unmarshal

package
v0.3.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 16, 2026 License: MIT Imports: 10 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	FdTypeOther  uint8 = 0
	FdTypeFile   uint8 = 1
	FdTypeSocket uint8 = 2
)

File descriptor types

View Source 
const (
	AfUnix  uint8 = 1
	AfInet  uint8 = 2
	AfInet6 uint8 = 10
)

Socket families

View Source 
const (
	SockStream uint8 = 1 // TCP
	SockDgram  uint8 = 2 // UDP
)

Socket types

View Source 
const (
	TcpEstablished uint8 = 1
	TcpSynSent     uint8 = 2
	TcpSynRecv     uint8 = 3
	TcpFinWait1    uint8 = 4
	TcpFinWait2    uint8 = 5
	TcpTimeWait    uint8 = 6
	TcpClose       uint8 = 7
	TcpCloseWait   uint8 = 8
	TcpLastAck     uint8 = 9
	TcpListen      uint8 = 10
	TcpClosing     uint8 = 11
)

TCP states

View Source 
const (
	FilePathLen = 256
)
View Source 
const TaskCommLen = 16

Variables

View Source 
var EmptyFileDescriptor = &FileDescriptor{}

EmptyFileDescriptor is used when no file context is available. This allows CEL expressions to safely access socket/file fields without nil checks.

Functions

func FormatMemory 

func FormatMemory(bytes uint64) string

FormatMemory formats bytes as human-readable (KB, MB, GB)

Types

type Capabilities added in v0.3.0 

type Capabilities struct {
	Effective   uint64 `cel:"effective"`
	Permitted   uint64 `cel:"permitted"`
	Inheritable uint64 `cel:"inheritable"`
}

Capabilities holds the Linux capability sets for a process

type FileDescriptor 

type FileDescriptor struct {
	Pid  int32 `cel:"pid"`
	Tid  int32 `cel:"tid"`
	Ppid int32 `cel:"ppid"`
	Fd   int32 `cel:"fd"`

	// Type information
	FdType     uint8 `cel:"fdType"`
	SockFamily uint8 `cel:"family"`
	SockType   uint8 `cel:"type"`
	SockState  uint8 `cel:"state"`

	// For regular files
	Path string `cel:"path"`

	// For inet sockets
	SrcAddr net.IP `cel:"srcAddr"`
	DstAddr net.IP `cel:"dstAddr"`
	SrcPort int32  `cel:"srcPort"`
	DstPort int32  `cel:"dstPort"`

	// For unix sockets
	UnixPath string `cel:"unixPath"`
}

func (*FileDescriptor) DstAddrStr 

func (f *FileDescriptor) DstAddrStr() string

DstAddrStr returns the destination address as a string (for CEL filtering)

func (*FileDescriptor) IsEstablished 

func (f *FileDescriptor) IsEstablished() bool

IsEstablished returns true if this is an established TCP connection

func (*FileDescriptor) IsListening 

func (f *FileDescriptor) IsListening() bool

IsListening returns true if this is a listening socket

func (*FileDescriptor) IsRegularFile 

func (f *FileDescriptor) IsRegularFile() bool

IsRegularFile returns true if this is a regular file (not a socket)

func (*FileDescriptor) IsSocket 

func (f *FileDescriptor) IsSocket() bool

IsSocket returns true if this is a socket file descriptor

func (*FileDescriptor) IsTCP 

func (f *FileDescriptor) IsTCP() bool

IsTCP returns true if this is a TCP socket

func (*FileDescriptor) IsUDP 

func (f *FileDescriptor) IsUDP() bool

IsUDP returns true if this is a UDP socket

func (*FileDescriptor) IsUnix 

func (f *FileDescriptor) IsUnix() bool

IsUnix returns true if this is a Unix socket

func (*FileDescriptor) Port 

func (f *FileDescriptor) Port() int32

Port returns the local port (srcPort) for convenience

func (*FileDescriptor) Protocol 

func (f *FileDescriptor) Protocol() string

Protocol returns the protocol as a string ("tcp", "udp", "unix", or "other")

func (*FileDescriptor) ProtocolString 

func (f *FileDescriptor) ProtocolString() string

ProtocolString returns a human-readable protocol name

func (FileDescriptor) Size 

func (FileDescriptor) Size() int

Size returns the size of the raw file descriptor in bytes

func (*FileDescriptor) SrcAddrStr 

func (f *FileDescriptor) SrcAddrStr() string

SrcAddrStr returns the source address as a string (for CEL filtering)

func (*FileDescriptor) State 

func (f *FileDescriptor) State() string

State returns the socket state as a string (for CEL filtering)

func (*FileDescriptor) StateString 

func (f *FileDescriptor) StateString() string

StateString returns a human-readable socket state (ss-style output) For UDP sockets, only UNCONN (unconnected) or ESTAB (connected) are meaningful

func (*FileDescriptor) String 

func (f *FileDescriptor) String() string

func (*FileDescriptor) Unmarshal 

func (f *FileDescriptor) Unmarshal(data []byte) error

type Namespaces added in v0.3.0 

type Namespaces struct {
	Uts    int64 `cel:"uts"`
	Ipc    int64 `cel:"ipc"`
	Mnt    int64 `cel:"mnt"`
	Pid    int64 `cel:"pid"`
	Net    int64 `cel:"net"`
	Cgroup int64 `cel:"cgroup"`
}

Namespaces holds the namespace inode numbers for a process

type ProcessState 

type ProcessState uint32

ProcessState represents the Linux process state 

const (
	TaskRunning         ProcessState = 0x00000000
	TaskInterruptible   ProcessState = 0x00000001
	TaskUninterruptible ProcessState = 0x00000002
	TaskStopped         ProcessState = 0x00000004
	TaskTraced          ProcessState = 0x00000008
	ExitDead            ProcessState = 0x00000010
	ExitZombie          ProcessState = 0x00000020
	TaskParked          ProcessState = 0x00000040
	TaskDead            ProcessState = 0x00000080
	TaskWakekill        ProcessState = 0x00000100
	TaskWaking          ProcessState = 0x00000200
	TaskNoload          ProcessState = 0x00000400
	TaskNew             ProcessState = 0x00000800
	TaskRtmutexWait     ProcessState = 0x00001000
	TaskFreezing        ProcessState = 0x00002000
	TaskFrozen          ProcessState = 0x00008000
)

func (ProcessState) StateChar 

func (s ProcessState) StateChar() string

StateChar returns a single character representing the process state (like ps)

type TaskDescriptor 

type TaskDescriptor struct {
	Euid      int32                     `cel:"euid"`
	Ruid      int32                     `cel:"ruid"`
	Suid      int32                     `cel:"suid"`
	Pid       int32                     `cel:"pid"`
	Tid       int32                     `cel:"tid"`
	Ppid      int32                     `cel:"ppid"`
	State     ProcessState              `cel:"state"`
	StartTime uint64                    `cel:"startTime"` // nanoseconds since boot
	Utime     uint64                    `cel:"utime"`     // user CPU time in nanoseconds
	Stime     uint64                    `cel:"stime"`     // system CPU time in nanoseconds
	Vsz       uint64                    `cel:"vsz"`       // virtual memory size in bytes
	Rss       uint64                    `cel:"rss"`       // resident set size in bytes
	Comm      string                    `cel:"name"`      // process name (comm)
	Cmdline   string                    `cel:"cmdline"`
	User      string                    `cel:"user"`         // username resolved from Euid
	Caps      Capabilities              `cel:"capabilities"` // process capabilities
	Ns        Namespaces                `cel:"namespaces"`   // process namespaces
	Files     []*FileDescriptor         `cel:"files"`        // associated file descriptors
	Container *containers.ContainerInfo `cel:"container"`    // container info (nil if not in container)
}

func (*TaskDescriptor) AddFile 

func (t *TaskDescriptor) AddFile(f *FileDescriptor)

AddFile adds a file descriptor to this task

func (*TaskDescriptor) CpuPercent 

func (t *TaskDescriptor) CpuPercent(bootTime time.Time) float64

CpuPercent calculates CPU usage percentage This is a rough estimate based on total CPU time / elapsed time

func (*TaskDescriptor) Enrich 

func (t *TaskDescriptor) Enrich()

Enrich reads additional info that can't be obtained from BPF. - cmdline: BPF iterators have restrictions on reading userspace memory - user: resolved from euid

func (*TaskDescriptor) FormatStartTime 

func (t *TaskDescriptor) FormatStartTime(bootTime time.Time) string

FormatStartTime formats the start time as a human-readable string

func (*TaskDescriptor) GetRegularFiles 

func (t *TaskDescriptor) GetRegularFiles() []*FileDescriptor

GetRegularFiles returns all regular file descriptors (non-sockets)

func (*TaskDescriptor) GetSockets 

func (t *TaskDescriptor) GetSockets() []*FileDescriptor

GetSockets returns all socket file descriptors

func (*TaskDescriptor) GetTCPSockets 

func (t *TaskDescriptor) GetTCPSockets() []*FileDescriptor

GetTCPSockets returns all TCP socket file descriptors

func (*TaskDescriptor) GetUDPSockets 

func (t *TaskDescriptor) GetUDPSockets() []*FileDescriptor

GetUDPSockets returns all UDP socket file descriptors

func (*TaskDescriptor) GetUnixSockets 

func (t *TaskDescriptor) GetUnixSockets() []*FileDescriptor

GetUnixSockets returns all Unix socket file descriptors

func (*TaskDescriptor) InContainer 

func (t *TaskDescriptor) InContainer() bool

InContainer returns true if this process is running in a container

func (*TaskDescriptor) SetContainer 

func (t *TaskDescriptor) SetContainer(c *containers.ContainerInfo)

SetContainer sets the container info for this task

func (*TaskDescriptor) SetFiles 

func (t *TaskDescriptor) SetFiles(files []*FileDescriptor)

SetFiles sets the file descriptors for this task

func (TaskDescriptor) Size 

func (TaskDescriptor) Size() int

Size returns the size of the raw task descriptor in bytes

func (*TaskDescriptor) Unmarshal 

func (t *TaskDescriptor) Unmarshal(data []byte) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.