perf(userspace/libscap): rewrite /proc/pid/net/{tcp6,udp6,raw6} parsing logic#2816
Merged
poiana merged 2 commits intofalcosecurity:masterfrom Feb 3, 2026
Merged
Conversation
Perf diff from master - unit testsHeap diff from master - unit testsHeap diff from master - scap fileBenchmarks diff from master |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2816 +/- ##
=======================================
Coverage 74.53% 74.53%
=======================================
Files 292 292
Lines 29987 29987
Branches 4660 4660
=======================================
Hits 22350 22350
Misses 7637 7637
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
ekoops
force-pushed
the
ekoops/proc-pid-net-ipv6
branch
from
7f5ecfb to
d2c470b
Compare
terror96
reviewed
Feb 2, 2026
…sing logic
The previous logic used 1 single `fopen()` to open the
`/proc/<pid>/net/{tcp6,udp6,raw6}`/`/proc/net/{tcp6,udp6,raw6}` files,
and `fread()` to read the content of the file in a single
heap-allocated buffer of 1MB.
The new parsing logic introduces the following optimizations:
- use `open()` and `read()` to avoid `fopen()` and `fread()`
allocation, buffering and lock acquisition overheads
- try to read the entire file content with a single `read()`. In the
case in which the file content is bigger than the stack-allocated
buffer of 32kB, the unprocessed content (the last truncated line) is
shifted at the beginning of the buffer, and a new read is attempted.
Notice that 32 kB is a good choice for the majority of the use
cases. Each file line is approximately 150 bytes. The following
table estimate how many `read()` system call are issued in the
optimistic case (e.g.: no signals):
- 100 sockets -> ~15 kB -> 1 read()
- 1000 sockets -> ~150 kB -> ~5 read()
- 10000 sockets -> ~1.5 MB -> ~50 read()
Even in the worst scenario, the cost of issuing 50 system call
should be overcome by the cache-friendly accesses using the
stack-allocated buffer.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
ekoops
force-pushed
the
ekoops/proc-pid-net-ipv6
branch
from
d2c470b to
98afca3
Compare
Contributor
Author
|
Fixed and pushed! @terror96 |
terror96
approved these changes
Feb 2, 2026
Contributor
terror96
left a comment
terror96
left a comment
There was a problem hiding this comment.
My eyes can't spot more problems: /lgtm
leogr
approved these changes
Feb 3, 2026
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ekoops, leogr, terror96 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
20 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind cleanup
Any specific area of the project related to this PR?
/area libscap
Does this PR require a change in the driver versions?
What this PR does / why we need it:
The previous logic used 1 single
fopen()to open the/proc/<pid>/net/{tcp6,udp6,raw6}//proc/net/{tcp6,udp6,raw6}files, andfread()to read the content of the file in a single heap-allocated buffer of 1MB.The new parsing logic introduces the following optimizations:
parse_procfs_proc_pid_socket_table_file()for efficiently read the socket table file content and (this uses lighteropen()andread()system calls, a stack-allocated for cache locality and a sliding window logic for handling truncated lines).parse_ipv6_socket_table_line()uses light helper likestr_scan_u64(),scan_ipv6_socket_table_address()andmemchr(); moreover, avoid polluting the cache by repeatedly write on the line buffer while parsing the addresses and portsWhich issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
/milestone 0.24.0
Does this PR introduce a user-facing change?: