clenup(userspace/libsinsp)!: remove unused filter compiler flag

userspace/chisel/chisel_api.cpp

@@ -743,7 +743,7 @@ int lua_cbacks::get_thread_table_int(lua_State *ls, bool include_fds, bool bareb
 		{
 			try
 			{
-				compiler = new sinsp_filter_compiler(ch->m_inspector, filterstr, true);
+				compiler = new sinsp_filter_compiler(ch->m_inspector, filterstr);
 				filter = compiler->compile();
 			}
 			catch(const sinsp_exception& e)

userspace/libsinsp/filter.cpp

@@ -45,37 +45,31 @@ sinsp_filter::sinsp_filter(sinsp *inspector)
 ///////////////////////////////////////////////////////////////////////////////
 sinsp_filter_compiler::sinsp_filter_compiler(
 		sinsp* inspector,
-		const std::string& fltstr,
-		bool ttable_only)
+		const std::string& fltstr)
 {
 	m_factory.reset(new sinsp_filter_factory(inspector, m_default_filterlist));
 	m_filter = NULL;
 	m_flt_str = fltstr;
 	m_flt_ast = NULL;
-	m_ttable_only = ttable_only;
 }
 
 sinsp_filter_compiler::sinsp_filter_compiler(
 		std::shared_ptr<gen_event_filter_factory> factory,
-		const std::string& fltstr,
-		bool ttable_only)
+		const std::string& fltstr)
 {
 	m_factory = factory;
 	m_filter = NULL;
 	m_flt_str = fltstr;
 	m_flt_ast = NULL;
-	m_ttable_only = ttable_only;
 }
 
 sinsp_filter_compiler::sinsp_filter_compiler(
 		std::shared_ptr<gen_event_filter_factory> factory,
-		const libsinsp::filter::ast::expr* fltast,
-		bool ttable_only)
+		const libsinsp::filter::ast::expr* fltast)
 {
 	m_factory = factory;
 	m_filter = NULL;
 	m_flt_ast = fltast;
-	m_ttable_only = ttable_only;
 }
 
 sinsp_filter* sinsp_filter_compiler::compile()
@@ -182,7 +176,6 @@ void sinsp_filter_compiler::visit(const libsinsp::filter::ast::unary_check_expr*
 	std::string field = create_filtercheck_name(e->field, e->arg);
 	gen_event_filter_check *check = create_filtercheck(field);
 	m_filter->add_check(check);
-	check_ttable_only(field, check);
 	check->m_cmpop = str_to_cmpop(e->op);
 	check->m_boolop = m_last_boolop;
 	check->parse_field_name(field.c_str(), true, true);
@@ -213,7 +206,6 @@ void sinsp_filter_compiler::visit(const libsinsp::filter::ast::binary_check_expr
 	std::string field = create_filtercheck_name(e->field, e->arg);
 	gen_event_filter_check *check = create_filtercheck(field);
 	m_filter->add_check(check);
-	check_ttable_only(field, check);
 	check->m_cmpop = str_to_cmpop(e->op);
 	check->m_boolop = m_last_boolop;
 	check->parse_field_name(field.c_str(), true, true);
@@ -281,28 +273,6 @@ gen_event_filter_check* sinsp_filter_compiler::create_filtercheck(std::string& f
 	return chk;
 }
 
-void sinsp_filter_compiler::check_ttable_only(std::string& field, gen_event_filter_check *check)
-{
-	if(m_ttable_only)
-	{
-		sinsp_filter_check* sinsp_check = dynamic_cast<sinsp_filter_check*>(check);
-		if (sinsp_check != nullptr
-			&& !(sinsp_check->get_fields()->m_flags & filter_check_info::FL_WORKS_ON_THREAD_TABLE))
-		{
-			if(field != "evt.rawtime" &&
-				field != "evt.rawtime.s" &&
-				field != "evt.rawtime.ns" &&
-				field != "evt.time" &&
-				field != "evt.time.s" &&
-				field != "evt.datetime" &&
-				field != "evt.reltime")
-			{
-				throw sinsp_exception("filter error: '" + field + "' is not supported for thread table filtering");
-			}
-		}
-	}
-}
-
 cmpop sinsp_filter_compiler::str_to_cmpop(const std::string& str)
 {
 	if(str == "=" || str == "==")

userspace/libsinsp/filter.h

@@ -60,28 +60,24 @@ class SINSP_PUBLIC sinsp_filter_compiler:
 		\param inspector Pointer to the inspector instance that will generate
 		the events to be filtered
 		\param fltstr The filter string to compile
-		\param ttable_only For internal use only
 
 		\note This is not the primary constructor, and is only maintained for
 		backward compatibility
 	*/
 	sinsp_filter_compiler(
 		sinsp* inspector,
-		const std::string& fltstr,
-		bool ttable_only=false);
+		const std::string& fltstr);
 
 	/*!
 		\brief Constructs the compiler
 
 		\param factory Pointer to a filter factory to be used to build
 		the filtercheck tree
 		\param fltstr The filter string to compile
-		\param ttable_only For internal use only
 	*/
 	sinsp_filter_compiler(
 		std::shared_ptr<gen_event_filter_factory> factory,
-		const std::string& fltstr,
-		bool ttable_only=false);
+		const std::string& fltstr);
 
 	/*!
 		\brief Constructs the compiler
@@ -90,12 +86,10 @@ class SINSP_PUBLIC sinsp_filter_compiler:
 		the filtercheck tree
 		\param fltast AST of a parsed filter, used to build the filtercheck
 		tree
-		\param ttable_only For internal use only
 	*/
 	sinsp_filter_compiler(
 		std::shared_ptr<gen_event_filter_factory> factory,
-		const libsinsp::filter::ast::expr* fltast,
-		bool ttable_only=false);
+		const libsinsp::filter::ast::expr* fltast);
 
 	/*!
 		\brief Builds a filtercheck tree and bundles it in sinsp_filter
@@ -117,13 +111,11 @@ class SINSP_PUBLIC sinsp_filter_compiler:
 	void visit(const libsinsp::filter::ast::list_expr*) override;
 	void visit(const libsinsp::filter::ast::unary_check_expr*) override;
 	void visit(const libsinsp::filter::ast::binary_check_expr*) override;
-	void check_ttable_only(std::string& field, gen_event_filter_check *check);
 	cmpop str_to_cmpop(const std::string& str);
 	std::string create_filtercheck_name(const std::string& name, const std::string& arg);
 	gen_event_filter_check* create_filtercheck(std::string& field);
 
 	libsinsp::filter::ast::pos_info m_pos;
-	bool m_ttable_only;
 	bool m_expect_values;
 	boolop m_last_boolop;
 	std::string m_flt_str;

userspace/libsinsp/sinsp.h

@@ -117,8 +117,7 @@ class filter_check_info
 	enum flags
 	{
 		FL_NONE =   0,
-		FL_WORKS_ON_THREAD_TABLE = (1 << 0),	///< This filter check class supports filtering incomplete events that contain only valid thread info and FD info.
-		FL_HIDDEN = (1 << 1),	///< This filter check class won't be shown by fields/filter listings.
+		FL_HIDDEN = (1 << 0),	///< This filter check class won't be shown by fields/filter listings.
 	};
 
 	filter_check_info()

userspace/libsinsp/sinsp_filtercheck_container.cpp

@@ -66,7 +66,7 @@ sinsp_filter_check_container::sinsp_filter_check_container()
 	m_info.m_desc = "Container information. If the event is not happening inside a container, both id and name will be set to 'host'.";
 	m_info.m_fields = sinsp_filter_check_container_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_container_fields) / sizeof(sinsp_filter_check_container_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 }
 
 sinsp_filter_check* sinsp_filter_check_container::allocate_new()

userspace/libsinsp/sinsp_filtercheck_fd.cpp

@@ -106,7 +106,7 @@ sinsp_filter_check_fd::sinsp_filter_check_fd()
 	m_info.m_desc = "Every syscall that has a file descriptor in its arguments has these fields set with information related to the file.";
 	m_info.m_fields = sinsp_filter_check_fd_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_fd_fields) / sizeof(sinsp_filter_check_fd_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 }
 
 sinsp_filter_check* sinsp_filter_check_fd::allocate_new()

userspace/libsinsp/sinsp_filtercheck_fdlist.cpp

@@ -43,7 +43,7 @@ sinsp_filter_check_fdlist::sinsp_filter_check_fdlist()
 	m_info.m_desc = "Poll event related fields.";
 	m_info.m_fields = sinsp_filter_check_fdlist_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_fdlist_fields) / sizeof(sinsp_filter_check_fdlist_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 }
 
 sinsp_filter_check* sinsp_filter_check_fdlist::allocate_new()

userspace/libsinsp/sinsp_filtercheck_fspath.cpp

@@ -53,7 +53,7 @@ sinsp_filter_check_fspath::sinsp_filter_check_fspath()
 	m_info.m_desc = "Every syscall that has a filesystem path in its arguments has these fields set with information related to the path arguments. This differs from the fd.* fields as it includes syscalls like unlink, rename, etc. that act directly on filesystem paths as compared to opened file descriptors.";
 	m_info.m_fields = sinsp_filter_check_fspath_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_fspath_fields) / sizeof(sinsp_filter_check_fspath_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 };
 
 std::shared_ptr<sinsp_filter_check> sinsp_filter_check_fspath::create_event_check(const char *name,

userspace/libsinsp/sinsp_filtercheck_group.cpp

@@ -47,7 +47,7 @@ sinsp_filter_check_group::sinsp_filter_check_group()
 	m_info.m_desc = "Information about the user group.";
 	m_info.m_fields = sinsp_filter_check_group_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_group_fields) / sizeof(sinsp_filter_check_group_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 }
 
 sinsp_filter_check* sinsp_filter_check_group::allocate_new()

userspace/libsinsp/sinsp_filtercheck_k8s.cpp

@@ -73,7 +73,7 @@ sinsp_filter_check_k8s::sinsp_filter_check_k8s()
 	m_info.m_desc = "Kubernetes related context. When configured to fetch from the API server, all fields are available. Otherwise, only the `k8s.pod.*` and `k8s.ns.name` fields are populated with data gathered from the container runtime.";
 	m_info.m_fields = sinsp_filter_check_k8s_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_k8s_fields) / sizeof(sinsp_filter_check_k8s_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 }
 
 sinsp_filter_check* sinsp_filter_check_k8s::allocate_new()

userspace/libsinsp/sinsp_filtercheck_mesos.cpp

@@ -51,7 +51,7 @@ sinsp_filter_check_mesos::sinsp_filter_check_mesos()
 	m_info.m_desc = "Mesos related context.";
 	m_info.m_fields = sinsp_filter_check_mesos_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_mesos_fields) / sizeof(sinsp_filter_check_mesos_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 }
 
 sinsp_filter_check* sinsp_filter_check_mesos::allocate_new()

userspace/libsinsp/sinsp_filtercheck_thread.cpp

@@ -134,7 +134,7 @@ sinsp_filter_check_thread::sinsp_filter_check_thread()
 	m_info.m_desc = "Additional information about the process and thread executing the syscall event.";
 	m_info.m_fields = sinsp_filter_check_thread_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_thread_fields) / sizeof(sinsp_filter_check_thread_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 
 	m_u64val = 0;
 	m_cursec_ts = 0;

userspace/libsinsp/sinsp_filtercheck_user.cpp

@@ -56,7 +56,7 @@ sinsp_filter_check_user::sinsp_filter_check_user()
 	m_info.m_desc = "Information about the user executing the specific event.";
 	m_info.m_fields = sinsp_filter_check_user_fields;
 	m_info.m_nfields = sizeof(sinsp_filter_check_user_fields) / sizeof(sinsp_filter_check_user_fields[0]);
-	m_info.m_flags = filter_check_info::FL_WORKS_ON_THREAD_TABLE;
+	m_info.m_flags = filter_check_info::FL_NONE;
 }
 
 sinsp_filter_check* sinsp_filter_check_user::allocate_new()