FirewallRuleManager Class Reference

#include <FirewallRuleManager.hpp>

Static Public Member Functions
static void	apply (FirewallType fw, const std::vector< std::string > &ips)

Static Private Member Functions
static bool	run (const std::vector< std::string > &argv)
static void	applyWithFirewalld (const std::vector< std::string > &ips)
static void	applyWithUfw (const std::vector< std::string > &ips)

Detailed Description

Definition at line 28 of file FirewallRuleManager.hpp.

Member Function Documentation

apply()

void FirewallRuleManager::apply ( FirewallType fw, const std::vector< std::string > & ips )

static

Definition at line 108 of file FirewallRuleManager.cpp.

                                                                                {
    switch (fw) {
        case FirewallType::FIREWALLD:
            std::cout << _("[Firewall] Applying rules with firewalld (ipset)\n");
            applyWithFirewalld(ips);
            break;
        case FirewallType::UFW:
            std::cout << _("[Firewall] Applying rules with UFW\n");
            applyWithUfw(ips);
            break;
        default:
            std::cerr << _("[Firewall] Nessun firewall selezionato.\n");
            break;
    }
}

References _, applyWithFirewalld(), applyWithUfw(), FIREWALLD, and UFW.

applyWithFirewalld()

void FirewallRuleManager::applyWithFirewalld ( const std::vector< std::string > & ips )

staticprivate

Definition at line 61 of file FirewallRuleManager.cpp.

                                                                            {
    std::unordered_set<std::string> ipv4;
    std::unordered_set<std::string> ipv6;
    for (const auto& ip : ips) {
        switch (ip_family(ip)) {
            case AF_INET: ipv4.insert(ip); break;
            case AF_INET6: ipv6.insert(ip); break;
            default: std::cerr << _("[Firewall] SKIP non-IP: ") << ip << "\n"; break;
        }
    }
    if (ipv4.empty() && ipv6.empty()) {
        std::cerr << _("[Firewall] Nessun IP valido da applicare.\n");
        return;
    }
    const auto add_family = [&](const std::unordered_set<std::string>& entries,
                                const std::string& name, const std::string& family,
                                const std::string& ipset_family) {
        if (entries.empty()) return;
        // Already-existing sets may return nonzero; adding entries is idempotent.
        run({"pkexec", "firewall-cmd", "--permanent", "--new-ipset=" + name,
             "--type=hash:ip", "--option=family=" + ipset_family});
        for (const auto& ip : entries) {
            run({"pkexec", "firewall-cmd", "--permanent", "--ipset=" + name,
                 "--add-entry=" + ip});
        }
        run({"pkexec", "firewall-cmd", "--permanent",
             "--add-rich-rule=rule family=\"" + family + "\" source ipset=\"" + name + "\" reject"});
    };
    add_family(ipv4, "bastionguard-blocklist", "ipv4", "inet");
    add_family(ipv6, "bastionguard-blocklist-v6", "ipv6", "inet6");
    run({"pkexec", "firewall-cmd", "--reload"});
}

References _, AF_INET, AF_INET6, and run().

Referenced by apply().

applyWithUfw()

void FirewallRuleManager::applyWithUfw ( const std::vector< std::string > & ips )

staticprivate

Definition at line 94 of file FirewallRuleManager.cpp.

                                                                      {
    std::unordered_set<std::string> filtered;
    for (const auto& ip : ips) {
        if (ip_family(ip) != AF_UNSPEC) filtered.insert(ip);
        else std::cerr << _("[Firewall] SKIP non-IP: ") << ip << "\n";
    }
    if (filtered.empty()) {
        std::cerr << _("[Firewall] Nessun IP valido da applicare.\n");
        return;
    }
    for (const auto& ip : filtered) run({"pkexec", "ufw", "deny", "from", ip});
    run({"pkexec", "ufw", "reload"});
}

References _, and run().

Referenced by apply().

run()

bool FirewallRuleManager::run ( const std::vector< std::string > & argv )

staticprivate

Definition at line 42 of file FirewallRuleManager.cpp.

                                                                 {
    if (command.empty()) return false;
    const pid_t pid = ::fork();
    if (pid < 0) return false;
    if (pid == 0) {
        std::vector<char*> argv;
        for (const auto& arg : command) argv.push_back(const_cast<char*>(arg.c_str()));
        argv.push_back(nullptr);
        ::execvp(argv.front(), argv.data());
        _exit(127);
    }
    int status = 0;
    pid_t result;
    do { result = ::waitpid(pid, &status, 0); } while (result < 0 && errno == EINTR);
    const bool ok = result == pid && WIFEXITED(status) && WEXITSTATUS(status) == 0;
    if (!ok) std::cerr << _("[Firewall] Command failed: ") << command[0] << "\n";
    return ok;
}

References _.

Referenced by applyWithFirewalld(), and applyWithUfw().

---

The documentation for this class was generated from the following files:

• BastionGuard/src/firewall/FirewallRuleManager.hpp
• BastionGuard/src/firewall/FirewallRuleManager.cpp