bsc::rule::anonymous_namespace{Rule.cpp} Namespace Reference

Functions
std::string	trim (std::string s)
std::string	digest_file (const std::string &path, const EVP_MD *(*algo)())
std::string	to_lower (std::string s)
std::string	normalize_operand (std::string op)
std::vector< std::string >	field_values (const bsc::model::Connection &c, const std::string &operand)
bool	parse_ipv4 (const std::string &ip, std::uint32_t &out)
bool	parse_ipv6 (const std::string &ip, in6_addr &out)
bool	ip_in_cidr (const std::string &ip, const std::string &cidr)
std::optional< std::pair< unsigned long long, unsigned long long > >	parse_range (const std::string &data)
std::unordered_set< std::string >	load_simple_list_file (const fs::path &path, bool sensitive)
Operator	parse_operator (const json &j)
json	to_json_op (const Operator &op)

Variables
std::map< std::string, std::vector< std::string > >	g_aliases

Function Documentation

digest_file()

std::string bsc::rule::anonymous_namespace{Rule.cpp}::digest_file	(	const std::string &	path,
		const EVP_MD *	algo (*)() )

Definition at line 30 of file Rule.cpp.

                                                                     {
    if (path.empty()) return {};
    std::ifstream in(path, std::ios::binary);
    if (!in) return {};
    EVP_MD_CTX* ctx = EVP_MD_CTX_new();
    if (!ctx) return {};
    unsigned char md[EVP_MAX_MD_SIZE]{};
    unsigned int md_len = 0;
    std::array<char, 8192> buf{};
    std::string out;
    if (EVP_DigestInit_ex(ctx, algo(), nullptr) == 1) {
        while (in.read(buf.data(), buf.size()) || in.gcount() > 0) EVP_DigestUpdate(ctx, buf.data(), static_cast<size_t>(in.gcount()));
        if (EVP_DigestFinal_ex(ctx, md, &md_len) == 1) {
            static const char* hex = "0123456789abcdef";
            out.reserve(md_len * 2);
            for (unsigned int i = 0; i < md_len; ++i) { out.push_back(hex[md[i] >> 4]); out.push_back(hex[md[i] & 0x0f]); }
        }
    }
    EVP_MD_CTX_free(ctx);
    return out;
}

References digest_file().

Referenced by digest_file(), and field_values().

field_values()

std::vector< std::string > bsc::rule::anonymous_namespace{Rule.cpp}::field_values	(	const bsc::model::Connection &	c,
		const std::string &	operand )

Definition at line 80 of file Rule.cpp.

                                                                                         {
    const auto op = normalize_operand(operand);
    if (op == "true") return {"true"};
    if (op == "protocol") return {c.protocol};
    if (op == "source.ip") return {c.src_ip};
    if (op == "dest.ip") return {c.dst_ip};
    if (op == "dest.host") return {c.dst_host};
    if (op == "process.path") return {c.process_path};
    if (op == "process.name") return {c.process_comm};
    if (op == "process.cwd") return {c.process_cwd};
    if (op == "user.id") return {std::to_string(c.user_id)};
    if (op == "user.name") {
        if (passwd* pw = getpwuid(c.user_id)) return {pw->pw_name ? std::string(pw->pw_name) : std::string{}};
        return {""};
    }
    if (op == "process.id") return {std::to_string(c.process_id)};
    if (op == "source.port") return {std::to_string(c.src_port)};
    if (op == "dest.port") return {std::to_string(c.dst_port)};
    if (op == "process.command") {
        std::ostringstream oss;
        for (std::size_t i = 0; i < c.process_args.size(); ++i) {
            if (i) oss << ' ';
            oss << c.process_args[i];
        }
        return {oss.str()};
    }
    if (op == "process.parent.path") {
        std::vector<std::string> out;
        for (std::size_t i = 1; i < c.process_tree.size(); ++i) out.push_back(c.process_tree[i].first);
        return out;
    }
    if (op.rfind("process.env.", 0) == 0) {
        const auto key = op.substr(12);
        if (const auto it = c.process_env.find(key); it != c.process_env.end()) return {it->second};
        return {""};
    }
    if (op == "process.hash.sha256") {
        if (const auto it = c.process_checksums.find("sha256"); it != c.process_checksums.end()) return {it->second};
        return {""};
    }
    if (op == "process.hash.md5") {
        if (const auto it = c.process_checksums.find("md5"); it != c.process_checksums.end()) return {it->second};
        if (!c.process_path.empty()) return {digest_file(c.process_path, EVP_md5)};
        return {""};
    }
    if (op == "process.hash.sha1") {
        if (const auto it = c.process_checksums.find("sha1"); it != c.process_checksums.end()) return {it->second};
        if (!c.process_path.empty()) return {digest_file(c.process_path, EVP_sha1)};
        return {""};
    }
    if (op == "iface.in" || op == "iface.out") return {""};
    return {""};
}

References digest_file(), bsc::model::Connection::dst_host, bsc::model::Connection::dst_ip, bsc::model::Connection::dst_port, field_values(), normalize_operand(), bsc::model::Connection::process_args, bsc::model::Connection::process_checksums, bsc::model::Connection::process_comm, bsc::model::Connection::process_cwd, bsc::model::Connection::process_env, bsc::model::Connection::process_id, bsc::model::Connection::process_path, bsc::model::Connection::process_tree, bsc::model::Connection::protocol, bsc::model::Connection::src_ip, bsc::model::Connection::src_port, and bsc::model::Connection::user_id.

Referenced by field_values().

ip_in_cidr()

bool bsc::rule::anonymous_namespace{Rule.cpp}::ip_in_cidr	(	const std::string &	ip,
		const std::string &	cidr )

Definition at line 142 of file Rule.cpp.

                                                            {
    const auto slash = cidr.find('/');
    if (slash == std::string::npos) return to_lower(ip) == to_lower(cidr);
    const auto net = cidr.substr(0, slash);
    const auto bits = std::stoi(cidr.substr(slash + 1));
    std::uint32_t ip4{}, net4{};
    if (parse_ipv4(ip, ip4) && parse_ipv4(net, net4)) {
        if (bits < 0 || bits > 32) return false;
        const std::uint32_t mask = bits == 0 ? 0u : 0xFFFFFFFFu << (32 - bits);
        return (ip4 & mask) == (net4 & mask);
    }
    in6_addr ip6{}, net6{};
    if (parse_ipv6(ip, ip6) && parse_ipv6(net, net6)) {
        if (bits < 0 || bits > 128) return false;
        const int full_bytes = bits / 8;
        const int extra_bits = bits % 8;
        if (full_bytes && std::memcmp(ip6.s6_addr, net6.s6_addr, full_bytes) != 0) return false;
        if (extra_bits == 0) return true;
        const std::uint8_t mask = static_cast<std::uint8_t>(0xFF << (8 - extra_bits));
        return (ip6.s6_addr[full_bytes] & mask) == (net6.s6_addr[full_bytes] & mask);
    }
    return false;
}

References ip_in_cidr(), parse_ipv4(), parse_ipv6(), and to_lower().

Referenced by ip_in_cidr().

load_simple_list_file()

std::unordered_set< std::string > bsc::rule::anonymous_namespace{Rule.cpp}::load_simple_list_file	(	const fs::path &	path,
		bool	sensitive )

Definition at line 176 of file Rule.cpp.

                                                                                      {
    std::unordered_set<std::string> out;
    std::ifstream in(path);
    std::string line;
    while (std::getline(in, line)) {
        if (const auto comment = line.find('#'); comment != std::string::npos) line.resize(comment);
        line.erase(std::remove_if(line.begin(), line.end(), [](unsigned char c) { return c == '\r' || c == '\n'; }), line.end());
        while (!line.empty() && std::isspace(static_cast<unsigned char>(line.back()))) line.pop_back();
        std::size_t start = 0; while (start < line.size() && std::isspace(static_cast<unsigned char>(line[start]))) ++start;
        if (start >= line.size()) continue;
        auto item = line.substr(start);
        if (!sensitive) item = to_lower(item);
        out.insert(std::move(item));
    }
    return out;
}

References load_simple_list_file(), and to_lower().

Referenced by load_simple_list_file().

normalize_operand()

std::string bsc::rule::anonymous_namespace{Rule.cpp}::normalize_operand

(

std::string

op

)

Definition at line 56 of file Rule.cpp.

                                          {
    std::replace(op.begin(), op.end(), '_', '.');
    if (op == "process.command" || op == "process.cmd") return "process.command";
    if (op == "process.hash.md5") return op;
    if (op == "process.hash.sha1") return op;
    if (op == "user.name") return op;
    if (op == "iface.in") return op;
    if (op == "iface.out") return op;
    if (op == "process.parent.path") return op;
    if (op == "process.name" || op == "process.comm") return "process.name";
    if (op == "process.path") return op;
    if (op == "process.cwd") return op;
    if (op == "process.id") return op;
    if (op == "protocol" || op == "true" || op == "list") return op;
    if (op == "source.ip" || op == "src.ip") return "source.ip";
    if (op == "source.port" || op == "src.port") return "source.port";
    if (op == "source.network" || op == "src.network") return "source.network";
    if (op == "dest.ip" || op == "dst.ip") return "dest.ip";
    if (op == "dest.host" || op == "dst.host") return "dest.host";
    if (op == "dest.port" || op == "dst.port") return "dest.port";
    if (op == "dest.network" || op == "dst.network") return "dest.network";
    if (op == "user.id") return op;
    return op;
}

References normalize_operand().

Referenced by field_values(), normalize_operand(), and parse_operator().

parse_ipv4()

bool bsc::rule::anonymous_namespace{Rule.cpp}::parse_ipv4	(	const std::string &	ip,
		std::uint32_t &	out )

Definition at line 133 of file Rule.cpp.

                                                       {
    in_addr addr{};
    if (inet_pton(AF_INET, ip.c_str(), &addr) != 1) return false;
    out = ntohl(addr.s_addr);
    return true;
}

References AF_INET, and parse_ipv4().

Referenced by ip_in_cidr(), and parse_ipv4().

parse_ipv6()

bool bsc::rule::anonymous_namespace{Rule.cpp}::parse_ipv6	(	const std::string &	ip,
		in6_addr &	out )

Definition at line 139 of file Rule.cpp.

                                                    {
    return inet_pton(AF_INET6, ip.c_str(), &out) == 1;
}

References AF_INET6, and parse_ipv6().

Referenced by ip_in_cidr(), and parse_ipv6().

parse_operator()

Operator bsc::rule::anonymous_namespace{Rule.cpp}::parse_operator

(

const json &

j

)

Definition at line 192 of file Rule.cpp.

                                       {
    Operator op;
    const auto type = j.value("type", "unknown");
    if (type == "simple") op.type = OperatorType::Simple;
    else if (type == "regexp") op.type = OperatorType::Regexp;
    else if (type == "network") op.type = OperatorType::Network;
    else if (type == "range") op.type = OperatorType::Range;
    else if (type == "list") op.type = OperatorType::List;
    else if (type == "lists") op.type = OperatorType::Lists;
    op.operand = normalize_operand(j.value("operand", ""));
    op.data = j.value("data", "");
    op.sensitive = j.value("sensitive", false);
    if (j.contains("list") && j["list"].is_array()) {
        for (const auto& item : j["list"]) op.list.push_back(parse_operator(item));
    } else if (op.type == OperatorType::List && !op.data.empty() && op.data.front() == '[') {
        try {
            for (const auto& item : json::parse(op.data)) op.list.push_back(parse_operator(item));
        } catch (...) {}
    }
    return op;
}

References bsc::rule::Operator::data, bsc::rule::List, bsc::rule::Operator::list, bsc::rule::Lists, bsc::rule::Network, normalize_operand(), bsc::rule::Operator::operand, parse_operator(), bsc::rule::Range, bsc::rule::Regexp, bsc::rule::Operator::sensitive, bsc::rule::Simple, and bsc::rule::Operator::type.

Referenced by parse_operator().

parse_range()

std::optional< std::pair< unsigned long long, unsigned long long > > bsc::rule::anonymous_namespace{Rule.cpp}::parse_range

(

const std::string &

data

)

Definition at line 165 of file Rule.cpp.

                                                                                                {
    const auto pos = data.find('-');
    if (pos == std::string::npos) return std::nullopt;
    const auto a = data.substr(0, pos);
    const auto b = data.substr(pos + 1);
    unsigned long long min = 0, max = 0;
    auto [p1, ec1] = std::from_chars(a.data(), a.data() + a.size(), min);
    auto [p2, ec2] = std::from_chars(b.data(), b.data() + b.size(), max);
    if (ec1 != std::errc{} || ec2 != std::errc{} || min > max) return std::nullopt;
    return {{min, max}};
}

References parse_range().

Referenced by parse_range().

to_json_op()

json bsc::rule::anonymous_namespace{Rule.cpp}::to_json_op

(

const Operator &

op

)

Definition at line 213 of file Rule.cpp.

                                    {
    std::string t = "unknown";
    switch (op.type) {
        case OperatorType::Simple: t = "simple"; break;
        case OperatorType::Regexp: t = "regexp"; break;
        case OperatorType::Network: t = "network"; break;
        case OperatorType::Range: t = "range"; break;
        case OperatorType::List: t = "list"; break;
        case OperatorType::Lists: t = "lists"; break;
        default: break;
    }
    json j{{"type", t}, {"operand", op.operand}, {"data", op.data}, {"sensitive", op.sensitive}, {"list", json::array()}};
    for (const auto& child : op.list) j["list"].push_back(to_json_op(child));
    return j;
}

References bsc::rule::Operator::data, bsc::rule::List, bsc::rule::Operator::list, bsc::rule::Lists, bsc::rule::Network, bsc::rule::Operator::operand, bsc::rule::Range, bsc::rule::Regexp, bsc::rule::Operator::sensitive, bsc::rule::Simple, to_json_op(), and bsc::rule::Operator::type.

Referenced by to_json_op().

to_lower()

std::string bsc::rule::anonymous_namespace{Rule.cpp}::to_lower

(

std::string

s

)

Definition at line 52 of file Rule.cpp.

                                {
    std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
    return s;
}

References to_lower().

Referenced by ip_in_cidr(), load_simple_list_file(), and to_lower().

trim()

std::string bsc::rule::anonymous_namespace{Rule.cpp}::trim

(

std::string

s

)

Definition at line 24 of file Rule.cpp.

                            {
    while (!s.empty() && std::isspace(static_cast<unsigned char>(s.front()))) s.erase(s.begin());
    while (!s.empty() && std::isspace(static_cast<unsigned char>(s.back()))) s.pop_back();
    return s;
}

References trim().

Referenced by trim().

Variable Documentation

g_aliases

std::map<std::string, std::vector<std::string> > bsc::rule::anonymous_namespace{Rule.cpp}::g_aliases

Definition at line 23 of file Rule.cpp.