DaemonService.cpp

Go to the documentation of this file.

#include "bsc/service/DaemonService.hpp"
#include "bsc/logging/Logger.hpp"
#include <cctype>
#include <chrono>
#include <filesystem>
#include <fstream>
#include <nlohmann/json.hpp>
#include <sstream>
#include <thread>
#include <libintl.h>
 
#define _(text) gettext(text)
#define N_(text) text
 
namespace bsc::service {
namespace fs = std::filesystem;
using json = nlohmann::json;
namespace {
constexpr auto kRecentFlowTtl = std::chrono::seconds(10);
 
std::string lower_copy(std::string s) {
    for (char& ch : s) ch = static_cast<char>(std::tolower(static_cast<unsigned char>(ch)));
    return s;
}
 
bool looks_like_browser_thread_comm(const std::string& comm) {
    const auto s = lower_copy(comm);
    return s.find("thread") != std::string::npos ||
           s.find("socket") != std::string::npos ||
           s.find("web content") != std::string::npos ||
           s.find("renderer") != std::string::npos ||
           s.find("utility") != std::string::npos ||
           s.find("chrome_") != std::string::npos ||
           s.find("isolated web") != std::string::npos ||
           s == "gpu process" ||
           s == "rdd process" ||
           s == "privileged cont";
}
 
bool has_process_identity(const bsc::model::Connection& c) {
    return c.process_id != 0 ||
           !c.process_path.empty() ||
           (!c.process_comm.empty() && !looks_like_browser_thread_comm(c.process_comm));
}
 
void merge_process_info(bsc::model::Connection& conn, const bsc::model::ProcessInfo& p) {
    if (conn.process_id == 0) conn.process_id = static_cast<std::uint32_t>(p.pid);
    // /proc/<tgid>/comm è il nome del processo principale. Preferiscilo
    // sempre al task comm catturato da eBPF, che nei browser spesso è il
    // nome del thread (es. "Socket Thread", "Chrome_ChildIOT").
    if (!p.comm.empty()) conn.process_comm = p.comm;
    if (!p.path.empty()) conn.process_path = p.path;
    if (conn.process_cwd.empty()) conn.process_cwd = p.cwd;
    if (conn.process_args.empty()) conn.process_args = p.args;
    if (conn.process_env.empty()) conn.process_env = p.env;
    if (conn.process_checksums.empty()) conn.process_checksums = p.checksums;
    if (conn.process_tree.empty()) conn.process_tree = p.process_tree;
    if (conn.user_id == 0xffffffffu) conn.user_id = static_cast<std::uint32_t>(p.uid);
}
 
bool same_process_signature(const bsc::model::ProcessInfo& a, const bsc::model::ProcessInfo& b) {
    if (!a.path.empty() && !b.path.empty()) return a.path == b.path;
    return !a.comm.empty() && !b.comm.empty() && a.comm == b.comm;
}
}
 
std::chrono::milliseconds DaemonService::parse_interval(const std::string& v, std::chrono::milliseconds def) {
    if (v.empty()) return def;
    try {
        if (v.ends_with("ms")) return std::chrono::milliseconds(std::stoll(v.substr(0, v.size() - 2)));
        if (v.ends_with("s")) return std::chrono::seconds(std::stoll(v.substr(0, v.size() - 1)));
        if (v.ends_with("m")) return std::chrono::minutes(std::stoll(v.substr(0, v.size() - 1)));
    } catch (...) {}
    return def;
}
 
DaemonService::DaemonService(bsc::config::Config config)
    : config_(std::move(config)), firewall_(config_.firewall), stats_(config_.stats.max_events), ui_(config_.server.address) {
    const auto aliases = std::filesystem::path(config_.rules.path).parent_path() / "network_aliases.json";
    rules_.load_aliases(aliases.string());
    rules_.load_directory(config_.rules.path);
    rules_changed();
}
 
void DaemonService::run() {
    auto& log = bsc::logging::Logger::instance();
 
    // Registra l'handler per le notifiche in arrivo dalla UI (cambio config,
    // stop, reload regole...). Viene chiamato dal thread reader del
    // UIClient — deve restare breve.
    ui_.set_notification_handler([this](const bsc::ui::NotificationEvent& ev) {
        handle_notification(ev);
    });
 
    // Avvia il thread di connessione/riconnessione in background. Non-blocca:
    // se la UI non e' ancora su (es. daemon partito dal gestore servizi,
    // utente non ancora loggato), il reconnector interno ritentera' ogni 1s
    // finche' la UI non compare.
    ui_.start();
    log.info("UIClient avviato verso " + config_.server.address);
 
    if (!config_.fw_options.config_path.empty()) firewall_.reload(config_.fw_options.config_path);
 
    auto scan_interval = std::chrono::seconds(2);
    auto heartbeat_interval = std::chrono::seconds(10);
    auto rules_interval = std::chrono::seconds(3);
    auto firewall_interval = parse_interval(config_.fw_options.monitor_interval, std::chrono::seconds(15));
 
    const fs::path tasks_file = fs::path(config_.tasks.config_path) / "tasks.json";
    if (fs::exists(tasks_file)) {
        try {
            std::ifstream in(tasks_file);
            json j;
            in >> j;
            if (j.contains("tasks") && j["tasks"].is_array()) {
                for (const auto& task : j["tasks"]) {
                    const auto name = task.value("name", std::string{});
                    const auto interval = parse_interval(task.value("interval", std::string{"5s"}), std::chrono::seconds(5));
                    if (name == "scan") {
                        scan_interval = std::chrono::duration_cast<std::chrono::seconds>(interval);
                    } else if (name == "heartbeat") {
                        heartbeat_interval = std::chrono::duration_cast<std::chrono::seconds>(interval);
                    } else if (name == "rules_reload") {
                        rules_interval = std::chrono::duration_cast<std::chrono::seconds>(interval);
                    }
                    else if (name == "firewall_reload") firewall_interval = interval;
                }
            }
        } catch (...) {
            log.warning("tasks.json non valido, uso gli intervalli di default");
        }
    }
 
    tasks_.every("scan", scan_interval, [this]() { scan_connections(); });
    tasks_.every("heartbeat", heartbeat_interval, [this]() { heartbeat(); });
    tasks_.every("rules_reload", rules_interval, [this]() { reload_rules(); });
    tasks_.every("firewall_reload", firewall_interval, [this]() { reload_firewall(); });
 
    const auto proc_method = [&]() {
        auto method = config_.proc_monitor_method;
        for (auto& ch : method) ch = static_cast<char>(std::tolower(static_cast<unsigned char>(ch)));
        return method;
    }();
 
    if (proc_method == "netlink" || proc_method == "proc" || proc_method == "audit" || proc_method == "ebpf") {
        if (proc_events_.start([this](const bsc::netlink::ProcEvent& ev) { handle_proc_event(ev); })) {
            log.info("proc event monitor attivo via netlink connector");
            if (proc_method == "audit" || proc_method == "ebpf") {
                // Quando l'utente sceglie "ebpf" attiviamo il monitor eBPF
                // in aggiunta al fallback netlink/proc già avviato sopra.
                // net_ è il SocketSnapshot condiviso: start_ebpf() carica
                // il programma BPF e avvia il thread di draining.
                // Se fallisce (kernel senza BTF, cap assenti) il daemon
                // prosegue normalmente via NFQUEUE + /proc/net/tcp.
                if (proc_method == "ebpf") {
                    const auto ebpf_obj = config_.ebpf_obj_path.empty()
                        ? std::string{"/usr/lib/bastionguard-sc/bsc_ebpf.o"}
                        : config_.ebpf_obj_path;
                    if (net_.start_ebpf(ebpf_obj)) {
                        log.info("eBPF monitor attivo: tracepoint inet_sock_set_state");
                        ui_.post_alert("eBPF monitor attivo — intercettazione a livello kernel");
                    } else {
                        ui_.post_alert("eBPF non disponibile — fallback NFQUEUE+/proc");
                    }
                } else {
                    ui_.post_alert("ProcMonitorMethod=" + config_.proc_monitor_method + " richiesto: uso netlink/proc come fallback runtime nel port C++");
                }
            }
        } else {
            log.warning("proc event monitor non disponibile, resto in modalità on-demand /proc");
        }
    }
 
    if (bsc::netfilter::available()) {
        // Installa la regola nft che dirotta il traffico in NFQUEUE.
        // Se fallisce (niente nft, niente CAP_NET_ADMIN, kernel senza
        // nf_tables) restiamo in modalita' polling /proc: gli alert partono
        // comunque dallo scanner periodico.
        const bool nft_ok = firewall_.install_nfqueue_rule(
            config_.fw_options.queue_num, config_.fw_options.queue_bypass);
 
        if (nft_ok && nfqueue_.open(config_.fw_options.queue_num, [this](const bsc::netfilter::PacketInfo& pkt) {
                if (!desktop_allows_activity()) {
                    bsc::netfilter::Decision d;
                    d.verdict = bsc::netfilter::Verdict::Accept;
                    return d;
                }
 
                auto conn = pkt.connection;
                if (conn.user_id == 0xffffffffu && pkt.uid != 0xffffffffu) conn.user_id = pkt.uid;
 
                net_.enrich_connection(conn);
                if (!has_process_identity(conn)) enrich_from_recent_flows(conn);
 
                for (int i = 0; i < 4 && !has_process_identity(conn); ++i) {
                    net_.invalidate_cache();
                    std::this_thread::sleep_for(std::chrono::milliseconds(15 + 10 * i));
                    net_.enrich_connection(conn);
                    if (!has_process_identity(conn)) enrich_from_recent_flows(conn);
                }
                if (!has_process_identity(conn)) enrich_from_recent_processes(conn, std::chrono::milliseconds(2500));
                if (!has_process_identity(conn)) enrich_from_recent_processes(conn, std::chrono::milliseconds(6000));
 
                return decide_connection(std::move(conn), true, false);
            })) {
            log.info("NFQUEUE attiva sulla coda " + std::to_string(config_.fw_options.queue_num));
            ui_.post_alert("NFQUEUE attiva: intercettazione pacchetti in tempo reale");
        } else {
            if (nft_ok) firewall_.remove_nfqueue_rule();  // apertura coda fallita, rollback
            log.warning("NFQUEUE non disponibile: uso polling /proc come fallback");
            ui_.post_alert("NFQUEUE non disponibile: fallback su /proc snapshot");
        }
    }
 
    log.info("bsc-daemon-cpp started");
    ui_.post_alert("bsc-daemon-cpp avviato");
    ui_.post_alert("runtime: proc_monitor_method=" + config_.proc_monitor_method + ", queue_num=" + std::to_string(config_.fw_options.queue_num));
    while (running_) std::this_thread::sleep_for(std::chrono::milliseconds(250));
    ui_.post_alert("bsc-daemon-cpp arrestato");
    // Breve attesa perche' il post_alert pending possa lasciare il processo
    // attraverso il socket.
    std::this_thread::sleep_for(std::chrono::milliseconds(200));
    nfqueue_.close();
    firewall_.remove_nfqueue_rule();  // pulizia nft all'uscita
    proc_events_.stop();
    net_.stop_ebpf();  // detach tracepoint eBPF (no-op se non avviato)
    tasks_.stop();
    ui_.stop();  // chiude thread reader + socket
    log.info("bsc-daemon-cpp stopped");
}
 
void DaemonService::stop() { running_ = false; }
 
bool DaemonService::desktop_allows_activity() const {
    return desktop_active_.load() && ui_.is_connected();
}
 
void DaemonService::set_desktop_active(bool active) {
    const bool previous = desktop_active_.exchange(active);
    if (previous == active) return;
 
    auto& log = bsc::logging::Logger::instance();
    if (active) {
        inactive_notice_logged_ = false;
        {
            std::lock_guard lock(seen_mutex_);
            seen_.clear();
        }
        net_.invalidate_cache();
        log.info("Desktop attivo: monitoraggio connessioni riattivato");
    } else {
        {
            std::lock_guard lock(seen_mutex_);
            seen_.clear();
        }
        net_.discard_pending_events();
        log.info("Desktop inattivo/bloccato: sospendo scansione e popup connessioni");
    }
}
 
bool DaemonService::rules_changed() const {
    std::error_code ec;
    fs::file_time_type latest{};
    if (!fs::exists(config_.rules.path, ec)) return false;
    for (const auto& entry : fs::directory_iterator(config_.rules.path, ec)) {
        if (!entry.is_regular_file() || entry.path().extension() != ".json") continue;
        latest = std::max(latest, fs::last_write_time(entry.path(), ec));
    }
    const bool changed = latest != rules_mtime_;
    if (changed) const_cast<DaemonService*>(this)->rules_mtime_ = latest;
    return changed;
}
 
void DaemonService::reload_rules() {
    std::lock_guard lock(rules_reload_mutex_);
    if (rules_changed()) {
        const auto aliases = std::filesystem::path(config_.rules.path).parent_path() / "network_aliases.json";
        rules_.load_aliases(aliases.string());
        rules_.load_directory(config_.rules.path);
    }
}
 
void DaemonService::reload_firewall() {
    if (config_.fw_options.config_path.empty()) {
        return;
    }
 
    if (!firewall_.reload(config_.fw_options.config_path)) {
        const std::string message =
        std::string{_("Reload firewall fallito: ")} +
        config_.fw_options.config_path;
 
        bsc::logging::Logger::instance().warning(message);
        ui_.post_alert(message);
    }
}
 
void DaemonService::handle_notification(const bsc::ui::NotificationEvent& ev) {
    auto& log = bsc::logging::Logger::instance();
    log.info("notification: " + ev.type);
 
    // I tipi sono lowercase (mapping stringhe definito in ipc/UIServer.cpp).
    if (ev.type == "reload_fw_rules") {
        reload_firewall();
    } else if (ev.type == "stop") {
        stop();
    } else if (ev.type == "enable_interception") {
        config_.intercept_unknown = true;
    } else if (ev.type == "disable_interception") {
        config_.intercept_unknown = false;
    } else if (ev.type == "desktop_active") {
        set_desktop_active(true);
    } else if (ev.type == "desktop_idle") {
        set_desktop_active(false);
    } else if (ev.type == "enable_firewall") {
        if (!config_.fw_options.config_path.empty()) firewall_.reload(config_.fw_options.config_path);
        tasks_.every("firewall_reload",
                     parse_interval(config_.fw_options.monitor_interval, std::chrono::seconds(15)),
                     [this]() { reload_firewall(); });
    } else if (ev.type == "disable_firewall") {
        log.warning("disable firewall: sospendo i reload periodici");
        tasks_.stop_task("firewall_reload");
    } else if (ev.type == "task_stop") {
        try {
            auto j = json::parse(ev.data);
            const auto name = j.value("Name", std::string{});
            if (!name.empty()) tasks_.stop_task(name);
        } catch (...) { log.warning("task_stop con JSON non valido"); }
    } else if (ev.type == "task_start") {
        try {
            auto j = json::parse(ev.data);
            const auto name = j.value("Name", std::string{});
            const auto interval = parse_interval(j.value("Interval", std::string{"5s"}), std::chrono::seconds(5));
            if (name == "scan") tasks_.every("scan", interval, [this]() { scan_connections(); });
            else if (name == "heartbeat") tasks_.every("heartbeat", interval, [this]() { heartbeat(); });
            else if (name == "rules_reload") tasks_.every("rules_reload", interval, [this]() { reload_rules(); });
            else if (name == "firewall_reload") tasks_.every("firewall_reload", interval, [this]() { reload_firewall(); });
        } catch (...) { log.warning("task_start con JSON non valido"); }
    } else if (ev.type == "log_level") {
        try {
            auto lvl = std::stoi(ev.data);
            config_.log_level = lvl <= 0 ? 0 : lvl >= 3 ? 3 : lvl;
            bsc::logging::Logger::instance().set_level(static_cast<bsc::logging::Level>(config_.log_level));
        } catch (...) { log.warning("log_level non valido"); }
    } else if (ev.type == "change_rule" || ev.type == "enable_rule" || ev.type == "disable_rule") {
        for (auto r : ev.rules) {
            if (ev.type == "disable_rule") r.enabled = false;
            if (ev.type == "enable_rule")  r.enabled = true;
            rules_.save_rule(r, config_.rules.path);
        }
        reload_rules();
    } else if (ev.type == "delete_rule") {
        for (const auto& r : ev.rules) {
            std::error_code ec;
            fs::remove(fs::path(config_.rules.path) / (r.name + ".json"), ec);
        }
        reload_rules();
    } else if (ev.type == "change_config") {
        try {
            auto j = json::parse(ev.data);
            if (j.contains("DefaultAction"))     config_.default_action     = j["DefaultAction"].get<std::string>();
            if (j.contains("DefaultDuration"))   config_.default_duration   = j["DefaultDuration"].get<std::string>();
            if (j.contains("Firewall"))          config_.firewall           = j["Firewall"].get<std::string>();
            if (j.contains("ProcMonitorMethod")) config_.proc_monitor_method = j["ProcMonitorMethod"].get<std::string>();
            if (j.contains("EBPFObjPath"))       config_.ebpf_obj_path       = j["EBPFObjPath"].get<std::string>();
            if (j.contains("InterceptUnknown"))  config_.intercept_unknown  = j["InterceptUnknown"].get<bool>();
            if (j.contains("LogUTC"))            config_.log_utc            = j["LogUTC"].get<bool>();
            if (j.contains("LogMicro"))          config_.log_micro          = j["LogMicro"].get<bool>();
            if (j.contains("LogLevel")) {
                config_.log_level = j["LogLevel"].get<int>();
                bsc::logging::Logger::instance().set_level(static_cast<bsc::logging::Level>(
                    config_.log_level <= 0 ? 0 : config_.log_level >= 3 ? 3 : config_.log_level));
            }
            bsc::logging::Logger::instance().set_utc(config_.log_utc);
            bsc::logging::Logger::instance().set_microseconds(config_.log_micro);
            const auto target = config_.source_path.empty()
                ? std::string{"/etc/bastionguard-secure-connectiond/default-config.json"}
                : config_.source_path;
            (void)bsc::config::save_file(config_, target);
        } catch (...) { log.warning("change_config con JSON non valido"); }
    }
}
 
void DaemonService::handle_proc_event(const bsc::netlink::ProcEvent& ev) {
    auto& log = bsc::logging::Logger::instance();
    const auto pid = ev.tgid ? ev.tgid : ev.pid;
    if (ev.type == bsc::netlink::ProcEvent::Type::Fork) {
        proc_.note_fork(pid, ev.parent_tgid ? ev.parent_tgid : ev.parent_pid);
        log.debug("fork pid=" + std::to_string(pid) + " ppid=" + std::to_string(ev.parent_tgid ? ev.parent_tgid : ev.parent_pid));
    } else if (ev.type == bsc::netlink::ProcEvent::Type::Exec) {
        proc_.note_exec(pid, config_.rules.enable_checksums);
        if (auto p = proc_.cached(pid, false)) {
            log.debug("exec pid=" + std::to_string(p->pid) + " path=" + p->path);
        }
    } else if (ev.type == bsc::netlink::ProcEvent::Type::Exit) {
        proc_.note_exit(pid);
        log.debug("exit pid=" + std::to_string(pid) + " code=" + std::to_string(ev.exit_code));
    }
}
 
void DaemonService::persist_learned_rule(const bsc::model::Connection& conn, const bsc::rule::Rule& decision) {
    if (decision.duration != "always") return;
    bsc::rule::Rule persisted = decision;
    persisted.created = std::chrono::duration_cast<std::chrono::seconds>(std::chrono::system_clock::now().time_since_epoch()).count();
    if (persisted.name.empty()) {
        std::ostringstream name;
        name << "autogen-" << persisted.action << '-' << conn.process_id << '-' << conn.dst_port << '-' << std::chrono::duration_cast<std::chrono::seconds>(std::chrono::system_clock::now().time_since_epoch()).count();
        persisted.name = name.str();
    }
    persisted.description = "Auto-generated from UI decision";
    persisted.enabled = true;
    persisted.precedence = false;
    persisted.nolog = false;
 
    bsc::rule::Operator proc_op;
    proc_op.type = bsc::rule::OperatorType::Simple;
    if (!conn.process_path.empty()) {
        proc_op.operand = "process.path";
        proc_op.data = conn.process_path;
    } else if (!conn.process_comm.empty()) {
        proc_op.operand = "process.name";
        proc_op.data = conn.process_comm;
    } else {
        proc_op.operand = "process.id";
        proc_op.data = std::to_string(conn.process_id);
    }
    bsc::rule::Operator host_op;
    host_op.type = bsc::rule::OperatorType::Simple;
    host_op.operand = !conn.dst_host.empty() ? "dest.host" : "dest.ip";
    host_op.data = !conn.dst_host.empty() ? conn.dst_host : conn.dst_ip;
    bsc::rule::Operator port_op;
    port_op.type = bsc::rule::OperatorType::Simple;
    port_op.operand = "dest.port";
    port_op.data = std::to_string(conn.dst_port);
    persisted.op.type = bsc::rule::OperatorType::List;
    persisted.op.operand = "list";
    persisted.op.list = {proc_op, host_op, port_op};
 
    if (rules_.save_rule(persisted, config_.rules.path)) {
        reload_rules();
        ui_.post_alert("Regola persistente salvata: " + persisted.name);
    }
}
 
void DaemonService::remember_connection(const bsc::model::Connection& conn) {
    if (conn.process_id == 0 && conn.process_path.empty() && conn.user_id == 0xffffffffu) return;
    const auto now = std::chrono::steady_clock::now();
    std::lock_guard lock(flow_mutex_);
    recent_flows_[conn.key()] = {conn, now};
    if (recent_flows_.size() > 4096) {
        for (auto it = recent_flows_.begin(); it != recent_flows_.end();) {
            if (now - it->second.second > kRecentFlowTtl) it = recent_flows_.erase(it);
            else ++it;
        }
    }
}
 
void DaemonService::enrich_from_recent_flows(bsc::model::Connection& conn) {
    const auto now = std::chrono::steady_clock::now();
    std::lock_guard lock(flow_mutex_);
    for (auto it = recent_flows_.begin(); it != recent_flows_.end();) {
        if (now - it->second.second > kRecentFlowTtl) {
            it = recent_flows_.erase(it);
            continue;
        }
        const auto& cached = it->second.first;
        const bool same_direct = conn.protocol == cached.protocol && conn.src_ip == cached.src_ip && conn.src_port == cached.src_port && conn.dst_ip == cached.dst_ip && conn.dst_port == cached.dst_port;
        const bool same_reverse = conn.protocol == cached.protocol && conn.src_ip == cached.dst_ip && conn.src_port == cached.dst_port && conn.dst_ip == cached.src_ip && conn.dst_port == cached.src_port;
        if (same_direct || same_reverse) {
            if (conn.process_id == 0) conn.process_id = cached.process_id;
            if (conn.user_id == 0xffffffffu) conn.user_id = cached.user_id;
            if (conn.process_path.empty()) conn.process_path = cached.process_path;
            if (conn.process_comm.empty() || looks_like_browser_thread_comm(conn.process_comm)) conn.process_comm = cached.process_comm;
            if (conn.process_cwd.empty()) conn.process_cwd = cached.process_cwd;
            if (conn.process_args.empty()) conn.process_args = cached.process_args;
            if (conn.process_env.empty()) conn.process_env = cached.process_env;
            if (conn.process_checksums.empty()) conn.process_checksums = cached.process_checksums;
            if (conn.process_tree.empty()) conn.process_tree = cached.process_tree;
            return;
        }
        ++it;
    }
}
 
void DaemonService::enrich_from_recent_processes(bsc::model::Connection& conn, std::chrono::milliseconds max_age) {
    if (conn.process_id != 0 && !conn.process_comm.empty() && !conn.process_path.empty()) return;
 
    std::vector<bsc::model::ProcessInfo> candidates;
    if (conn.user_id != 0xffffffffu) candidates = proc_.recent_candidates(conn.user_id, max_age, 8);
    else candidates = proc_.recent_candidates_any(max_age, 4);
    if (candidates.empty()) return;
 
    const auto& best = candidates.front();
    bool unambiguous = candidates.size() == 1;
    if (!unambiguous) {
        unambiguous = true;
        for (std::size_t i = 1; i < std::min<std::size_t>(candidates.size(), 3); ++i) {
            if (!same_process_signature(best, candidates[i])) {
                unambiguous = false;
                break;
            }
        }
    }
    if (!unambiguous) return;
    merge_process_info(conn, best);
}
 
std::string DaemonService::verdict_key(const bsc::model::Connection& c) {
    const std::string host = !c.dst_host.empty() ? c.dst_host : c.dst_ip;
    std::string proc_key = !c.process_path.empty() ? c.process_path : c.process_comm;
    if (proc_key.empty() && c.process_id != 0) proc_key = "pid:" + std::to_string(c.process_id);
    return proc_key + "|" + host + "|" + std::to_string(c.dst_port);
}
 
std::optional<DaemonService::CachedVerdict>
DaemonService::verdict_lookup(const bsc::model::Connection& c) const {
    const auto key = verdict_key(c);
    const auto now = std::chrono::steady_clock::now();
    std::lock_guard lk(verdict_cache_mutex_);
    auto it = verdict_cache_.find(key);
    if (it == verdict_cache_.end()) return std::nullopt;
    if (it->second.expires_at != std::chrono::steady_clock::time_point{} &&
        now >= it->second.expires_at) {
        return std::nullopt;  // scaduto
    }
    return it->second;
}
 
void DaemonService::verdict_store(const bsc::model::Connection& c, const bsc::rule::Rule& r) {
    // Memorizziamo SOLO verdetti "always": once e' per definizione one-shot.
    // Per "always" teniamo scadenza infinita (salvato anche su disco come
    // regola — vedi persist_learned_rule).
    if (r.duration != "always") return;
    CachedVerdict cv{r.action, r.duration, std::chrono::steady_clock::time_point{}};
    std::lock_guard lk(verdict_cache_mutex_);
    verdict_cache_[verdict_key(c)] = std::move(cv);
    // Bound di sicurezza: dimentica il piu' vecchio se superiamo 4096 entry.
    if (verdict_cache_.size() > 4096) {
        auto oldest = verdict_cache_.begin();
        verdict_cache_.erase(oldest);
    }
}
 
bsc::netfilter::Decision DaemonService::decide_connection(bsc::model::Connection conn, bool realtime, bool allow_blocking_ask) {
    auto& log = bsc::logging::Logger::instance();
 
    // Se il desktop non è attivo o la UI non è connessa, non fare lookup,
    // reverse DNS, popup o scansioni costose: lascia passare e basta.
    // Questo evita allarmi/attività di rete quando la sessione grafica è
    // inattiva, bloccata o non ancora pronta.
    if (!desktop_allows_activity()) {
        bsc::netfilter::Decision d;
        d.verdict = bsc::netfilter::Verdict::Accept;
        return d;
    }
 
    if (conn.process_id == 0 || conn.process_path.empty()) enrich_from_recent_flows(conn);
    if (!has_process_identity(conn)) {
        enrich_from_recent_processes(conn, std::chrono::milliseconds(2500));
    }
    if (!has_process_identity(conn)) {
        enrich_from_recent_processes(conn, std::chrono::milliseconds(6000));
    }
    if (conn.process_id > 0) {
        if (auto p = proc_.inspect(conn.process_id, config_.rules.enable_checksums)) {
            merge_process_info(conn, *p);
        }
    }
    if (realtime && conn.process_id == 0 && conn.process_comm.empty() && conn.process_path.empty()) {
        log.warning("Connessione senza processo risolto: uid=" + std::to_string(conn.user_id) +
                    " dst=" + conn.dst_ip + ":" + std::to_string(conn.dst_port));
    }
    if (conn.dst_host.empty()) {
        conn.dst_host = dns_.reverse_lookup(conn.dst_ip);
        if (!conn.dst_host.empty()) stats_.note_dns_response();
    }
 
    std::string action;
    std::string rule_name;
    std::string duration = config_.default_duration;
    bool asked_ui = false;
 
    // 1) Cache dei verdetti "always" dati dall'utente in questa sessione:
    //    se Firefox ha gia' avuto un "allow always" verso google.com:443,
    //    le prossime 50 connessioni non aprono popup.
    if (auto cached = verdict_lookup(conn)) {
        action = cached->action;
        duration = cached->duration;
        rule_name = "cache";
    }
    // 2) Regole JSON persistite (localhost, regole utente salvate)
    else if (auto matched = rules_.find_match(conn)) {
        action = matched->action;
        duration = matched->duration;
        rule_name = matched->name;
    }
    // 3) Chiedi all'utente solo fuori dal callback NFQUEUE.
    //    Il callback NFQUEUE deve restare veloce: se aspetta il popup per
    //    15-30s, la coda kernel si riempie e gli eventi successivi sembrano
    //    "persi". NFQUEUE quindi applica cache/regole/default e la scansione
    //    periodica farà l'eventuale AskRule senza bloccare la coda pacchetti.
    else if (config_.intercept_unknown && realtime && allow_blocking_ask) {
        if (is_asking_.load()) {
            log.debug("ask_rule gia' in volo, applico default_action=" +
                      config_.default_action + " per " + conn.process_path);
            action = config_.default_action;
        } else {
            is_asking_ = true;
            asked_ui = true;
            log.info("AskRule: " + conn.protocol + " " + conn.process_path + " -> " +
                     (!conn.dst_host.empty() ? conn.dst_host : conn.dst_ip) +
                     ":" + std::to_string(conn.dst_port));
            auto asked = ui_.ask_rule(conn);
            is_asking_ = false;
 
            if (asked) {
                action = asked->action.empty() ? config_.default_action : asked->action;
                duration = asked->duration.empty() ? config_.default_duration : asked->duration;
                rule_name = asked->name;
                asked->duration = duration;
                asked->action = action;
                log.info("AskRule risposta: action=" + action + ", duration=" + duration);
                verdict_store(conn, *asked);       // cache in-memory
                persist_learned_rule(conn, *asked); // + eventuale save su disco
            } else {
                log.warning("AskRule senza risposta, uso default_action=" +
                            config_.default_action);
                action = config_.default_action;
            }
        }
    } else {
        action = config_.default_action;
    }
 
    remember_connection(conn);
    stats_.record(conn, action, rule_name);
 
    // Non perdere più le connessioni "default": se la UI non ha già ricevuto
    // un AskRule per questa connessione, invia sempre l'evento realtime.
    // La UI aggiorna liste/mappa/statistiche senza dover aprire un popup.
    if (realtime && !asked_ui && desktop_allows_activity()) {
        log.info("PostAlert UI: action=" + action +
                 (rule_name.empty() ? std::string{} : ", rule=" + rule_name));
        ui_.post_connection_alert(conn, action, rule_name);
    }
 
    std::ostringstream oss;
    oss << conn.protocol << ' ' << conn.process_path << ' ' << conn.dst_ip << ':' << conn.dst_port << " -> " << action;
    if (!rule_name.empty()) oss << " [" << rule_name << ']';
    log.info(oss.str());
 
    bsc::netfilter::Decision d;
    d.verdict = action == "deny" ? bsc::netfilter::Verdict::Drop : bsc::netfilter::Verdict::Accept;
    return d;
}
 
void DaemonService::scan_connections() {
    if (!desktop_allows_activity()) {
        if (!inactive_notice_logged_.exchange(true)) {
            bsc::logging::Logger::instance().info(
                "scan sospesa: desktop inattivo o UI non connessa");
        }
        net_.discard_pending_events();
        return;
    }
    inactive_notice_logged_ = false;
 
    for (auto conn : net_.list_connections()) {
        if ((conn.dst_ip == "0.0.0.0" || conn.dst_ip == "::") && conn.dst_port == 0) continue;
        const auto key = conn.key();
        {
            std::lock_guard lock(seen_mutex_);
            if (seen_.contains(key)) continue;
            seen_.insert(key);
            if (seen_.size() > 50000) seen_.clear();
        }
        (void)decide_connection(std::move(conn), config_.intercept_unknown, true);
    }
}
 
void DaemonService::heartbeat() {
    ui_.ping(stats_);
}
 
} // namespace bsc::service