Add db structure, fix filePath, start filtering

This commit I made several changes:

- Use structure instead of simple bson.M(interface{}). bson.M has
  some shortcomings: 1) It makes the database in chaos and hard to
  read, but this's not important; 2) Some entrys may has more or
  less content than others, which makes it hard to decode and filt.
  So I design new data structure to encode and decode. Hopes that
  there's no bugs.
- Fix the way to calculate file path. The original method is to add
  all the PATH entries together, that's totally wrong! PATH entry
  has several types, as it shows in "objtype". I can't find it in
  the kernel src code, so what i know is just "PARENT" means the dir
  the file is in, while the filename itself has the path, so we
  whould ignore all "PARENT"s. When the src code is found, we should
  check it again.
- Fix bugs in updating. The update function of mongodb is set to
  required to has a '$' such as 'set'/'push', so when we update a
  whole doc, we should use replace but not update function. And,
  we should never ignore the error infomation it gives us.

Hope that there's no more bugs for this Big Change.

Now its' time to write filter as well as viewer. Best wishes with
NO BUGS!

3 files changed, 186 insertions, 0 deletions

diff --git a/filter/filter.go b/filter/filter.go
new file mode 100644
index 0000000..c83fb13
--- /dev/null
+++ b/filter/filter.go
@@ -0,0 +1,118 @@
+package main
+
+import (
+        "context"
+        "fmt"
+        "log"
+        "os"
+        "time"
+
+        "go.mongodb.org/mongo-driver/bson"
+        "go.mongodb.org/mongo-driver/mongo"
+        "go.mongodb.org/mongo-driver/mongo/options"
+        "go.mongodb.org/mongo-driver/mongo/readpref"
+)
+
+type Exec struct {
+        timestamp time.Time `bson:"timestamp"`
+        execArgs  []string  `bson:"execArgs"`
+}
+
+type Process struct {
+        timestamp      time.Time `bson:"start_timestamp"`
+        ppid           int       `bson:"ppid"`
+        parentTgid     int       `bson:"parentTgid"`
+        pid            int       `bson:"pid"`
+        tgid           int       `bson:"tgid"`
+        args           []string  `bson:"args"`
+        comm           string    `bson:"comm"`
+        cwd            string    `bson:"cwd"`
+        execve         []Exec    `bson:"execve"`
+        exit_code      int       `bson:"exit_code"`
+        exit_signal    int       `bson:"exit_signal"`
+        exit_timestamp time.Time `bson:"exit_timestamp"`
+}
+
+func (p Process) String() string {
+        var res string
+        res = ""
+        res += fmt.Sprintf("timestamp\t%v\n", p.timestamp)
+        res += fmt.Sprintf("ppid\t%d\nparentTgid\t%d\n", p.ppid, p.parentTgid)
+        res += fmt.Sprintf("pid\t%d\ntgid\t%d\nargs: ", p.pid, p.tgid)
+        for i := 0; i < len(p.args); i++ {
+                res += fmt.Sprintf("%s ", p.args[i])
+        }
+        res += fmt.Sprintf("\ncomm\t%s\ncwd\t%s\n", p.comm, p.cwd)
+        return res
+}
+
+// type Process struct {
+//      StartTimestamp time.Time  `bson:"start_timestamp"`
+//      Ppid           *int       `bson:"ppid"`
+//      ParentTgid     *int       `bson:"parentTgid"`
+//      Pid            int        `bson:"pid"`
+//      Tgid           int        `bson:"tgid"`
+//      Args           []string   `bson:"args"`
+//      Comm           *string    `bson:"comm"`
+//      Cwd            *string    `bson:"cwd"`
+//      Execve         []Exec     `bson:"execve"`
+//      ExitCode       *int       `bson:"exit_code"`
+//      ExitSignal     *int       `bson:"exit_signal"`
+//      ExitTimestamp  *time.Time `bson:"exit_timestamp"`
+// }
+
+// func (p Process) String() string {
+//      var res string
+//      res = ""
+//      res += fmt.Sprintf("timestamp\t%v\n", p.StartTimestamp)
+//      if p.Ppid != nil && p.ParentTgid != nil {
+//              res += fmt.Sprintf("ppid\t%d\nparentTgid\t%d\n", *(p.Ppid), *(p.ParentTgid))
+//      }
+//      res += fmt.Sprintf("pid\t%d\ntgid\t%d\nargs: ", p.Pid, p.Tgid)
+//      for i := 0; i < len(p.Args); i++ {
+//              res += fmt.Sprintf("%s ", p.Args[i])
+//      }
+//      if p.Comm != nil && p.Cwd != nil {
+//              res += fmt.Sprintf("\ncomm\t%s\ncwd\t%s\n", *(p.Comm), *(p.Cwd))
+//      }
+//      return res
+// }
+
+func main() {
+        client, err := mongo.Connect(context.TODO(), options.Client().ApplyURI("mongodb://localhost:27017"))
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err connecting mongodb: %v\n", err)
+        }
+        defer client.Disconnect(context.TODO())
+
+        // 检查连接
+        err = client.Ping(context.TODO(), readpref.Primary())
+        if err != nil {
+                log.Fatal(err)
+        }
+
+        pidCol := client.Database("test").Collection("pids")
+        cur, err := pidCol.Find(context.TODO(), bson.M{}) // 查询所有文档
+        if err != nil {
+                log.Fatal(err)
+        }
+        defer cur.Close(context.TODO()) // 确保游标被关闭
+
+        var res []Process
+        for cur.Next(context.TODO()) {
+                var tmp Process
+                // 解码到Process结构体
+                if err := cur.Decode(&tmp); err != nil {
+                        log.Fatal(err)
+                }
+                res = append(res, tmp)
+        }
+
+        if err := cur.Err(); err != nil {
+                log.Fatal(err)
+        }
+
+        for i := 0; i < len(res); i++ {
+                fmt.Printf("------\n%v\n", res[i])
+        }
+}
diff --git a/filter/go.mod b/filter/go.mod
new file mode 100644
index 0000000..4e9c553
--- /dev/null
+++ b/filter/go.mod
@@ -0,0 +1,18 @@
+module filter
+
+go 1.21.5
+
+require go.mongodb.org/mongo-driver v1.16.1
+
+require (
+        github.com/golang/snappy v0.0.4 // indirect
+        github.com/klauspost/compress v1.13.6 // indirect
+        github.com/montanaflynn/stats v0.7.1 // indirect
+        github.com/xdg-go/pbkdf2 v1.0.0 // indirect
+        github.com/xdg-go/scram v1.1.2 // indirect
+        github.com/xdg-go/stringprep v1.0.4 // indirect
+        github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d // indirect
+        golang.org/x/crypto v0.22.0 // indirect
+        golang.org/x/sync v0.7.0 // indirect
+        golang.org/x/text v0.14.0 // indirect
+)
diff --git a/filter/go.sum b/filter/go.sum
new file mode 100644
index 0000000..3bc8cc9
--- /dev/null
+++ b/filter/go.sum
@@ -0,0 +1,50 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/klauspost/compress v1.13.6 h1:P76CopJELS0TiO2mebmnzgWaajssP/EszplttgQxcgc=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d h1:splanxYIlg+5LfHAM6xpdFEAYOk8iySO56hMFq6uLyA=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.mongodb.org/mongo-driver v1.16.1 h1:rIVLL3q0IHM39dvE+z2ulZLp9ENZKThVfuvN/IiN4l8=
+go.mongodb.org/mongo-driver v1.16.1/go.mod h1:oB6AhJQvFQL4LEHyXi6aJzQJtBiTQHiAd83l0GdFaiw=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=