fix(c++): improve const correctness

Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>

unit_tests/engine/test_rule_loader.cpp

@@ -62,7 +62,7 @@ class engine_loader_test : public ::testing::Test {
 			return false;
 		}
 
-		for(auto &warn : m_load_result_json["warnings"])
+		for(const auto &warn : m_load_result_json["warnings"])
 		{
 			std::string msg = warn["message"];
 			// Debug:
@@ -84,7 +84,7 @@ class engine_loader_test : public ::testing::Test {
 			return false;
 		}
 
-		for(auto &err : m_load_result_json["errors"])
+		for(const auto &err : m_load_result_json["errors"])
 		{
 			std::string msg = err["message"];
 			// Debug:

userspace/engine/evttype_index_ruleset.cpp

@@ -115,7 +115,7 @@ bool evttype_index_ruleset::ruleset_filters::run(sinsp_evt *evt, falco_rule& mat
 {
     if(evt->get_type() < m_filter_by_event_type.size())
     {
-        for(auto &wrap : m_filter_by_event_type[evt->get_type()])
+        for(const auto &wrap : m_filter_by_event_type[evt->get_type()])
         {
             if(wrap->filter->run(evt))
             {
@@ -126,7 +126,7 @@ bool evttype_index_ruleset::ruleset_filters::run(sinsp_evt *evt, falco_rule& mat
     }
 
 	// Finally, try filters that are not specific to an event type.
-	for(auto &wrap : m_filter_all_event_types)
+	for(const auto &wrap : m_filter_all_event_types)
 	{
 		if(wrap->filter->run(evt))
 		{
@@ -144,7 +144,7 @@ bool evttype_index_ruleset::ruleset_filters::run(sinsp_evt *evt, std::vector<fal
 
 	if(evt->get_type() < m_filter_by_event_type.size())
 	{
-		for(auto &wrap : m_filter_by_event_type[evt->get_type()])
+		for(const auto &wrap : m_filter_by_event_type[evt->get_type()])
 		{
 			if(wrap->filter->run(evt))
 			{
@@ -160,7 +160,7 @@ bool evttype_index_ruleset::ruleset_filters::run(sinsp_evt *evt, std::vector<fal
 	}
 
 	// Finally, try filters that are not specific to an event type.
-	for(auto &wrap : m_filter_all_event_types)
+	for(const auto &wrap : m_filter_all_event_types)
 	{
 		if(wrap->filter->run(evt))
 		{
@@ -175,7 +175,7 @@ bool evttype_index_ruleset::ruleset_filters::run(sinsp_evt *evt, std::vector<fal
 libsinsp::events::set<ppm_sc_code> evttype_index_ruleset::ruleset_filters::sc_codes()
 {
 	libsinsp::events::set<ppm_sc_code> res;
-	for(auto &wrap : m_filters)
+	for(const auto &wrap : m_filters)
 	{
 		res.insert(wrap->sc_codes.begin(), wrap->sc_codes.end());
 	}
@@ -185,7 +185,7 @@ libsinsp::events::set<ppm_sc_code> evttype_index_ruleset::ruleset_filters::sc_co
 libsinsp::events::set<ppm_event_code> evttype_index_ruleset::ruleset_filters::event_codes()
 {
 	libsinsp::events::set<ppm_event_code> res;
-	for(auto &wrap : m_filters)
+	for(const auto &wrap : m_filters)
 	{
 		res.insert(wrap->event_codes.begin(), wrap->event_codes.end());
 	}

userspace/engine/falco_common.cpp

@@ -33,7 +33,7 @@ static std::vector<std::string> rule_matching_names = {
 	"all"
 };
 
-bool falco_common::parse_priority(std::string v, priority_type& out)
+bool falco_common::parse_priority(const std::string& v, priority_type& out)
 {
 	for (size_t i = 0; i < priority_names.size(); i++)
 	{
@@ -50,7 +50,7 @@ bool falco_common::parse_priority(std::string v, priority_type& out)
 	return false;
 }
 
-falco_common::priority_type falco_common::parse_priority(std::string v)
+falco_common::priority_type falco_common::parse_priority(const std::string& v)
 {
 	falco_common::priority_type out;
 	if (!parse_priority(v, out))
@@ -87,7 +87,7 @@ std::string falco_common::format_priority(priority_type v, bool shortfmt)
 	return out;
 }
 
-bool falco_common::parse_rule_matching(std::string v, rule_matching& out)
+bool falco_common::parse_rule_matching(const std::string& v, rule_matching& out)
 {
 	for (size_t i = 0; i < rule_matching_names.size(); i++)
 	{

userspace/engine/falco_common.h

@@ -57,8 +57,8 @@ namespace falco_common
 		PRIORITY_DEBUG = 7
 	};
 
-	bool parse_priority(std::string v, priority_type& out);
-	priority_type parse_priority(std::string v);
+	bool parse_priority(const std::string& v, priority_type& out);
+	priority_type parse_priority(const std::string& v);
 	bool format_priority(priority_type v, std::string& out, bool shortfmt=false);
 	std::string format_priority(priority_type v, bool shortfmt=false);
 
@@ -68,5 +68,5 @@ namespace falco_common
 		ALL = 1
 	};
 
-	bool parse_rule_matching(std::string v, rule_matching& out);
+	bool parse_rule_matching(const std::string& v, rule_matching& out);
 };

userspace/engine/falco_engine.cpp

@@ -120,7 +120,7 @@ static std::string fieldclass_key(const sinsp_filter_factory::filter_fieldclass_
 	return fld_info.name + fld_info.shortdesc;
 }
 
-void falco_engine::list_fields(std::string &source, bool verbose, bool names_only, bool markdown) const
+void falco_engine::list_fields(const std::string &source, bool verbose, bool names_only, bool markdown) const
 {
 	// Maps from field class name + short desc to list of event
 	// sources for which this field class can be used.
@@ -360,7 +360,7 @@ uint64_t falco_engine::num_rules_for_ruleset(const std::string &ruleset)
 	return ret;
 }
 
-void falco_engine::evttypes_for_ruleset(std::string &source, std::set<uint16_t> &evttypes, const std::string &ruleset)
+void falco_engine::evttypes_for_ruleset(const std::string &source, std::set<uint16_t> &evttypes, const std::string &ruleset)
 {
 	find_source(source)->ruleset->enabled_evttypes(evttypes, find_ruleset_id(ruleset));
 }
@@ -422,7 +422,7 @@ std::unique_ptr<std::vector<falco_engine::rule_result>> falco_engine::process_ev
 	}
 
 	auto res = std::make_unique<std::vector<falco_engine::rule_result>>();
-	for(auto rule : source->m_rules)
+	for(const auto& rule : source->m_rules)
 	{
 		rule_result rule_result;
 		rule_result.evt = ev;
@@ -1025,7 +1025,7 @@ void falco_engine::fill_engine_state_funcs(filter_ruleset::engine_state_funcs &e
 {
 	engine_state.get_ruleset = [this](const std::string &source_name, std::shared_ptr<filter_ruleset> &ruleset) -> bool
 	{
-		falco_source *src = m_sources.at(source_name);
+		const falco_source *src = m_sources.at(source_name);
 		if(src == nullptr)
 		{
 			return false;
@@ -1055,7 +1055,7 @@ void falco_engine::set_sampling_multiplier(double sampling_multiplier)
 	m_sampling_multiplier = sampling_multiplier;
 }
 
-void falco_engine::set_extra(std::string &extra, bool replace_container_info)
+void falco_engine::set_extra(const std::string &extra, bool replace_container_info)
 {
 	m_extra = extra;
 	m_replace_container_info = replace_container_info;

userspace/engine/falco_engine.h

@@ -64,7 +64,7 @@ class falco_engine
 
 	// Print to stdout (using printf) a description of each field supported by this engine.
 	// If source is non-empty, only fields for the provided source are printed.
-	void list_fields(std::string &source, bool verbose, bool names_only, bool markdown) const;
+	void list_fields(const std::string &source, bool verbose, bool names_only, bool markdown) const;
 
 	// Provide an alternate rule reader, collector, and compiler
 	// to compile any rules provided via load_rules*
@@ -168,7 +168,7 @@ class falco_engine
 	// add k8s/container information to outputs when
 	// available.
 	//
-	void set_extra(std::string &extra, bool replace_container_info);
+	void set_extra(const std::string &extra, bool replace_container_info);
 
 	// Represents the result of matching an event against a set of
 	// rules.
@@ -271,7 +271,7 @@ class falco_engine
 	// typing-improved `enabled_event_codes` and `enabled_sc_codes` instead
 	// todo(jasondellaluce): remove this in future code refactors
 	//
-	void evttypes_for_ruleset(std::string &source,
+	void evttypes_for_ruleset(const std::string &source,
 				  std::set<uint16_t> &evttypes,
 				  const std::string &ruleset = s_default_ruleset);
 

userspace/engine/filter_ruleset.cpp

@@ -17,7 +17,7 @@ limitations under the License.
 
 #include "filter_ruleset.h"
 
-void filter_ruleset::set_engine_state(filter_ruleset::engine_state_funcs& engine_state)
+void filter_ruleset::set_engine_state(const filter_ruleset::engine_state_funcs& engine_state)
 {
 	m_engine_state = engine_state;
 }

userspace/engine/filter_ruleset.h

@@ -43,7 +43,7 @@ class filter_ruleset
 
 	virtual ~filter_ruleset() = default;
 
-	void set_engine_state(engine_state_funcs &engine_state);
+	void set_engine_state(const engine_state_funcs &engine_state);
 	engine_state_funcs &get_engine_state();
 
 	/*!

userspace/engine/formats.cpp

@@ -34,7 +34,7 @@ falco_formats::~falco_formats()
 }
 
 std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule, const std::string &source,
-				   const std::string &level, const std::string &format, std::set<std::string> &tags,
+				   const std::string &level, const std::string &format, const std::set<std::string> &tags,
 				   const std::string &hostname) const
 {
 	std::string line;
@@ -101,7 +101,7 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
 			}
 			else
 			{
-				for (auto &tag : tags)
+				for (const auto &tag : tags)
 				{
 					rule_tags[rule_tags_idx++] = tag;
 				}
@@ -128,7 +128,7 @@ std::string falco_formats::format_event(sinsp_evt *evt, const std::string &rule,
 		line = full_line;
 	}
 
-	return line.c_str();
+	return line;
 }
 
 std::map<std::string, std::string> falco_formats::get_field_values(sinsp_evt *evt, const std::string &source,

userspace/engine/formats.h

@@ -30,7 +30,7 @@ class falco_formats
 	virtual ~falco_formats();
 
 	std::string format_event(sinsp_evt *evt, const std::string &rule, const std::string &source,
-				 const std::string &level, const std::string &format, std::set<std::string> &tags,
+				 const std::string &level, const std::string &format, const std::set<std::string> &tags,
 				 const std::string &hostname) const;
 
 	std::map<std::string, std::string> get_field_values(sinsp_evt *evt, const std::string &source,

userspace/engine/rule_loader.cpp

@@ -140,7 +140,7 @@ std::string rule_loader::context::as_string()
 
 	bool first = true;
 
-	for(auto& loc : m_locs)
+	for(const auto& loc : m_locs)
 	{
 		os << (first ? "In " : "    ");
 		first = false;
@@ -174,7 +174,7 @@ nlohmann::json rule_loader::context::as_json()
 		throw falco_exception("rule_loader::context without location?");
 	}
 
-	for(auto& loc : m_locs)
+	for(const auto& loc : m_locs)
 	{
 		nlohmann::json jloc, jpos;
 

userspace/engine/rule_loader_collector.cpp

@@ -78,15 +78,15 @@ static void validate_exception_info(
 		THROW(ex.fields.items.size() != ex.comps.items.size(),
 		       "Fields and comps lists must have equal length",
 		       ex.ctx);
-		for (auto &v : ex.comps.items)
+		for (const auto &v : ex.comps.items)
 		{
 			THROW(!is_operator_defined(v.item),
 			      std::string("'") + v.item + "' is not a supported comparison operator",
 			      ex.ctx);
 		}
 		if (source)
 		{
-			for (auto &v : ex.fields.items)
+			for (const auto &v : ex.fields.items)
 			{
 				THROW(!source->is_field_defined(v.item),
 					std::string("'") + v.item + "' is not a supported filter field",
@@ -212,12 +212,12 @@ void rule_loader::collector::append(configuration& cfg, macro_info& info)
 
 void rule_loader::collector::define(configuration& cfg, rule_info& info)
 {
-	auto prev = m_rule_infos.at(info.name);
+	const auto* prev = m_rule_infos.at(info.name);
 	THROW(prev && prev->source != info.source,
 		"Rule has been re-defined with a different source",
 		info.ctx);
 
-	auto source = cfg.sources.at(info.source);
+	const auto* source = cfg.sources.at(info.source);
 	if (!source)
 	{
 		info.unknown_source = true;
@@ -248,7 +248,7 @@ void rule_loader::collector::append(configuration& cfg, rule_update_info& info)
 
 	// note: source can be nullptr in case we've collected a
 	// rule for which the source is unknown
-	falco_source* source = nullptr;
+	const falco_source* source = nullptr;
 	if (!prev->unknown_source)
 	{
 		// note: if the source is not unknown, this should not return nullptr
@@ -330,7 +330,7 @@ void rule_loader::collector::selective_replace(configuration& cfg, rule_update_i
 
 	// note: source can be nullptr in case we've collected a
 	// rule for which the source is unknown
-	falco_source* source = nullptr;
+	const falco_source* source = nullptr;
 	if (!prev->unknown_source)
 	{
 		// note: if the source is not unknown, this should not return nullptr

userspace/engine/rule_loader_compiler.cpp

@@ -394,7 +394,7 @@ void rule_loader::compiler::compile_macros_infos(
 	filter_macro_resolver macro_resolver;
 	for (auto &m : out)
 	{
-		auto info = macro_info_from_name(col, m.name);
+		const auto* info = macro_info_from_name(col, m.name);
 		resolve_macros(macro_resolver, col.macros(), out, m.condition, info->cond, info->visibility, info->ctx);
 	}
 }

userspace/engine/rule_loader_reader.cpp

@@ -314,7 +314,7 @@ static void read_rule_exceptions(
 			rule_loader::context vals_ctx(exvals, rule_loader::context::EXCEPTION_VALUES, "", ex_ctx);
 			THROW(!exvals.IsSequence(),
 			       "Rule exception values must be a sequence", vals_ctx);
-			for (auto &val : exvals)
+			for (const auto &val : exvals)
 			{
 				rule_loader::context vctx(val, rule_loader::context::EXCEPTION_VALUE, "", vals_ctx);
 				rule_loader::rule_exception_info::entry v_ex_val;
@@ -654,7 +654,7 @@ void rule_loader::reader::read_item(
 			}
 
 			// if any expected key has not been defined throw an error
-			for (auto &key : expected_keys) {
+			for (const auto &key : expected_keys) {
 				rule_loader::context keyctx(item[key], rule_loader::context::OVERRIDE, key, ctx);
 				THROW(true, "Unexpected key '" + key + "': no corresponding entry under 'override' is defined.", keyctx);
 			}

userspace/falco/app/actions/actions.h

@@ -26,29 +26,29 @@ namespace actions {
 
 falco::app::run_result configure_interesting_sets(falco::app::state& s);
 falco::app::run_result configure_syscall_buffer_size(falco::app::state& s);
-falco::app::run_result configure_syscall_buffer_num(falco::app::state& s);
+falco::app::run_result configure_syscall_buffer_num(const falco::app::state& s);
 falco::app::run_result create_requested_paths(falco::app::state& s);
 falco::app::run_result create_signal_handlers(falco::app::state& s);
-falco::app::run_result pidfile(falco::app::state& s);
+falco::app::run_result pidfile(const falco::app::state& s);
 falco::app::run_result init_falco_engine(falco::app::state& s);
 falco::app::run_result init_inspectors(falco::app::state& s);
 falco::app::run_result init_outputs(falco::app::state& s);
 falco::app::run_result list_fields(falco::app::state& s);
-falco::app::run_result list_plugins(falco::app::state& s);
-falco::app::run_result load_config(falco::app::state& s);
+falco::app::run_result list_plugins(const falco::app::state& s);
+falco::app::run_result load_config(const falco::app::state& s);
 falco::app::run_result load_plugins(falco::app::state& s);
 falco::app::run_result load_rules_files(falco::app::state& s);
 falco::app::run_result print_generated_gvisor_config(falco::app::state& s);
 falco::app::run_result print_help(falco::app::state& s);
-falco::app::run_result print_ignored_events(falco::app::state& s);
-falco::app::run_result print_kernel_version(falco::app::state& s);
-falco::app::run_result print_page_size(falco::app::state& s);
-falco::app::run_result print_plugin_info(falco::app::state& s);
+falco::app::run_result print_ignored_events(const falco::app::state& s);
+falco::app::run_result print_kernel_version(const falco::app::state& s);
+falco::app::run_result print_page_size(const falco::app::state& s);
+falco::app::run_result print_plugin_info(const falco::app::state& s);
 falco::app::run_result print_support(falco::app::state& s);
 falco::app::run_result print_syscall_events(falco::app::state& s);
 falco::app::run_result print_version(falco::app::state& s);
 falco::app::run_result process_events(falco::app::state& s);
-falco::app::run_result require_config_file(falco::app::state& s);
+falco::app::run_result require_config_file(const falco::app::state& s);
 falco::app::run_result select_event_sources(falco::app::state& s);
 falco::app::run_result start_grpc_server(falco::app::state& s);
 falco::app::run_result start_webserver(falco::app::state& s);

userspace/falco/app/actions/configure_syscall_buffer_num.cpp

@@ -20,7 +20,7 @@ limitations under the License.
 using namespace falco::app;
 using namespace falco::app::actions;
 
-falco::app::run_result falco::app::actions::configure_syscall_buffer_num(falco::app::state& s)
+falco::app::run_result falco::app::actions::configure_syscall_buffer_num(const falco::app::state& s)
 {
 #ifdef __linux__
 	if(!s.is_modern_ebpf())

userspace/falco/app/actions/helpers.h

@@ -47,7 +47,7 @@ void read_files(InputIterator begin, InputIterator end,
 	// Read the contents in a first pass
 	for(auto it = begin; it != end; it++)
 	{
-		std::string &filename = *it;
+		const std::string &filename = *it;
 		std::ifstream is;
 		is.open(filename);
 		if (!is.is_open())