Rule.cpp

Go to the documentation of this file.

#include "bsc/rule/Rule.hpp"
#include <algorithm>
#include <functional>
#include <array>
#include <arpa/inet.h>
#include <charconv>
#include <chrono>
#include <cctype>
#include <filesystem>
#include <fstream>
#include <nlohmann/json.hpp>
#include <ranges>
#include <sstream>
#include <unordered_set>
#include <cstring>
#include <openssl/evp.h>
#include <pwd.h>
 
namespace bsc::rule {
using json = nlohmann::json;
namespace fs = std::filesystem;
namespace {
std::map<std::string, std::vector<std::string>> g_aliases;
std::string trim(std::string s) {
    while (!s.empty() && std::isspace(static_cast<unsigned char>(s.front()))) s.erase(s.begin());
    while (!s.empty() && std::isspace(static_cast<unsigned char>(s.back()))) s.pop_back();
    return s;
}
 
std::string digest_file(const std::string& path, const EVP_MD*(*algo)()) {
    if (path.empty()) return {};
    std::ifstream in(path, std::ios::binary);
    if (!in) return {};
    EVP_MD_CTX* ctx = EVP_MD_CTX_new();
    if (!ctx) return {};
    unsigned char md[EVP_MAX_MD_SIZE]{};
    unsigned int md_len = 0;
    std::array<char, 8192> buf{};
    std::string out;
    if (EVP_DigestInit_ex(ctx, algo(), nullptr) == 1) {
        while (in.read(buf.data(), buf.size()) || in.gcount() > 0) EVP_DigestUpdate(ctx, buf.data(), static_cast<size_t>(in.gcount()));
        if (EVP_DigestFinal_ex(ctx, md, &md_len) == 1) {
            static const char* hex = "0123456789abcdef";
            out.reserve(md_len * 2);
            for (unsigned int i = 0; i < md_len; ++i) { out.push_back(hex[md[i] >> 4]); out.push_back(hex[md[i] & 0x0f]); }
        }
    }
    EVP_MD_CTX_free(ctx);
    return out;
}
 
std::string to_lower(std::string s) {
    std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
    return s;
}
std::string normalize_operand(std::string op) {
    std::replace(op.begin(), op.end(), '_', '.');
    if (op == "process.command" || op == "process.cmd") return "process.command";
    if (op == "process.hash.md5") return op;
    if (op == "process.hash.sha1") return op;
    if (op == "user.name") return op;
    if (op == "iface.in") return op;
    if (op == "iface.out") return op;
    if (op == "process.parent.path") return op;
    if (op == "process.name" || op == "process.comm") return "process.name";
    if (op == "process.path") return op;
    if (op == "process.cwd") return op;
    if (op == "process.id") return op;
    if (op == "protocol" || op == "true" || op == "list") return op;
    if (op == "source.ip" || op == "src.ip") return "source.ip";
    if (op == "source.port" || op == "src.port") return "source.port";
    if (op == "source.network" || op == "src.network") return "source.network";
    if (op == "dest.ip" || op == "dst.ip") return "dest.ip";
    if (op == "dest.host" || op == "dst.host") return "dest.host";
    if (op == "dest.port" || op == "dst.port") return "dest.port";
    if (op == "dest.network" || op == "dst.network") return "dest.network";
    if (op == "user.id") return op;
    return op;
}
std::vector<std::string> field_values(const bsc::model::Connection& c, const std::string& operand) {
    const auto op = normalize_operand(operand);
    if (op == "true") return {"true"};
    if (op == "protocol") return {c.protocol};
    if (op == "source.ip") return {c.src_ip};
    if (op == "dest.ip") return {c.dst_ip};
    if (op == "dest.host") return {c.dst_host};
    if (op == "process.path") return {c.process_path};
    if (op == "process.name") return {c.process_comm};
    if (op == "process.cwd") return {c.process_cwd};
    if (op == "user.id") return {std::to_string(c.user_id)};
    if (op == "user.name") {
        if (passwd* pw = getpwuid(c.user_id)) return {pw->pw_name ? std::string(pw->pw_name) : std::string{}};
        return {""};
    }
    if (op == "process.id") return {std::to_string(c.process_id)};
    if (op == "source.port") return {std::to_string(c.src_port)};
    if (op == "dest.port") return {std::to_string(c.dst_port)};
    if (op == "process.command") {
        std::ostringstream oss;
        for (std::size_t i = 0; i < c.process_args.size(); ++i) {
            if (i) oss << ' ';
            oss << c.process_args[i];
        }
        return {oss.str()};
    }
    if (op == "process.parent.path") {
        std::vector<std::string> out;
        for (std::size_t i = 1; i < c.process_tree.size(); ++i) out.push_back(c.process_tree[i].first);
        return out;
    }
    if (op.rfind("process.env.", 0) == 0) {
        const auto key = op.substr(12);
        if (const auto it = c.process_env.find(key); it != c.process_env.end()) return {it->second};
        return {""};
    }
    if (op == "process.hash.sha256") {
        if (const auto it = c.process_checksums.find("sha256"); it != c.process_checksums.end()) return {it->second};
        return {""};
    }
    if (op == "process.hash.md5") {
        if (const auto it = c.process_checksums.find("md5"); it != c.process_checksums.end()) return {it->second};
        if (!c.process_path.empty()) return {digest_file(c.process_path, EVP_md5)};
        return {""};
    }
    if (op == "process.hash.sha1") {
        if (const auto it = c.process_checksums.find("sha1"); it != c.process_checksums.end()) return {it->second};
        if (!c.process_path.empty()) return {digest_file(c.process_path, EVP_sha1)};
        return {""};
    }
    if (op == "iface.in" || op == "iface.out") return {""};
    return {""};
}
bool parse_ipv4(const std::string& ip, std::uint32_t& out) {
    in_addr addr{};
    if (inet_pton(AF_INET, ip.c_str(), &addr) != 1) return false;
    out = ntohl(addr.s_addr);
    return true;
}
bool parse_ipv6(const std::string& ip, in6_addr& out) {
    return inet_pton(AF_INET6, ip.c_str(), &out) == 1;
}
bool ip_in_cidr(const std::string& ip, const std::string& cidr) {
    const auto slash = cidr.find('/');
    if (slash == std::string::npos) return to_lower(ip) == to_lower(cidr);
    const auto net = cidr.substr(0, slash);
    const auto bits = std::stoi(cidr.substr(slash + 1));
    std::uint32_t ip4{}, net4{};
    if (parse_ipv4(ip, ip4) && parse_ipv4(net, net4)) {
        if (bits < 0 || bits > 32) return false;
        const std::uint32_t mask = bits == 0 ? 0u : 0xFFFFFFFFu << (32 - bits);
        return (ip4 & mask) == (net4 & mask);
    }
    in6_addr ip6{}, net6{};
    if (parse_ipv6(ip, ip6) && parse_ipv6(net, net6)) {
        if (bits < 0 || bits > 128) return false;
        const int full_bytes = bits / 8;
        const int extra_bits = bits % 8;
        if (full_bytes && std::memcmp(ip6.s6_addr, net6.s6_addr, full_bytes) != 0) return false;
        if (extra_bits == 0) return true;
        const std::uint8_t mask = static_cast<std::uint8_t>(0xFF << (8 - extra_bits));
        return (ip6.s6_addr[full_bytes] & mask) == (net6.s6_addr[full_bytes] & mask);
    }
    return false;
}
std::optional<std::pair<unsigned long long, unsigned long long>> parse_range(const std::string& data) {
    const auto pos = data.find('-');
    if (pos == std::string::npos) return std::nullopt;
    const auto a = data.substr(0, pos);
    const auto b = data.substr(pos + 1);
    unsigned long long min = 0, max = 0;
    auto [p1, ec1] = std::from_chars(a.data(), a.data() + a.size(), min);
    auto [p2, ec2] = std::from_chars(b.data(), b.data() + b.size(), max);
    if (ec1 != std::errc{} || ec2 != std::errc{} || min > max) return std::nullopt;
    return {{min, max}};
}
std::unordered_set<std::string> load_simple_list_file(const fs::path& path, bool sensitive) {
    std::unordered_set<std::string> out;
    std::ifstream in(path);
    std::string line;
    while (std::getline(in, line)) {
        if (const auto comment = line.find('#'); comment != std::string::npos) line.resize(comment);
        line.erase(std::remove_if(line.begin(), line.end(), [](unsigned char c) { return c == '\r' || c == '\n'; }), line.end());
        while (!line.empty() && std::isspace(static_cast<unsigned char>(line.back()))) line.pop_back();
        std::size_t start = 0; while (start < line.size() && std::isspace(static_cast<unsigned char>(line[start]))) ++start;
        if (start >= line.size()) continue;
        auto item = line.substr(start);
        if (!sensitive) item = to_lower(item);
        out.insert(std::move(item));
    }
    return out;
}
Operator parse_operator(const json& j) {
    Operator op;
    const auto type = j.value("type", "unknown");
    if (type == "simple") op.type = OperatorType::Simple;
    else if (type == "regexp") op.type = OperatorType::Regexp;
    else if (type == "network") op.type = OperatorType::Network;
    else if (type == "range") op.type = OperatorType::Range;
    else if (type == "list") op.type = OperatorType::List;
    else if (type == "lists") op.type = OperatorType::Lists;
    op.operand = normalize_operand(j.value("operand", ""));
    op.data = j.value("data", "");
    op.sensitive = j.value("sensitive", false);
    if (j.contains("list") && j["list"].is_array()) {
        for (const auto& item : j["list"]) op.list.push_back(parse_operator(item));
    } else if (op.type == OperatorType::List && !op.data.empty() && op.data.front() == '[') {
        try {
            for (const auto& item : json::parse(op.data)) op.list.push_back(parse_operator(item));
        } catch (...) {}
    }
    return op;
}
json to_json_op(const Operator& op) {
    std::string t = "unknown";
    switch (op.type) {
        case OperatorType::Simple: t = "simple"; break;
        case OperatorType::Regexp: t = "regexp"; break;
        case OperatorType::Network: t = "network"; break;
        case OperatorType::Range: t = "range"; break;
        case OperatorType::List: t = "list"; break;
        case OperatorType::Lists: t = "lists"; break;
        default: break;
    }
    json j{{"type", t}, {"operand", op.operand}, {"data", op.data}, {"sensitive", op.sensitive}, {"list", json::array()}};
    for (const auto& child : op.list) j["list"].push_back(to_json_op(child));
    return j;
}
}
 
bool Operator::matches(const bsc::model::Connection& conn) const {
    const auto op = normalize_operand(operand);
    if (op == "true") return true;
    if (type == OperatorType::List || op == "list") {
        if (list.empty()) return true;
        for (const auto& child : list) if (!child.matches(conn)) return false;
        return true;
    }
    const auto values = field_values(conn, op);
    auto str_matches = [&](const std::string& value) -> bool {
        switch (type) {
            case OperatorType::Simple:
                return sensitive ? value == data : to_lower(value) == to_lower(data);
            case OperatorType::Regexp:
                try {
                    return std::regex_search(value, std::regex(data, sensitive ? std::regex::ECMAScript : (std::regex::ECMAScript | std::regex::icase)));
                } catch (...) { return false; }
            case OperatorType::Network:
                if (const auto it = g_aliases.find(data); it != g_aliases.end()) { for (const auto& cidr : it->second) if (ip_in_cidr(value, cidr)) return true; return false; }
                return ip_in_cidr(value, data);
            case OperatorType::Range: {
                const auto range = parse_range(data);
                if (!range) return false;
                unsigned long long n = 0;
                auto [p, ec] = std::from_chars(value.data(), value.data() + value.size(), n);
                return ec == std::errc{} && n >= range->first && n <= range->second;
            }
            case OperatorType::Lists: {
                namespace fs = std::filesystem;
                std::error_code ec;
                if (!fs::exists(data, ec)) return false;
                const auto is_domain_regex = op == "lists.domains_regexp";
                const auto is_nets = op == "lists.nets";
                auto match_file = [&](const fs::path& p) {
                    std::ifstream in(p);
                    std::string line;
                    while (std::getline(in, line)) {
                        line = trim(line);
                        if (line.empty() || line[0] == '#') continue;
                        if (is_nets) { if (ip_in_cidr(value, line)) return true; continue; }
                        if (is_domain_regex) { try { if (std::regex_search(value, std::regex(line, sensitive ? std::regex::ECMAScript : (std::regex::ECMAScript | std::regex::icase)))) return true; } catch (...) {} continue; }
                        auto cmp = sensitive ? line : to_lower(line);
                        auto vv = sensitive ? value : to_lower(value);
                        if (op == "lists.domains" && vv.size() >= cmp.size()) { if (vv == cmp || (vv.size() > cmp.size() && vv.ends_with('.' + cmp))) return true; }
                        else if (cmp == vv) return true;
                    }
                    return false;
                };
                if (fs::is_regular_file(data, ec)) return match_file(data);
                for (const auto& entry : fs::directory_iterator(data, ec)) if (entry.is_regular_file() && match_file(entry.path())) return true;
                return false;
            }
            default:
                return false;
        }
    };
    for (const auto& value : values) if (str_matches(value)) return true;
    return false;
}
 
bool Rule::matches(const bsc::model::Connection& conn) const { return enabled && op.matches(conn); }
 
void Loader::load_aliases(const std::string& path) {
    aliases_.clear();
    g_aliases.clear();
    if (path.empty()) return;
    std::ifstream in(path);
    if (!in) return;
    try {
        json j; in >> j;
        if (!j.is_object()) return;
        for (auto it = j.begin(); it != j.end(); ++it) {
            if (!it.value().is_array()) continue;
            std::vector<std::string> vals;
            for (const auto& item : it.value()) if (item.is_string()) vals.push_back(item.get<std::string>());
            aliases_[it.key()] = vals;
            g_aliases[it.key()] = std::move(vals);
        }
    } catch (...) {}
}
 
void Loader::load_directory(const std::string& dir) {
    rules_.clear();
    std::error_code ec;
    if (!fs::exists(dir, ec)) return;
    for (const auto& entry : fs::directory_iterator(dir, ec)) {
        if (!entry.is_regular_file() || entry.path().extension() != ".json") continue;
        std::ifstream in(entry.path());
        if (!in) continue;
        json j; in >> j;
        Rule r;
        if (j.contains("created")) {
            if (j["created"].is_number_integer()) r.created = j["created"].get<std::int64_t>();
            else r.created = static_cast<std::int64_t>(std::chrono::duration_cast<std::chrono::seconds>(std::chrono::file_clock::to_sys(fs::last_write_time(entry.path())).time_since_epoch()).count());
        }
        r.name = j.value("name", entry.path().stem().string());
        r.description = j.value("description", "");
        r.enabled = j.value("enabled", true);
        r.precedence = j.value("precedence", false);
        r.nolog = j.value("nolog", false);
        r.action = j.value("action", "allow");
        r.duration = j.value("duration", "once");
        if (j.contains("operator")) r.op = parse_operator(j["operator"]);
        rules_.push_back(std::move(r));
    }
    std::sort(rules_.begin(), rules_.end(), [](const Rule& a, const Rule& b) {
        if (a.precedence != b.precedence) return a.precedence > b.precedence;
        if (a.created != b.created) return a.created < b.created;
        return a.name < b.name;
    });
}
 
bool Loader::save_rule(const Rule& rule, const std::string& dir) const {
    std::error_code ec;
    fs::create_directories(dir, ec);
    if (ec) return false;
    auto safe_name = rule.name;
    for (char& c : safe_name) if (!(std::isalnum(static_cast<unsigned char>(c)) || c == '-' || c == '_' || c == '.')) c = '_';
    const auto path = fs::path(dir) / (safe_name + ".json");
    json j{{"created", rule.created}, {"name", rule.name}, {"description", rule.description}, {"enabled", rule.enabled},
           {"precedence", rule.precedence}, {"nolog", rule.nolog}, {"action", rule.action}, {"duration", rule.duration},
           {"operator", to_json_op(rule.op)}};
    std::ofstream out(path);
    if (!out) return false;
    out << j.dump(2) << '\n';
    return true;
}
 
std::optional<Rule> Loader::find_match(const bsc::model::Connection& conn) const {
    for (const auto& r : rules_) if (r.matches(conn)) return r;
    return std::nullopt;
}
 
} // namespace bsc::rule