anonymous_namespace{bastionguard-firewall.cpp} Namespace Reference

Classes
struct	SecureInput

Functions
std::optional< uid_t >	parse_uid (const char *value)
uid_t	original_caller_uid ()
bool	allowed_input_path (const std::string &path)
std::optional< SecureInput >	open_input_securely (const std::string &path, uid_t caller_uid)
std::string	trim (std::string value)
bool	is_valid_ip (const std::string &value)
std::vector< std::string >	load_and_validate_ips (int fd)
std::optional< std::string >	find_program (std::initializer_list< const char * > candidates)
bool	run_program (const std::string &executable, const std::vector< std::string > &arguments, bool silence_stderr=false)
bool	apply_ufw (const std::vector< std::string > &ips)
bool	apply_firewalld (const std::vector< std::string > &ips)
void	clear_firewall ()

Variables
constexpr std::string_view	kInputPrefix = "/tmp/bastionguard-firewall-ips-"
constexpr off_t	kMaxInputBytes = 16 * 1024 * 1024
constexpr std::size_t	kMaxEntries = 250000
constexpr std::size_t	kMaxLineLength = 128

Function Documentation

allowed_input_path()

bool anonymous_namespace{bastionguard-firewall.cpp}::allowed_input_path

(

const std::string &

path

)

Definition at line 98 of file bastionguard-firewall.cpp.

                                               {
    if (!path.starts_with(kInputPrefix)) return false;
 
    const std::string_view suffix(path.data() + kInputPrefix.size(),
                                  path.size() - kInputPrefix.size());
    return !suffix.empty() && suffix.find('/') == std::string_view::npos;
}

References allowed_input_path(), and kInputPrefix.

Referenced by allowed_input_path(), and open_input_securely().

apply_firewalld()

bool anonymous_namespace{bastionguard-firewall.cpp}::apply_firewalld

(

const std::vector< std::string > &

ips

)

Definition at line 286 of file bastionguard-firewall.cpp.

                                                      {
    const auto firewall_cmd =
        find_program({"/usr/bin/firewall-cmd", "/usr/sbin/firewall-cmd"});
    if (!firewall_cmd) return false;
 
    // These operations are idempotent from BastionGuard's perspective. An
    // already existing ipset/source association is not fatal.
    run_program(*firewall_cmd,
                {"--permanent", "--new-ipset=bastionguard-blacklist",
                 "--type=hash:ip"},
                true);
    run_program(*firewall_cmd,
                {"--permanent", "--zone=public",
                 "--add-source-ipset=bastionguard-blacklist"},
                true);
 
    bool success = true;
    for (const auto& ip : ips) {
        if (!run_program(*firewall_cmd,
                         {"--permanent",
                          "--ipset=bastionguard-blacklist",
                          "--add-entry=" + ip},
                         true)) {
            // Duplicate entries may return a non-zero status. Continue and let
            // reload determine whether firewalld is operational.
            success = false;
        }
    }
 
    const bool reloaded = run_program(*firewall_cmd, {"--reload"});
    return reloaded && (success || !ips.empty());
}

References apply_firewalld(), find_program(), and run_program().

Referenced by apply_firewalld(), and main().

apply_ufw()

bool anonymous_namespace{bastionguard-firewall.cpp}::apply_ufw

(

const std::vector< std::string > &

ips

)

Definition at line 273 of file bastionguard-firewall.cpp.

                                                {
    const auto ufw = find_program({"/usr/sbin/ufw", "/usr/bin/ufw"});
    if (!ufw) return false;
 
    if (!run_program(*ufw, {"--force", "enable"})) return false;
 
    bool success = true;
    for (const auto& ip : ips) {
        if (!run_program(*ufw, {"deny", "from", ip})) success = false;
    }
    return success;
}

References apply_ufw(), find_program(), and run_program().

Referenced by apply_ufw(), and main().

clear_firewall()

void anonymous_namespace{bastionguard-firewall.cpp}::clear_firewall

(

)

Definition at line 319 of file bastionguard-firewall.cpp.

                      {
    if (const auto ufw = find_program({"/usr/sbin/ufw", "/usr/bin/ufw"})) {
        run_program(*ufw, {"--force", "reset"});
    }
 
    if (const auto firewall_cmd =
            find_program({"/usr/bin/firewall-cmd", "/usr/sbin/firewall-cmd"})) {
        run_program(*firewall_cmd,
                    {"--permanent", "--delete-ipset=bastionguard-blacklist"},
                    true);
        run_program(*firewall_cmd, {"--reload"});
    }
}

References clear_firewall(), find_program(), and run_program().

Referenced by clear_firewall(), and main().

find_program()

std::optional< std::string > anonymous_namespace{bastionguard-firewall.cpp}::find_program

(

std::initializer_list< const char * >

candidates

)

Definition at line 227 of file bastionguard-firewall.cpp.

                                                 {
    for (const char* candidate : candidates) {
        if (::access(candidate, X_OK) == 0) return std::string(candidate);
    }
    return std::nullopt;
}

References find_program().

Referenced by apply_firewalld(), apply_ufw(), clear_firewall(), and find_program().

is_valid_ip()

bool anonymous_namespace{bastionguard-firewall.cpp}::is_valid_ip

(

const std::string &

value

)

Definition at line 162 of file bastionguard-firewall.cpp.

                                         {
    if (value.empty() || value.size() > kMaxLineLength) return false;
 
    in_addr ipv4 {};
    if (::inet_pton(AF_INET, value.c_str(), &ipv4) == 1) return true;
 
    in6_addr ipv6 {};
    return ::inet_pton(AF_INET6, value.c_str(), &ipv6) == 1;
}

References AF_INET, AF_INET6, is_valid_ip(), and kMaxLineLength.

Referenced by is_valid_ip(), and load_and_validate_ips().

load_and_validate_ips()

std::vector< std::string > anonymous_namespace{bastionguard-firewall.cpp}::load_and_validate_ips

(

int

fd

)

Definition at line 172 of file bastionguard-firewall.cpp.

                                                   {
    std::string data;
    data.reserve(64 * 1024);
 
    char buffer[8192];
    while (true) {
        const ssize_t count = ::read(fd, buffer, sizeof(buffer));
        if (count == 0) break;
        if (count < 0) {
            if (errno == EINTR) continue;
            std::cerr << _("[Firewall] Errore lettura file input: ")
                      << std::strerror(errno) << "\n";
            return {};
        }
 
        if (data.size() + static_cast<std::size_t>(count) >
            static_cast<std::size_t>(kMaxInputBytes)) {
            std::cerr << _("[Firewall] File input troppo grande.\n");
            return {};
        }
        data.append(buffer, static_cast<std::size_t>(count));
    }
 
    std::vector<std::string> ips;
    std::unordered_set<std::string> seen;
    std::size_t start = 0;
 
    while (start <= data.size()) {
        const auto end = data.find('\n', start);
        std::string line = trim(data.substr(
            start,
            end == std::string::npos ? std::string::npos : end - start));
 
        if (!line.empty() && line.front() != '#') {
            if (!is_valid_ip(line)) {
                std::cerr << _("[Firewall] Voce IP rifiutata: ") << line << "\n";
                return {};
            }
 
            if (seen.insert(line).second) {
                ips.push_back(std::move(line));
                if (ips.size() > kMaxEntries) {
                    std::cerr << _("[Firewall] Troppe voci nel file input.\n");
                    return {};
                }
            }
        }
 
        if (end == std::string::npos) break;
        start = end + 1;
    }
 
    return ips;
}

References _, is_valid_ip(), kMaxEntries, kMaxInputBytes, load_and_validate_ips(), and trim().

Referenced by load_and_validate_ips(), and main().

open_input_securely()

std::optional< SecureInput > anonymous_namespace{bastionguard-firewall.cpp}::open_input_securely	(	const std::string &	path,
		uid_t	caller_uid )

Definition at line 106 of file bastionguard-firewall.cpp.

                                                                  {
    if (!allowed_input_path(path)) {
        std::cerr << _("[Firewall] Percorso input non autorizzato.\n");
        return std::nullopt;
    }
 
    const int fd = ::open(path.c_str(), O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
    if (fd < 0) {
        std::cerr << _("[Firewall] Impossibile aprire il file input: ")
                  << std::strerror(errno) << "\n";
        return std::nullopt;
    }
 
    struct stat st {};
    if (::fstat(fd, &st) != 0) {
        std::cerr << _("[Firewall] fstat fallita: ")
                  << std::strerror(errno) << "\n";
        ::close(fd);
        return std::nullopt;
    }
 
    const bool ownership_ok =
        (caller_uid == 0 && st.st_uid == 0) ||
        (caller_uid != 0 && st.st_uid == caller_uid);
 
    if (!S_ISREG(st.st_mode) ||
        st.st_nlink != 1 ||
        !ownership_ok ||
        (st.st_mode & (S_IWGRP | S_IWOTH)) != 0 ||
        st.st_size <= 0 ||
        st.st_size > kMaxInputBytes) {
        std::cerr << _("[Firewall] File input non sicuro o non valido.\n");
        ::close(fd);
        return std::nullopt;
    }
 
    // The descriptor remains valid after unlink and cannot be replaced through
    // the pathname while the privileged process is reading it.
    if (::unlink(path.c_str()) != 0) {
        std::cerr << _("[Firewall] Impossibile rimuovere il file temporaneo: ")
                  << std::strerror(errno) << "\n";
        ::close(fd);
        return std::nullopt;
    }
 
    return SecureInput(fd, path);
}

References _, allowed_input_path(), kMaxInputBytes, open_input_securely(), S_IWGRP, S_IWOTH, and anonymous_namespace{bastionguard-firewall.cpp}::SecureInput::SecureInput().

Referenced by main(), and open_input_securely().

original_caller_uid()

uid_t anonymous_namespace{bastionguard-firewall.cpp}::original_caller_uid

(

)

Definition at line 91 of file bastionguard-firewall.cpp.

                            {
    if (const auto uid = parse_uid(std::getenv("PKEXEC_UID"))) {
        return *uid;
    }
    return ::getuid();
}

References original_caller_uid(), and parse_uid().

Referenced by main(), and original_caller_uid().

parse_uid()

std::optional< uid_t > anonymous_namespace{bastionguard-firewall.cpp}::parse_uid

(

const char *

value

)

Definition at line 78 of file bastionguard-firewall.cpp.

                                                {
    if (!value || !*value) return std::nullopt;
 
    unsigned long long parsed = 0;
    for (const unsigned char ch : std::string(value)) {
        if (!std::isdigit(ch)) return std::nullopt;
        parsed = parsed * 10 + static_cast<unsigned long long>(ch - '0');
        if (parsed > std::numeric_limits<uid_t>::max()) return std::nullopt;
    }
 
    return static_cast<uid_t>(parsed);
}

References parse_uid().

Referenced by original_caller_uid(), and parse_uid().

run_program()

bool anonymous_namespace{bastionguard-firewall.cpp}::run_program	(	const std::string &	executable,
		const std::vector< std::string > &	arguments,
		bool	silence_stderr = false )

Definition at line 235 of file bastionguard-firewall.cpp.

                                            {
    std::vector<std::string> storage;
    storage.reserve(arguments.size() + 1);
    storage.push_back(executable);
    storage.insert(storage.end(), arguments.begin(), arguments.end());
 
    std::vector<char*> argv;
    argv.reserve(storage.size() + 1);
    for (auto& value : storage) argv.push_back(value.data());
    argv.push_back(nullptr);
 
    const pid_t pid = ::fork();
    if (pid < 0) return false;
 
    if (pid == 0) {
        if (silence_stderr) {
            const int null_fd = ::open("/dev/null", O_WRONLY | O_CLOEXEC);
            if (null_fd >= 0) {
                ::dup2(null_fd, STDERR_FILENO);
                if (null_fd != STDERR_FILENO) ::close(null_fd);
            }
        }
 
        ::execv(executable.c_str(), argv.data());
        _exit(127);
    }
 
    int status = 0;
    while (::waitpid(pid, &status, 0) < 0) {
        if (errno == EINTR) continue;
        return false;
    }
 
    return WIFEXITED(status) && WEXITSTATUS(status) == 0;
}

References run_program().

Referenced by apply_firewalld(), apply_ufw(), clear_firewall(), and run_program().

trim()

std::string anonymous_namespace{bastionguard-firewall.cpp}::trim

(

std::string

value

)

Definition at line 155 of file bastionguard-firewall.cpp.

                                {
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos) return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}

References trim().

Referenced by load_and_validate_ips(), and trim().

Variable Documentation

kInputPrefix

std::string_view anonymous_namespace{bastionguard-firewall.cpp}::kInputPrefix = "/tmp/bastionguard-firewall-ips-"

constexpr

Definition at line 42 of file bastionguard-firewall.cpp.

Referenced by allowed_input_path().

kMaxEntries

std::size_t anonymous_namespace{bastionguard-firewall.cpp}::kMaxEntries = 250000

constexpr

Definition at line 44 of file bastionguard-firewall.cpp.

Referenced by load_and_validate_ips().

kMaxInputBytes

off_t anonymous_namespace{bastionguard-firewall.cpp}::kMaxInputBytes = 16 * 1024 * 1024

constexpr

Definition at line 43 of file bastionguard-firewall.cpp.

Referenced by load_and_validate_ips(), and open_input_securely().

kMaxLineLength

std::size_t anonymous_namespace{bastionguard-firewall.cpp}::kMaxLineLength = 128

constexpr

Definition at line 45 of file bastionguard-firewall.cpp.

Referenced by is_valid_ip().