update(libsinsp/filter): parse wider whitespace combinations in filter expressions

[jasondellaluce]

What type of PR is this?

/kind bug

/kind feature

Any specific area of the project related to this PR?

/area libsinsp

/area tests

Does this PR require a change in the driver versions?

No

What this PR does / why we need it:

The parser for filter expressions (used in Falco rules conditions) has historically been a bit strict with the way it accepts whitespaces when required between a comparison operator and right-hand values. This now supports also line breaks, which has been reported being rejected in some corner cases.

Additionally, the parser tests has been updated to "fuzz" a bit the whitespaces handled by each of the existing test cases, with the purpose of extending our coverage from this perspective.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[github-actions]

Perf diff from master - unit tests

     3.65%     -1.23%  [.] sinsp_thread_manager::find_thread
     2.59%     -1.04%  [.] sinsp::fetch_next_event
     3.65%     +1.01%  [.] gzfile_read
     3.34%     +0.98%  [.] sinsp_parser::process_event
     5.60%     -0.87%  [.] next
     1.63%     +0.86%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release
     1.16%     +0.73%  [.] std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char const*>
     4.91%     +0.68%  [.] sinsp_evt::get_type
     1.76%     -0.66%  [.] 0x00000000000eb3b0
     1.26%     -0.52%  [.] sinsp_evt::get_ts

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0099         -0.0099           152           150           152           150
BM_sinsp_split_median                                          -0.0100         -0.0100           152           150           152           150
BM_sinsp_split_stddev                                          -0.6462         -0.6461             2             1             2             1
BM_sinsp_split_cv                                              -0.6427         -0.6426             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.0350         +0.0350            60            62            60            62
BM_sinsp_concatenate_paths_relative_path_median                +0.0333         +0.0333            60            62            60            62
BM_sinsp_concatenate_paths_relative_path_stddev                +1.2819         +1.2837             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    +1.2048         +1.2066             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0013         -0.0013            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_median                   -0.0026         -0.0027            25            25            25            25
BM_sinsp_concatenate_paths_empty_path_stddev                   +0.3272         +0.3269             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +0.3289         +0.3287             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0153         +0.0153            64            65            64            65
BM_sinsp_concatenate_paths_absolute_path_median                +0.0187         +0.0187            63            65            63            65
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.4450         -0.4456             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.4533         -0.4540             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0024         +0.0024           389           390           389           390
BM_sinsp_split_container_image_median                          +0.0013         +0.0013           389           389           389           389
BM_sinsp_split_container_image_stddev                          +0.5278         +0.5283             3             5             3             5
BM_sinsp_split_container_image_cv                              +0.5242         +0.5248             0             0             0             0

[codecov]

Codecov Report

Attention: Patch coverage is 98.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 75.17%. Comparing base (556d868) to head (80009f7).
Report is 6 commits behind head on master.

Files with missing lines	Patch %	Lines
userspace/libsinsp/test/filter_parser.ut.cpp	97.43%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2183      +/-   ##
==========================================
+ Coverage   75.16%   75.17%   +0.01%     
==========================================
  Files         257      257              
  Lines       33711    33735      +24     
  Branches     5744     5750       +6     
==========================================
+ Hits        25339    25361      +22     
- Misses       8372     8374       +2     

Flag	Coverage Δ
libsinsp	75.17% <98.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[FedeDP]

/milestone 0.20.0

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 52ae15faaa8964a2706f26056a34ee236198a650

[Andreagit97]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment