Public Member Functions
	InotifyEngine (YaraEngine &y, DelayedScanQueue &dq, ArchiveInspector &ai)
	~InotifyEngine ()
void	add_watch (const std::string &path)
void	add_recursive (const std::string &root)
bool	init ()
void	run ()

Private Member Functions
std::string	decode_mask (uint32_t m)
void	maybe_inspect_archive (const std::string &full)

Private Attributes
int	in_fd = -1
std::map< int, std::string >	watch_map
std::mutex	map_mutex
YaraEngine &	yara
DelayedScanQueue &	delayed
ArchiveInspector &	archive_inspector

Detailed Description

Definition at line 922 of file BastionGuard-ransomware-realtime.cpp.

Constructor & Destructor Documentation

◆ InotifyEngine()

InotifyEngine::InotifyEngine	(	YaraEngine &	y,
		DelayedScanQueue &	dq,
		ArchiveInspector &	ai )

inline

Definition at line 983 of file BastionGuard-ransomware-realtime.cpp.

984 : yara(y), delayed(dq), archive_inspector(ai) {}

InotifyEngine::yara

YaraEngine & yara

Definition BastionGuard-ransomware-realtime.cpp:928

InotifyEngine::delayed

DelayedScanQueue & delayed

Definition BastionGuard-ransomware-realtime.cpp:929

InotifyEngine::archive_inspector

ArchiveInspector & archive_inspector

Definition BastionGuard-ransomware-realtime.cpp:930

References archive_inspector, delayed, and yara.

◆ ~InotifyEngine()

InotifyEngine::~InotifyEngine ( )

inline

Definition at line 986 of file BastionGuard-ransomware-realtime.cpp.

    {
        if (in_fd >= 0)
            close(in_fd);
    }

References in_fd.

Member Function Documentation

◆ add_recursive()

void InotifyEngine::add_recursive ( const std::string & root )

inline

Definition at line 1014 of file BastionGuard-ransomware-realtime.cpp.

    {
        std::error_code ec;
 
        if (is_excluded_path(root)) {
            log_msg(_("SKIP: directory esclusa dal realtime: ") + root);
            return;
        }
 
        if (!std::filesystem::exists(root, ec) || ec) {
            log_msg("SKIP: " + root + _(" non accessibile"));
            return;
        }
 
        add_watch(root);
 
        for (auto it = std::filesystem::recursive_directory_iterator(
            root,
            std::filesystem::directory_options::skip_permission_denied,
            ec);
        it != std::filesystem::recursive_directory_iterator();
        it.increment(ec))
        {
            if (ec) {
                ec.clear();
                continue;
            }
 
            const auto& entry = *it;
            const std::string entry_path = entry.path().string();
 
            if (is_excluded_path(entry_path)) {
                std::error_code type_ec;
                if (entry.is_directory(type_ec) && !type_ec)
                    it.disable_recursion_pending();
                continue;
            }
 
            ec.clear();
            if (entry.is_directory(ec) && !ec) {
                add_watch(entry_path);
            }
        }
    }

References _, add_watch(), is_excluded_path(), and log_msg().

Referenced by init().

◆ add_watch()

void InotifyEngine::add_watch ( const std::string & path )

inline

Definition at line 992 of file BastionGuard-ransomware-realtime.cpp.

    {
        if (in_fd < 0)
            return;
 
        int wd = inotify_add_watch(
            in_fd,
            path.c_str(),
                                   IN_CREATE | IN_CLOSE_WRITE | IN_MODIFY |
                                   IN_MOVED_TO | IN_MOVED_FROM | IN_ATTRIB |
                                   IN_DELETE | IN_DELETE_SELF | IN_ISDIR
        );
 
        if (wd >= 0) {
            std::lock_guard<std::mutex> lock(map_mutex);
            watch_map[wd] = path;
            log_msg("WATCH aggiunto: " + path);
        } else {
            log_msg("WATCH fallito: " + path + " | errno=" + std::to_string(errno));
        }
    }

References in_fd, log_msg(), map_mutex, and watch_map.

Referenced by add_recursive(), and run().

◆ decode_mask()

std::string InotifyEngine::decode_mask ( uint32_t m )

inlineprivate

Definition at line 932 of file BastionGuard-ransomware-realtime.cpp.

    {
        std::stringstream ss;
        if (m & IN_CREATE) ss << "CREATE ";
        if (m & IN_CLOSE_WRITE) ss << "CLOSE_WRITE ";
        if (m & IN_MODIFY) ss << "MODIFY ";
        if (m & IN_MOVED_TO) ss << "MOVED_TO ";
        if (m & IN_MOVED_FROM) ss << "MOVED_FROM ";
        if (m & IN_ATTRIB) ss << "ATTRIB ";
        if (m & IN_DELETE) ss << "DELETE ";
        if (m & IN_DELETE_SELF) ss << "DELETE_SELF ";
        if (m & IN_ISDIR) ss << "ISDIR ";
        return ss.str();
    }

Referenced by run().

◆ init()

bool InotifyEngine::init ( )

inline

Definition at line 1059 of file BastionGuard-ransomware-realtime.cpp.

    {
        in_fd = inotify_init1(IN_NONBLOCK);
        if (in_fd < 0)
            return false;
 
        for (const auto& d : WATCH_DIRS)
            add_recursive(d);
 
        return true;
    }

References add_recursive(), in_fd, and WATCH_DIRS.

Referenced by main().

◆ maybe_inspect_archive()

void InotifyEngine::maybe_inspect_archive ( const std::string & full )

inlineprivate

Definition at line 947 of file BastionGuard-ransomware-realtime.cpp.

    {
        if (!looks_like_archive_path(full))
            return;
 
        if (!is_regular_file_safe(full))
            return;
 
        ArchiveInspectionResult ar = archive_inspector.inspect(full);
 
        log_archive_result(full, ar);
 
        if (!ar.success) {
            log_msg(_("ArchiveInspector fallito su: ") + full +
            " | " + ar.reason_code + " | " + ar.detail);
            return;
        }
 
        if (!ar.is_zip)
            return;
 
        if (ar.risk != ArchiveRisk::CLEAN) {
            std::stringstream ss;
            ss << "ARCHIVE THREAT SIGNAL: "
            << full
            << " risk=" << archiveRiskToString(ar.risk)
            << " score=" << ar.risk_score
            << " reason=" << ar.reason_code
            << " detail=" << ar.detail;
            log_msg(ss.str());
 
            send_archive_alert(full, ar);
        }
    }

References _, archive_inspector, archiveRiskToString(), CLEAN, ArchiveInspectionResult::detail, ArchiveInspector::inspect(), is_regular_file_safe(), ArchiveInspectionResult::is_zip, log_archive_result(), log_msg(), looks_like_archive_path(), ArchiveInspectionResult::reason_code, ArchiveInspectionResult::risk, ArchiveInspectionResult::risk_score, send_archive_alert(), and ArchiveInspectionResult::success.

Referenced by run().

◆ run()

void InotifyEngine::run ( )

inline

Definition at line 1071 of file BastionGuard-ransomware-realtime.cpp.

    {
        char buf[16384] __attribute__((aligned(8)));
 
        while (running) {
            int len = read(in_fd, buf, sizeof(buf));
            if (len <= 0) {
                std::this_thread::sleep_for(std::chrono::milliseconds(25));
                continue;
            }
 
            int i = 0;
            while (i < len) {
                auto* ev = (struct inotify_event*)&buf[i];
                std::string dir;
 
                {
                    std::lock_guard<std::mutex> lock(map_mutex);
                    if (watch_map.count(ev->wd))
                        dir = watch_map[ev->wd];
                }
 
                if (!dir.empty() && ev->len > 0) {
                    std::string full = dir + "/" + ev->name;
 
                    if (is_excluded_path(full)) {
                        log_msg(_("INOTIFY IGNORATO: percorso escluso: ") + full);
                        i += sizeof(struct inotify_event) + ev->len;
                        continue;
                    }
 
                    log_msg("INOTIFY EVENT: " + full + " [" +
                    decode_mask(ev->mask) + "]");
 
                    if (ev->mask & IN_ISDIR) {
                        add_watch(full);
                        i += sizeof(struct inotify_event) + ev->len;
                        continue;
                    }
 
                    bool file_event =
                    (ev->mask & (IN_CREATE |
                    IN_CLOSE_WRITE |
                    IN_MODIFY |
                    IN_MOVED_TO |
                    IN_DELETE_SELF |
                    IN_ATTRIB));
 
                    if (!file_event) {
                        i += sizeof(struct inotify_event) + ev->len;
                        continue;
                    }
 
                    bool atomic_rename =
                    (ev->mask & IN_MOVED_TO) &&
                    !(ev->mask & IN_CREATE);
 
                    if (atomic_rename) {
                        log_msg(_("ATOMIC RENAME rilevato → ") + full);
                    }
 
                    const bool writer_event =
                    (ev->mask & IN_CLOSE_WRITE) ||
                    (ev->mask & IN_MOVED_TO);
 
                    if (writer_event) {
                        if (should_guess_pid(full, 600)) {
                            pid_t pid = guess_writer_pid(full);
                            if (pid > 0) {
                                yara.scan_pid(pid);
                            }
                        }
 
                        maybe_inspect_archive(full);
                        yara.scan_file(full);
                        delayed.enqueue(full);
                    }
                }
 
                i += sizeof(struct inotify_event) + ev->len;
            }
        }
    }