bsc::net::SocketSnapshot Class Reference

#include <SocketSnapshot.hpp>

Classes
struct	SnapshotCache

Public Member Functions
std::vector< bsc::model::Connection >	list_connections () const
std::optional< bsc::model::Connection >	find_connection (const bsc::model::Connection &needle) const
bool	enrich_connection (bsc::model::Connection &conn) const
void	invalidate_cache ()
void	discard_pending_events () const
bool	start_ebpf (const std::string &obj_path="/usr/lib/bastionguard-sc/bsc_ebpf.o")
void	stop_ebpf ()

Private Member Functions
std::vector< bsc::model::Connection >	collect_connections () const
bool	cache_valid (std::chrono::steady_clock::time_point now) const

Private Attributes
std::mutex	cache_mutex_
SnapshotCache	cache_
bsc::ebpf::EBPFMon	ebpf_mon_

Detailed Description

Definition at line 13 of file SocketSnapshot.hpp.

Member Function Documentation

cache_valid()

bool bsc::net::SocketSnapshot::cache_valid ( std::chrono::steady_clock::time_point now ) const

nodiscardprivate

Definition at line 338 of file SocketSnapshot.cpp.

                                                                          {
    return !cache_.connections.empty() && (now - cache_.updated_at) <= kSnapshotTtl;
}

References cache_, bsc::net::SocketSnapshot::SnapshotCache::connections, and bsc::net::SocketSnapshot::SnapshotCache::updated_at.

Referenced by list_connections().

collect_connections()

std::vector< bsc::model::Connection > bsc::net::SocketSnapshot::collect_connections ( ) const

nodiscardprivate

Definition at line 342 of file SocketSnapshot.cpp.

                                                                        {
    // ── Sorgente eBPF (prioritaria, se attiva) ─────────────────────────
    // drain() è O(1) e thread-safe: scambia atomicamente il buffer interno
    // con uno vuoto. Gli eventi eBPF arrivano già con process_id, process_comm
    // e user_id valorizzati dal kernel — nessuna scansione /proc/*/fd.
    std::vector<bsc::model::Connection> conns = ebpf_mon_.drain();
    ebpf_flow_cache_store_many(conns);
 
    // Costruiamo un set di chiavi già presenti dagli eventi eBPF per evitare
    // duplicati con i risultati di /proc/net/tcp (stessa connessione vista
    // da entrambe le sorgenti).
    std::unordered_set<std::string> ebpf_keys;
    ebpf_keys.reserve(conns.size());
    for (const auto& c : conns) ebpf_keys.insert(c.key());
 
    // ── Sorgente /proc/net (fallback + connessioni preesistenti) ──────
    auto inode_map = build_inode_pid_map();
    std::vector<bsc::model::Connection> proc_conns;
    append_rows(proc_conns, parse_file("/proc/net/tcp",  "tcp",  false), inode_map);
    append_rows(proc_conns, parse_file("/proc/net/udp",  "udp",  false), inode_map);
    append_rows(proc_conns, parse_file("/proc/net/tcp6", "tcp6", true),  inode_map);
    append_rows(proc_conns, parse_file("/proc/net/udp6", "udp6", true),  inode_map);
 
    // Aggiungi solo i flow /proc non già coperti da eBPF.
    // Per le connessioni già viste da eBPF, i dati eBPF sono più freschi
    // (PID e comm catturati nel momento esatto della connect()).
    for (auto& c : proc_conns) {
        if (ebpf_keys.find(c.key()) == ebpf_keys.end())
            conns.push_back(std::move(c));
    }
 
    return conns;
}

References bsc::ebpf::EBPFMon::drain(), and ebpf_mon_.

Referenced by list_connections().

discard_pending_events()

void bsc::net::SocketSnapshot::discard_pending_events

(

)

const

Definition at line 406 of file SocketSnapshot.cpp.

                                                  {
    (void)ebpf_mon_.drain();
    std::lock_guard lock(cache_mutex_);
    cache_.connections.clear();
    cache_.updated_at = {};
}

References cache_, cache_mutex_, bsc::net::SocketSnapshot::SnapshotCache::connections, bsc::ebpf::EBPFMon::drain(), ebpf_mon_, and bsc::net::SocketSnapshot::SnapshotCache::updated_at.

enrich_connection()

bool bsc::net::SocketSnapshot::enrich_connection

(

bsc::model::Connection &

conn

)

const

Definition at line 423 of file SocketSnapshot.cpp.

                                                                     {
    auto pending_ebpf = ebpf_mon_.drain();
    ebpf_flow_cache_store_many(pending_ebpf);
    if (auto from_ebpf = ebpf_flow_cache_lookup(conn)) {
        if (conn.process_id == 0) conn.process_id = from_ebpf->process_id;
        if (conn.user_id == 0xffffffffu) conn.user_id = from_ebpf->user_id;
        if (conn.protocol.empty()) conn.protocol = from_ebpf->protocol;
        if (conn.src_ip.empty()) conn.src_ip = from_ebpf->src_ip;
        if (conn.src_port == 0) conn.src_port = from_ebpf->src_port;
        if (conn.dst_ip.empty()) conn.dst_ip = from_ebpf->dst_ip;
        if (conn.dst_port == 0) conn.dst_port = from_ebpf->dst_port;
        if (conn.process_comm.empty()) conn.process_comm = from_ebpf->process_comm;
        if (!from_ebpf->process_path.empty() && conn.process_path.empty()) conn.process_path = from_ebpf->process_path;
        if (conn.process_id != 0 || !conn.process_comm.empty()) return true;
    }
    // ── STRATEGIA 1: eBPF recent-flow cache già drenata sopra ──────────
    // Se non basta, scendiamo ai fallback tradizionali.
    // ── STRATEGIA 2: NETLINK_SOCK_DIAG ─────────────────────────────────
    // Chiede al kernel direttamente l'inode del socket che matcha la
    // 4-tupla. E' cio' che fa `ss` internamente. Vantaggi critici:
    //   - Nessuna race: il kernel ha sempre l'inode dal momento in cui
    //     il socket e' creato (prima ancora che NFQUEUE veda il SYN).
    //   - Veloce: singola syscall netlink, non scansione di /proc.
    //   - Niente parsing: struttura binaria.
    // Facciamo questo PRIMA di qualsiasi cosa: se il kernel conosce il
    // socket, l'inode e' subito buono e serviamo in <1ms.
    if (!conn.src_ip.empty() && !conn.dst_ip.empty() &&
        conn.src_port != 0 && conn.dst_port != 0) {
        const bool is_udp = normalize_proto(conn.protocol) == "udp";
        auto info = is_udp
            ? sockdiag_lookup_udp(conn.src_ip, static_cast<std::uint16_t>(conn.src_port),
                                  conn.dst_ip, static_cast<std::uint16_t>(conn.dst_port))
            : sockdiag_lookup_tcp(conn.src_ip, static_cast<std::uint16_t>(conn.src_port),
                                  conn.dst_ip, static_cast<std::uint16_t>(conn.dst_port));
        if (info) {
            if (conn.user_id == 0xffffffffu) conn.user_id = info->uid;
            const auto inode_str = std::to_string(info->inode);
            const auto pid = find_pid_by_inode_direct(inode_str);
            if (pid != 0) {
                conn.process_id = pid;
                if (conn.process_comm.empty()) conn.process_comm = read_proc_comm(pid);
                return true;
            }
            // Inode noto ma PID non ancora mappato in /proc/*/fd: retry
            // rapido (il kernel potrebbe non aver ancora scritto il
            // symlink socket:[inode] nel fd del processo).
            for (int i = 0; i < 3 && conn.process_id == 0; ++i) {
                std::this_thread::sleep_for(std::chrono::milliseconds(15 + 10 * i));
                const auto p2 = find_pid_by_inode_direct(inode_str);
                if (p2 != 0) {
                    conn.process_id = p2;
                    if (conn.process_comm.empty()) conn.process_comm = read_proc_comm(p2);
                    return true;
                }
            }
        }
    }
 
    // ── STRATEGIA 2: snapshot /proc/net/tcp cached (fallback) ──────────
    if (auto found = find_connection(conn)) {
        if (conn.process_id == 0) conn.process_id = found->process_id;
        if (conn.user_id == 0xffffffffu) conn.user_id = found->user_id;
        if (conn.protocol.empty()) conn.protocol = found->protocol;
        if (conn.src_ip.empty()) conn.src_ip = found->src_ip;
        if (conn.src_port == 0) conn.src_port = found->src_port;
        if (conn.dst_ip.empty()) conn.dst_ip = found->dst_ip;
        if (conn.dst_port == 0) conn.dst_port = found->dst_port;
        if (conn.process_comm.empty()) conn.process_comm = found->process_comm;
        if (conn.process_id != 0) {
            if (conn.process_comm.empty()) conn.process_comm = read_proc_comm(conn.process_id);
            return true;
        }
    }
 
    // ── STRATEGIA 3: inode da /proc/net/tcp, poi PID da /proc/*/fd ────
    const auto inode = find_inode_for_flow(conn);
    if (inode.empty()) {
        if (conn.process_id != 0 && conn.process_comm.empty()) {
            conn.process_comm = read_proc_comm(conn.process_id);
        }
        return conn.process_id != 0;
    }
 
    const auto pid = find_pid_by_inode_direct(inode);
    if (pid != 0) {
        conn.process_id = pid;
        if (conn.process_comm.empty()) conn.process_comm = read_proc_comm(pid);
        return true;
    }
 
    if (conn.process_id != 0 && conn.process_comm.empty()) {
        conn.process_comm = read_proc_comm(conn.process_id);
    }
    return conn.process_id != 0;
}

References bsc::ebpf::EBPFMon::drain(), bsc::model::Connection::dst_ip, bsc::model::Connection::dst_port, ebpf_mon_, find_connection(), bsc::model::Connection::process_comm, bsc::model::Connection::process_id, bsc::model::Connection::process_path, bsc::model::Connection::protocol, bsc::net::sockdiag_lookup_tcp(), bsc::net::sockdiag_lookup_udp(), bsc::model::Connection::src_ip, bsc::model::Connection::src_port, and bsc::model::Connection::user_id.

Referenced by bsc::service::DaemonService::run().

find_connection()

std::optional< bsc::model::Connection > bsc::net::SocketSnapshot::find_connection ( const bsc::model::Connection & needle ) const

nodiscard

Definition at line 413 of file SocketSnapshot.cpp.

                                                                                                      {
    auto pending_ebpf = ebpf_mon_.drain();
    ebpf_flow_cache_store_many(pending_ebpf);
    if (auto cached = ebpf_flow_cache_lookup(needle)) return cached;
    for (const auto& conn : list_connections()) {
        if (same_flow(conn, needle)) return conn;
    }
    return std::nullopt;
}

References bsc::ebpf::EBPFMon::drain(), ebpf_mon_, and list_connections().

Referenced by enrich_connection().

invalidate_cache()

void bsc::net::SocketSnapshot::invalidate_cache

(

)

Definition at line 400 of file SocketSnapshot.cpp.

                                      {
    std::lock_guard lock(cache_mutex_);
    cache_.connections.clear();
    cache_.updated_at = {};
}

References cache_, cache_mutex_, bsc::net::SocketSnapshot::SnapshotCache::connections, and bsc::net::SocketSnapshot::SnapshotCache::updated_at.

Referenced by bsc::service::DaemonService::run().

list_connections()

std::vector< bsc::model::Connection > bsc::net::SocketSnapshot::list_connections ( ) const

nodiscard

Definition at line 384 of file SocketSnapshot.cpp.

                                                                     {
    const auto now = std::chrono::steady_clock::now();
    {
        std::lock_guard lock(cache_mutex_);
        if (cache_valid(now)) return cache_.connections;
    }
 
    auto refreshed = collect_connections();
    {
        std::lock_guard lock(cache_mutex_);
        cache_.connections = refreshed;
        cache_.updated_at = now;
        return cache_.connections;
    }
}

References cache_, cache_mutex_, cache_valid(), collect_connections(), bsc::net::SocketSnapshot::SnapshotCache::connections, and bsc::net::SocketSnapshot::SnapshotCache::updated_at.

Referenced by find_connection().

start_ebpf()

bool bsc::net::SocketSnapshot::start_ebpf

(

const std::string &

obj_path = "/usr/lib/bastionguard-sc/bsc_ebpf.o"

)

Definition at line 376 of file SocketSnapshot.cpp.

                                                         {
    return ebpf_mon_.start(obj_path);
}

References ebpf_mon_, and bsc::ebpf::EBPFMon::start().

Referenced by bsc::service::DaemonService::run().

stop_ebpf()

void bsc::net::SocketSnapshot::stop_ebpf

(

)

Definition at line 380 of file SocketSnapshot.cpp.

                               {
    ebpf_mon_.stop();
}

References ebpf_mon_, and bsc::ebpf::EBPFMon::stop().

Member Data Documentation

cache_

SnapshotCache bsc::net::SocketSnapshot::cache_

mutableprivate

Definition at line 46 of file SocketSnapshot.hpp.

Referenced by cache_valid(), discard_pending_events(), invalidate_cache(), and list_connections().

cache_mutex_

std::mutex bsc::net::SocketSnapshot::cache_mutex_

mutableprivate

Definition at line 45 of file SocketSnapshot.hpp.

Referenced by discard_pending_events(), invalidate_cache(), and list_connections().

ebpf_mon_

bsc::ebpf::EBPFMon bsc::net::SocketSnapshot::ebpf_mon_

mutableprivate

Definition at line 50 of file SocketSnapshot.hpp.

Referenced by collect_connections(), discard_pending_events(), enrich_connection(), find_connection(), start_ebpf(), and stop_ebpf().

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-secure-connection/daemon/include/bsc/net/SocketSnapshot.hpp
• BastionGuard/thirdparty/bastionguard-secure-connection/daemon/src/net/SocketSnapshot.cpp