NFQueue.cpp

1. Overview

NFQUEUE packet interceptor. Opens a libnetfilter_queue queue, parses IPv4/IPv6 TCP/UDP packet headers, invokes the policy callback and returns kernel accept or drop verdicts. A stub is compiled when the dependency is absent.

The original source path is:

src/netfilter/NFQueue.cpp

---

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

---

3. Namespaces

• bsc::netfilter

---

4. Dependencies and Included Interfaces

• bsc/netfilter/NFQueue.hpp
• bsc/logging/Logger.hpp
• arpa/inet.h
• cerrno
• cstring
• linux/netfilter.h
• linux/netfilter/nfnetlink_queue.h
• linux/types.h
• libnetfilter_queue/libnetfilter_queue.h
• memory
• netinet/ip.h
• netinet/ip6.h
• netinet/tcp.h
• netinet/udp.h
• sys/socket.h
• thread
• unistd.h

---

5. Declared Types

• struct ParsedPacket
• class QueueOwner
• class NFQueue

---

6. API and Functions

The file declares or implements the following callable entry points:

• to_ipv4(std::uint32_t ip)
• to_ipv6(const in6_addr& addr)
• parse_payload(unsigned char* data, int len)
• ~QueueOwner()
• start()
• stop()
• nfq_callback(nfq_q_handle* qh, nfgenmsg*, nfq_data* nfa, void* data)
• NFQueue::NFQueue() : impl_(std::make_unique<Impl>())
• NFQueue::~NFQueue()
• NFQueue::open(std::uint16_t queue_id, Handler handler)
• NFQueue::close()
• available()
• NFQueue::open(std::uint16_t, Handler)

---

7. Constants and Compile-Time Controls

• int kAF_INET = 2
• int kAF_INET6 = 10
• auto version = static_cast<std::uint8_t>(data[0] >> 4)
• auto* ip = reinterpret_cast<const iphdr*>(data)
• auto ihl = static_cast<int>(ip->ihl) * 4
• auto* tcp = reinterpret_cast<const tcphdr*>(data + ihl)
• auto* udp = reinterpret_cast<const udphdr*>(data + ihl)
• auto* ip6 = reinterpret_cast<const ip6_hdr*>(data)
• auto nexthdr = ip6->ip6_nxt
• auto offset = static_cast<int>(sizeof(ip6_hdr))
• auto* tcp = reinterpret_cast<const tcphdr*>(data + offset)
• auto* udp = reinterpret_cast<const udphdr*>(data + offset)
• int rv = recv(fd, buf, sizeof(buf), 0)
• int payload_len = nfq_get_payload(nfa, &payload)

---

8. Verdict Semantics

The handler returns a Decision containing an allow/drop verdict and optional mark. The implementation translates this decision into the corresponding libnetfilter_queue kernel verdict for the packet ID.

---

9. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

• bsc/netfilter/NFQueue.hpp
• bsc/logging/Logger.hpp

---

10. Concurrency and Lifecycle

• Uses one or more worker threads.
• Uses atomic flags for lifecycle or activity state.

---

11. Security Considerations

• The component processes privileged operating-system or network data and should run with only the capabilities required by its backend.

---

12. Implementation Considerations

• The file compiles a functional implementation only when BSC_HAS_NFQ is defined; otherwise open() returns false and the daemon uses polling.
• Packet parsing intentionally focuses on IPv4/IPv6 TCP and UDP endpoints needed by the policy engine.
• The callback must return quickly because queued packets are waiting for a kernel verdict.
• The file creates or manages worker threads and requires deterministic stop/join behavior during daemon shutdown.
• Atomic flags are used for low-cost lifecycle or activity state coordination.
• Compile-time feature flags select a functional backend or a graceful fallback implementation.

---

13. Source Metrics

Metric	Value
File size	8080 bytes
Lines	254
Detected API entries	13
Detected types	3