Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix bash module #503

Closed
wants to merge 1 commit into from
Closed

fix bash module #503

wants to merge 1 commit into from

Conversation

sancppp
Copy link
Contributor

@sancppp sancppp commented Mar 4, 2024

fix #490

  • The number of built-in commands without returned value (such as exit, exec) is limited, perhaps they can be treated specially.
  • The uretprobe/readline function should check whether the key already exists, and if so, perform an append operation (in fact, this logic should be done in user space rather than in kernel space. The BPF program merely sends the collected data to user space.).

So in this PR:

  • The BPF program in kernel space merely sends the collected data to user space.
  • Change bashEvent.eventType from EventTypeOutput to EventTypeEventProcessor.
  • Rebuild iworker.go.Implemented a new bashEventWorker struct for the iworker interface to handle bashevent.

@ruitianzhong
Copy link
Contributor

Can we just reuse the String function for BashEvent to avoid the extensive modification for iworker ?

@cfc4n
Copy link
Member

cfc4n commented Mar 5, 2024

Rebuild iworker.go.Implemented a new bashEventWorker struct for the iworker interface to handle bashevent.

This approach is not very elegant. It should use the same worker to process HTTP requests, HTTP responses, and bash, regardless of which one it is processing. It only needs to implement a bash IParser.


@sancppp @ruitianzhong 如果你们会说汉语的话,可以在我的公众号私信,留下微信号,我来加你们。近期我们发起一次语音会议,讨论这些问题。

@sancppp sancppp closed this Mar 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Interactive bash command might be missed/lost under some circumstances
3 participants