Add db structure, fix filePath, start filtering

This commit I made several changes:

- Use structure instead of simple bson.M(interface{}). bson.M has
  some shortcomings: 1) It makes the database in chaos and hard to
  read, but this's not important; 2) Some entrys may has more or
  less content than others, which makes it hard to decode and filt.
  So I design new data structure to encode and decode. Hopes that
  there's no bugs.
- Fix the way to calculate file path. The original method is to add
  all the PATH entries together, that's totally wrong! PATH entry
  has several types, as it shows in "objtype". I can't find it in
  the kernel src code, so what i know is just "PARENT" means the dir
  the file is in, while the filename itself has the path, so we
  whould ignore all "PARENT"s. When the src code is found, we should
  check it again.
- Fix bugs in updating. The update function of mongodb is set to
  required to has a '$' such as 'set'/'push', so when we update a
  whole doc, we should use replace but not update function. And,
  we should never ignore the error infomation it gives us.

Hope that there's no more bugs for this Big Change.

Now its' time to write filter as well as viewer. Best wishes with
NO BUGS!

1 files changed, 102 insertions, 98 deletions

diff --git a/src/deal.go b/listener/deal.go
index e553174..8f77431 100644
--- a/src/deal.go
+++ b/listener/deal.go
@@ -4,6 +4,7 @@ import (
         "fmt"
         "os"
         "syscall"
+        "time"
 
         "go.mongodb.org/mongo-driver/bson"
 )
@@ -15,10 +16,7 @@ const (
         fileColName string = "files"
 )
 
-// var mongoMutex sync.Mutex
 var pidCol, fdCol, fileCol mongoClient
-
-var docRes []bson.M
 var err error
 
 func deal() {
@@ -30,12 +28,12 @@ func deal() {
                 fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
                 return
         }
-        err = pidCol.InsertOne(bson.M{
-                "ppid":     1,
-                "pid":      containerdPid,
-                "cwd":      "/",
-                "children": []bson.M{},
-                "daemon":   true,
+        err = pidCol.InsertOne(Process{
+                Ppid:     1,
+                Pid:      containerdPid,
+                Cwd:      "/",
+                Children: make([]int, 0),
+                Star:     true,
         })
         if err != nil {
                 fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
@@ -50,7 +48,6 @@ func deal() {
                 fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
         }
 
-        fmt.Printf("Containerd: %d\n", containerdPid)
         defer pidCol.Disconnect()
         defer fdCol.Disconnect()
         defer fileCol.Disconnect()
@@ -81,30 +78,25 @@ func deal() {
 }
 
 func deletePid(cooked Event) {
-        // 先从老爹那里销户
-        pidCol.UpdateOne(bson.M{"pid": cooked.ppid}, bson.M{
-                "$pull": bson.M{
-                        "children": cooked.pid,
-                },
-        })
-
         // 在这套逻辑里，孩子是不需要收容的，因为我们根本就不看ppid来工作
-
-        // ����去���了
-        pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
+        // 父节点那里也不需要销户
+        // 理论上这里需要���闭所有文件���述符，���为了处理效率，留���������流程
+        err := pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
                 "$set": bson.M{
                         "exit_timestamp": cooked.timestamp,
                         "exit_code":      cooked.exit_code,
                         "exit_signal":    cooked.exit_signal,
                 },
         })
-
-        // 理论上这里需要关闭所有文件描述符，但为了处理效率，留给后续流程
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err updating: %v\n", err)
+        }
 }
 
 func dealNewPid(cooked Event) {
         // 自身是否已经记录
-        docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.pid})
+        var docRes []Process
+        err = pidCol.Finddoc(bson.M{"pid": cooked.pid}, &docRes)
         if err != nil {
                 fmt.Fprintf(os.Stderr, "Err finding: %v\n", err)
                 return
@@ -113,97 +105,104 @@ func dealNewPid(cooked Event) {
         if len(docRes) != 0 {
                 // 进程原本就存在，换言之别的消息先到了
                 // 所有先行抵达的消息必须保留execve/children字段
-                // 此处不再更新
-                // 以防把原有信息更没了
-                pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
-                        "start_timestamp": cooked.timestamp,
-                        "ppid":            cooked.ppid,
-                        "parentTgid":      cooked.parentTgid,
-                        "pid":             cooked.pid,
-                        "tgid":            cooked.tgid,
-                        "cwd":             cooked.cwd,
-                        // "execve":          []bson.M{},
-                        "args": cooked.argv,
-                        // "children":        []bson.M{},
-                })
+                docRes[0].Ppid = cooked.ppid
+                docRes[0].ParentTgid = cooked.parentTgid
+                docRes[0].Pid = cooked.pid
+                docRes[0].Tgid = cooked.tgid
+                docRes[0].Cwd = cooked.cwd
+                docRes[0].Comm = cooked.comm
+                docRes[0].Args = cooked.argv
+
+                err := pidCol.ReplaceOne(bson.M{"pid": cooked.pid}, docRes[0])
+                if err != nil {
+                        fmt.Fprintf(os.Stderr, "Err replaceing: %v\n", err)
+                }
         } else {
                 // 这进程本是新修的
-                pidCol.InsertOne(bson.M{
-                        "start_timestamp": cooked.timestamp,
-                        "ppid":            cooked.ppid,
-                        "parentTgid":      cooked.parentTgid,
-                        "pid":             cooked.pid,
-                        "tgid":            cooked.tgid,
-                        "cwd":             cooked.cwd,
-                        "execve":          []bson.M{},
-                        "args":            cooked.argv,
-                        "children":        []bson.M{},
+                err := pidCol.InsertOne(Process{
+                        StartTimestamp: cooked.timestamp,
+                        Ppid:           cooked.ppid,
+                        ParentTgid:     cooked.parentTgid,
+                        Pid:            cooked.pid,
+                        Tgid:           cooked.tgid,
+                        Args:           cooked.argv,
+                        Comm:           cooked.comm,
+                        Cwd:            cooked.cwd,
+                        Execve:         make([]Exec, 0),
+                        Children:       make([]int, 0),
                 })
+                if err != nil {
+                        fmt.Fprintf(os.Stderr, "Err inserting: %v\n", err)
+                }
         }
 
-        pidCol.UpdateOne(bson.M{"pid": cooked.ppid}, bson.M{
+        err := pidCol.UpdateOne(bson.M{"pid": cooked.ppid}, bson.M{
                 "$push": bson.M{
                         "children": cooked.pid,
                 },
         })
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err updating: %v\n", err)
+        }
 }
 
 func dealExecve(cooked Event) {
-        // 父进程在不在？不在扔
-        docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
-        if err != nil || len(docRes) != 1 {
-                return
-        }
-
+        var docRes []Process
         // 首先检查进程是否存在，如不存在则为之创建
-        docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.pid})
+        err = pidCol.Finddoc(bson.M{"pid": cooked.pid}, &docRes)
         if err != nil {
                 return
         }
 
         if len(docRes) == 1 {
                 // 自身已在，直接记录
-                pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
-                        "$push": bson.M{
-                                "execve": bson.M{
-                                        "timestamp": cooked.timestamp,
-                                        "execArgs":  cooked.argv,
-                                },
-                        },
+                docRes[0].Execve = append(docRes[0].Execve, Exec{
+                        Timestamp: cooked.timestamp,
+                        ExecArgs:  cooked.argv,
                 })
+
+                err := pidCol.ReplaceOne(bson.M{"pid": cooked.pid}, docRes[0])
+                if err != nil {
+                        fmt.Fprintf(os.Stderr, "Err replacing: %v\n", err)
+                }
         } else {
                 // 先fork抵达，插入
-                pidCol.InsertOne(bson.M{
-                        "ppid":     cooked.ppid,
-                        "pid":      cooked.pid,
-                        "children": []bson.M{},
-                        "execve": []bson.M{
-                                {
-                                        "timestamp": cooked.timestamp,
-                                        "execArgs":  cooked.argv,
-                                },
-                        },
+                process := Process{
+                        Ppid:     cooked.ppid,
+                        Pid:      cooked.pid,
+                        Execve:   make([]Exec, 0),
+                        Children: make([]int, 0),
+                }
+                process.Execve = append(process.Execve, Exec{
+                        Timestamp: cooked.timestamp,
+                        ExecArgs:  cooked.argv,
                 })
+
+                err := pidCol.InsertOne(process)
+                if err != nil {
+                        fmt.Fprintf(os.Stderr, "Err inserting: %v\n", err)
+                }
         }
 }
 
 func fileOpen(cooked Event) {
         // 权限检查过了，不必再查
-        fdCol.InsertOne(bson.M{
-                "timestamp": cooked.timestamp,
-                "fileName":  cooked.srcPath,
-                "pid":       cooked.pid,
-                "fd":        cooked.exit_code,
-                "flags":     cooked.syscallParam,
-                "written":   []bson.M{},
-        })
-
+        file := File{
+                OpenTimestamp: cooked.timestamp,
+                FileName:      cooked.srcPath,
+                Pid:           cooked.pid,
+                Fd:            cooked.exit_code,
+                Flags:         cooked.syscallParam,
+                Written:       make([]time.Time, 0),
+        }
         if cooked.syscallParam[1]&syscall.O_TRUNC != 0 {
-                fdCol.UpdateOne(bson.M{"pid": cooked.pid, "fd": cooked.exit_code}, bson.M{
-                        "$push": bson.M{
-                                "written": cooked.timestamp,
-                        },
-                })
+                // 文件以清空方式打开
+                file.Written = append(file.Written, cooked.timestamp)
+        }
+
+        err := fdCol.InsertOne(file)
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err inserting: %v\n", err)
         }
 }
 
@@ -213,33 +212,39 @@ func fileClose(cooked Event) {
                 return
         }
         res["close_timestamp"] = cooked.timestamp
-        if err := fileCol.InsertOne(res); err != nil {
+
+        err = fileCol.InsertOne(res)
+        if err != nil {
                 fmt.Fprintf(os.Stderr, "Err inserting files: %v\n", err)
         }
 }
 
 func fileWrite(cooked Event) {
-        res, err := fdCol.Finddoc(bson.M{
-                "pid":             cooked.pid,
-                "fd":              cooked.syscallParam[0],
-                "close_timestamp": bson.M{"$exists": false},
-        })
+        var res []File
+        err := fdCol.Finddoc(bson.M{
+                "pid": cooked.pid,
+                "fd":  cooked.syscallParam[0],
+        }, &res)
         if err != nil {
                 fmt.Fprintf(os.Stderr, "Err closing fd %d of pid %d: %v\n", cooked.syscallParam[0], cooked.pid, err)
         }
         if len(res) == 0 {
                 return
         }
-        fdCol.UpdateOne(bson.M{
-                "pid":             cooked.pid,
-                "fd":              cooked.syscallParam[0],
-                "close_timestamp": bson.M{"$exists": false},
+
+        err = fdCol.UpdateOne(bson.M{
+                "pid": cooked.pid,
+                "fd":  cooked.syscallParam[0],
         }, bson.M{"$push": bson.M{"written": cooked.timestamp}})
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err updating: %v\n", err)
+        }
 }
 
 func pivotRoot(cooked Event) {
+        var docRes []Process
         // docker的根目录信息，记录
-        docRes, err := pidCol.Finddoc(bson.M{"pid": cooked.pid})
+        err := pidCol.Finddoc(bson.M{"pid": cooked.pid}, &docRes)
         if err != nil {
                 fmt.Fprintf(os.Stderr, "Err finding: %v\n", err)
                 return
@@ -255,10 +260,9 @@ func pivotRoot(cooked Event) {
                 })
         } else {
                 // 读取已有的工作目录
-                cwd := docRes[0]["cwd"]
                 pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
                         "$set": bson.M{
-                                "rootfs": cwd,
+                                "rootfs": docRes[0].Cwd,
                         },
                 })
         }