sinsp_filtercheck_event.h index b50e2317ee..65afa2034c 100644 --- a/userspace/libsinsp/sinsp_filtercheck_event.h +++ b/userspace/libsinsp/sinsp_filtercheck_event.h @@ -94,17 +94,17 @@ class sinsp_filter_check_event : public sinsp_filter_check size_t parse_filter_value(const char* str, uint32_t len, uint8_t* storage, uint32_t storage_len) override; protected: - Json::Value extract_as_js(sinsp_evt*, OUT uint32_t* len) override; - virtual uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + Json::Value extract_as_js(sinsp_evt*, uint32_t* len) override; + virtual uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; virtual bool compare_nocache(sinsp_evt*) override; private: void validate_filter_value(const char* str, uint32_t len); - int32_t extract_arg(std::string_view fldname, std::string_view val, OUT const ppm_param_info**); - int32_t extract_type(std::string_view fldname, std::string_view val, OUT const ppm_param_info**); - uint8_t* extract_error_count(sinsp_evt *evt, OUT uint32_t* len); - uint8_t *extract_abspath(sinsp_evt *evt, OUT uint32_t *len); - inline uint8_t* extract_buflen(sinsp_evt *evt, OUT uint32_t* len); + int32_t extract_arg(std::string_view fldname, std::string_view val, const ppm_param_info**); + int32_t extract_type(std::string_view fldname, std::string_view val, const ppm_param_info**); + uint8_t* extract_error_count(sinsp_evt *evt, uint32_t* len); + uint8_t *extract_abspath(sinsp_evt *evt, uint32_t *len); + inline uint8_t* extract_buflen(sinsp_evt *evt, uint32_t* len); union { uint16_t u16; diff --git a/userspace/libsinsp/sinsp_filtercheck_evtin.cpp b/userspace/libsinsp/sinsp_filtercheck_evtin.cpp index 2ccaa60264..81ed2c80f5 100644 --- a/userspace/libsinsp/sinsp_filtercheck_evtin.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_evtin.cpp @@ -198,7 +198,7 @@ std::unique_ptr sinsp_filter_check_evtin::allocate_new() return std::make_unique(); } -uint8_t* sinsp_filter_check_evtin::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_evtin::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { // do nothing: support to tracers has been dropped *len = 0; diff --git a/userspace/libsinsp/sinsp_filtercheck_evtin.h b/userspace/libsinsp/sinsp_filtercheck_evtin.h index a992c94691..6754e0c765 100644 --- a/userspace/libsinsp/sinsp_filtercheck_evtin.h +++ b/userspace/libsinsp/sinsp_filtercheck_evtin.h @@ -62,7 +62,7 @@ class sinsp_filter_check_evtin : public sinsp_filter_check int32_t parse_field_name(std::string_view, bool alloc_state, bool needed_for_filtering) override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: int32_t extract_arg(std::string_view fldname, std::string_view val); diff --git a/userspace/libsinsp/sinsp_filtercheck_fd.cpp b/userspace/libsinsp/sinsp_filtercheck_fd.cpp index 71f7979479..f0f54182b6 100644 --- a/userspace/libsinsp/sinsp_filtercheck_fd.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_fd.cpp @@ -161,7 +161,7 @@ int32_t sinsp_filter_check_fd::parse_field_name(std::string_view val, bool alloc return sinsp_filter_check::parse_field_name(val, alloc_state, needed_for_filtering); } -bool sinsp_filter_check_fd::extract_fdname_from_creator(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings, bool fd_nameraw) +bool sinsp_filter_check_fd::extract_fdname_from_creator(sinsp_evt *evt, uint32_t* len, bool sanitize_strings, bool fd_nameraw) { const char* resolved_argstr; uint16_t etype = evt->get_type(); @@ -273,7 +273,7 @@ bool sinsp_filter_check_fd::extract_fdname_from_creator(sinsp_evt *evt, OUT uint } } -uint8_t* sinsp_filter_check_fd::extract_from_null_fd(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_fd::extract_from_null_fd(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; // @@ -418,7 +418,7 @@ uint8_t* sinsp_filter_check_fd::extract_from_null_fd(sinsp_evt *evt, OUT uint32_ } } -bool sinsp_filter_check_fd::extract(sinsp_evt *evt, OUT std::vector& values, bool sanitize_strings) +bool sinsp_filter_check_fd::extract(sinsp_evt *evt, std::vector& values, bool sanitize_strings) { values.clear(); @@ -466,7 +466,7 @@ bool sinsp_filter_check_fd::extract(sinsp_evt *evt, OUT std::vector allocate_new() override; int32_t parse_field_name(std::string_view, bool alloc_state, bool needed_for_filtering) override; - bool extract(sinsp_evt*, OUT std::vector& values, bool sanitize_strings = true) override; + bool extract(sinsp_evt*, std::vector& values, bool sanitize_strings = true) override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; bool compare_nocache(sinsp_evt*) override; private: int32_t extract_arg(std::string_view fldname, std::string_view val); - uint8_t* extract_from_null_fd(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings); - bool extract_fdname_from_creator(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings, bool fd_nameraw = false); + uint8_t* extract_from_null_fd(sinsp_evt *evt, uint32_t* len, bool sanitize_strings); + bool extract_fdname_from_creator(sinsp_evt *evt, uint32_t* len, bool sanitize_strings, bool fd_nameraw = false); bool extract_fd(sinsp_evt *evt); bool compare_ip(sinsp_evt *evt); diff --git a/userspace/libsinsp/sinsp_filtercheck_fdlist.cpp b/userspace/libsinsp/sinsp_filtercheck_fdlist.cpp index afe91659a5..9c48d2294d 100644 --- a/userspace/libsinsp/sinsp_filtercheck_fdlist.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_fdlist.cpp @@ -55,7 +55,7 @@ std::unique_ptr sinsp_filter_check_fdlist::allocate_new() return std::make_unique(); } -uint8_t* sinsp_filter_check_fdlist::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_fdlist::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; ASSERT(evt); diff --git a/userspace/libsinsp/sinsp_filtercheck_fdlist.h b/userspace/libsinsp/sinsp_filtercheck_fdlist.h index 60cebf1fd5..3c9c5deee0 100644 --- a/userspace/libsinsp/sinsp_filtercheck_fdlist.h +++ b/userspace/libsinsp/sinsp_filtercheck_fdlist.h @@ -39,7 +39,7 @@ class sinsp_filter_check_fdlist : public sinsp_filter_check std::unique_ptr allocate_new() override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: std::string m_strval; diff --git a/userspace/libsinsp/sinsp_filtercheck_fspath.cpp b/userspace/libsinsp/sinsp_filtercheck_fspath.cpp index dbe0e7f649..af285fe6d9 100644 --- a/userspace/libsinsp/sinsp_filtercheck_fspath.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_fspath.cpp @@ -240,7 +240,7 @@ std::unique_ptr sinsp_filter_check_fspath::allocate_new() return ret; } -uint8_t* sinsp_filter_check_fspath::extract_single(sinsp_evt* evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_fspath::extract_single(sinsp_evt* evt, uint32_t* len, bool sanitize_strings) { *len = 0; ASSERT(evt); @@ -367,7 +367,7 @@ uint8_t* sinsp_filter_check_fspath::extract_single(sinsp_evt* evt, OUT uint32_t* } bool sinsp_filter_check_fspath::extract_fspath(sinsp_evt* evt, - OUT std::vector& values, + std::vector& values, std::shared_ptr checks) { sinsp_evt* extract_evt = evt; diff --git a/userspace/libsinsp/sinsp_filtercheck_fspath.h b/userspace/libsinsp/sinsp_filtercheck_fspath.h index c15dddaa16..d2112074aa 100644 --- a/userspace/libsinsp/sinsp_filtercheck_fspath.h +++ b/userspace/libsinsp/sinsp_filtercheck_fspath.h @@ -39,7 +39,7 @@ class sinsp_filter_check_fspath : public sinsp_filter_check std::unique_ptr allocate_new() override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: typedef std::map> filtercheck_map_t; @@ -56,7 +56,7 @@ class sinsp_filter_check_fspath : public sinsp_filter_check std::shared_ptr source_checks, std::shared_ptr target_checks); bool extract_fspath(sinsp_evt* evt, - OUT std::vector& values, + std::vector& values, std::shared_ptr map); std::string m_tstr; diff --git a/userspace/libsinsp/sinsp_filtercheck_gen_event.cpp b/userspace/libsinsp/sinsp_filtercheck_gen_event.cpp index 1329aaa74b..4dbb60dab8 100644 --- a/userspace/libsinsp/sinsp_filtercheck_gen_event.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_gen_event.cpp @@ -84,7 +84,7 @@ std::unique_ptr sinsp_filter_check_gen_event::allocate_new() return std::make_unique(); } -Json::Value sinsp_filter_check_gen_event::extract_as_js(sinsp_evt *evt, OUT uint32_t* len) +Json::Value sinsp_filter_check_gen_event::extract_as_js(sinsp_evt *evt, uint32_t* len) { switch(m_field_id) { @@ -109,7 +109,7 @@ Json::Value sinsp_filter_check_gen_event::extract_as_js(sinsp_evt *evt, OUT uint return Json::nullValue; } -uint8_t* sinsp_filter_check_gen_event::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_gen_event::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { std::shared_ptr plugin; diff --git a/userspace/libsinsp/sinsp_filtercheck_gen_event.h b/userspace/libsinsp/sinsp_filtercheck_gen_event.h index 7c2a01095d..f21127abe6 100644 --- a/userspace/libsinsp/sinsp_filtercheck_gen_event.h +++ b/userspace/libsinsp/sinsp_filtercheck_gen_event.h @@ -51,8 +51,8 @@ class sinsp_filter_check_gen_event : public sinsp_filter_check std::unique_ptr allocate_new() override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; - Json::Value extract_as_js(sinsp_evt*, OUT uint32_t* len) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; + Json::Value extract_as_js(sinsp_evt*, uint32_t* len) override; private: union { diff --git a/userspace/libsinsp/sinsp_filtercheck_group.cpp b/userspace/libsinsp/sinsp_filtercheck_group.cpp index 4433fa0812..47291870d7 100644 --- a/userspace/libsinsp/sinsp_filtercheck_group.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_group.cpp @@ -56,7 +56,7 @@ std::unique_ptr sinsp_filter_check_group::allocate_new() return std::make_unique(); } -uint8_t* sinsp_filter_check_group::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_group::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; sinsp_threadinfo* tinfo = evt->get_thread_info(); diff --git a/userspace/libsinsp/sinsp_filtercheck_group.h b/userspace/libsinsp/sinsp_filtercheck_group.h index 0d762ac562..8dee9c32fe 100644 --- a/userspace/libsinsp/sinsp_filtercheck_group.h +++ b/userspace/libsinsp/sinsp_filtercheck_group.h @@ -35,7 +35,7 @@ class sinsp_filter_check_group : public sinsp_filter_check std::unique_ptr allocate_new() override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: uint32_t m_gid; diff --git a/userspace/libsinsp/sinsp_filtercheck_k8s.cpp b/userspace/libsinsp/sinsp_filtercheck_k8s.cpp index 10d7288e40..1f9176c557 100644 --- a/userspace/libsinsp/sinsp_filtercheck_k8s.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_k8s.cpp @@ -204,7 +204,7 @@ void sinsp_filter_check_k8s::concatenate_container_labels(const map allocate_new() override; int32_t parse_field_name(std::string_view, bool alloc_state, bool needed_for_filtering) override; - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: std::string m_text; diff --git a/userspace/libsinsp/sinsp_filtercheck_reference.cpp b/userspace/libsinsp/sinsp_filtercheck_reference.cpp index 0fc949bccc..8a7a44fa8c 100644 --- a/userspace/libsinsp/sinsp_filtercheck_reference.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_reference.cpp @@ -48,7 +48,7 @@ int32_t sinsp_filter_check_reference::parse_field_name(std::string_view, bool al return -1; } -uint8_t* sinsp_filter_check_reference::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_reference::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = m_len; return m_val; diff --git a/userspace/libsinsp/sinsp_filtercheck_reference.h b/userspace/libsinsp/sinsp_filtercheck_reference.h index 351711837e..8e800b2084 100644 --- a/userspace/libsinsp/sinsp_filtercheck_reference.h +++ b/userspace/libsinsp/sinsp_filtercheck_reference.h @@ -34,7 +34,7 @@ class sinsp_filter_check_reference : public sinsp_filter_check std::unique_ptr allocate_new() override; int32_t parse_field_name(std::string_view, bool alloc_state, bool needed_for_filtering) override; - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; inline void set_val(ppm_param_type type, filtercheck_field_flags flags, uint8_t* val, int32_t len, diff --git a/userspace/libsinsp/sinsp_filtercheck_syslog.cpp b/userspace/libsinsp/sinsp_filtercheck_syslog.cpp index bbb97de9e2..da53485b45 100644 --- a/userspace/libsinsp/sinsp_filtercheck_syslog.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_syslog.cpp @@ -67,7 +67,7 @@ std::unique_ptr sinsp_filter_check_syslog::allocate_new() return std::make_unique(); } -uint8_t* sinsp_filter_check_syslog::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_syslog::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; auto& decoder = m_inspector->get_parser()->get_syslog_decoder(); diff --git a/userspace/libsinsp/sinsp_filtercheck_syslog.h b/userspace/libsinsp/sinsp_filtercheck_syslog.h index fb189eec55..fd7983e6d1 100644 --- a/userspace/libsinsp/sinsp_filtercheck_syslog.h +++ b/userspace/libsinsp/sinsp_filtercheck_syslog.h @@ -38,7 +38,7 @@ class sinsp_filter_check_syslog : public sinsp_filter_check std::unique_ptr allocate_new() override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: uint32_t m_storageu32; diff --git a/userspace/libsinsp/sinsp_filtercheck_thread.cpp b/userspace/libsinsp/sinsp_filtercheck_thread.cpp index ade39d31fb..9b3bf4edaf 100644 --- a/userspace/libsinsp/sinsp_filtercheck_thread.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_thread.cpp @@ -147,7 +147,7 @@ std::unique_ptr sinsp_filter_check_thread::allocate_new() return std::make_unique(); } -int32_t sinsp_filter_check_thread::extract_arg(std::string_view fldname, std::string_view val, OUT const ppm_param_info** parinfo) +int32_t sinsp_filter_check_thread::extract_arg(std::string_view fldname, std::string_view val, const ppm_param_info** parinfo) { std::string::size_type parsed_len = 0; @@ -469,7 +469,7 @@ uint64_t sinsp_filter_check_thread::extract_exectime(sinsp_evt *evt) return res; } -uint8_t* sinsp_filter_check_thread::extract_thread_cpu(sinsp_evt *evt, OUT uint32_t* len, sinsp_threadinfo* tinfo, bool extract_user, bool extract_system) +uint8_t* sinsp_filter_check_thread::extract_thread_cpu(sinsp_evt *evt, uint32_t* len, sinsp_threadinfo* tinfo, bool extract_user, bool extract_system) { uint16_t etype = evt->get_type(); @@ -523,7 +523,7 @@ inline bool should_extract_xid(int64_t xid) return xid >= -1 && xid <= UINT32_MAX; } -uint8_t* sinsp_filter_check_thread::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_thread::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; sinsp_threadinfo* tinfo = evt->get_thread_info(); diff --git a/userspace/libsinsp/sinsp_filtercheck_thread.h b/userspace/libsinsp/sinsp_filtercheck_thread.h index a70d775baf..5f59812eea 100644 --- a/userspace/libsinsp/sinsp_filtercheck_thread.h +++ b/userspace/libsinsp/sinsp_filtercheck_thread.h @@ -117,13 +117,13 @@ class sinsp_filter_check_thread : public sinsp_filter_check int32_t get_argid() const; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; bool compare_nocache(sinsp_evt*) override; private: uint64_t extract_exectime(sinsp_evt *evt); - int32_t extract_arg(std::string_view fldname, std::string_view val, OUT const ppm_param_info**); - uint8_t* extract_thread_cpu(sinsp_evt *evt, OUT uint32_t* len, sinsp_threadinfo* tinfo, bool extract_user, bool extract_system); + int32_t extract_arg(std::string_view fldname, std::string_view val, const ppm_param_info**); + uint8_t* extract_thread_cpu(sinsp_evt *evt, uint32_t* len, sinsp_threadinfo* tinfo, bool extract_user, bool extract_system); inline bool compare_full_apid(sinsp_evt *evt); bool compare_full_aname(sinsp_evt *evt); bool compare_full_aexe(sinsp_evt *evt); diff --git a/userspace/libsinsp/sinsp_filtercheck_tracer.cpp b/userspace/libsinsp/sinsp_filtercheck_tracer.cpp index 12de97f321..336c8946a2 100644 --- a/userspace/libsinsp/sinsp_filtercheck_tracer.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_tracer.cpp @@ -76,7 +76,7 @@ std::unique_ptr sinsp_filter_check_tracer::allocate_new() return std::make_unique(); } -int32_t sinsp_filter_check_tracer::extract_arg(string_view fldname, string_view val, OUT const ppm_param_info** parinfo) +int32_t sinsp_filter_check_tracer::extract_arg(string_view fldname, string_view val, const ppm_param_info** parinfo) { uint32_t parsed_len = 0; @@ -185,7 +185,7 @@ int32_t sinsp_filter_check_tracer::parse_field_name(std::string_view val, bool a return res; } -uint8_t* sinsp_filter_check_tracer::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_tracer::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { // do nothing: support to tracers has been dropped *len = 0; diff --git a/userspace/libsinsp/sinsp_filtercheck_tracer.h b/userspace/libsinsp/sinsp_filtercheck_tracer.h index 2c5d5a2aa3..250be09eb6 100644 --- a/userspace/libsinsp/sinsp_filtercheck_tracer.h +++ b/userspace/libsinsp/sinsp_filtercheck_tracer.h @@ -54,10 +54,10 @@ class sinsp_filter_check_tracer : public sinsp_filter_check int32_t parse_field_name(std::string_view, bool alloc_state, bool needed_for_filtering) override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: - int32_t extract_arg(std::string_view fldname, std::string_view val, OUT const struct ppm_param_info** parinfo); + int32_t extract_arg(std::string_view fldname, std::string_view val, const struct ppm_param_info** parinfo); int32_t m_argid; std::string m_argname; diff --git a/userspace/libsinsp/sinsp_filtercheck_user.cpp b/userspace/libsinsp/sinsp_filtercheck_user.cpp index 98d6aff03a..352d754171 100644 --- a/userspace/libsinsp/sinsp_filtercheck_user.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_user.cpp @@ -61,7 +61,7 @@ std::unique_ptr sinsp_filter_check_user::allocate_new() return std::make_unique(); } -uint8_t* sinsp_filter_check_user::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_user::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; sinsp_threadinfo* tinfo = evt->get_thread_info(); diff --git a/userspace/libsinsp/sinsp_filtercheck_user.h b/userspace/libsinsp/sinsp_filtercheck_user.h index 2f9debb5c6..a2bdf16000 100644 --- a/userspace/libsinsp/sinsp_filtercheck_user.h +++ b/userspace/libsinsp/sinsp_filtercheck_user.h @@ -39,7 +39,7 @@ class sinsp_filter_check_user : public sinsp_filter_check std::unique_ptr allocate_new() override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: union { diff --git a/userspace/libsinsp/sinsp_filtercheck_utils.cpp b/userspace/libsinsp/sinsp_filtercheck_utils.cpp index e8b1241e19..dba10b01df 100644 --- a/userspace/libsinsp/sinsp_filtercheck_utils.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_utils.cpp @@ -51,7 +51,7 @@ std::unique_ptr sinsp_filter_check_utils::allocate_new() return std::make_unique(); } -uint8_t* sinsp_filter_check_utils::extract_single(sinsp_evt *evt, OUT uint32_t* len, bool sanitize_strings) +uint8_t* sinsp_filter_check_utils::extract_single(sinsp_evt *evt, uint32_t* len, bool sanitize_strings) { *len = 0; switch(m_field_id) diff --git a/userspace/libsinsp/sinsp_filtercheck_utils.h b/userspace/libsinsp/sinsp_filtercheck_utils.h index 0d3ba5a408..7b9146b464 100644 --- a/userspace/libsinsp/sinsp_filtercheck_utils.h +++ b/userspace/libsinsp/sinsp_filtercheck_utils.h @@ -34,7 +34,7 @@ class sinsp_filter_check_utils : public sinsp_filter_check std::unique_ptr allocate_new() override; protected: - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override; + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override; private: uint64_t m_cnt; diff --git a/userspace/libsinsp/test/filter_compiler.ut.cpp b/userspace/libsinsp/test/filter_compiler.ut.cpp index 937fe3476a..984bdac886 100644 --- a/userspace/libsinsp/test/filter_compiler.ut.cpp +++ b/userspace/libsinsp/test/filter_compiler.ut.cpp @@ -48,7 +48,7 @@ class mock_compiler_filter_check : public sinsp_filter_check throw sinsp_exception("unexpected right-hand side filter comparison"); } - inline bool extract(sinsp_evt *e, OUT vector& v, bool) override + inline bool extract(sinsp_evt *e, vector& v, bool) override { return false; } diff --git a/userspace/libsinsp/test/filterchecks/mock.cpp b/userspace/libsinsp/test/filterchecks/mock.cpp index e7bc776d97..6902e366b3 100644 --- a/userspace/libsinsp/test/filterchecks/mock.cpp +++ b/userspace/libsinsp/test/filterchecks/mock.cpp @@ -76,7 +76,7 @@ class sinsp_filter_check_mock : public sinsp_filter_check } protected: - bool extract(sinsp_evt* evt, OUT std::vector& values, bool sanitize_strings) override + bool extract(sinsp_evt* evt, std::vector& values, bool sanitize_strings) override { static const char* list_value_1 = "value1"; static const char* list_value_2 = "charbuf"; @@ -99,7 +99,7 @@ class sinsp_filter_check_mock : public sinsp_filter_check return sinsp_filter_check::extract(evt, values, sanitize_strings); } - uint8_t* extract_single(sinsp_evt*, OUT uint32_t* len, bool sanitize_strings = true) override + uint8_t* extract_single(sinsp_evt*, uint32_t* len, bool sanitize_strings = true) override { *len = 0; switch(m_field_id) diff --git a/userspace/libsinsp/utils.cpp b/userspace/libsinsp/utils.cpp index 96bd870ec5..b448160c6a 100644 --- a/userspace/libsinsp/utils.cpp +++ b/userspace/libsinsp/utils.cpp @@ -962,7 +962,7 @@ static int32_t gmt2local(time_t t) return dt; } -void sinsp_utils::ts_to_string(uint64_t ts, OUT std::string* res, bool date, bool ns) +void sinsp_utils::ts_to_string(uint64_t ts, std::string* res, bool date, bool ns) { struct tm *tm; time_t Time; @@ -1003,7 +1003,7 @@ void sinsp_utils::ts_to_string(uint64_t ts, OUT std::string* res, bool date, boo } #define TS_STR_FMT "YYYY-MM-DDTHH:MM:SS-0000" -void sinsp_utils::ts_to_iso_8601(uint64_t ts, OUT std::string* res) +void sinsp_utils::ts_to_iso_8601(uint64_t ts, std::string* res) { static const char *fmt = TS_STR_FMT; char buf[sizeof(TS_STR_FMT)]; diff --git a/userspace/libsinsp/utils.h b/userspace/libsinsp/utils.h index 33248e17bb..0285a41953 100644 --- a/userspace/libsinsp/utils.h +++ b/userspace/libsinsp/utils.h @@ -147,9 +147,15 @@ class sinsp_utils std::string &digest, bool split_repo = true); - static void ts_to_string(uint64_t ts, OUT std::string* res, bool date, bool ns); - - static void ts_to_iso_8601(uint64_t ts, OUT std::string* res); + /* + * \param res [out] the generated string representation of the provided timestamp + */ + static void ts_to_string(uint64_t ts, std::string* res, bool date, bool ns); + + /* + * \param res [out] the generated string representation of the provided timestamp + */ + static void ts_to_iso_8601(uint64_t ts, std::string* res); // // Convert caps from their numeric representation to a space-separated string list