Documentation
¶
Overview ¶
Package envreassembler handles reassembly of environment variable data from eBPF events.
eBPF sends environment and argument data in two ways:
- Chunk-based: Large data split into multiple EnvChunkEvent messages
- Streaming: Individual variables sent as EnvVarEvent messages
State Machine (ChunkReassembler):
┌─────────┐
│ Start │
└────┬────┘
│
│ EnvChunkEvent (IsFinal=0)
▼
┌──────────┐
│Buffering │ ◄──┐
└────┬─────┘ │ More chunks
│ │
│ EnvChunkEvent (IsFinal=1)
▼ │
┌──────────┐ │
│ Reassemble│ │
└────┬─────┘ │
│ │
▼ │
┌──────────┐ │
│ Complete │ │
└──────────┘ │
State Machine (StreamingReassembler):
┌─────────┐
│ Start │
└────┬────┘
│
│ EnvVarEvent (IsFinal=0)
▼
┌───────────┐
│Collecting │ ◄──┐
└────┬──────┘ │ More variables
│ │
│ EnvVarEvent (IsFinal=1)
▼ │
┌──────────┐ │
│ Finalize │ │
└────┬─────┘ │
│ │
▼ │
┌──────────┐ │
│ Complete │ │
└──────────┘ │
Both produce ReassembledData containing:
- Args: []string - Command-line arguments
- Env: map[string]string - Environment variables
- Issues: []string - Warnings about truncation or missing data
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ChunkBuffer ¶
type ChunkBuffer struct {
// contains filtered or unexported fields
}
ChunkBuffer holds incomplete environment chunk sequences.
type ChunkReassembler ¶
type ChunkReassembler struct {
// contains filtered or unexported fields
}
ChunkReassembler handles reassembly of chunked environment data from execve events.
func NewChunkReassembler ¶
func NewChunkReassembler() *ChunkReassembler
NewChunkReassembler creates a new chunk reassembler.
func (*ChunkReassembler) Cleanup ¶
func (r *ChunkReassembler) Cleanup(maxAge time.Duration) int
Cleanup removes stale chunk buffers that haven't been updated recently.
func (*ChunkReassembler) HandleChunk ¶
func (r *ChunkReassembler) HandleChunk(chunk *bpf.EnvChunkEvent) (*ReassembledData, error)
HandleChunk processes a single environment chunk event. Returns the reassembled data if this was the final chunk, or nil if more chunks are expected.
type ReassembledData ¶
ReassembledData represents the result of chunk reassembly.
type StreamingReassembler ¶
type StreamingReassembler struct {
// contains filtered or unexported fields
}
StreamingReassembler handles reassembly of streaming environment variable events.
func NewStreamingReassembler ¶
func NewStreamingReassembler() *StreamingReassembler
NewStreamingReassembler creates a new streaming reassembler.
func (*StreamingReassembler) Cleanup ¶
func (s *StreamingReassembler) Cleanup(maxAge time.Duration) int
Cleanup removes stale collectors that haven't been updated recently.
func (*StreamingReassembler) HandleVar ¶
func (s *StreamingReassembler) HandleVar(envVar *bpf.EnvVarEvent) (*ReassembledData, error)
HandleVar processes a single environment variable event. Returns the reassembled data if collection is complete, or nil if more variables are expected.
type VarCollector ¶
type VarCollector struct {
// contains filtered or unexported fields
}
VarCollector holds streaming environment variables from execve events.
Source Files