Repository: gojue/ecapture
File: user/event/event_bash.go (Go)

Code before:
// Copyright 2022 CFC4N <cfc4n.cs@gmail.com>. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package event

import (
	"bytes"
	"encoding/binary"
	"fmt"

	"golang.org/x/sys/unix"
)

var lineMap map[string]string = make(map[string]string)

/*
 u32 pid;
 u8 line[MAX_DATE_SIZE_BASH];
 u32 Retval;
 char Comm[TASK_COMM_LEN];
*/

const MaxDataSizeBash = 256
const BASH_ERRNO_DEFAULT = 128
const (
	BASH_EVENT_TYPE_READLINE     = 0
	BASH_EVENT_TYPE_RETVAL       = 1
	BASH_EVENT_TYPE_EXIT_OR_EXEC = 2
)

type BashEvent struct {
	eventType EventType
	Type      uint32                 `json:"type"`
	Pid       uint32                 `json:"pid"`
	Uid       uint32                 `json:"uid"`
	Line      [MaxDataSizeBash]uint8 `json:"line"`
	Retval    uint32                 `json:"Retval"`
	Comm      [16]byte               `json:"Comm"`
}

Review comment (suggestion):
In the `event` package, it is not very elegant to use a `global variable map` to store events. The `event` package should ideally only be a collection of objects for serialization and deserialization of structures. 

You can implement it in module/probe_bash.go, refer to: https://github.com/gojue/ecapture/blob/a286703c4d65e90991813445dd3e53dd0d70c5df/user/module/probe_openssl.go#L601

--- 

在event的包内，使用全局变量的map来存储事件的做法，不太优雅。  event包尽可能只是一个结构体的序列化、反序列化的对象集合。   

你可以放到module/probe_bash.go里实现，参考：https://github.com/gojue/ecapture/blob/a286703c4d65e90991813445dd3e53dd0d70c5df/user/module/probe_openssl.go#L601

Code after:
// Copyright 2022 CFC4N <cfc4n.cs@gmail.com>. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package event

import (
	"bytes"
	"encoding/binary"
	"fmt"
)

/*
  u8 type;
  u32 pid;
  u32 uid;
  u8 line[MAX_DATA_SIZE_BASH];
  u32 retval;
  char comm[TASK_COMM_LEN];
*/

const MaxDataSizeBash = 256

type BashEvent struct {
	eventType EventType
	BashType  uint32                 `json:"bashtype"`
	Pid       uint32                 `json:"pid"`
	Uid       uint32                 `json:"uid"`
	Line      [MaxDataSizeBash]uint8 `json:"line"`
	Retval    uint32                 `json:"Retval"`
	Comm      [16]byte               `json:"Comm"`
	AllLines  string
}

func (be *BashEvent) Decode(payload []byte) (err error) {
	buf := bytes.NewBuffer(payload)
	if err = binary.Read(buf, binary.LittleEndian, &be.BashType); err != nil {
		return
	}
	if err = binary.Read(buf, binary.LittleEndian, &be.Pid); err != nil {