Skip to content
API Documentation
BastionGuard™
bsc::net Namespace Reference

Namespaces

namespace  anonymous_namespace{SockDiag.cpp}
namespace  anonymous_namespace{SocketSnapshot.cpp}

Classes

class  DnsResolver
class  SocketSnapshot
struct  SockInfo

Functions

std::optional< SockInfo > sockdiag_lookup_tcp (const std::string &src_ip, std::uint16_t src_port, const std::string &dst_ip, std::uint16_t dst_port)
std::optional< SockInfo > sockdiag_lookup_udp (const std::string &src_ip, std::uint16_t src_port, const std::string &dst_ip, std::uint16_t dst_port)

Function Documentation

◆ sockdiag_lookup_tcp()

std::optional< SockInfo > bsc::net::sockdiag_lookup_tcp ( const std::string & src_ip,
std::uint16_t src_port,
const std::string & dst_ip,
std::uint16_t dst_port )

Risolve un flow TCP (saddr:sport → daddr:dport) al suo inode + uid tramite NETLINK_SOCK_DIAG.

Parameters
src_ip/src_portEndpoint locale (stringa IPv4 o IPv6)
dst_ip/dst_portEndpoint remoto
Returns
SockInfo con inode e uid, o nullopt se il kernel non trova il socket

Thread-safe. Ogni chiamata crea/chiude il proprio netlink socket (operazione molto leggera).

Definition at line 118 of file SockDiag.cpp.

122{
123 if (src_ip.empty() || dst_ip.empty()) return std::nullopt;
124 const bool is_v6 = src_ip.find(':') != std::string::npos ||
125 dst_ip.find(':') != std::string::npos;
126 return sockdiag_query(is_v6 ? AF_INET6 : AF_INET, IPPROTO_TCP,
127 src_ip, src_port, dst_ip, dst_port);
128}
#define IPPROTO_TCP
Definition bsc_ebpf.c:60
#define AF_INET
Definition bsc_ebpf.c:56
#define AF_INET6
Definition bsc_ebpf.c:57

References AF_INET, AF_INET6, IPPROTO_TCP, and sockdiag_lookup_tcp().

Referenced by bsc::net::SocketSnapshot::enrich_connection(), and sockdiag_lookup_tcp().

◆ sockdiag_lookup_udp()

std::optional< SockInfo > bsc::net::sockdiag_lookup_udp ( const std::string & src_ip,
std::uint16_t src_port,
const std::string & dst_ip,
std::uint16_t dst_port )

Definition at line 130 of file SockDiag.cpp.

134{
135 if (src_ip.empty() || dst_ip.empty()) return std::nullopt;
136 const bool is_v6 = src_ip.find(':') != std::string::npos ||
137 dst_ip.find(':') != std::string::npos;
138 return sockdiag_query(is_v6 ? AF_INET6 : AF_INET, IPPROTO_UDP,
139 src_ip, src_port, dst_ip, dst_port);
140}
#define IPPROTO_UDP
Definition bsc_ebpf.c:61

References AF_INET, AF_INET6, IPPROTO_UDP, and sockdiag_lookup_udp().

Referenced by bsc::net::SocketSnapshot::enrich_connection(), and sockdiag_lookup_udp().