Fuck\!

8 files changed, 457 insertions, 48 deletions

diff --git a/src/connector.go b/src/connector.go
new file mode 100644
index 0000000..278dfe9
--- /dev/null
+++ b/src/connector.go
@@ -0,0 +1,176 @@
+package main
+
+import "unsafe"
+
+const (
+        SizeofCnMsg           = 0x14
+        SizeofProcCnMcastOp   = 0x04
+        SizeofProcEventHeader = 0x10
+        SizeofProcEventData   = 0x18
+)
+
+const (
+        CN_IDX_PROC = 0x1
+        CN_VAL_PROC = 0x1
+)
+
+// linux/connector.h
+type CbId struct {
+        idx uint32
+        val uint32
+}
+
+type CnMsg struct {
+        id    CbId
+        seq   uint32
+        ack   uint32
+        len   uint16
+        flags uint16
+        //data  []uint8
+}
+
+func (cm *CnMsg) Serialize() []byte {
+        return (*(*[SizeofCnMsg]byte)(unsafe.Pointer(cm)))[:]
+}
+
+func (cm *CnMsg) Len() int {
+        return SizeofCnMsg
+}
+
+func NewCnMsg() *CnMsg {
+        return &CnMsg{
+                id:  CbId{idx: CN_IDX_PROC, val: CN_VAL_PROC},
+                seq: 0,
+                ack: 0,
+                len: SizeofProcCnMcastOp,
+        }
+}
+
+type ProcCnMcastOp int
+
+const (
+        _ ProcCnMcastOp = iota
+        PROC_CN_MCAST_LISTEN
+        PROC_CN_MCAST_IGNORE
+)
+
+func (op *ProcCnMcastOp) Serialize() []byte {
+        return (*(*[SizeofProcCnMcastOp]byte)(unsafe.Pointer(op)))[:]
+}
+
+func (op *ProcCnMcastOp) Len() int {
+        return SizeofProcCnMcastOp
+}
+
+type ProcEventType uint32
+
+const (
+        PROC_EVENT_NONE     = 0x00000000
+        PROC_EVENT_FORK     = 0x00000001
+        PROC_EVENT_EXEC     = 0x00000002
+        PROC_EVENT_UID      = 0x00000004
+        PROC_EVENT_GID      = 0x00000040
+        PROC_EVENT_SID      = 0x00000080
+        PROC_EVENT_PTRACE   = 0x00000100
+        PROC_EVENT_COMM     = 0x00000200
+        PROC_EVENT_COREDUMP = 0x40000000
+        PROC_EVENT_EXIT     = 0x80000000
+)
+
+type ProcEventData interface {
+}
+
+// linux/cn_proc.h
+type ProcEvent struct {
+        What      ProcEventType
+        Cpu       uint32
+        Timestamp uint64
+        Data      ProcEventData
+}
+
+type ProcEventNone struct{}
+
+type ProcEventFork struct {
+        ParentPid  int32
+        ParentTgid int32
+        ChildPid   int32
+        ChildTgid  int32
+}
+
+type ProcEventExec struct {
+        ProcessPid  int32
+        ProcessTgid int32
+}
+
+type ProcEventUid struct {
+        ProcessPid  int32
+        ProcessTgid int32
+        RUid        uint32
+        EUid        uint32
+}
+
+type ProcEventGid struct {
+        ProcessPid  int32
+        ProcessTgid int32
+        RGid        uint32
+        EGid        uint32
+}
+
+type ProcEventExit struct {
+        ProcessPid  int32
+        ProcessTgid int32
+        ExitCode    uint32
+        ExitSignal  uint32
+}
+
+type ProcEventCoreDump struct {
+        ProcessPid  int32
+        ProcessTgid int32
+}
+
+type ProcEventComm struct {
+        ProcessPid  int32
+        ProcessTgid int32
+        Comm        [16]byte
+}
+
+type ProcEventPtrace struct {
+        ProcessPid  int32
+        ProcessTgid int32
+        TracerPid   int32
+        TracerTgid  int32
+}
+
+type ProcEventSid struct {
+        ProcessPid  int32
+        ProcessTgid int32
+}
+
+func ParseProcEvent(data []byte) *ProcEvent {
+        pe := (*ProcEvent)(unsafe.Pointer(&data[SizeofCnMsg]))
+        switch pe.What {
+        case PROC_EVENT_NONE:
+                pe.Data = nil
+        case PROC_EVENT_FORK:
+                pe.Data = *(*ProcEventFork)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_EXEC:
+                pe.Data = *(*ProcEventExec)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_UID:
+                pe.Data = *(*ProcEventUid)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_GID:
+                pe.Data = *(*ProcEventGid)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_SID:
+                pe.Data = *(*ProcEventSid)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_PTRACE:
+                pe.Data = *(*ProcEventPtrace)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_COMM:
+                pe.Data = *(*ProcEventComm)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_COREDUMP:
+                pe.Data = *(*ProcEventCoreDump)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        case PROC_EVENT_EXIT:
+                pe.Data = *(*ProcEventExit)(unsafe.Pointer(&data[SizeofCnMsg+SizeofProcEventHeader]))
+        default:
+                pe.Data = nil
+        }
+        return pe
+}
diff --git a/src/deal.go b/src/deal.go
index 717344c..c50174a 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -2,7 +2,6 @@ package main
 
 import (
         "fmt"
-        "sync"
         "syscall"
 
         "go.mongodb.org/mongo-driver/bson"
@@ -14,9 +13,6 @@ const (
         fdColName  string = "fds"
 )
 
-var mongoMutex sync.Mutex
-var pidCol, fdCol mongoClient
-
 var docRes []bson.M
 var err error
 
@@ -55,15 +51,17 @@ func deal() {
                         break
                 }
 
-                // fmt.Printf("%v\n", cooked)
+                fmt.Printf("recv: %v\n", cooked.tag)
 
                 switch cooked.tag {
                 case NEWPID:
+                        fmt.Printf("Fork: ppid=%6d, pid=%6d\n", cooked.ppid, cooked.pid)
                         dealNewPid(cooked)
                 case EXECVE:
                         check(cooked)
                         dealExecve(cooked)
                 case PIDEXIT:
+                        fmt.Printf("Exit: pid=%6d\n", cooked.pid)
                         check(cooked)
                         deletePid(cooked)
                 case FILEOPEN:
@@ -104,11 +102,13 @@ func deletePid(cooked Event) {
 }
 
 func dealNewPid(cooked Event) {
+        fmt.Printf("tag0 fork: %d %d\n", cooked.ppid, cooked.pid)
         // 有无父进程在观察中
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
         if err != nil || len(docRes) != 1 {
                 return
         }
+        fmt.Printf("tag1 fork: %d %d\n", cooked.ppid, cooked.pid)
 
         // 自身是否已经记录
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.pid})
@@ -117,6 +117,7 @@ func dealNewPid(cooked Event) {
                 return
         }
         mongoMutex.Lock()
+        fmt.Printf("tag2 fork: %d %d\n", cooked.ppid, cooked.pid)
         if len(docRes) != 0 {
                 // 进程原本就存在，换言之别的消息先到了
                 // 所有先行抵达的消息必须保留execve/children字段
@@ -193,6 +194,7 @@ func dealExecve(cooked Event) {
 }
 
 func fileOpen(cooked Event) {
+        fmt.Printf("FILEOPEN: %d %d %s\n", cooked.ppid, cooked.pid, cooked.pathName)
         // 查看是否记录了该进程
         res, err := pidCol.Finddoc(bson.M{"pid": cooked.pid})
         if err != nil {
diff --git a/src/global.go b/src/global.go
index f0f909c..d9bf4d0 100644
--- a/src/global.go
+++ b/src/global.go
@@ -33,12 +33,13 @@ type Event struct {
         timestamp    time.Time
         pid, ppid    int
         syscall      int
-        exit_code    uint64
         argc         int
         argv         []string
         cwd          string
         syscallParam [4]uint64
         pathName     string
+        exit_code    uint64
+        exit_signal  int
 }
 
 func (event Event) String() string {
diff --git a/src/godo.go b/src/godo.go
index 0edcc9f..c4d92c1 100644
--- a/src/godo.go
+++ b/src/godo.go
@@ -6,11 +6,14 @@ import (
         "log"
         "os"
         "os/exec"
-        "time"
+        "sync"
 
         "github.com/elastic/go-libaudit/v2"
 )
 
+var mongoMutex sync.Mutex
+var pidCol, fdCol mongoClient
+
 var (
         fs          = flag.NewFlagSet("audit", flag.ExitOnError)
         diag        = fs.String("diag", "", "dump raw information from kernel to file")
@@ -37,7 +40,8 @@ func main() {
         auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
         auditCmd.Run()
 
-        pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
+        pidSyscall := []string{"execve"}
+        // pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
         // 设置监听规则
         for i := 0; i < len(pidSyscall); i++ {
                 auditCmd = exec.Command("auditctl", "-a", "exit,always", "-F", "arch=b64", "-S", pidSyscall[i])
@@ -76,14 +80,17 @@ func main() {
 func coroutine(client *libaudit.AuditClient) {
         // 各协程至此开始
         rawChan = make(chan interface{})
-        cookedChan = make(chan Event)
-        wg.Add(1)
-        go receive(client)
-        wg.Add(1)
-        go orgnaze()
-        wg.Add(1)
-        go deal()
+        cookedChan = make(chan Event, 1024)
+        ProcWatch()
+        // wg.Add(1)
+        // go ProcWatch()
+        // wg.Add(1)
+        // go receive(client)
+        // wg.Add(1)
+        // go orgnaze()
+        // wg.Add(1)
+        // go deal()
 
-        wg.Wait()
-        time.Sleep(2 * time.Second)
+        // wg.Wait()
+        // time.Sleep(2 * time.Second)
 }
diff --git a/src/organize.go b/src/organize.go
index d7a1df1..49796cc 100644
--- a/src/organize.go
+++ b/src/organize.go
@@ -47,7 +47,7 @@ func orgnaze() {
                         break
                 }
                 rawEvent = raw.(libaudit.RawAuditMessage)
-                fmt.Printf("type=%v msg=%s\n", rawEvent.Type, rawEvent.Data)
+                // fmt.Printf("type=%v msg=%s\n", rawEvent.Type, rawEvent.Data)
 
                 switch rawEvent.Type {
                 case auparse.AUDIT_SYSCALL:
@@ -100,24 +100,24 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) {
         }
 
         switch syscallTable[event.syscall] {
-        case "clone":
-                if exit == 0 || event.pid > exit {
-                        // exit=0是给新进程的返回，没用
-                        // pid>exit，证明有问题，抛弃
-                        break
-                } else {
-                        eventTable.Store(eventId, &Event{
-                                tag:       NEWPID,
-                                timestamp: event.timestamp,
-                                syscall:   event.syscall,
-                                exit_code: 0,
-                                ppid:      event.pid,
-                                pid:       exit,
-                                argc:      0,
-                                argv:      make([]string, 0),
-                                cwd:       "",
-                        })
-                }
+        // case "clone":
+        //      if exit == 0 || event.pid > exit {
+        //              // exit=0是给新进程的返回，没用
+        //              // pid>exit，证明有问题，抛弃
+        //              break
+        //      } else {
+        //              eventTable.Store(eventId, &Event{
+        //                      tag:       NEWPID,
+        //                      timestamp: event.timestamp,
+        //                      syscall:   event.syscall,
+        //                      exit_code: 0,
+        //                      ppid:      event.pid,
+        //                      pid:       exit,
+        //                      argc:      0,
+        //                      argv:      make([]string, 0),
+        //                      cwd:       "",
+        //              })
+        //      }
         case "execve":
                 eventTable.Store(eventId, &Event{
                         tag:       EXECVE,
@@ -130,18 +130,18 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) {
                         argv:      make([]string, 0),
                         cwd:       "",
                 })
-        case "exit", "exit_group":
-                eventTable.Store(eventId, &Event{
-                        tag:       PIDEXIT,
-                        timestamp: event.timestamp,
-                        syscall:   event.syscall,
-                        exit_code: a[0],
-                        ppid:      event.ppid,
-                        pid:       event.pid,
-                        argc:      0,
-                        argv:      make([]string, 0),
-                        cwd:       "",
-                })
+        // case "exit", "exit_group":
+        //      eventTable.Store(eventId, &Event{
+        //              tag:       PIDEXIT,
+        //              timestamp: event.timestamp,
+        //              syscall:   event.syscall,
+        //              exit_code: a[0],
+        //              ppid:      event.ppid,
+        //              pid:       event.pid,
+        //              argc:      0,
+        //              argv:      make([]string, 0),
+        //              cwd:       "",
+        //      })
         case "open":
                 // 检查打开的权限
                 if a[1]&(syscall.O_APPEND|syscall.O_WRONLY|syscall.O_RDWR|syscall.O_TRUNC) == 0 {
@@ -190,6 +190,7 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) {
                         syscallParam: a,
                         // pathName:     "",
                 })
+        default:
         }
 }
 
diff --git a/src/procWatch.go b/src/procWatch.go
new file mode 100644
index 0000000..34721cf
--- /dev/null
+++ b/src/procWatch.go
@@ -0,0 +1,86 @@
+package main
+
+import (
+        "bufio"
+        "fmt"
+        "os"
+        "strings"
+        "syscall"
+        "time"
+)
+
+func ProcWatch() error {
+        ns, err := NewNetlinkSocket(syscall.NETLINK_CONNECTOR, 12345)
+        if err != nil {
+                return err
+        }
+        defer ns.Close()
+        fmt.Printf("Proc Watch!\n")
+        for {
+                res, err := ns.Receive()
+                if err != nil {
+                        continue
+                }
+                for i := 0; i < len(res); i++ {
+                        procEvent := ParseProcEvent(res[i].Data)
+                        switch procEvent.What {
+                        case PROC_EVENT_FORK:
+                                data := procEvent.Data.(ProcEventFork)
+                                // if data.ChildPid != data.ChildTgid {
+                                //      break
+                                // }
+                                fmt.Printf("fork\t%6d\t%6d\t%6d\t%6d\n", data.ParentPid, data.ParentTgid, data.ChildPid, data.ChildTgid)
+                                cooked := Event{
+                                        tag:          NEWPID,
+                                        timestamp:    time.Now(),
+                                        ppid:         int(data.ParentTgid),
+                                        pid:          int(data.ChildTgid),
+                                        syscall:      57,
+                                        syscallParam: [4]uint64{},
+                                }
+                                checkProc(&cooked)
+                                cookedChan <- cooked
+                                fmt.Printf("send fork: %d-->%d\n", cooked.ppid, cooked.pid)
+                        case PROC_EVENT_EXIT:
+                                data := procEvent.Data.(ProcEventExit)
+                                // TODO: Event是否增加退出信号字段, 酌定
+                                if data.ProcessPid != data.ProcessTgid {
+                                        break
+                                }
+                                cooked := Event{
+                                        tag:         PIDEXIT,
+                                        timestamp:   time.Now(),
+                                        pid:         int(data.ProcessTgid),
+                                        exit_code:   uint64(data.ExitCode),
+                                        exit_signal: int(data.ExitSignal),
+                                }
+                                cookedChan <- cooked
+                        default:
+                        }
+                }
+        }
+}
+
+// 补充args与cwd
+func checkProc(pCooked *Event) {
+        fileName := fmt.Sprintf("/proc/%d/cmdline", pCooked.pid)
+        fd, err := os.Open(fileName)
+        if err != nil {
+                return
+        }
+        // defer fd.Close()
+
+        scanner := bufio.NewScanner(fd)
+        for scanner.Scan() {
+                line := scanner.Text()
+                pCooked.argv = append(pCooked.argv, strings.Split(line, "\x00")...)
+        }
+        pCooked.argc = len(pCooked.argv)
+        fd.Close()
+
+        fileName = fmt.Sprintf("/proc/%d/cwd", pCooked.pid)
+        pCooked.cwd, err = os.Readlink(fileName)
+        if err != nil {
+                pCooked.cwd = ""
+        }
+}
diff --git a/src/request.go b/src/request.go
new file mode 100644
index 0000000..40df8df
--- /dev/null
+++ b/src/request.go
@@ -0,0 +1,57 @@
+package main
+
+import (
+        "os"
+        "syscall"
+        "unsafe"
+)
+
+type NetlinkRequestData interface {
+        Len() int
+        Serialize() []byte
+}
+
+// linux/netlink.h
+type NetlinkRequest struct {
+        syscall.NlMsghdr
+        Data []NetlinkRequestData
+}
+
+func (req *NetlinkRequest) Serialize() []byte {
+        length := syscall.SizeofNlMsghdr
+        dataBytes := make([][]byte, len(req.Data))
+        for i, data := range req.Data {
+                dataBytes[i] = data.Serialize()
+                length = length + len(dataBytes[i])
+        }
+        req.Len = uint32(length)
+        b := make([]byte, length)
+        hdr := (*(*[syscall.SizeofNlMsghdr]byte)(unsafe.Pointer(req)))[:]
+        next := syscall.SizeofNlMsghdr
+        copy(b[0:next], hdr)
+        for _, data := range dataBytes {
+                for _, dataByte := range data {
+                        b[next] = dataByte
+                        next = next + 1
+                }
+        }
+        return b
+}
+
+func (req *NetlinkRequest) AddData(data NetlinkRequestData) {
+        if data != nil {
+                req.Data = append(req.Data, data)
+        }
+}
+
+func NewNetlinkRequest() *NetlinkRequest {
+        return &NetlinkRequest{
+                NlMsghdr: syscall.NlMsghdr{
+                        Len:   uint32(0),
+                        Type:  uint16(syscall.NLMSG_DONE),
+                        Flags: uint16(0),
+                        Seq:   uint32(0),
+                        Pid:   uint32(os.Getpid()),
+                },
+        }
+}
diff --git a/src/socket.go b/src/socket.go
new file mode 100644
index 0000000..83c7333
--- /dev/null
+++ b/src/socket.go
@@ -0,0 +1,79 @@
+package main
+
+import (
+        "fmt"
+        "os"
+        "syscall"
+)
+
+type NetlinkProtocol int
+
+const (
+        CONNECTOR NetlinkProtocol = syscall.NETLINK_CONNECTOR
+        INET_DIAG NetlinkProtocol = syscall.NETLINK_INET_DIAG
+)
+
+type NetlinkSocket struct {
+        fd       int
+        protocol NetlinkProtocol
+        groups   uint32
+}
+
+func NewNetlinkSocket(protocol NetlinkProtocol, groups uint32) (*NetlinkSocket, error) {
+        fd, err := syscall.Socket(syscall.AF_NETLINK, syscall.SOCK_RAW, int(protocol))
+        if err != nil {
+                return nil, err
+        }
+        ns := &NetlinkSocket{
+                fd:       fd,
+                protocol: protocol,
+                groups:   groups,
+        }
+        if ns.protocol == CONNECTOR {
+                sockaddr := &syscall.SockaddrNetlink{
+                        Family: syscall.AF_NETLINK,
+                        Pid:    uint32(os.Getpid()),
+                        Groups: groups,
+                }
+                if err = syscall.Bind(fd, sockaddr); err != nil {
+                        syscall.Close(fd)
+                        return nil, err
+                }
+        }
+        return ns, nil
+}
+
+func (ns *NetlinkSocket) Close() {
+        syscall.Close(ns.fd)
+}
+
+func (ns *NetlinkSocket) Send(request *NetlinkRequest) error {
+        if ns.protocol == CONNECTOR {
+                if _, err := syscall.Write(ns.fd, request.Serialize()); err != nil {
+                        return err
+                }
+        } else {
+                sockaddr := &syscall.SockaddrNetlink{
+                        Family: syscall.AF_NETLINK,
+                        Pid:    0,
+                        Groups: ns.groups,
+                }
+                if err := syscall.Sendto(ns.fd, request.Serialize(), 0, sockaddr); err != nil {
+                        return err
+                }
+        }
+        return nil
+}
+
+func (s *NetlinkSocket) Receive() ([]syscall.NetlinkMessage, error) {
+        rb := make([]byte, syscall.Getpagesize())
+        nr, _, err := syscall.Recvfrom(s.fd, rb, 0)
+        if err != nil {
+                return nil, err
+        }
+        if nr < syscall.NLMSG_HDRLEN {
+                return nil, fmt.Errorf("Got short response from netlink")
+        }
+        rb = rb[:nr]
+        return syscall.ParseNetlinkMessage(rb)
+}