Backend.hpp

1. Overview

The Backend.hpp header defines the Backend class, the central orchestration layer of BastionGuard. It acts as a unified control plane coordinating:

  • Anti-Ransomware engine
  • Anti-Phishing engine
  • ClamAV integration (daemon + on-access)
  • Samba scanning subsystem
  • Firewall integration (UFW / firewalld)
  • Google Safe Browsing API
  • Whitelist and bank-domain management
  • DNS-based phishing blocking (dnsmasq)

The class follows a singleton pattern and provides both static and instance-level operations for security-critical services.

2. Dependencies and Includes

#include <string>
#include <vector>
#include <memory>
#include <filesystem>
#include <functional>
#include <map>
#include <atomic>
#include <libsmbclient.h>
#include <sigc++/signal.h>

Internal modules:

  • FirewallEnums.hpp – firewall type abstraction
  • AntiRansomEngine.hpp – ransomware detection engine
  • WebProbe.hpp – phishing URL filtering engine
  • Utils.hpp – shared helpers

3. Class Declaration and Pattern

class Backend

Implements a thread-safe singleton:

static Backend& instance();

Copy constructor and assignment are deleted to prevent duplication.

4. Versioning and Build Metadata

static std::string getAppVersion();
static int getAppBuild();

Returns compile-time version and build metadata (via macros).

5. ClamAV Integration

5.1 Real-Time Protection

static bool enableClamonacc();
static bool disableClamonacc();
static bool isClamonaccActive();
static std::string getClamonaccStatus();

5.2 Database Information

static std::string getLastUpdateDate();
static std::string getDbVersion();

5.3 On-Access Monitoring

static std::vector<std::string> getOnAccessPaths();
static std::vector<std::string> getOnAccessEvents();

6. Anti-Ransomware Engine

void start_antiransom();
void stop_antiransom();
bool updateYaraRules(...);
bool updateSanesecurityDB(...);
static bool isAntiransomActive();

Integrates YARA rules, Sanesecurity databases, and emits signals:

sigc::signal<void(const std::string&)>& signal_antiransom_event();

7. Anti-Phishing Engine

void start_antiphish();
void stop_antiphish();
bool isAntiphishActive();
bool updatePhishLists();
std::string checkUrl(const std::string& url);

Uses WebProbe for URL inspection and emits:

sigc::signal<void(const std::string&)>& signal_antiphish_event();

8. Google Safe Browsing

bool isGoogleSafeEnabled() const;
void setGoogleSafeEnabled(bool);
void setGoogleSafeApiKey(const std::string&);
std::string getGoogleSafeApiKey() const;
void saveGoogleSafeConfig();
bool testGoogleSafeKey();

Provides configuration persistence and remote validation.

9. Whitelist and Bank Domains

std::vector<std::string> getWhitelist() const;
void addToWhitelist(const std::string& domain);
void removeFromWhitelist(const std::string& domain);
bool isBankDomain(const std::string& host) const;
bool updateBankListFromURL(const std::string& source_url);

Maintains in-memory whitelist and supports JSON persistence.

10. Samba Subsystem

Full SMB client integration via libsmbclient.

10.1 Credential Management

void saveSMBCredentials(...);
std::pair<std::string,std::string> getCreds(...);

10.2 SMB Context

SMBCCTX* createThreadSmbContext();
static void smb_auth_fn(...);

10.3 Recursive Collection

void smb_collect_files(...);
void smb_collect_files_impl(...);

10.4 Scanning and State

void scanSambaDir(const std::string& dir);
void scanAllSambaDirs();
std::atomic<bool> samba_stop_requested;

Exposes detailed scan state through:

struct ScanStatus
struct SambaScanState

11. Quarantine Management

static void setQuarantinePath(const std::string&);
static std::string getQuarantinePath();
void moveToQuarantine(const std::string&);
void ensureQuarantinePath();

12. DNS and Phishing Blocking

bool reload_dnsmasq();
bool isPhishAutoUpdateEnabled();
bool enablePhishAutoUpdate(bool);

13. Firewall Integration

void applyFirewallFromBlacklist(...);
void applyFirewallFromPhishingBlacklist();
void scheduleFirewallApply();
void setFirewallType(FirewallType fw);
void setFirewallEnabled(bool enabled);

Supports dynamic rule application for:

  • UFW
  • firewalld

14. Internal State

AntiRansomEngine antiransom_;
std::unique_ptr<WebProbe> webprobe_;
std::vector<std::string> whitelist_;
bool googleSafeEnabled_;
FirewallType firewallType_;

Maintains runtime state for ransomware, phishing, firewall, and SMB contexts.

15. Runtime and Security Considerations

  • Privilege Separation: System operations require pkexec.
  • Thread Safety: Atomic flags used for scan cancellation.
  • Signal-based UI Updates: sigc++ signals decouple backend from UI.
  • Firewall Deferred Execution: Rule application scheduled asynchronously.
  • Credential Handling: SMB credentials stored in controlled scope.
  • Singleton Integrity: Single backend instance guarantees state coherence.
Published on:
Last updated on: