EBPFMon.hpp

1. Overview

Userspace eBPF monitor interface. Declares event structures, conversion helpers and the background ring-buffer consumer used to collect kernel connection events.

The original source path is:

include/bsc/ebpf/EBPFMon.hpp

---

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

---

3. Namespaces

• bsc::ebpf

---

4. Dependencies and Included Interfaces

• bsc/model/Connection.hpp
• atomic
• functional
• mutex
• string
• thread
• vector

---

5. Declared Types

• enum EventKind
• struct ConnEvent
• class EBPFMon

---

6. State and Data Members

The interface declares the following relevant state members:

• uint32_t pid
• uint32_t tid
• uint32_t uid
• uint32_t gid
• uint8_t family
• uint8_t proto
• uint8_t event_kind
• uint16_t src_port
• uint16_t dst_port
• uint64_t ts_ns
• std::thread thread_
• mutable std::mutex buf_mutex_
• std::vector<bsc::model::Connection> buf_
• std::vector<void*> links_

---

7. API and Functions

The file declares or implements the following callable entry points:

• bsc::model::Connection event_to_connection(const ConnEvent& ev)
• public: EBPFMon()
• bool start(const std::string& obj_path = "/usr/lib/bastionguard-sc/bsc_ebpf.o")
• void stop()
• std::vector<bsc::model::Connection> drain()
• private: void drain_loop()
• friend int ringbuf_callback(void* ctx, void* data, size_t size)
• EBPFMon()
• EBPFMon(const EBPFMon&) = delete

---

8. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

• bsc/model/Connection.hpp
• /usr/lib/bastionguard-sc/bsc_ebpf.o

---

9. Concurrency and Lifecycle

• Uses one or more worker threads.
• Protects mutable shared data with std::mutex.
• Uses atomic flags for lifecycle or activity state.

---

10. Security Considerations

• The component processes privileged operating-system or network data and should run with only the capabilities required by its backend.

---

11. Implementation Considerations

• Shared state is protected by mutexes; callers should avoid holding external locks while invoking callbacks.
• The file creates or manages worker threads and requires deterministic stop/join behavior during daemon shutdown.
• Atomic flags are used for low-cost lifecycle or activity state coordination.
• Compile-time feature flags select a functional backend or a graceful fallback implementation.

---

12. Licensing and Attribution

• Copyright (C) 2025–2026 Calogero Scarnà
• GPL-3.0

---

13. Source Metrics

Metric	Value
File size	4839 bytes
Lines	137
Detected API entries	9
Detected types	3