bsc::service::DaemonService Class Reference

#include <DaemonService.hpp>

Classes
struct	CachedVerdict

Public Member Functions
	DaemonService (bsc::config::Config config)
void	run ()
void	stop ()

Private Member Functions
void	scan_connections ()
bool	desktop_allows_activity () const
void	set_desktop_active (bool active)
void	handle_proc_event (const bsc::netlink::ProcEvent &ev)
void	heartbeat ()
void	reload_rules ()
void	reload_firewall ()
void	handle_notification (const bsc::ui::NotificationEvent &ev)
bsc::netfilter::Decision	decide_connection (bsc::model::Connection conn, bool realtime, bool allow_blocking_ask=true)
void	persist_learned_rule (const bsc::model::Connection &conn, const bsc::rule::Rule &decision)
void	remember_connection (const bsc::model::Connection &conn)
void	enrich_from_recent_flows (bsc::model::Connection &conn)
void	enrich_from_recent_processes (bsc::model::Connection &conn, std::chrono::milliseconds max_age=std::chrono::milliseconds(5000))
bool	rules_changed () const
std::optional< CachedVerdict >	verdict_lookup (const bsc::model::Connection &c) const
void	verdict_store (const bsc::model::Connection &c, const bsc::rule::Rule &r)

Static Private Member Functions
static std::chrono::milliseconds	parse_interval (const std::string &v, std::chrono::milliseconds def=std::chrono::seconds(5))
static std::string	verdict_key (const bsc::model::Connection &c)

Private Attributes
bsc::config::Config	config_
bsc::fw::Firewall	firewall_
bsc::net::DnsResolver	dns_
bsc::netlink::ProcEventMonitor	proc_events_
bsc::net::SocketSnapshot	net_
bsc::netfilter::NFQueue	nfqueue_
bsc::proc::ProcMon	proc_
bsc::rule::Loader	rules_
bsc::stats::Statistics	stats_
bsc::ui::UIClient	ui_
bsc::task::TaskRunner	tasks_
std::atomic_bool	running_ {true}
std::mutex	seen_mutex_
std::set< std::string >	seen_
std::mutex	rules_reload_mutex_
std::mutex	flow_mutex_
std::unordered_map< std::string, std::pair< bsc::model::Connection, std::chrono::steady_clock::time_point > >	recent_flows_
std::mutex	verdict_cache_mutex_
std::unordered_map< std::string, CachedVerdict >	verdict_cache_
std::atomic_bool	is_asking_ {false}
std::atomic_bool	desktop_active_ {false}
std::atomic_bool	inactive_notice_logged_ {false}
std::filesystem::file_time_type	rules_mtime_ {}
std::chrono::steady_clock::time_point	start_time_ {std::chrono::steady_clock::now()}

Detailed Description

Definition at line 23 of file DaemonService.hpp.

Constructor & Destructor Documentation

DaemonService()

bsc::service::DaemonService::DaemonService ( bsc::config::Config config )

explicit

Definition at line 77 of file DaemonService.cpp.

    : config_(std::move(config)), firewall_(config_.firewall), stats_(config_.stats.max_events), ui_(config_.server.address) {
    const auto aliases = std::filesystem::path(config_.rules.path).parent_path() / "network_aliases.json";
    rules_.load_aliases(aliases.string());
    rules_.load_directory(config_.rules.path);
    rules_changed();
}

References config_, firewall_, bsc::rule::Loader::load_aliases(), bsc::rule::Loader::load_directory(), bsc::config::Config::RulesOptions::path, bsc::config::Config::rules, rules_, rules_changed(), stats_, and ui_.

Referenced by rules_changed().

Member Function Documentation

decide_connection()

bsc::netfilter::Decision bsc::service::DaemonService::decide_connection ( bsc::model::Connection conn, bool realtime, bool allow_blocking_ask = true )

private

Definition at line 544 of file DaemonService.cpp.

                                                                                                                     {
    auto& log = bsc::logging::Logger::instance();
 
    // Se il desktop non è attivo o la UI non è connessa, non fare lookup,
    // reverse DNS, popup o scansioni costose: lascia passare e basta.
    // Questo evita allarmi/attività di rete quando la sessione grafica è
    // inattiva, bloccata o non ancora pronta.
    if (!desktop_allows_activity()) {
        bsc::netfilter::Decision d;
        d.verdict = bsc::netfilter::Verdict::Accept;
        return d;
    }
 
    if (conn.process_id == 0 || conn.process_path.empty()) enrich_from_recent_flows(conn);
    if (!has_process_identity(conn)) {
        enrich_from_recent_processes(conn, std::chrono::milliseconds(2500));
    }
    if (!has_process_identity(conn)) {
        enrich_from_recent_processes(conn, std::chrono::milliseconds(6000));
    }
    if (conn.process_id > 0) {
        if (auto p = proc_.inspect(conn.process_id, config_.rules.enable_checksums)) {
            merge_process_info(conn, *p);
        }
    }
    if (realtime && conn.process_id == 0 && conn.process_comm.empty() && conn.process_path.empty()) {
        log.warning("Connessione senza processo risolto: uid=" + std::to_string(conn.user_id) +
                    " dst=" + conn.dst_ip + ":" + std::to_string(conn.dst_port));
    }
    if (conn.dst_host.empty()) {
        conn.dst_host = dns_.reverse_lookup(conn.dst_ip);
        if (!conn.dst_host.empty()) stats_.note_dns_response();
    }
 
    std::string action;
    std::string rule_name;
    std::string duration = config_.default_duration;
    bool asked_ui = false;
 
    // 1) Cache dei verdetti "always" dati dall'utente in questa sessione:
    //    se Firefox ha gia' avuto un "allow always" verso google.com:443,
    //    le prossime 50 connessioni non aprono popup.
    if (auto cached = verdict_lookup(conn)) {
        action = cached->action;
        duration = cached->duration;
        rule_name = "cache";
    }
    // 2) Regole JSON persistite (localhost, regole utente salvate)
    else if (auto matched = rules_.find_match(conn)) {
        action = matched->action;
        duration = matched->duration;
        rule_name = matched->name;
    }
    // 3) Chiedi all'utente solo fuori dal callback NFQUEUE.
    //    Il callback NFQUEUE deve restare veloce: se aspetta il popup per
    //    15-30s, la coda kernel si riempie e gli eventi successivi sembrano
    //    "persi". NFQUEUE quindi applica cache/regole/default e la scansione
    //    periodica farà l'eventuale AskRule senza bloccare la coda pacchetti.
    else if (config_.intercept_unknown && realtime && allow_blocking_ask) {
        if (is_asking_.load()) {
            log.debug("ask_rule gia' in volo, applico default_action=" +
                      config_.default_action + " per " + conn.process_path);
            action = config_.default_action;
        } else {
            is_asking_ = true;
            asked_ui = true;
            log.info("AskRule: " + conn.protocol + " " + conn.process_path + " -> " +
                     (!conn.dst_host.empty() ? conn.dst_host : conn.dst_ip) +
                     ":" + std::to_string(conn.dst_port));
            auto asked = ui_.ask_rule(conn);
            is_asking_ = false;
 
            if (asked) {
                action = asked->action.empty() ? config_.default_action : asked->action;
                duration = asked->duration.empty() ? config_.default_duration : asked->duration;
                rule_name = asked->name;
                asked->duration = duration;
                asked->action = action;
                log.info("AskRule risposta: action=" + action + ", duration=" + duration);
                verdict_store(conn, *asked);       // cache in-memory
                persist_learned_rule(conn, *asked); // + eventuale save su disco
            } else {
                log.warning("AskRule senza risposta, uso default_action=" +
                            config_.default_action);
                action = config_.default_action;
            }
        }
    } else {
        action = config_.default_action;
    }
 
    remember_connection(conn);
    stats_.record(conn, action, rule_name);
 
    // Non perdere più le connessioni "default": se la UI non ha già ricevuto
    // un AskRule per questa connessione, invia sempre l'evento realtime.
    // La UI aggiorna liste/mappa/statistiche senza dover aprire un popup.
    if (realtime && !asked_ui && desktop_allows_activity()) {
        log.info("PostAlert UI: action=" + action +
                 (rule_name.empty() ? std::string{} : ", rule=" + rule_name));
        ui_.post_connection_alert(conn, action, rule_name);
    }
 
    std::ostringstream oss;
    oss << conn.protocol << ' ' << conn.process_path << ' ' << conn.dst_ip << ':' << conn.dst_port << " -> " << action;
    if (!rule_name.empty()) oss << " [" << rule_name << ']';
    log.info(oss.str());
 
    bsc::netfilter::Decision d;
    d.verdict = action == "deny" ? bsc::netfilter::Verdict::Drop : bsc::netfilter::Verdict::Accept;
    return d;
}

References bsc::netfilter::Accept, config_, decide_connection(), desktop_allows_activity(), dns_, bsc::netfilter::Drop, bsc::model::Connection::dst_host, bsc::model::Connection::dst_ip, bsc::model::Connection::dst_port, enrich_from_recent_flows(), enrich_from_recent_processes(), bsc::logging::Logger::instance(), is_asking_, persist_learned_rule(), proc_, bsc::model::Connection::process_comm, bsc::model::Connection::process_id, bsc::model::Connection::process_path, bsc::model::Connection::protocol, remember_connection(), rules_, stats_, ui_, bsc::model::Connection::user_id, bsc::netfilter::Decision::verdict, verdict_lookup(), and verdict_store().

Referenced by decide_connection(), run(), and scan_connections().

desktop_allows_activity()

bool bsc::service::DaemonService::desktop_allows_activity ( ) const

private

Definition at line 234 of file DaemonService.cpp.

                                                  {
    return desktop_active_.load() && ui_.is_connected();
}

References desktop_active_, desktop_allows_activity(), and ui_.

Referenced by decide_connection(), desktop_allows_activity(), and scan_connections().

enrich_from_recent_flows()

void bsc::service::DaemonService::enrich_from_recent_flows ( bsc::model::Connection & conn )

private

Definition at line 458 of file DaemonService.cpp.

                                                                     {
    const auto now = std::chrono::steady_clock::now();
    std::lock_guard lock(flow_mutex_);
    for (auto it = recent_flows_.begin(); it != recent_flows_.end();) {
        if (now - it->second.second > kRecentFlowTtl) {
            it = recent_flows_.erase(it);
            continue;
        }
        const auto& cached = it->second.first;
        const bool same_direct = conn.protocol == cached.protocol && conn.src_ip == cached.src_ip && conn.src_port == cached.src_port && conn.dst_ip == cached.dst_ip && conn.dst_port == cached.dst_port;
        const bool same_reverse = conn.protocol == cached.protocol && conn.src_ip == cached.dst_ip && conn.src_port == cached.dst_port && conn.dst_ip == cached.src_ip && conn.dst_port == cached.src_port;
        if (same_direct || same_reverse) {
            if (conn.process_id == 0) conn.process_id = cached.process_id;
            if (conn.user_id == 0xffffffffu) conn.user_id = cached.user_id;
            if (conn.process_path.empty()) conn.process_path = cached.process_path;
            if (conn.process_comm.empty() || looks_like_browser_thread_comm(conn.process_comm)) conn.process_comm = cached.process_comm;
            if (conn.process_cwd.empty()) conn.process_cwd = cached.process_cwd;
            if (conn.process_args.empty()) conn.process_args = cached.process_args;
            if (conn.process_env.empty()) conn.process_env = cached.process_env;
            if (conn.process_checksums.empty()) conn.process_checksums = cached.process_checksums;
            if (conn.process_tree.empty()) conn.process_tree = cached.process_tree;
            return;
        }
        ++it;
    }
}

References bsc::model::Connection::dst_ip, bsc::model::Connection::dst_port, enrich_from_recent_flows(), flow_mutex_, bsc::model::Connection::process_args, bsc::model::Connection::process_checksums, bsc::model::Connection::process_comm, bsc::model::Connection::process_cwd, bsc::model::Connection::process_env, bsc::model::Connection::process_id, bsc::model::Connection::process_path, bsc::model::Connection::process_tree, bsc::model::Connection::protocol, recent_flows_, bsc::model::Connection::src_ip, bsc::model::Connection::src_port, and bsc::model::Connection::user_id.

Referenced by decide_connection(), enrich_from_recent_flows(), and run().

enrich_from_recent_processes()

void bsc::service::DaemonService::enrich_from_recent_processes ( bsc::model::Connection & conn, std::chrono::milliseconds max_age = std::chrono::milliseconds(5000) )

private

Definition at line 485 of file DaemonService.cpp.

                                                                                                        {
    if (conn.process_id != 0 && !conn.process_comm.empty() && !conn.process_path.empty()) return;
 
    std::vector<bsc::model::ProcessInfo> candidates;
    if (conn.user_id != 0xffffffffu) candidates = proc_.recent_candidates(conn.user_id, max_age, 8);
    else candidates = proc_.recent_candidates_any(max_age, 4);
    if (candidates.empty()) return;
 
    const auto& best = candidates.front();
    bool unambiguous = candidates.size() == 1;
    if (!unambiguous) {
        unambiguous = true;
        for (std::size_t i = 1; i < std::min<std::size_t>(candidates.size(), 3); ++i) {
            if (!same_process_signature(best, candidates[i])) {
                unambiguous = false;
                break;
            }
        }
    }
    if (!unambiguous) return;
    merge_process_info(conn, best);
}

References enrich_from_recent_processes(), proc_, bsc::model::Connection::process_comm, bsc::model::Connection::process_id, bsc::model::Connection::process_path, and bsc::model::Connection::user_id.

Referenced by decide_connection(), enrich_from_recent_processes(), and run().

handle_notification()

void bsc::service::DaemonService::handle_notification ( const bsc::ui::NotificationEvent & ev )

private

Definition at line 298 of file DaemonService.cpp.

                                                                        {
    auto& log = bsc::logging::Logger::instance();
    log.info("notification: " + ev.type);
 
    // I tipi sono lowercase (mapping stringhe definito in ipc/UIServer.cpp).
    if (ev.type == "reload_fw_rules") {
        reload_firewall();
    } else if (ev.type == "stop") {
        stop();
    } else if (ev.type == "enable_interception") {
        config_.intercept_unknown = true;
    } else if (ev.type == "disable_interception") {
        config_.intercept_unknown = false;
    } else if (ev.type == "desktop_active") {
        set_desktop_active(true);
    } else if (ev.type == "desktop_idle") {
        set_desktop_active(false);
    } else if (ev.type == "enable_firewall") {
        if (!config_.fw_options.config_path.empty()) firewall_.reload(config_.fw_options.config_path);
        tasks_.every("firewall_reload",
                     parse_interval(config_.fw_options.monitor_interval, std::chrono::seconds(15)),
                     [this]() { reload_firewall(); });
    } else if (ev.type == "disable_firewall") {
        log.warning("disable firewall: sospendo i reload periodici");
        tasks_.stop_task("firewall_reload");
    } else if (ev.type == "task_stop") {
        try {
            auto j = json::parse(ev.data);
            const auto name = j.value("Name", std::string{});
            if (!name.empty()) tasks_.stop_task(name);
        } catch (...) { log.warning("task_stop con JSON non valido"); }
    } else if (ev.type == "task_start") {
        try {
            auto j = json::parse(ev.data);
            const auto name = j.value("Name", std::string{});
            const auto interval = parse_interval(j.value("Interval", std::string{"5s"}), std::chrono::seconds(5));
            if (name == "scan") tasks_.every("scan", interval, [this]() { scan_connections(); });
            else if (name == "heartbeat") tasks_.every("heartbeat", interval, [this]() { heartbeat(); });
            else if (name == "rules_reload") tasks_.every("rules_reload", interval, [this]() { reload_rules(); });
            else if (name == "firewall_reload") tasks_.every("firewall_reload", interval, [this]() { reload_firewall(); });
        } catch (...) { log.warning("task_start con JSON non valido"); }
    } else if (ev.type == "log_level") {
        try {
            auto lvl = std::stoi(ev.data);
            config_.log_level = lvl <= 0 ? 0 : lvl >= 3 ? 3 : lvl;
            bsc::logging::Logger::instance().set_level(static_cast<bsc::logging::Level>(config_.log_level));
        } catch (...) { log.warning("log_level non valido"); }
    } else if (ev.type == "change_rule" || ev.type == "enable_rule" || ev.type == "disable_rule") {
        for (auto r : ev.rules) {
            if (ev.type == "disable_rule") r.enabled = false;
            if (ev.type == "enable_rule")  r.enabled = true;
            rules_.save_rule(r, config_.rules.path);
        }
        reload_rules();
    } else if (ev.type == "delete_rule") {
        for (const auto& r : ev.rules) {
            std::error_code ec;
            fs::remove(fs::path(config_.rules.path) / (r.name + ".json"), ec);
        }
        reload_rules();
    } else if (ev.type == "change_config") {
        try {
            auto j = json::parse(ev.data);
            if (j.contains("DefaultAction"))     config_.default_action     = j["DefaultAction"].get<std::string>();
            if (j.contains("DefaultDuration"))   config_.default_duration   = j["DefaultDuration"].get<std::string>();
            if (j.contains("Firewall"))          config_.firewall           = j["Firewall"].get<std::string>();
            if (j.contains("ProcMonitorMethod")) config_.proc_monitor_method = j["ProcMonitorMethod"].get<std::string>();
            if (j.contains("EBPFObjPath"))       config_.ebpf_obj_path       = j["EBPFObjPath"].get<std::string>();
            if (j.contains("InterceptUnknown"))  config_.intercept_unknown  = j["InterceptUnknown"].get<bool>();
            if (j.contains("LogUTC"))            config_.log_utc            = j["LogUTC"].get<bool>();
            if (j.contains("LogMicro"))          config_.log_micro          = j["LogMicro"].get<bool>();
            if (j.contains("LogLevel")) {
                config_.log_level = j["LogLevel"].get<int>();
                bsc::logging::Logger::instance().set_level(static_cast<bsc::logging::Level>(
                    config_.log_level <= 0 ? 0 : config_.log_level >= 3 ? 3 : config_.log_level));
            }
            bsc::logging::Logger::instance().set_utc(config_.log_utc);
            bsc::logging::Logger::instance().set_microseconds(config_.log_micro);
            const auto target = config_.source_path.empty()
                ? std::string{"/etc/bastionguard-secure-connectiond/default-config.json"}
                : config_.source_path;
            (void)bsc::config::save_file(config_, target);
        } catch (...) { log.warning("change_config con JSON non valido"); }
    }
}

References config_, bsc::ui::NotificationEvent::data, firewall_, handle_notification(), heartbeat(), bsc::logging::Logger::instance(), parse_interval(), reload_firewall(), reload_rules(), bsc::ui::NotificationEvent::rules, rules_, bsc::config::save_file(), scan_connections(), set_desktop_active(), bsc::logging::Logger::set_level(), bsc::logging::Logger::set_microseconds(), bsc::logging::Logger::set_utc(), stop(), tasks_, and bsc::ui::NotificationEvent::type.

Referenced by handle_notification(), and run().

handle_proc_event()

void bsc::service::DaemonService::handle_proc_event ( const bsc::netlink::ProcEvent & ev )

private

Definition at line 384 of file DaemonService.cpp.

                                                                   {
    auto& log = bsc::logging::Logger::instance();
    const auto pid = ev.tgid ? ev.tgid : ev.pid;
    if (ev.type == bsc::netlink::ProcEvent::Type::Fork) {
        proc_.note_fork(pid, ev.parent_tgid ? ev.parent_tgid : ev.parent_pid);
        log.debug("fork pid=" + std::to_string(pid) + " ppid=" + std::to_string(ev.parent_tgid ? ev.parent_tgid : ev.parent_pid));
    } else if (ev.type == bsc::netlink::ProcEvent::Type::Exec) {
        proc_.note_exec(pid, config_.rules.enable_checksums);
        if (auto p = proc_.cached(pid, false)) {
            log.debug("exec pid=" + std::to_string(p->pid) + " path=" + p->path);
        }
    } else if (ev.type == bsc::netlink::ProcEvent::Type::Exit) {
        proc_.note_exit(pid);
        log.debug("exit pid=" + std::to_string(pid) + " code=" + std::to_string(ev.exit_code));
    }
}

References config_, bsc::netlink::ProcEvent::Exec, bsc::netlink::ProcEvent::Exit, bsc::netlink::ProcEvent::exit_code, bsc::netlink::ProcEvent::Fork, handle_proc_event(), bsc::logging::Logger::instance(), bsc::netlink::ProcEvent::parent_pid, bsc::netlink::ProcEvent::parent_tgid, bsc::netlink::ProcEvent::pid, proc_, bsc::netlink::ProcEvent::tgid, and bsc::netlink::ProcEvent::type.

Referenced by handle_proc_event().

heartbeat()

void bsc::service::DaemonService::heartbeat ( )

private

Definition at line 681 of file DaemonService.cpp.

                              {
    ui_.ping(stats_);
}

References heartbeat(), stats_, and ui_.

Referenced by handle_notification(), heartbeat(), and run().

parse_interval()

std::chrono::milliseconds bsc::service::DaemonService::parse_interval ( const std::string & v, std::chrono::milliseconds def = std::chrono::seconds(5) )

staticprivate

Definition at line 67 of file DaemonService.cpp.

                                                                                                 {
    if (v.empty()) return def;
    try {
        if (v.ends_with("ms")) return std::chrono::milliseconds(std::stoll(v.substr(0, v.size() - 2)));
        if (v.ends_with("s")) return std::chrono::seconds(std::stoll(v.substr(0, v.size() - 1)));
        if (v.ends_with("m")) return std::chrono::minutes(std::stoll(v.substr(0, v.size() - 1)));
    } catch (...) {}
    return def;
}

Referenced by handle_notification(), and run().

persist_learned_rule()

void bsc::service::DaemonService::persist_learned_rule ( const bsc::model::Connection & conn, const bsc::rule::Rule & decision )

private

Definition at line 401 of file DaemonService.cpp.

                                                                                                    {
    if (decision.duration != "always") return;
    bsc::rule::Rule persisted = decision;
    persisted.created = std::chrono::duration_cast<std::chrono::seconds>(std::chrono::system_clock::now().time_since_epoch()).count();
    if (persisted.name.empty()) {
        std::ostringstream name;
        name << "autogen-" << persisted.action << '-' << conn.process_id << '-' << conn.dst_port << '-' << std::chrono::duration_cast<std::chrono::seconds>(std::chrono::system_clock::now().time_since_epoch()).count();
        persisted.name = name.str();
    }
    persisted.description = "Auto-generated from UI decision";
    persisted.enabled = true;
    persisted.precedence = false;
    persisted.nolog = false;
 
    bsc::rule::Operator proc_op;
    proc_op.type = bsc::rule::OperatorType::Simple;
    if (!conn.process_path.empty()) {
        proc_op.operand = "process.path";
        proc_op.data = conn.process_path;
    } else if (!conn.process_comm.empty()) {
        proc_op.operand = "process.name";
        proc_op.data = conn.process_comm;
    } else {
        proc_op.operand = "process.id";
        proc_op.data = std::to_string(conn.process_id);
    }
    bsc::rule::Operator host_op;
    host_op.type = bsc::rule::OperatorType::Simple;
    host_op.operand = !conn.dst_host.empty() ? "dest.host" : "dest.ip";
    host_op.data = !conn.dst_host.empty() ? conn.dst_host : conn.dst_ip;
    bsc::rule::Operator port_op;
    port_op.type = bsc::rule::OperatorType::Simple;
    port_op.operand = "dest.port";
    port_op.data = std::to_string(conn.dst_port);
    persisted.op.type = bsc::rule::OperatorType::List;
    persisted.op.operand = "list";
    persisted.op.list = {proc_op, host_op, port_op};
 
    if (rules_.save_rule(persisted, config_.rules.path)) {
        reload_rules();
        ui_.post_alert("Regola persistente salvata: " + persisted.name);
    }
}

References bsc::rule::Rule::action, config_, bsc::rule::Rule::created, bsc::rule::Operator::data, bsc::rule::Rule::description, bsc::model::Connection::dst_host, bsc::model::Connection::dst_ip, bsc::model::Connection::dst_port, bsc::rule::Rule::duration, bsc::rule::Rule::enabled, bsc::rule::List, bsc::rule::Operator::list, bsc::rule::Rule::name, bsc::rule::Rule::nolog, bsc::rule::Rule::op, bsc::rule::Operator::operand, persist_learned_rule(), bsc::rule::Rule::precedence, bsc::model::Connection::process_comm, bsc::model::Connection::process_id, bsc::model::Connection::process_path, reload_rules(), rules_, bsc::rule::Simple, bsc::rule::Operator::type, and ui_.

Referenced by decide_connection(), and persist_learned_rule().

reload_firewall()

void bsc::service::DaemonService::reload_firewall ( )

private

Definition at line 283 of file DaemonService.cpp.

                                    {
    if (config_.fw_options.config_path.empty()) {
        return;
    }
 
    if (!firewall_.reload(config_.fw_options.config_path)) {
        const std::string message =
        std::string{_("Reload firewall fallito: ")} +
        config_.fw_options.config_path;
 
        bsc::logging::Logger::instance().warning(message);
        ui_.post_alert(message);
    }
}

References _, config_, firewall_, bsc::logging::Logger::instance(), reload_firewall(), ui_, and bsc::logging::Logger::warning().

Referenced by handle_notification(), reload_firewall(), and run().

reload_rules()

void bsc::service::DaemonService::reload_rules ( )

private

Definition at line 274 of file DaemonService.cpp.

                                 {
    std::lock_guard lock(rules_reload_mutex_);
    if (rules_changed()) {
        const auto aliases = std::filesystem::path(config_.rules.path).parent_path() / "network_aliases.json";
        rules_.load_aliases(aliases.string());
        rules_.load_directory(config_.rules.path);
    }
}

References config_, reload_rules(), rules_, rules_changed(), and rules_reload_mutex_.

Referenced by handle_notification(), persist_learned_rule(), reload_rules(), and run().

remember_connection()

void bsc::service::DaemonService::remember_connection ( const bsc::model::Connection & conn )

private

Definition at line 445 of file DaemonService.cpp.

                                                                      {
    if (conn.process_id == 0 && conn.process_path.empty() && conn.user_id == 0xffffffffu) return;
    const auto now = std::chrono::steady_clock::now();
    std::lock_guard lock(flow_mutex_);
    recent_flows_[conn.key()] = {conn, now};
    if (recent_flows_.size() > 4096) {
        for (auto it = recent_flows_.begin(); it != recent_flows_.end();) {
            if (now - it->second.second > kRecentFlowTtl) it = recent_flows_.erase(it);
            else ++it;
        }
    }
}

References flow_mutex_, bsc::model::Connection::key(), bsc::model::Connection::process_id, bsc::model::Connection::process_path, recent_flows_, remember_connection(), and bsc::model::Connection::user_id.

Referenced by decide_connection(), and remember_connection().

rules_changed()

bool bsc::service::DaemonService::rules_changed ( ) const

private

Definition at line 261 of file DaemonService.cpp.

                                        {
    std::error_code ec;
    fs::file_time_type latest{};
    if (!fs::exists(config_.rules.path, ec)) return false;
    for (const auto& entry : fs::directory_iterator(config_.rules.path, ec)) {
        if (!entry.is_regular_file() || entry.path().extension() != ".json") continue;
        latest = std::max(latest, fs::last_write_time(entry.path(), ec));
    }
    const bool changed = latest != rules_mtime_;
    if (changed) const_cast<DaemonService*>(this)->rules_mtime_ = latest;
    return changed;
}

References config_, DaemonService(), rules_changed(), and rules_mtime_.

Referenced by DaemonService(), reload_rules(), and rules_changed().

run()

void bsc::service::DaemonService::run

(

)

Definition at line 85 of file DaemonService.cpp.

                        {
    auto& log = bsc::logging::Logger::instance();
 
    // Registra l'handler per le notifiche in arrivo dalla UI (cambio config,
    // stop, reload regole...). Viene chiamato dal thread reader del
    // UIClient — deve restare breve.
    ui_.set_notification_handler([this](const bsc::ui::NotificationEvent& ev) {
        handle_notification(ev);
    });
 
    // Avvia il thread di connessione/riconnessione in background. Non-blocca:
    // se la UI non e' ancora su (es. daemon partito dal gestore servizi,
    // utente non ancora loggato), il reconnector interno ritentera' ogni 1s
    // finche' la UI non compare.
    ui_.start();
    log.info("UIClient avviato verso " + config_.server.address);
 
    if (!config_.fw_options.config_path.empty()) firewall_.reload(config_.fw_options.config_path);
 
    auto scan_interval = std::chrono::seconds(2);
    auto heartbeat_interval = std::chrono::seconds(10);
    auto rules_interval = std::chrono::seconds(3);
    auto firewall_interval = parse_interval(config_.fw_options.monitor_interval, std::chrono::seconds(15));
 
    const fs::path tasks_file = fs::path(config_.tasks.config_path) / "tasks.json";
    if (fs::exists(tasks_file)) {
        try {
            std::ifstream in(tasks_file);
            json j;
            in >> j;
            if (j.contains("tasks") && j["tasks"].is_array()) {
                for (const auto& task : j["tasks"]) {
                    const auto name = task.value("name", std::string{});
                    const auto interval = parse_interval(task.value("interval", std::string{"5s"}), std::chrono::seconds(5));
                    if (name == "scan") {
                        scan_interval = std::chrono::duration_cast<std::chrono::seconds>(interval);
                    } else if (name == "heartbeat") {
                        heartbeat_interval = std::chrono::duration_cast<std::chrono::seconds>(interval);
                    } else if (name == "rules_reload") {
                        rules_interval = std::chrono::duration_cast<std::chrono::seconds>(interval);
                    }
                    else if (name == "firewall_reload") firewall_interval = interval;
                }
            }
        } catch (...) {
            log.warning("tasks.json non valido, uso gli intervalli di default");
        }
    }
 
    tasks_.every("scan", scan_interval, [this]() { scan_connections(); });
    tasks_.every("heartbeat", heartbeat_interval, [this]() { heartbeat(); });
    tasks_.every("rules_reload", rules_interval, [this]() { reload_rules(); });
    tasks_.every("firewall_reload", firewall_interval, [this]() { reload_firewall(); });
 
    const auto proc_method = [&]() {
        auto method = config_.proc_monitor_method;
        for (auto& ch : method) ch = static_cast<char>(std::tolower(static_cast<unsigned char>(ch)));
        return method;
    }();
 
    if (proc_method == "netlink" || proc_method == "proc" || proc_method == "audit" || proc_method == "ebpf") {
        if (proc_events_.start([this](const bsc::netlink::ProcEvent& ev) { handle_proc_event(ev); })) {
            log.info("proc event monitor attivo via netlink connector");
            if (proc_method == "audit" || proc_method == "ebpf") {
                // Quando l'utente sceglie "ebpf" attiviamo il monitor eBPF
                // in aggiunta al fallback netlink/proc già avviato sopra.
                // net_ è il SocketSnapshot condiviso: start_ebpf() carica
                // il programma BPF e avvia il thread di draining.
                // Se fallisce (kernel senza BTF, cap assenti) il daemon
                // prosegue normalmente via NFQUEUE + /proc/net/tcp.
                if (proc_method == "ebpf") {
                    const auto ebpf_obj = config_.ebpf_obj_path.empty()
                        ? std::string{"/usr/lib/bastionguard-sc/bsc_ebpf.o"}
                        : config_.ebpf_obj_path;
                    if (net_.start_ebpf(ebpf_obj)) {
                        log.info("eBPF monitor attivo: tracepoint inet_sock_set_state");
                        ui_.post_alert("eBPF monitor attivo — intercettazione a livello kernel");
                    } else {
                        ui_.post_alert("eBPF non disponibile — fallback NFQUEUE+/proc");
                    }
                } else {
                    ui_.post_alert("ProcMonitorMethod=" + config_.proc_monitor_method + " richiesto: uso netlink/proc come fallback runtime nel port C++");
                }
            }
        } else {
            log.warning("proc event monitor non disponibile, resto in modalità on-demand /proc");
        }
    }
 
    if (bsc::netfilter::available()) {
        // Installa la regola nft che dirotta il traffico in NFQUEUE.
        // Se fallisce (niente nft, niente CAP_NET_ADMIN, kernel senza
        // nf_tables) restiamo in modalita' polling /proc: gli alert partono
        // comunque dallo scanner periodico.
        const bool nft_ok = firewall_.install_nfqueue_rule(
            config_.fw_options.queue_num, config_.fw_options.queue_bypass);
 
        if (nft_ok && nfqueue_.open(config_.fw_options.queue_num, [this](const bsc::netfilter::PacketInfo& pkt) {
                if (!desktop_allows_activity()) {
                    bsc::netfilter::Decision d;
                    d.verdict = bsc::netfilter::Verdict::Accept;
                    return d;
                }
 
                auto conn = pkt.connection;
                if (conn.user_id == 0xffffffffu && pkt.uid != 0xffffffffu) conn.user_id = pkt.uid;
 
                net_.enrich_connection(conn);
                if (!has_process_identity(conn)) enrich_from_recent_flows(conn);
 
                for (int i = 0; i < 4 && !has_process_identity(conn); ++i) {
                    net_.invalidate_cache();
                    std::this_thread::sleep_for(std::chrono::milliseconds(15 + 10 * i));
                    net_.enrich_connection(conn);
                    if (!has_process_identity(conn)) enrich_from_recent_flows(conn);
                }
                if (!has_process_identity(conn)) enrich_from_recent_processes(conn, std::chrono::milliseconds(2500));
                if (!has_process_identity(conn)) enrich_from_recent_processes(conn, std::chrono::milliseconds(6000));
 
                return decide_connection(std::move(conn), true, false);
            })) {
            log.info("NFQUEUE attiva sulla coda " + std::to_string(config_.fw_options.queue_num));
            ui_.post_alert("NFQUEUE attiva: intercettazione pacchetti in tempo reale");
        } else {
            if (nft_ok) firewall_.remove_nfqueue_rule();  // apertura coda fallita, rollback
            log.warning("NFQUEUE non disponibile: uso polling /proc come fallback");
            ui_.post_alert("NFQUEUE non disponibile: fallback su /proc snapshot");
        }
    }
 
    log.info("bsc-daemon-cpp started");
    ui_.post_alert("bsc-daemon-cpp avviato");
    ui_.post_alert("runtime: proc_monitor_method=" + config_.proc_monitor_method + ", queue_num=" + std::to_string(config_.fw_options.queue_num));
    while (running_) std::this_thread::sleep_for(std::chrono::milliseconds(250));
    ui_.post_alert("bsc-daemon-cpp arrestato");
    // Breve attesa perche' il post_alert pending possa lasciare il processo
    // attraverso il socket.
    std::this_thread::sleep_for(std::chrono::milliseconds(200));
    nfqueue_.close();
    firewall_.remove_nfqueue_rule();  // pulizia nft all'uscita
    proc_events_.stop();
    net_.stop_ebpf();  // detach tracepoint eBPF (no-op se non avviato)
    tasks_.stop();
    ui_.stop();  // chiude thread reader + socket
    log.info("bsc-daemon-cpp stopped");
}

References bsc::config::Config::ServerConfig::address, bsc::netfilter::available(), config_, bsc::config::Config::FwOptions::config_path, bsc::config::Config::TasksOptions::config_path, bsc::netfilter::PacketInfo::connection, decide_connection(), bsc::config::Config::ebpf_obj_path, bsc::net::SocketSnapshot::enrich_connection(), enrich_from_recent_flows(), enrich_from_recent_processes(), bsc::task::TaskRunner::every(), firewall_, bsc::config::Config::fw_options, handle_notification(), heartbeat(), bsc::fw::Firewall::install_nfqueue_rule(), bsc::logging::Logger::instance(), bsc::net::SocketSnapshot::invalidate_cache(), bsc::config::Config::FwOptions::monitor_interval, net_, nfqueue_, bsc::netfilter::NFQueue::open(), parse_interval(), bsc::ui::UIClient::post_alert(), proc_events_, bsc::config::Config::proc_monitor_method, bsc::config::Config::FwOptions::queue_bypass, bsc::config::Config::FwOptions::queue_num, bsc::fw::Firewall::reload(), reload_firewall(), reload_rules(), bsc::fw::Firewall::remove_nfqueue_rule(), scan_connections(), bsc::config::Config::server, bsc::ui::UIClient::set_notification_handler(), bsc::netlink::ProcEventMonitor::start(), bsc::ui::UIClient::start(), bsc::net::SocketSnapshot::start_ebpf(), bsc::config::Config::tasks, tasks_, ui_, bsc::netfilter::PacketInfo::uid, and bsc::model::Connection::user_id.

scan_connections()

void bsc::service::DaemonService::scan_connections ( )

private

Definition at line 657 of file DaemonService.cpp.

                                     {
    if (!desktop_allows_activity()) {
        if (!inactive_notice_logged_.exchange(true)) {
            bsc::logging::Logger::instance().info(
                "scan sospesa: desktop inattivo o UI non connessa");
        }
        net_.discard_pending_events();
        return;
    }
    inactive_notice_logged_ = false;
 
    for (auto conn : net_.list_connections()) {
        if ((conn.dst_ip == "0.0.0.0" || conn.dst_ip == "::") && conn.dst_port == 0) continue;
        const auto key = conn.key();
        {
            std::lock_guard lock(seen_mutex_);
            if (seen_.contains(key)) continue;
            seen_.insert(key);
            if (seen_.size() > 50000) seen_.clear();
        }
        (void)decide_connection(std::move(conn), config_.intercept_unknown, true);
    }
}

References config_, decide_connection(), desktop_allows_activity(), inactive_notice_logged_, bsc::logging::Logger::info(), bsc::logging::Logger::instance(), net_, scan_connections(), seen_, and seen_mutex_.

Referenced by handle_notification(), run(), and scan_connections().

set_desktop_active()

void bsc::service::DaemonService::set_desktop_active ( bool active )

private

Definition at line 238 of file DaemonService.cpp.

                                                  {
    const bool previous = desktop_active_.exchange(active);
    if (previous == active) return;
 
    auto& log = bsc::logging::Logger::instance();
    if (active) {
        inactive_notice_logged_ = false;
        {
            std::lock_guard lock(seen_mutex_);
            seen_.clear();
        }
        net_.invalidate_cache();
        log.info("Desktop attivo: monitoraggio connessioni riattivato");
    } else {
        {
            std::lock_guard lock(seen_mutex_);
            seen_.clear();
        }
        net_.discard_pending_events();
        log.info("Desktop inattivo/bloccato: sospendo scansione e popup connessioni");
    }
}

References desktop_active_, inactive_notice_logged_, bsc::logging::Logger::instance(), net_, seen_, seen_mutex_, and set_desktop_active().

Referenced by handle_notification(), and set_desktop_active().

stop()

void bsc::service::DaemonService::stop

(

)

Definition at line 232 of file DaemonService.cpp.

{ running_ = false; }

References running_, and stop().

Referenced by handle_notification(), and stop().

verdict_key()

std::string bsc::service::DaemonService::verdict_key ( const bsc::model::Connection & c )

staticprivate

Definition at line 508 of file DaemonService.cpp.

                                                                {
    const std::string host = !c.dst_host.empty() ? c.dst_host : c.dst_ip;
    std::string proc_key = !c.process_path.empty() ? c.process_path : c.process_comm;
    if (proc_key.empty() && c.process_id != 0) proc_key = "pid:" + std::to_string(c.process_id);
    return proc_key + "|" + host + "|" + std::to_string(c.dst_port);
}

References bsc::model::Connection::dst_host, bsc::model::Connection::dst_ip, bsc::model::Connection::dst_port, bsc::model::Connection::process_comm, bsc::model::Connection::process_id, bsc::model::Connection::process_path, and verdict_key().

Referenced by verdict_key(), verdict_lookup(), and verdict_store().

verdict_lookup()

std::optional< DaemonService::CachedVerdict > bsc::service::DaemonService::verdict_lookup ( const bsc::model::Connection & c ) const

private

Definition at line 516 of file DaemonService.cpp.

                                                               {
    const auto key = verdict_key(c);
    const auto now = std::chrono::steady_clock::now();
    std::lock_guard lk(verdict_cache_mutex_);
    auto it = verdict_cache_.find(key);
    if (it == verdict_cache_.end()) return std::nullopt;
    if (it->second.expires_at != std::chrono::steady_clock::time_point{} &&
        now >= it->second.expires_at) {
        return std::nullopt;  // scaduto
    }
    return it->second;
}

References verdict_cache_, verdict_cache_mutex_, verdict_key(), and verdict_lookup().

Referenced by decide_connection(), and verdict_lookup().

verdict_store()

void bsc::service::DaemonService::verdict_store ( const bsc::model::Connection & c, const bsc::rule::Rule & r )

private

Definition at line 529 of file DaemonService.cpp.

                                                                                   {
    // Memorizziamo SOLO verdetti "always": once e' per definizione one-shot.
    // Per "always" teniamo scadenza infinita (salvato anche su disco come
    // regola — vedi persist_learned_rule).
    if (r.duration != "always") return;
    CachedVerdict cv{r.action, r.duration, std::chrono::steady_clock::time_point{}};
    std::lock_guard lk(verdict_cache_mutex_);
    verdict_cache_[verdict_key(c)] = std::move(cv);
    // Bound di sicurezza: dimentica il piu' vecchio se superiamo 4096 entry.
    if (verdict_cache_.size() > 4096) {
        auto oldest = verdict_cache_.begin();
        verdict_cache_.erase(oldest);
    }
}

References verdict_cache_, verdict_cache_mutex_, verdict_key(), and verdict_store().

Referenced by decide_connection(), and verdict_store().

Member Data Documentation

config_

bsc::config::Config bsc::service::DaemonService::config_

private

Definition at line 48 of file DaemonService.hpp.

Referenced by DaemonService(), decide_connection(), handle_notification(), handle_proc_event(), persist_learned_rule(), reload_firewall(), reload_rules(), rules_changed(), run(), and scan_connections().

desktop_active_

std::atomic_bool bsc::service::DaemonService::desktop_active_ {false}

private

Definition at line 92 of file DaemonService.hpp.

Referenced by desktop_allows_activity(), and set_desktop_active().

dns_

bsc::net::DnsResolver bsc::service::DaemonService::dns_

private

Definition at line 50 of file DaemonService.hpp.

Referenced by decide_connection().

firewall_

bsc::fw::Firewall bsc::service::DaemonService::firewall_

private

Definition at line 49 of file DaemonService.hpp.

Referenced by DaemonService(), handle_notification(), reload_firewall(), and run().

flow_mutex_

std::mutex bsc::service::DaemonService::flow_mutex_

mutableprivate

Definition at line 63 of file DaemonService.hpp.

Referenced by enrich_from_recent_flows(), and remember_connection().

inactive_notice_logged_

std::atomic_bool bsc::service::DaemonService::inactive_notice_logged_ {false}

private

Definition at line 93 of file DaemonService.hpp.

Referenced by scan_connections(), and set_desktop_active().

is_asking_

std::atomic_bool bsc::service::DaemonService::is_asking_ {false}

private

Definition at line 87 of file DaemonService.hpp.

Referenced by decide_connection().

net_

bsc::net::SocketSnapshot bsc::service::DaemonService::net_

private

Definition at line 52 of file DaemonService.hpp.

Referenced by run(), scan_connections(), and set_desktop_active().

nfqueue_

bsc::netfilter::NFQueue bsc::service::DaemonService::nfqueue_

private

Definition at line 53 of file DaemonService.hpp.

Referenced by run().

proc_

bsc::proc::ProcMon bsc::service::DaemonService::proc_

private

Definition at line 54 of file DaemonService.hpp.

Referenced by decide_connection(), enrich_from_recent_processes(), and handle_proc_event().

proc_events_

bsc::netlink::ProcEventMonitor bsc::service::DaemonService::proc_events_

private

Definition at line 51 of file DaemonService.hpp.

Referenced by run().

recent_flows_

std::unordered_map<std::string, std::pair<bsc::model::Connection, std::chrono::steady_clock::time_point> > bsc::service::DaemonService::recent_flows_

private

Definition at line 64 of file DaemonService.hpp.

Referenced by enrich_from_recent_flows(), and remember_connection().

rules_

bsc::rule::Loader bsc::service::DaemonService::rules_

private

Definition at line 55 of file DaemonService.hpp.

Referenced by DaemonService(), decide_connection(), handle_notification(), persist_learned_rule(), and reload_rules().

rules_mtime_

std::filesystem::file_time_type bsc::service::DaemonService::rules_mtime_ {}

private

Definition at line 95 of file DaemonService.hpp.

Referenced by rules_changed().

rules_reload_mutex_

std::mutex bsc::service::DaemonService::rules_reload_mutex_

mutableprivate

Definition at line 62 of file DaemonService.hpp.

Referenced by reload_rules().

running_

std::atomic_bool bsc::service::DaemonService::running_ {true}

private

Definition at line 59 of file DaemonService.hpp.

Referenced by stop().

seen_

std::set<std::string> bsc::service::DaemonService::seen_

private

Definition at line 61 of file DaemonService.hpp.

Referenced by scan_connections(), and set_desktop_active().

seen_mutex_

std::mutex bsc::service::DaemonService::seen_mutex_

private

Definition at line 60 of file DaemonService.hpp.

Referenced by scan_connections(), and set_desktop_active().

start_time_

std::chrono::steady_clock::time_point bsc::service::DaemonService::start_time_ {std::chrono::steady_clock::now()}

private

Definition at line 96 of file DaemonService.hpp.

stats_

bsc::stats::Statistics bsc::service::DaemonService::stats_

private

Definition at line 56 of file DaemonService.hpp.

Referenced by DaemonService(), decide_connection(), and heartbeat().

tasks_

bsc::task::TaskRunner bsc::service::DaemonService::tasks_

private

Definition at line 58 of file DaemonService.hpp.

Referenced by handle_notification(), and run().

ui_

bsc::ui::UIClient bsc::service::DaemonService::ui_

private

Definition at line 57 of file DaemonService.hpp.

Referenced by DaemonService(), decide_connection(), desktop_allows_activity(), heartbeat(), persist_learned_rule(), reload_firewall(), and run().

verdict_cache_

std::unordered_map<std::string, CachedVerdict> bsc::service::DaemonService::verdict_cache_

private

Definition at line 77 of file DaemonService.hpp.

Referenced by verdict_lookup(), and verdict_store().

verdict_cache_mutex_

std::mutex bsc::service::DaemonService::verdict_cache_mutex_

mutableprivate

Definition at line 76 of file DaemonService.hpp.

Referenced by verdict_lookup(), and verdict_store().

---

The documentation for this class was generated from the following files:

• BastionGuard/thirdparty/bastionguard-secure-connection/daemon/include/bsc/service/DaemonService.hpp
• BastionGuard/thirdparty/bastionguard-secure-connection/daemon/src/service/DaemonService.cpp