SocketSnapshot.hpp

1. Overview

Socket inventory interface. Declares the cached connection snapshot, eBPF integration and targeted connection-enrichment API.

The original source path is:

include/bsc/net/SocketSnapshot.hpp

---

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

---

3. Namespaces

• bsc::net

---

4. Dependencies and Included Interfaces

• bsc/model/Connection.hpp
• bsc/ebpf/EBPFMon.hpp
• chrono
• mutex
• optional
• string
• unordered_map
• vector

---

5. Declared Types

• class SocketSnapshot
• struct SnapshotCache

---

6. State and Data Members

The interface declares the following relevant state members:

• std::vector<bsc::model::Connection> connections
• mutable std::mutex cache_mutex_
• mutable SnapshotCache cache_
• mutable bsc::ebpf::EBPFMon ebpf_mon_

---

7. API and Functions

The file declares or implements the following callable entry points:

• bool enrich_connection(bsc::model::Connection& conn) const
• void invalidate_cache()
• void discard_pending_events() const
• bool start_ebpf(const std::string& obj_path = "/usr/lib/bastionguard-sc/bsc_ebpf.o")
• void stop_ebpf()

---

8. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

• bsc/model/Connection.hpp
• bsc/ebpf/EBPFMon.hpp
• ebpf
• /usr/lib/bastionguard-sc/bsc_ebpf.o

---

9. Concurrency and Lifecycle

• Protects mutable shared data with std::mutex.

---

10. Security Considerations

• The component processes privileged operating-system or network data and should run with only the capabilities required by its backend.

---

11. Implementation Considerations

• Shared state is protected by mutexes; callers should avoid holding external locks while invoking callbacks.
• Linux /proc data can disappear between reads because processes and sockets are inherently short-lived.

---

12. Source Metrics

Metric	Value
File size	1880 bytes
Lines	53
Detected API entries	5
Detected types	2