EBPFMon.cpp

1. Overview

Userspace eBPF loader and consumer. Loads the BPF object, attaches available programs, opens the ring buffer, converts events into Connection objects and provides a no-op fallback when libbpf support is unavailable.

The original source path is:

src/ebpf/EBPFMon.cpp

---

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

---

3. Namespaces

• bsc::ebpf

---

4. Dependencies and Included Interfaces

• bsc/ebpf/EBPFMon.hpp
• bsc/logging/Logger.hpp
• arpa/inet.h
• chrono
• cstring

---

5. Declared Types

• enum libbpf_print_level
• struct bpf_object_open_opts
• struct bpf_object
• struct bpf_program
• struct bpf_link
• struct bpf_map
• struct ring_buffer

---

6. API and Functions

The file declares or implements the following callable entry points:

• event_to_connection(const ConnEvent& ev)
• EBPFMon::~EBPFMon()
• ringbuf_callback(void* ctx, void* data, size_t size)
• EBPFMon::start(const std::string& obj_path)
• bpf_object__for_each_program(prog, obj)
• EBPFMon::stop()
• EBPFMon::drain_loop()
• EBPFMon::drain()
• EBPFMon::start(const std::string&)
• int ringbuf_callback(void* ctx, void* data, size_t size)

---

7. Constants and Compile-Time Controls

• char* name = bpf_program__name(prog)
• char* sect = bpf_program__section_name(prog)

---

8. Attachment and Event Buffering

The loader opens the compiled object, loads programs, attaches each available probe, creates a ring-buffer consumer and starts a polling thread. Converted events are accumulated under a mutex and transferred to callers through drain().

---

9. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

• bsc/ebpf/EBPFMon.hpp
• bsc/logging/Logger.hpp
• (tracepoint + kprobes TCP/UDP)

---

10. Concurrency and Lifecycle

• Uses one or more worker threads.

---

11. Security Considerations

• The component processes privileged operating-system or network data and should run with only the capabilities required by its backend.

---

12. Implementation Considerations

• The file contains a full libbpf implementation under BSC_HAS_EBPF and a zero-overhead stub when the feature is not compiled.
• Individual probe attachment failures are tolerated so partial kernel coverage can remain active.
• The userspace event buffer is bounded to avoid memory exhaustion under high connection rates.
• Shared state is protected by mutexes; callers should avoid holding external locks while invoking callbacks.
• The file creates or manages worker threads and requires deterministic stop/join behavior during daemon shutdown.
• Linux /proc data can disappear between reads because processes and sockets are inherently short-lived.
• Compile-time feature flags select a functional backend or a graceful fallback implementation.

---

13. Licensing and Attribution

• Copyright (C) 2025–2026 Calogero Scarnà
• GPL-3.0

---

14. Source Metrics

Metric	Value
File size	10480 bytes
Lines	292
Detected API entries	10
Detected types	7