ProcMon.cpp

Go to the documentation of this file.

#include "bsc/proc/ProcMon.hpp"
#include <algorithm>
#include <cctype>
#include <filesystem>
#include <fstream>
#include <openssl/md5.h>
#include <openssl/sha.h>
#include <sstream>
#include <unistd.h>
 
namespace bsc::proc {
namespace fs = std::filesystem;
namespace {
constexpr auto kFreshCacheTtl = std::chrono::seconds(3);
constexpr auto kRecentExitTtl = std::chrono::seconds(2);
 
std::string slurp(const fs::path& p, bool binary=false) {
    std::ifstream in(p, binary ? std::ios::binary : std::ios::in);
    if (!in) return {};
    std::ostringstream ss; ss << in.rdbuf(); return ss.str();
}
std::vector<std::string> split_nulls(const std::string& s) {
    std::vector<std::string> out; std::string cur;
    for (char c : s) {
        if (c == '\0') { if (!cur.empty()) out.push_back(cur); cur.clear(); }
        else cur.push_back(c);
    }
    if (!cur.empty()) out.push_back(cur);
    return out;
}
std::string md5_file(const fs::path& p) {
    std::ifstream in(p, std::ios::binary); if (!in) return {};
    MD5_CTX ctx; MD5_Init(&ctx);
    char buf[8192];
    while (in.read(buf, sizeof(buf)) || in.gcount() > 0) MD5_Update(&ctx, buf, static_cast<size_t>(in.gcount()));
    unsigned char out[MD5_DIGEST_LENGTH]; MD5_Final(out, &ctx);
    static const char* hex = "0123456789abcdef";
    std::string s; s.reserve(MD5_DIGEST_LENGTH * 2);
    for (unsigned char b : out) { s.push_back(hex[b >> 4]); s.push_back(hex[b & 0xF]); }
    return s;
}
std::string sha1_file(const fs::path& p) {
    std::ifstream in(p, std::ios::binary); if (!in) return {};
    SHA_CTX ctx; SHA1_Init(&ctx);
    char buf[8192];
    while (in.read(buf, sizeof(buf)) || in.gcount() > 0) SHA1_Update(&ctx, buf, static_cast<size_t>(in.gcount()));
    unsigned char out[SHA_DIGEST_LENGTH]; SHA1_Final(out, &ctx);
    static const char* hex = "0123456789abcdef";
    std::string s; s.reserve(SHA_DIGEST_LENGTH * 2);
    for (unsigned char b : out) { s.push_back(hex[b >> 4]); s.push_back(hex[b & 0xF]); }
    return s;
}
std::string sha256_file(const fs::path& p) {
    std::ifstream in(p, std::ios::binary); if (!in) return {};
    SHA256_CTX ctx; SHA256_Init(&ctx);
    char buf[8192];
    while (in.read(buf, sizeof(buf)) || in.gcount() > 0) SHA256_Update(&ctx, buf, static_cast<size_t>(in.gcount()));
    unsigned char out[SHA256_DIGEST_LENGTH]; SHA256_Final(out, &ctx);
    static const char* hex = "0123456789abcdef";
    std::string s; s.reserve(SHA256_DIGEST_LENGTH * 2);
    for (unsigned char b : out) { s.push_back(hex[b >> 4]); s.push_back(hex[b & 0xF]); }
    return s;
}
}
 
std::optional<bsc::model::ProcessInfo> ProcMon::inspect_procfs(std::uint32_t pid, bool checksums) {
    fs::path base = fs::path("/proc") / std::to_string(pid);
    if (!fs::exists(base)) return std::nullopt;
    bsc::model::ProcessInfo p; p.pid = pid;
    std::error_code ec;
    p.path = fs::read_symlink(base / "exe", ec).string();
    ec.clear(); p.cwd = fs::read_symlink(base / "cwd", ec).string();
    p.args = split_nulls(slurp(base / "cmdline", true));
    auto env = split_nulls(slurp(base / "environ", true));
    for (const auto& e : env) { auto pos=e.find('='); if (pos!=std::string::npos) p.env[e.substr(0,pos)] = e.substr(pos+1); }
 
    // /proc/<pid>/comm contiene il nome del processo terminato da \n.
    // Piu' affidabile del parsing di /proc/<pid>/status (separatore variabile).
    {
        std::ifstream comm_file(base / "comm");
        if (comm_file) {
            std::string comm_line;
            if (std::getline(comm_file, comm_line)) {
                while (!comm_line.empty() &&
                       (comm_line.back() == '\n' || comm_line.back() == '\r' ||
                        std::isspace(static_cast<unsigned char>(comm_line.back()))))
                    comm_line.pop_back();
                p.comm = std::move(comm_line);
            }
        }
    }
 
    std::ifstream status(base / "status");
    std::string line;
    while (std::getline(status, line)) {
        // Fallback per p.comm se /proc/<pid>/comm non era leggibile
        if (p.comm.empty() && line.rfind("Name:", 0) == 0) {
            p.comm = line.substr(5);
            while (!p.comm.empty() && std::isspace(static_cast<unsigned char>(p.comm.front()))) p.comm.erase(p.comm.begin());
            while (!p.comm.empty() && std::isspace(static_cast<unsigned char>(p.comm.back()))) p.comm.pop_back();
        }
        else if (line.rfind("PPid:", 0) == 0) p.ppid = std::stoull(line.substr(6));
        else if (line.rfind("Uid:", 0) == 0) { std::istringstream iss(line.substr(5)); iss >> p.uid; }
    }
    for (auto current = p.pid; current > 0;) {
        fs::path status_path = fs::path("/proc") / std::to_string(current) / "status";
        std::ifstream st(status_path);
        if (!st) break;
        std::string name; std::uint64_t ppid=0;
        while (std::getline(st, line)) {
            if (line.rfind("Name:",0)==0) { name = line.substr(6); while (!name.empty() && std::isspace(static_cast<unsigned char>(name.front()))) name.erase(name.begin()); }
            else if (line.rfind("PPid:",0)==0) ppid = std::stoull(line.substr(6));
        }
        p.process_tree.emplace_back(name, static_cast<std::uint32_t>(current));
        if (ppid == current) break;
        current = ppid;
    }
    if (checksums && !p.path.empty()) { p.checksums["md5"] = md5_file(p.path); p.checksums["sha1"] = sha1_file(p.path); p.checksums["sha256"] = sha256_file(p.path); }
    return p;
}
 
std::optional<bsc::model::ProcessInfo> ProcMon::cached(std::uint32_t pid, bool allow_recent_exit) const {
    const auto now = std::chrono::steady_clock::now();
    std::lock_guard lock(cache_mutex_);
    if (const auto it = cache_.find(pid); it != cache_.end()) return it->second.info;
    if (allow_recent_exit) {
        if (const auto it = exited_.find(pid); it != exited_.end()) {
            if (now - it->second.updated_at <= kRecentExitTtl) return it->second.info;
            exited_.erase(it);
        }
    }
    return std::nullopt;
}
 
std::vector<bsc::model::ProcessInfo> ProcMon::recent_candidates(std::uint32_t uid,
                                                                std::chrono::milliseconds max_age,
                                                                std::size_t limit) const {
    const auto now = std::chrono::steady_clock::now();
    std::vector<std::pair<std::chrono::steady_clock::time_point, bsc::model::ProcessInfo>> tmp;
 
    std::lock_guard lock(cache_mutex_);
    auto consider = [&](const CacheEntry& entry) {
        if (entry.info.uid != uid) return;
        if (entry.info.comm.empty() && entry.info.path.empty()) return;
        if (max_age.count() > 0 && now - entry.updated_at > max_age) return;
        tmp.emplace_back(entry.updated_at, entry.info);
    };
    for (const auto& [pid, entry] : cache_) consider(entry);
    for (const auto& [pid, entry] : exited_) consider(entry);
 
    std::sort(tmp.begin(), tmp.end(), [](const auto& a, const auto& b) {
        return a.first > b.first;
    });
 
    std::vector<bsc::model::ProcessInfo> out;
    out.reserve(std::min(limit, tmp.size()));
    for (const auto& [ts, info] : tmp) {
        out.push_back(info);
        if (out.size() >= limit) break;
    }
    return out;
}
 
 
std::vector<bsc::model::ProcessInfo> ProcMon::recent_candidates_any(std::chrono::milliseconds max_age,
                                                                    std::size_t limit) const {
    const auto now = std::chrono::steady_clock::now();
    std::vector<std::pair<std::chrono::steady_clock::time_point, bsc::model::ProcessInfo>> tmp;
 
    std::lock_guard lock(cache_mutex_);
    auto consider = [&](const CacheEntry& entry) {
        if (entry.info.comm.empty() && entry.info.path.empty()) return;
        if (max_age.count() > 0 && now - entry.updated_at > max_age) return;
        tmp.emplace_back(entry.updated_at, entry.info);
    };
    for (const auto& [pid, entry] : cache_) consider(entry);
    for (const auto& [pid, entry] : exited_) consider(entry);
 
    std::sort(tmp.begin(), tmp.end(), [](const auto& a, const auto& b) {
        return a.first > b.first;
    });
 
    std::vector<bsc::model::ProcessInfo> out;
    out.reserve(std::min(limit, tmp.size()));
    for (const auto& [ts, info] : tmp) {
        out.push_back(info);
        if (out.size() >= limit) break;
    }
    return out;
}
 
std::optional<bsc::model::ProcessInfo> ProcMon::inspect(std::uint32_t pid, bool checksums) const {
    const auto now = std::chrono::steady_clock::now();
    {
        std::lock_guard lock(cache_mutex_);
        if (const auto it = cache_.find(pid); it != cache_.end()) {
            const auto age = now - it->second.updated_at;
            const auto fresh = age <= kFreshCacheTtl;
            const auto checksum_ok = !checksums || it->second.has_checksums;
            if (fresh && checksum_ok) return it->second.info;
        }
        if (const auto it = exited_.find(pid); it != exited_.end()) {
            const auto age = now - it->second.updated_at;
            const auto checksum_ok = !checksums || it->second.has_checksums;
            if (age <= kRecentExitTtl && checksum_ok) return it->second.info;
            if (age > kRecentExitTtl) exited_.erase(it);
        }
    }
 
    auto info = inspect_procfs(pid, checksums);
    if (!info) {
        if (auto stale = cached(pid, true)) return stale;
        invalidate(pid);
        return std::nullopt;
    }
 
    CacheEntry entry;
    entry.info = *info;
    entry.has_checksums = !info->checksums.empty();
    entry.updated_at = now;
    std::lock_guard lock(cache_mutex_);
    exited_.erase(pid);
    cache_[pid] = std::move(entry);
    return info;
}
 
void ProcMon::cache_process(const bsc::model::ProcessInfo& info) const {
    std::lock_guard lock(cache_mutex_);
    auto& entry = cache_[static_cast<std::uint32_t>(info.pid)];
    entry.info = info;
    entry.has_checksums = !info.checksums.empty();
    entry.updated_at = std::chrono::steady_clock::now();
    exited_.erase(static_cast<std::uint32_t>(info.pid));
}
 
void ProcMon::invalidate(std::uint32_t pid) const {
    std::lock_guard lock(cache_mutex_);
    cache_.erase(pid);
    exited_.erase(pid);
}
 
void ProcMon::note_fork(std::uint32_t child_pid, std::uint32_t parent_pid) const {
    std::lock_guard lock(cache_mutex_);
    if (const auto it = cache_.find(parent_pid); it != cache_.end()) {
        auto child = it->second;
        child.info.pid = child_pid;
        child.info.ppid = parent_pid;
        child.info.checksums.clear();
        child.has_checksums = false;
        child.updated_at = std::chrono::steady_clock::now();
        child.info.process_tree.clear();
        cache_[child_pid] = std::move(child);
        exited_.erase(child_pid);
    }
}
 
void ProcMon::note_exec(std::uint32_t pid, bool checksums) const {
    if (auto info = inspect_procfs(pid, checksums)) {
        cache_process(*info);
    }
}
 
void ProcMon::note_exit(std::uint32_t pid) const {
    std::lock_guard lock(cache_mutex_);
    if (const auto it = cache_.find(pid); it != cache_.end()) {
        auto entry = it->second;
        entry.updated_at = std::chrono::steady_clock::now();
        exited_[pid] = std::move(entry);
        cache_.erase(it);
    }
}
 
} // namespace bsc::proc