bsc::fw::anonymous_namespace{Firewall.cpp} Namespace Reference

Classes
struct	RenderedRuleLine

Functions
std::string	trim (std::string s)
std::string	lower (std::string s)
std::vector< std::string >	split_csv_values (const std::string &raw)
std::optional< std::string >	resolve_nft_binary ()
std::string	shell_quote (const std::string &in)
std::string	normalize_chain_type (const std::string &type, const std::string &hook)
std::string	default_priority_for (const std::string &type)
std::string	normalize_chain_name (std::string name)
std::string	normalize_table_name (std::string name)
std::string	render_value_set (const std::vector< std::string > &values)
std::string	render_statement (const json &stmt)
std::string	render_rule (const json &rule)
std::string	convert_legacy_parameters (const std::string &params)
std::optional< RenderedRuleLine >	render_legacy_rule (const json &legacy_rule)
void	ensure_table_and_chain (std::ostringstream &script, std::set< std::string > &recreated_tables, std::set< std::string > &created_chains, const std::string &family, const std::string &table, const std::string &chain, const std::string &type, const std::string &hook, const std::string &priority, const std::string &policy)
bool	render_json_config_to_nft (const json &j, const fs::path &script_path)

Function Documentation

convert_legacy_parameters()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::convert_legacy_parameters

(

const std::string &

params

)

Definition at line 206 of file Firewall.cpp.

                                                             {
    std::istringstream iss(params);
    std::vector<std::string> out;
    std::string tok;
    while (iss >> tok) {
        if ((tok == "-p" || tok == "--protocol") && iss >> tok) out.push_back(lower(tok));
        else if ((tok == "--dport" || tok == "--destination-port") && iss >> tok) out.push_back("tcp dport " + tok);
        else if ((tok == "--sport" || tok == "--source-port") && iss >> tok) out.push_back("tcp sport " + tok);
        else if ((tok == "-d" || tok == "--destination") && iss >> tok) out.push_back("ip daddr " + tok);
        else if ((tok == "-s" || tok == "--source") && iss >> tok) out.push_back("ip saddr " + tok);
    }
    std::ostringstream oss;
    for (std::size_t i = 0; i < out.size(); ++i) {
        if (i) oss << ' ';
        oss << out[i];
    }
    return trim(oss.str());
}

References convert_legacy_parameters(), lower(), and trim().

Referenced by convert_legacy_parameters(), and render_legacy_rule().

default_priority_for()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::default_priority_for

(

const std::string &

type

)

Definition at line 99 of file Firewall.cpp.

                                                      {
    const auto t = lower(type);
    if (t == "natdest") return "dstnat";
    if (t == "natsource") return "srcnat";
    if (t == "mangle") return "mangle";
    return "filter";
}

References default_priority_for(), and lower().

Referenced by default_priority_for(), and render_json_config_to_nft().

ensure_table_and_chain()

void bsc::fw::anonymous_namespace{Firewall.cpp}::ensure_table_and_chain	(	std::ostringstream &	script,
		std::set< std::string > &	recreated_tables,
		std::set< std::string > &	created_chains,
		const std::string &	family,
		const std::string &	table,
		const std::string &	chain,
		const std::string &	type,
		const std::string &	hook,
		const std::string &	priority,
		const std::string &	policy )

Definition at line 271 of file Firewall.cpp.

                                                     {
    const auto table_key = family + ":" + table;
    if (recreated_tables.find(table_key) == recreated_tables.end()) {
        script << "delete table " << family << ' ' << table << "\n";
        script << "add table " << family << ' ' << table << "\n";
        recreated_tables.insert(table_key);
    }
 
    const auto chain_key = table_key + ":" + chain;
    if (created_chains.find(chain_key) != created_chains.end()) return;
 
    script << "add chain " << family << ' ' << table << ' ' << chain;
    if (!hook.empty()) {
        script << " { type " << type
               << " hook " << hook
               << " priority " << priority
               << "; policy " << policy << "; }";
    }
    script << "\n";
    created_chains.insert(chain_key);
}

References ensure_table_and_chain().

Referenced by ensure_table_and_chain(), and render_json_config_to_nft().

lower()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::lower

(

std::string

s

)

Definition at line 31 of file Firewall.cpp.

                             {
    std::transform(s.begin(), s.end(), s.begin(),
                   [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
    return s;
}

References lower().

Referenced by convert_legacy_parameters(), default_priority_for(), lower(), normalize_chain_name(), normalize_chain_type(), normalize_table_name(), render_json_config_to_nft(), render_legacy_rule(), and render_rule().

normalize_chain_name()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::normalize_chain_name

(

std::string

name

)

Definition at line 107 of file Firewall.cpp.

                                               {
    name = lower(trim(std::move(name)));
    if (name == "input" || name == "output" || name == "forward" || name == "prerouting" || name == "postrouting") {
        return name;
    }
    return name;
}

References lower(), normalize_chain_name(), and trim().

Referenced by normalize_chain_name(), and render_legacy_rule().

normalize_chain_type()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::normalize_chain_type	(	const std::string &	type,
		const std::string &	hook )

Definition at line 90 of file Firewall.cpp.

                                                                             {
    const auto t = lower(type);
    const auto h = lower(hook);
    if (t == "natdest" || t == "natsource" || t == "nat") return "nat";
    if (t == "route") return "route";
    if (t == "mangle") return h == "output" ? "route" : "filter";
    return "filter";
}

References lower(), and normalize_chain_type().

Referenced by normalize_chain_type(), and render_json_config_to_nft().

normalize_table_name()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::normalize_table_name

(

std::string

name

)

Definition at line 115 of file Firewall.cpp.

                                               {
    name = lower(trim(std::move(name)));
    return name.empty() ? std::string{"filter"} : name;
}

References lower(), normalize_table_name(), and trim().

Referenced by normalize_table_name(), and render_legacy_rule().

render_json_config_to_nft()

bool bsc::fw::anonymous_namespace{Firewall.cpp}::render_json_config_to_nft	(	const json &	j,
		const fs::path &	script_path )

Definition at line 302 of file Firewall.cpp.

                                                                         {
    if (j.contains("Enabled") && j["Enabled"].is_boolean() && !j["Enabled"].get<bool>()) {
        bsc::logging::Logger::instance().info("firewall config caricata ma disabilitata: skip reload");
        return true;
    }
 
    if (!j.contains("SystemRules") || !j["SystemRules"].is_array()) return false;
 
    std::ostringstream script;
    script << "#!/usr/sbin/nft -f\n";
 
    std::set<std::string> recreated_tables;
    std::set<std::string> created_chains;
    std::size_t added_rules = 0;  // contatore regole effettivamente emesse
 
    for (const auto& group : j["SystemRules"]) {
        if (!group.is_object()) continue;
 
        if (group.contains("Rule") && group["Rule"].is_object()) {
            if (auto legacy = render_legacy_rule(group["Rule"])) {
                ensure_table_and_chain(script, recreated_tables, created_chains,
                                       legacy->family, legacy->table, legacy->chain,
                                       normalize_chain_type(legacy->table, legacy->chain),
                                       legacy->chain,
                                       default_priority_for(legacy->table),
                                       "accept");
                script << "add rule " << legacy->family << ' ' << legacy->table << ' ' << legacy->chain
                       << ' ' << legacy->rule << "\n";
                ++added_rules;
            }
        }
 
        if (!group.contains("Chains") || !group["Chains"].is_array()) continue;
 
        for (const auto& chain : group["Chains"]) {
            if (!chain.is_object()) continue;
 
            const auto family = lower(trim(chain.value("Family", std::string{"inet"})));
            const auto table = trim(chain.value("Table", std::string{}));
            const auto name = trim(chain.value("Name", std::string{}));
            const auto hook = lower(trim(chain.value("Hook", std::string{})));
            if (table.empty() || name.empty()) continue;
 
            // Conta quante Rules dentro questa chain sono enabled. Se zero,
            // non creiamo neanche la chain: con `system-fw.json` legacy di
            // OpenSnitch tutte le chain sono placeholder vuote che nft non
            // sa gestire senza priority valida.
            std::size_t chain_enabled_rules = 0;
            if (chain.contains("Rules") && chain["Rules"].is_array()) {
                for (const auto& rule : chain["Rules"]) {
                    if (rule.is_object() && rule.contains("Enabled") &&
                        rule["Enabled"].is_boolean() && !rule["Enabled"].get<bool>()) continue;
                    if (!render_rule(rule).empty()) ++chain_enabled_rules;
                }
            }
            if (chain_enabled_rules == 0) continue;
 
            const auto policy = lower(trim(chain.value("Policy", std::string{"accept"})));
            const auto priority = trim(chain.value("Priority", std::string{}));
            const auto type = normalize_chain_type(chain.value("Type", std::string{"filter"}), hook);
            ensure_table_and_chain(script, recreated_tables, created_chains,
                                   family, table, name, type, hook,
                                   priority.empty() ? default_priority_for(chain.value("Type", std::string{"filter"})) : priority,
                                   policy);
 
            for (const auto& rule : chain["Rules"]) {
                const auto rendered = render_rule(rule);
                if (!rendered.empty()) {
                    script << "add rule " << family << ' ' << table << ' ' << name
                           << ' ' << rendered << "\n";
                    ++added_rules;
                }
            }
        }
    }
 
    // Se non abbiamo emesso nessuna regola effettiva, non scriviamo neanche
    // lo script: il chiamante interpretera' questo come "niente da fare"
    // (ritorno true) e non generera' un warning inutile.
    if (added_rules == 0) {
        bsc::logging::Logger::instance().info(
            "system-fw.json presente ma nessuna regola abilitata: skip reload");
        return true;
    }
 
    std::ofstream out(script_path);
    out << script.str();
    return static_cast<bool>(out);
}

References default_priority_for(), ensure_table_and_chain(), bsc::logging::Logger::info(), bsc::logging::Logger::instance(), lower(), normalize_chain_type(), render_json_config_to_nft(), render_legacy_rule(), render_rule(), and trim().

Referenced by render_json_config_to_nft().

render_legacy_rule()

std::optional< RenderedRuleLine > bsc::fw::anonymous_namespace{Firewall.cpp}::render_legacy_rule

(

const json &

legacy_rule

)

Definition at line 232 of file Firewall.cpp.

                                                                          {
    if (!legacy_rule.is_object()) return std::nullopt;
    if (legacy_rule.contains("Enabled") && legacy_rule["Enabled"].is_boolean() && !legacy_rule["Enabled"].get<bool>()) return std::nullopt;
 
    RenderedRuleLine line;
    line.table = normalize_table_name(legacy_rule.value("Table", std::string{}));
    line.chain = normalize_chain_name(legacy_rule.value("Chain", std::string{}));
    std::vector<std::string> parts;
 
    if (legacy_rule.contains("Parameters") && legacy_rule["Parameters"].is_string()) {
        const auto converted = convert_legacy_parameters(legacy_rule["Parameters"].get<std::string>());
        if (!converted.empty()) parts.push_back(converted);
    }
 
    if (legacy_rule.contains("Expressions") && legacy_rule["Expressions"].is_array()) {
        for (const auto& expr : legacy_rule["Expressions"]) {
            if (!expr.is_object() || !expr.contains("Statement")) continue;
            const auto stmt = render_statement(expr["Statement"]);
            if (!stmt.empty()) parts.push_back(stmt);
        }
    }
 
    const auto target = trim(lower(legacy_rule.value("Target", std::string{})));
    if (!target.empty()) parts.push_back(target);
    if (legacy_rule.contains("TargetParameters") && legacy_rule["TargetParameters"].is_string()) {
        const auto params = trim(legacy_rule["TargetParameters"].get<std::string>());
        if (!params.empty()) parts.push_back(params);
    }
 
    std::ostringstream oss;
    for (std::size_t i = 0; i < parts.size(); ++i) {
        if (i) oss << ' ';
        oss << parts[i];
    }
    line.rule = trim(oss.str());
    if (line.table.empty() || line.chain.empty() || line.rule.empty()) return std::nullopt;
    return line;
}

References convert_legacy_parameters(), lower(), normalize_chain_name(), normalize_table_name(), render_legacy_rule(), render_statement(), and trim().

Referenced by render_json_config_to_nft(), and render_legacy_rule().

render_rule()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::render_rule

(

const json &

rule

)

Definition at line 169 of file Firewall.cpp.

                                        {
    if (!rule.is_object()) return {};
    if (rule.contains("Enabled") && rule["Enabled"].is_boolean() && !rule["Enabled"].get<bool>()) return {};
 
    std::vector<std::string> parts;
 
    if (rule.contains("Parameters") && rule["Parameters"].is_string()) {
        const auto params = trim(rule["Parameters"].get<std::string>());
        if (!params.empty()) parts.push_back(params);
    }
 
    if (rule.contains("Expressions") && rule["Expressions"].is_array()) {
        for (const auto& expr : rule["Expressions"]) {
            if (!expr.is_object()) continue;
            if (expr.contains("Statement")) {
                const auto stmt = render_statement(expr["Statement"]);
                if (!stmt.empty()) parts.push_back(stmt);
            }
        }
    }
 
    const auto target = trim(lower(rule.value("Target", std::string{})));
    if (!target.empty()) parts.push_back(target);
 
    if (rule.contains("TargetParameters") && rule["TargetParameters"].is_string()) {
        const auto params = trim(rule["TargetParameters"].get<std::string>());
        if (!params.empty()) parts.push_back(params);
    }
 
    std::ostringstream oss;
    for (std::size_t i = 0; i < parts.size(); ++i) {
        if (i) oss << ' ';
        oss << parts[i];
    }
    return trim(oss.str());
}

References lower(), render_rule(), render_statement(), and trim().

Referenced by render_json_config_to_nft(), and render_rule().

render_statement()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::render_statement

(

const json &

stmt

)

Definition at line 134 of file Firewall.cpp.

                                             {
    if (!stmt.is_object()) return {};
 
    const std::string name = trim(stmt.value("Name", std::string{}));
    if (name.empty()) return {};
 
    std::map<std::string, std::vector<std::string>> grouped;
    if (stmt.contains("Values") && stmt["Values"].is_array()) {
        for (const auto& value : stmt["Values"]) {
            if (!value.is_object()) continue;
            const auto key = trim(value.value("Key", std::string{}));
            const auto raw = trim(value.value("Value", std::string{}));
            if (raw.empty()) continue;
            for (const auto& item : split_csv_values(raw)) grouped[key].push_back(item);
        }
    }
 
    std::ostringstream oss;
    bool first = true;
    const auto op = trim(stmt.value("Op", std::string{}));
 
    for (const auto& kv : grouped) {
        if (!first) oss << ' ';
        first = false;
        oss << name;
        if (!kv.first.empty()) oss << ' ' << kv.first;
        if (!op.empty()) oss << ' ' << op;
        oss << ' ' << render_value_set(kv.second);
    }
    if (!grouped.empty()) return oss.str();
 
    if (!op.empty()) return name + " " + op;
    return name;
}

References render_statement(), render_value_set(), split_csv_values(), and trim().

Referenced by render_legacy_rule(), render_rule(), and render_statement().

render_value_set()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::render_value_set

(

const std::vector< std::string > &

values

)

Definition at line 120 of file Firewall.cpp.

                                                               {
    if (values.empty()) return {};
    if (values.size() == 1) return values.front();
 
    std::ostringstream oss;
    oss << "{ ";
    for (std::size_t i = 0; i < values.size(); ++i) {
        if (i) oss << ", ";
        oss << values[i];
    }
    oss << " }";
    return oss.str();
}

References render_value_set().

Referenced by render_statement(), and render_value_set().

resolve_nft_binary()

std::optional< std::string > bsc::fw::anonymous_namespace{Firewall.cpp}::resolve_nft_binary

(

)

Definition at line 52 of file Firewall.cpp.

                                            {
    if (const char* env = std::getenv("NFT_BIN")) {
        fs::path p(env);
        if (env[0] && fs::exists(p)) return p.string();
    }
 
    if (const char* path_env = std::getenv("PATH")) {
        std::stringstream ss(path_env);
        std::string entry;
        while (std::getline(ss, entry, ':')) {
            if (entry.empty()) continue;
            fs::path p = fs::path(entry) / "nft";
            if (fs::exists(p)) return p.string();
        }
    }
 
    static constexpr std::array<const char*, 4> candidates{
        "/usr/sbin/nft", "/sbin/nft", "/usr/bin/nft", "/bin/nft"
    };
    for (const auto* c : candidates) {
        if (fs::exists(c)) return std::string(c);
    }
    return std::nullopt;
}

References resolve_nft_binary().

Referenced by resolve_nft_binary().

shell_quote()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::shell_quote

(

const std::string &

in

)

Definition at line 77 of file Firewall.cpp.

                                           {
    std::string out = "'";
    for (char ch : in) {
        if (ch == '\'') {
            out += "'\\''";
        } else {
            out.push_back(ch);
        }
    }
    out += "'";
    return out;
}

References shell_quote().

Referenced by shell_quote().

split_csv_values()

std::vector< std::string > bsc::fw::anonymous_namespace{Firewall.cpp}::split_csv_values

(

const std::string &

raw

)

Definition at line 37 of file Firewall.cpp.

                                                            {
    std::vector<std::string> out;
    std::stringstream ss(raw);
    std::string item;
    while (std::getline(ss, item, ',')) {
        item = trim(item);
        if (!item.empty()) out.push_back(item);
    }
    if (out.empty()) {
        const auto v = trim(raw);
        if (!v.empty()) out.push_back(v);
    }
    return out;
}

References split_csv_values(), and trim().

Referenced by render_statement(), and split_csv_values().

trim()

std::string bsc::fw::anonymous_namespace{Firewall.cpp}::trim

(

std::string

s

)

Definition at line 24 of file Firewall.cpp.

                            {
    auto not_space = [](unsigned char ch) { return !std::isspace(ch); };
    s.erase(s.begin(), std::find_if(s.begin(), s.end(), not_space));
    s.erase(std::find_if(s.rbegin(), s.rend(), not_space).base(), s.end());
    return s;
}

References trim().

Referenced by convert_legacy_parameters(), normalize_chain_name(), normalize_table_name(), render_json_config_to_nft(), render_legacy_rule(), render_rule(), render_statement(), split_csv_values(), and trim().