NETOBSERV-2143 improve pcapng implementation

[jpinsonneau]

Description

Rely on comments to add enrichment to the pcap:

Also fixed the end capture behavior

Dependencies

n/a

Checklist

If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.

• Is this PR backed with a JIRA ticket? If so, make sure it is written as a title prefix (in general, PRs affecting the NetObserv/Network Observability product should be backed with a JIRA ticket - especially if they bring user facing changes).
• Does this PR require product documentation?
  • If so, make sure the JIRA epic is labelled with "documentation" and provides a description relevant for doc writers, such as use cases or scenarios. Any required step to activate or configure the feature should be documented there, such as new CRD knobs.
• Does this PR require a product release notes entry?
  • If so, fill in "Release Note Text" in the JIRA.
• Is there anything else the QE team should know before testing? E.g: configuration changes, environment setup, etc.
  • If so, make sure it is described in the JIRA ticket.
• QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[jpinsonneau]

This points on an open PR which never been merged: google/gopacket#1076

Let me know if you prefer to have our own implementation in netobserv org

[jotak]

is there a reason to use google/gopacket rather than gopacket/gopacket? I kind of remember in the ebpf agent we switch to the latter, can't remember the exact reason, but I think gopacket/gopacket was more up to date.
And it sounds like it also have ngread: https://github.com/search?q=repo%3Agopacket%2Fgopacket%20ngread&type=code

[jpinsonneau]

I compared GameFabric/sts-pkg-gopacket to gopacket/gopacket and it doesn't contains the comments capabilities I'm looking for:

So I need to keep the replace part wich forces me to keep the google one since the modules been renamed between the two:

module declares its path as: github.com/google/gopacket
	        but was required as: github.com/gopacket/gopacket

Unless we want to have our own implementation in netobserv repos as mentionned before ?

[jotak]

So I think we need to fork it. The replacement used here seems to be from 2023, could be pretty bad for security...

[jpinsonneau]

oh it seems like the main branch actually contains something for comments !

[jpinsonneau]

376e136

[codecov]

Codecov Report

Attention: Patch coverage is 31.46067% with 61 lines in your changes missing coverage. Please review.

Project coverage is 22.83%. Comparing base (9cceb49) to head (376e136).
Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/packet_capture.go	0.00%	49 Missing ⚠️
cmd/map_format.go	80.00%	7 Missing ⚠️
cmd/flow_display.go	0.00%	4 Missing ⚠️
cmd/flow_capture.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #293      +/-   ##
==========================================
+ Coverage   22.60%   22.83%   +0.22%     
==========================================
  Files          14       14              
  Lines        1451     1454       +3     
==========================================
+ Hits          328      332       +4     
  Misses       1099     1099              
+ Partials       24       23       -1     

Flag	Coverage Δ
unittests	22.83% <31.46%> (+0.22%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/root.go	22.54% <ø> (ø)
cmd/flow_capture.go	6.19% <0.00%> (+0.16%)	⬆️
cmd/flow_display.go	46.11% <0.00%> (-0.22%)	⬇️
cmd/map_format.go	26.20% <80.00%> (+0.42%)	⬆️
cmd/packet_capture.go	0.00% <0.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jotak]

scanner return code seems always ignored, if that's on purpose I'd suggest to make it not returning anything then

[jpinsonneau]

sure, 7043094

[jotak]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jotak. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jotak]

nice!
/lgtm