Rule.cpp

1. Overview

Rule parser and matcher. Normalizes operands, evaluates simple/regex/network/range/list operators, expands aliases, loads rules from JSON, saves learned rules and finds the first matching policy.

The original source path is:

src/rule/Rule.cpp

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

3. Namespaces

  • bsc::rule
  • fs

4. Dependencies and Included Interfaces

  • bsc/rule/Rule.hpp
  • algorithm
  • functional
  • array
  • arpa/inet.h
  • charconv
  • chrono
  • cctype
  • filesystem
  • fstream
  • nlohmann/json.hpp
  • ranges
  • sstream
  • unordered_set
  • cstring
  • openssl/evp.h
  • pwd.h

5. API and Functions

The file declares or implements the following callable entry points:

  • trim(std::string s)
  • digest_file(const std::string& path, const EVP_MD*(*algo)())
  • to_lower(std::string s)
  • std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c)
  • normalize_operand(std::string op)
  • field_values(const bsc::model::Connection& c, const std::string& operand)
  • parse_ipv4(const std::string& ip, std::uint32_t& out)
  • parse_ipv6(const std::string& ip, in6_addr& out)
  • ip_in_cidr(const std::string& ip, const std::string& cidr)
  • parse_range(const std::string& data)
  • load_simple_list_file(const fs::path& path, bool sensitive)
  • parse_operator(const json& j)
  • to_json_op(const Operator& op)
  • Operator::matches(const bsc::model::Connection& conn)
  • Rule::matches(const bsc::model::Connection& conn)
  • Loader::load_aliases(const std::string& path)
  • Loader::load_directory(const std::string& dir)
  • std::sort(rules_.begin(), rules_.end(), [](const Rule& a, const Rule& b)
  • Loader::save_rule(const Rule& rule, const std::string& dir)
  • Loader::find_match(const bsc::model::Connection& conn)

6. Constants and Compile-Time Controls

  • char* hex = "0123456789abcdef"
  • auto op = normalize_operand(operand)
  • auto key = op.substr(12)
  • auto slash = cidr.find('/')
  • auto net = cidr.substr(0, slash)
  • auto bits = std::stoi(cidr.substr(slash + 1))
  • std::uint32_t mask = bits == 0 ? 0u : 0xFFFFFFFFu << (32 - bits)
  • int full_bytes = bits / 8
  • int extra_bits = bits % 8
  • std::uint8_t mask = static_cast<std::uint8_t>(0xFF << (8 - extra_bits))
  • auto pos = data.find('-')
  • auto a = data.substr(0, pos)
  • auto b = data.substr(pos + 1)
  • auto type = j.value("type", "unknown")
  • auto values = field_values(conn, op)
  • auto range = parse_range(data)
  • auto is_domain_regex = op == "lists.domains_regexp"
  • auto is_nets = op == "lists.nets"
  • auto path = fs::path(dir) / (safe_name + ".json")

7. Operational Flow

  1. Load named network aliases and rule JSON files from the configured directories.
  2. Normalize operands and recursively parse simple, regexp, network, range and list operators.
  3. Evaluate enabled high-precedence rules before ordinary rules and return the first match.
  4. Serialize permanent UI decisions as learned rule files when requested.

8. Supported Operators

  • simple: exact string or normalized field comparison.
  • regexp: regular-expression matching.
  • network: IPv4/IPv6 address or CIDR membership, including aliases.
  • range: numeric inclusive ranges, useful for ports and identifiers.
  • list/lists: nested predicates and external list-file matching.

9. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

  • bsc/rule/Rule.hpp
  • allow

10. Security Considerations

  • Configuration and protocol JSON must be considered untrusted until successfully parsed and type-checked.
  • Process environment data may contain credentials and should not be exposed unnecessarily.

11. Implementation Considerations

  • JSON input is an administrative trust boundary; type errors and malformed documents must remain contained.

12. Source Metrics

MetricValue
File size16528 bytes
Lines363
Detected API entries20
Detected types0

Published on:
Last updated on: