Skip to content

Commit

Permalink
Add workaround: Revert to using raw argument values in engine stage
Browse files Browse the repository at this point in the history
Introduced a workaround to revert to raw argument values for tracee signatures,
maintaining compatibility while further migration is planned.
  • Loading branch information
yanivagman committed Dec 25, 2024
1 parent b46a2b6 commit a481d11
Showing 1 changed file with 21 additions and 9 deletions.
30 changes: 21 additions & 9 deletions pkg/ebpf/signature_engine.go
Original file line number Diff line number Diff line change
Expand Up @@ -82,16 +82,28 @@ func (t *Tracee) engineEvents(ctx context.Context, in <-chan *trace.Event) (<-ch
// arguments parsing) can affect engine stage.
eventCopy := *event

// if t.config.Output.ParseArguments {
// // shallow clone the event arguments before parsing them (new slice is created),
// // to keep the eventCopy with raw arguments.
// eventCopy.Args = slices.Clone(event.Args)

// err := t.parseArguments(event)
// if err != nil {
// t.handleError(err)
// return
// }
// }

// This is a workaround to keep working with parsed arguments in the engine stage.
// Once fully migrated, this should be reverted to the commented code above
eventCopy.Args = slices.Clone(event.Args)
err := t.parseArguments(&eventCopy)
if err != nil {
t.handleError(err)
return
}
if t.config.Output.ParseArguments {
// shallow clone the event arguments before parsing them (new slice is created),
// to keep the eventCopy with raw arguments.
eventCopy.Args = slices.Clone(event.Args)

err := t.parseArguments(event)
if err != nil {
t.handleError(err)
return
}
event.Args = slices.Clone(eventCopy.Args)
}

// pass the event to the sink stage, if the event is also marked as emit
Expand Down

0 comments on commit a481d11

Please sign in to comment.