Documentation
¶
Overview ¶
Package dedupcache provides a lock-free, fixed-size deduplication cache for high-throughput eBPF event filtering before CEL rule evaluation.
Index ¶
- func ComputeCapabilitiesKey(mntns uint64, pid uint32, capability string, syscall string) uint64
- func ComputeDNSKey(mntns uint64, dnsName string) uint64
- func ComputeHTTPKey(mntns uint64, pid uint32, direction string, method string, host string, ...) uint64
- func ComputeHardlinkKey(mntns uint64, pid uint32, oldPath string, newPath string) uint64
- func ComputeNetworkKey(mntns uint64, pid uint32, dstAddr string, dstPort uint16, proto string) uint64
- func ComputeOpenKey(mntns uint64, pid uint32, path string, flagsRaw uint32) uint64
- func ComputePtraceKey(mntns uint64, pid uint32, exePath string) uint64
- func ComputeSSHKey(mntns uint64, dstIP string, dstPort uint16) uint64
- func ComputeSymlinkKey(mntns uint64, pid uint32, oldPath string, newPath string) uint64
- func ComputeSyscallKey(mntns uint64, pid uint32, syscall string) uint64
- type DedupCache
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ComputeCapabilitiesKey ¶
ComputeCapabilitiesKey computes a dedup key for capabilities events.
func ComputeDNSKey ¶
ComputeDNSKey computes a dedup key for DNS events. No qtype getter exists in the interface, so key is mntns + dnsName.
func ComputeHTTPKey ¶
func ComputeHTTPKey(mntns uint64, pid uint32, direction string, method string, host string, path string, rawQuery string) uint64
ComputeHTTPKey computes a dedup key for HTTP events.
func ComputeHardlinkKey ¶
ComputeHardlinkKey computes a dedup key for hardlink events.
func ComputeNetworkKey ¶
func ComputeNetworkKey(mntns uint64, pid uint32, dstAddr string, dstPort uint16, proto string) uint64
ComputeNetworkKey computes a dedup key for network events.
func ComputeOpenKey ¶
ComputeOpenKey computes a dedup key for open events.
func ComputePtraceKey ¶
ComputePtraceKey computes a dedup key for ptrace events.
func ComputeSSHKey ¶
ComputeSSHKey computes a dedup key for SSH events.
func ComputeSymlinkKey ¶
ComputeSymlinkKey computes a dedup key for symlink events.
Types ¶
type DedupCache ¶
type DedupCache struct {
// contains filtered or unexported fields
}
DedupCache is a lock-free, fixed-size deduplication cache. Each slot packs a 48-bit key and 16-bit expiry bucket into a single atomic uint64. Concurrent access from thousands of goroutines is safe without mutexes — benign races only cause missed dedup (safe direction), never false dedup.
func NewDedupCache ¶
func NewDedupCache(slotsExponent uint8) *DedupCache
NewDedupCache creates a cache with 2^slotsExponent slots. Each slot is 8 bytes; e.g. exponent 18 = 262,144 slots = 2 MB. slotsExponent is clamped to [10, 30] (1 KB to 8 GB).
func (*DedupCache) CheckAndSet ¶
func (c *DedupCache) CheckAndSet(key uint64, ttlBuckets uint16, currentBucket uint16) bool
CheckAndSet returns true if the key is already present and not expired (duplicate). Otherwise it inserts the key with expiry = currentBucket + ttlBuckets and returns false.
Source Files