feat(userspace/libscap): Add a raw block engine - #3038
Open
geraldcombs wants to merge 11 commits into
Open
Conversation
poiana
added
release-note-none
kind/feature
Contributor
Author
|
The corresponding Stratoshark merge request can be found at https://gitlab.com/wireshark/wireshark/-/merge_requests/25550. |
Perf diff from master - unit testsHeap diff from master - unit testsHeap diff from master - scap fileBenchmarks diff from master |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #3038 +/- ##
==========================================
- Coverage 76.56% 76.39% -0.18%
==========================================
Files 301 302 +1
Lines 33693 33944 +251
Branches 5038 5117 +79
==========================================
+ Hits 25797 25931 +134
- Misses 7896 8013 +117
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
geraldcombs
force-pushed
the
raw-block-engine
branch
2 times, most recently
from
June 30, 2026 18:14
0466770 to
8144283
Compare
There was a problem hiding this comment.
Pull request overview
Adds a new libscap “raw_block” engine and corresponding libsinsp API to process scap/pcapng blocks from an in-memory buffer, enabling external applications to reuse libsinsp analysis without concurrently opening capture files.
Changes:
- Introduces the
raw_blocklibscap engine (plus a membuf reader) and wires it into engine selection/build config. - Exposes
sinsp::open_raw_block()and updates the sinsp example + CI to exercise the new engine. - Refactors parts of the savefile engine to share block parsing/event reading code with the new engine.
Reviewed changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| userspace/libsinsp/sinsp.h | Adds open_raw_block() API and documentation. |
| userspace/libsinsp/sinsp.cpp | Implements sinsp::open_raw_block() using the new engine/platform. |
| userspace/libsinsp/examples/test.cpp | Adds --raw_block option and in-memory (optionally gzip-inflated) replay logic. |
| userspace/libsinsp/examples/CMakeLists.txt | Links the example against zlib for gzip inflation support. |
| userspace/libscap/scap.h | Includes the raw_block engine public header. |
| userspace/libscap/scap_engines.h | Declares scap_raw_block_engine under HAS_ENGINE_RAW_BLOCK. |
| userspace/libscap/scap_config.h.in | Adds HAS_ENGINE_RAW_BLOCK configure define. |
| userspace/libscap/engine/savefile/scap_savefile.c | Exposes savefile init/next helpers for reuse by raw_block. |
| userspace/libscap/engine/savefile/savefile.h | Declares the newly exposed savefile helper APIs. |
| userspace/libscap/engine/raw_block/scap_reader_membuf.c | New reader implementation over a memory buffer. |
| userspace/libscap/engine/raw_block/scap_raw_block.c | New engine implementation reusing savefile parsing + converter. |
| userspace/libscap/engine/raw_block/raw_block.h | Defines raw_block engine handle type (alias of savefile_engine). |
| userspace/libscap/engine/raw_block/raw_block_public.h | Public params/docs for configuring the raw_block engine. |
| userspace/libscap/engine/raw_block/raw_block_platform.h | Platform struct definition for raw_block. |
| userspace/libscap/engine/raw_block/CMakeLists.txt | Adds the raw_block engine static library target and deps. |
| userspace/libscap/CMakeLists.txt | Builds/links raw_block engine when enabled. |
| cmake/modules/engine_config.cmake | Enables HAS_ENGINE_RAW_BLOCK by default. |
| .github/workflows/ci.yml | Runs sinsp-example with --raw_block and diffs output vs savefile engine. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
geraldcombs
commented
Jul 2, 2026
Contributor
|
LGTM label has been added. DetailsGit tree hash: 571c909d00135556b3a7d4768f217ef7babe924f |
leogr
reviewed
Jul 16, 2026
leogr
left a comment
leogr
left a comment
Member
There was a problem hiding this comment.
Hi,
This is a really nice work 👍
I took a look by myself and then with the help of https://github.com/leogr/falco-expert
It SGTM already, I just have one doubt before the final approve, plus a few minor things (that you're free to ignore 😅 )
See inline comments 👇
Add an engine that lets you process individual scap / pcapng blocks in memory. This lets another application that might have a scap file open make use of the analysis features in libsinsp. Assisted-by: Claude:claude-opus-4-6 claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
Fix a few issues found by Copilot. Assisted-by: GitHub Copilot Signed-off-by: Gerald Combs <gerald@wireshark.org>
Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
Use the savefile engine's next() routine in the raw_block engine. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
…tests Update test.cpp to test blocks incrementally. Add a separate "whole file" option and add it to our CI tests. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
Note that only host-endian data is currently supported. Fix a typo. Signed-off-by: Gerald Combs <gerald@wireshark.org>
geraldcombs
force-pushed
the
raw-block-engine
branch
from
August 12, 2026 00:00
3681475 to
7c9ff44
Compare
leogr
reviewed
Aug 12, 2026
Member
|
The failing |
gnosek
previously approved these changes
Aug 12, 2026
Contributor
|
LGTM label has been added. DetailsGit tree hash: 8b2c240825fd3f85157b09f956c9faba507cc72f |
Add support for concatenated files / mid-stream metadata blocks to the raw block engine. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
Contributor
|
New changes are detected. LGTM label has been removed. |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ekoops, geraldcombs The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
1 similar comment
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ekoops, geraldcombs The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Add a test for the incremental append mode, and change the raw block mode flag to support "whole_file", "incremental_replace", and "incremental_append" modes. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
geraldcombs
force-pushed
the
raw-block-engine
branch
from
August 20, 2026 16:30
8692721 to
1926c02
Compare
This makes it easier to test sinsp::open_raw_block and should improve our code coverage. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Gerald Combs <gerald@wireshark.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an engine that lets you process individual scap / pcapng blocks in memory. This lets another application that might have a scap file open make use of the analysis features in libsinsp.
Assisted-by: Claude:claude-opus-4-6 claude-opus-4-8
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area libscap
/area libsinsp
Does this PR require a change in the driver versions?
What this PR does / why we need it:
This adds a "raw_block" engine, which lets you process events from scap/pcapng blocks in memory. This would let Stratoshark process scap events without having to open capture files concurrently within Stratoshark and libs: https://gitlab.com/wireshark/wireshark/-/work_items/21014.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?: