FirewallDetector

1. Overview

The FirewallDetector module provides a minimal, synchronous environment detection utility used by BastionGuard to identify:

  • The presence of supported firewall backends (firewalld, UFW)
  • The underlying Linux distribution (best-effort)
  • The most appropriate firewall type to propose or auto-select

This module is intentionally lightweight and side-effect free. It performs detection only and does not modify system state.

2. Responsibilities

The module is responsible for:

  • Detecting whether firewalld tooling is available
  • Detecting whether ufw tooling is available
  • Determining the current Linux distribution identifier
  • Returning a normalized FirewallType enum value

All detection logic is executed synchronously and is expected to run during UI initialization without noticeable latency.

3. Firewall Backend Detection

3.1 firewalld Detection

Presence of firewalld is determined by checking whether the firewall-cmd binary is available in the current PATH:

std::system("which firewall-cmd > /dev/null 2>&1")

If the command returns exit code 0, firewalld is considered present.

This approach detects tooling availability rather than service state; the service may still be inactive.

3.2 UFW Detection

Presence of UFW is determined by checking whether the ufw binary is available in the current PATH:

std::system("which ufw > /dev/null 2>&1")

As with firewalld detection, this checks binary availability only.

3.3 Detection Priority

Firewall detection follows a fixed priority order:

  1. firewalld
  2. UFW
  3. None

If both firewalld and UFW are present, firewalld is selected.

4. Distribution Detection

4.1 os-release Parsing

The distribution identifier is detected by reading:

/etc/os-release

The module scans the file line-by-line and extracts the value of the first line starting with:

ID=

The returned value is the raw identifier string following the prefix.

4.2 Fallback Behavior

If:

  • The file cannot be opened
  • No ID= line is found

The function returns:

"unknown"

No further normalization or mapping is applied at this stage.

5. Public API

5.1 isFirewalldPresent()

Signature:

bool FirewallDetector::isFirewalldPresent()

Returns true if the firewall-cmd binary is found in PATH, otherwise false.

5.2 isUfwPresent()

Signature:

bool FirewallDetector::isUfwPresent()

Returns true if the ufw binary is found in PATH, otherwise false.

5.3 detectDistro()

Signature:

std::string FirewallDetector::detectDistro()

Returns the Linux distribution identifier read from /etc/os-release, or "unknown" on failure.

5.4 detectFirewall()

Signature:

FirewallType FirewallDetector::detectFirewall()

Returns one of:

  • FirewallType::FIREWALLD
  • FirewallType::UFW
  • FirewallType::NONE

The function internally calls isFirewalldPresent() and isUfwPresent() and applies the defined priority order.

6. Design and Security Considerations

  • Non-invasive detection: detection relies on binary presence only and does not start, stop, or query services
  • No privilege escalation: all checks are executed without elevated privileges
  • Predictable behavior: fixed priority avoids ambiguity when multiple firewalls are installed
  • Fast execution: simple which calls and file parsing make this suitable for UI startup paths
  • Best-effort distro detection: returned distro ID is used for guidance only (e.g., install command hints)
  • Extensibility: additional firewall backends can be added by extending detection helpers and the FirewallType enum
Published on:
Last updated on: