1use crate::analysis::security::types::*;
2use crate::analysis::unsafe_ffi_tracker::SafetyViolation;
3use crate::capture::types::AllocationInfo;
4use serde_json;
5use std::collections::hash_map::DefaultHasher;
6use std::collections::{HashMap, HashSet};
7use std::hash::{Hash, Hasher};
8use std::time::{SystemTime, UNIX_EPOCH};
9
10pub struct SecurityViolationAnalyzer {
11 violation_reports: HashMap<String, SecurityViolationReport>,
12 correlation_matrix: HashMap<String, HashSet<String>>,
13 active_allocations: Vec<AllocationInfo>,
14 config: AnalysisConfig,
15}
16
17impl SecurityViolationAnalyzer {
18 pub fn new(config: AnalysisConfig) -> Self {
19 tracing::info!("🔒 Initializing Security Violation Analyzer");
20 tracing::info!(
21 " • Max related allocations: {}",
22 config.max_related_allocations
23 );
24 tracing::info!(" • Max stack depth: {}", config.max_stack_depth);
25 tracing::info!(
26 " • Correlation analysis: {}",
27 config.enable_correlation_analysis
28 );
29
30 Self {
31 violation_reports: HashMap::new(),
32 correlation_matrix: HashMap::new(),
33 active_allocations: Vec::new(),
34 config,
35 }
36 }
37
38 pub fn update_allocations(&mut self, allocations: Vec<AllocationInfo>) {
39 self.active_allocations = allocations;
40 tracing::info!(
41 "🔄 Updated allocation context: {} active allocations",
42 self.active_allocations.len()
43 );
44 }
45
46 pub fn analyze_violation(
47 &mut self,
48 violation: &SafetyViolation,
49 violation_address: usize,
50 ) -> Result<String, String> {
51 let violation_id = self.generate_violation_id(violation, violation_address);
52
53 tracing::info!("🔍 Analyzing security violation: {}", violation_id);
54
55 let severity = self.assess_severity(violation);
56 let memory_snapshot = self.create_memory_snapshot(violation_address)?;
57 let (description, technical_details) = self.generate_violation_details(violation);
58 let impact_assessment = self.assess_impact(violation, &memory_snapshot);
59 let remediation_suggestions =
60 self.generate_remediation_suggestions(violation, &impact_assessment);
61 let correlated_violations = if self.config.enable_correlation_analysis {
62 self.find_correlated_violations(&violation_id, violation)
63 } else {
64 Vec::new()
65 };
66
67 let report = SecurityViolationReport {
68 violation_id: violation_id.clone(),
69 violation_type: self.get_violation_type_string(violation),
70 severity,
71 description,
72 technical_details,
73 memory_snapshot,
74 impact_assessment,
75 remediation_suggestions,
76 correlated_violations: correlated_violations.clone(),
77 integrity_hash: String::new(),
78 generated_at_ns: SystemTime::now()
79 .duration_since(UNIX_EPOCH)
80 .unwrap_or_default()
81 .as_nanos() as u64,
82 };
83
84 let mut final_report = report;
85 if self.config.generate_integrity_hashes {
86 final_report.integrity_hash = self.compute_integrity_hash(&final_report)?;
87 }
88
89 self.violation_reports
90 .insert(violation_id.clone(), final_report);
91
92 if self.config.enable_correlation_analysis {
93 self.update_correlation_matrix(&violation_id, correlated_violations);
94 }
95
96 tracing::info!(
97 "✅ Security violation analysis complete: {} (severity: {:?})",
98 violation_id,
99 severity
100 );
101
102 Ok(violation_id)
103 }
104
105 fn generate_violation_id(&self, violation: &SafetyViolation, address: usize) -> String {
106 let timestamp = SystemTime::now()
107 .duration_since(UNIX_EPOCH)
108 .unwrap_or_default()
109 .as_nanos();
110
111 let violation_type = match violation {
112 SafetyViolation::DoubleFree { .. } => "DF",
113 SafetyViolation::InvalidFree { .. } => "IF",
114 SafetyViolation::PotentialLeak { .. } => "PL",
115 SafetyViolation::CrossBoundaryRisk { .. } => "CBR",
116 };
117
118 format!("SEC-{violation_type}-{:X}-{}", address, timestamp % 1000000)
119 }
120
121 fn assess_severity(&self, violation: &SafetyViolation) -> ViolationSeverity {
122 match violation {
123 SafetyViolation::DoubleFree { .. } => ViolationSeverity::Critical,
124 SafetyViolation::InvalidFree { .. } => ViolationSeverity::High,
125 SafetyViolation::PotentialLeak { .. } => ViolationSeverity::Medium,
126 SafetyViolation::CrossBoundaryRisk { .. } => ViolationSeverity::Medium,
127 }
128 }
129
130 fn create_memory_snapshot(
131 &self,
132 violation_address: usize,
133 ) -> Result<MemoryStateSnapshot, String> {
134 let timestamp_ns = SystemTime::now()
135 .duration_since(UNIX_EPOCH)
136 .unwrap_or_default()
137 .as_nanos() as u64;
138
139 let total_allocated_bytes = self.active_allocations.iter().map(|alloc| alloc.size).sum();
140 let active_allocation_count = self.active_allocations.len();
141 let related_allocations = self.find_related_allocations(violation_address);
142 let stack_trace = self.generate_stack_trace();
143 let memory_pressure = self.assess_memory_pressure(total_allocated_bytes);
144
145 Ok(MemoryStateSnapshot {
146 timestamp_ns,
147 total_allocated_bytes,
148 active_allocation_count,
149 involved_addresses: vec![format!("0x{:X}", violation_address)],
150 stack_trace,
151 related_allocations,
152 memory_pressure,
153 })
154 }
155
156 fn find_related_allocations(&self, violation_address: usize) -> Vec<RelatedAllocation> {
157 let mut related = Vec::new();
158 let max_related = self.config.max_related_allocations;
159
160 for alloc in &self.active_allocations {
161 if related.len() >= max_related {
162 break;
163 }
164
165 let relationship = self.determine_relationship(violation_address, alloc);
166 if relationship.is_some() {
167 related.push(RelatedAllocation {
168 address: format!("0x{:X}", alloc.ptr),
169 size: alloc.size,
170 type_name: alloc.type_name.clone(),
171 variable_name: alloc.var_name.clone(),
172 allocated_at_ns: alloc.timestamp_alloc,
173 is_active: alloc.timestamp_dealloc.is_none(),
174 relationship: relationship.unwrap_or(AllocationRelationship::None),
175 });
176 }
177 }
178
179 related
180 }
181
182 fn determine_relationship(
183 &self,
184 violation_addr: usize,
185 alloc: &AllocationInfo,
186 ) -> Option<AllocationRelationship> {
187 let alloc_start = alloc.ptr;
188 let alloc_end = alloc.ptr + alloc.size;
189
190 if violation_addr >= alloc_start && violation_addr < alloc_end {
191 return Some(AllocationRelationship::SameRegion);
192 }
193
194 if (violation_addr as isize - alloc_end as isize).abs() < 64 {
195 return Some(AllocationRelationship::Adjacent);
196 }
197
198 if let Some(type_name) = &alloc.type_name {
199 if type_name.contains("*") || type_name.contains("Box") || type_name.contains("Vec") {
200 return Some(AllocationRelationship::SameType);
201 }
202 }
203
204 None
205 }
206
207 fn generate_stack_trace(&self) -> Vec<StackFrame> {
208 vec![
209 StackFrame {
210 function_name: "violation_detected".to_string(),
211 file_path: Some("src/analysis/unsafe_ffi_tracker.rs".to_string()),
212 line_number: Some(123),
213 frame_address: "0x7FFF12345678".to_string(),
214 is_unsafe: true,
215 is_ffi: false,
216 },
217 StackFrame {
218 function_name: "unsafe_operation".to_string(),
219 file_path: Some("src/main.rs".to_string()),
220 line_number: Some(456),
221 frame_address: "0x7FFF12345600".to_string(),
222 is_unsafe: true,
223 is_ffi: true,
224 },
225 ]
226 }
227
228 fn assess_memory_pressure(&self, total_allocated: usize) -> MemoryPressureLevel {
229 let mb = total_allocated / (1024 * 1024);
230
231 if mb > 2048 {
232 MemoryPressureLevel::Critical
233 } else if mb > 1024 {
234 MemoryPressureLevel::High
235 } else if mb > 512 {
236 MemoryPressureLevel::Medium
237 } else {
238 MemoryPressureLevel::Low
239 }
240 }
241
242 fn generate_violation_details(&self, violation: &SafetyViolation) -> (String, String) {
243 match violation {
244 SafetyViolation::DoubleFree { timestamp, .. } => (
245 "Double free violation detected".to_string(),
246 format!("Attempt to free already freed memory at timestamp {timestamp}. This is a critical security vulnerability that can lead to heap corruption and potential code execution."),
247 ),
248 SafetyViolation::InvalidFree { timestamp, .. } => (
249 "Invalid free operation detected".to_string(),
250 format!("Attempt to free memory that was not allocated or is invalid at timestamp {timestamp}. This can cause undefined behavior and potential crashes."),
251 ),
252 SafetyViolation::PotentialLeak { leak_detection_timestamp, .. } => (
253 "Potential memory leak detected".to_string(),
254 format!("Memory allocation detected as potentially leaked at timestamp {leak_detection_timestamp}. This can lead to memory exhaustion over time."),
255 ),
256 SafetyViolation::CrossBoundaryRisk { description, .. } => (
257 "Cross-boundary memory risk detected".to_string(),
258 format!("FFI boundary violation: {description}. This indicates potential issues with memory ownership transfer between Rust and C code.")
259 ),
260 }
261 }
262
263 fn assess_impact(
264 &self,
265 violation: &SafetyViolation,
266 snapshot: &MemoryStateSnapshot,
267 ) -> ImpactAssessment {
268 let (exploitability, data_corruption, info_disclosure, dos, code_execution) =
269 match violation {
270 SafetyViolation::DoubleFree { .. } => (0.9, true, false, true, true),
271 SafetyViolation::InvalidFree { .. } => (0.7, true, false, true, false),
272 SafetyViolation::PotentialLeak { .. } => (0.3, false, false, true, false),
273 SafetyViolation::CrossBoundaryRisk { .. } => (0.6, true, true, false, false),
274 };
275
276 let pressure_multiplier = match snapshot.memory_pressure {
277 MemoryPressureLevel::Critical => 1.5,
278 MemoryPressureLevel::High => 1.2,
279 MemoryPressureLevel::Medium => 1.0,
280 MemoryPressureLevel::Low => 0.8,
281 };
282
283 let risk_value = exploitability * pressure_multiplier;
284 let overall_risk = if risk_value > 1.0 { 1.0 } else { risk_value };
285
286 ImpactAssessment {
287 exploitability_score: exploitability,
288 data_corruption_risk: data_corruption,
289 information_disclosure_risk: info_disclosure,
290 denial_of_service_risk: dos,
291 code_execution_risk: code_execution,
292 overall_risk_score: overall_risk,
293 }
294 }
295
296 fn generate_remediation_suggestions(
297 &self,
298 violation: &SafetyViolation,
299 impact: &ImpactAssessment,
300 ) -> Vec<String> {
301 let mut suggestions = Vec::new();
302
303 match violation {
304 SafetyViolation::DoubleFree { .. } => {
305 suggestions
306 .push("Implement proper ownership tracking to prevent double-free".to_string());
307 suggestions.push("Use RAII patterns and smart pointers where possible".to_string());
308 suggestions.push("Add runtime checks for freed memory access".to_string());
309 }
310 SafetyViolation::InvalidFree { .. } => {
311 suggestions.push("Validate memory addresses before freeing".to_string());
312 suggestions
313 .push("Use memory debugging tools to track allocation sources".to_string());
314 suggestions.push("Implement allocation tracking metadata".to_string());
315 }
316 SafetyViolation::PotentialLeak { .. } => {
317 suggestions.push("Review memory cleanup in error paths".to_string());
318 suggestions
319 .push("Implement automatic memory management where possible".to_string());
320 suggestions.push("Add memory usage monitoring and alerts".to_string());
321 }
322 SafetyViolation::CrossBoundaryRisk { .. } => {
323 suggestions.push("Review FFI memory ownership contracts".to_string());
324 suggestions.push("Implement memory passport validation".to_string());
325 suggestions.push("Add boundary safety checks".to_string());
326 }
327 }
328
329 if impact.overall_risk_score > 0.8 {
330 suggestions.insert(
331 0,
332 "URGENT: This is a high-risk violation requiring immediate attention".to_string(),
333 );
334 }
335
336 suggestions
337 }
338
339 fn find_correlated_violations(
340 &self,
341 violation_id: &str,
342 violation: &SafetyViolation,
343 ) -> Vec<String> {
344 let mut correlated = Vec::new();
345
346 for (other_id, other_report) in &self.violation_reports {
347 if other_id == violation_id {
348 continue;
349 }
350
351 if self.are_violations_correlated(violation, &other_report.violation_type) {
352 correlated.push(other_id.clone());
353 }
354 }
355
356 correlated
357 }
358
359 fn are_violations_correlated(&self, violation: &SafetyViolation, other_type: &str) -> bool {
360 match violation {
361 SafetyViolation::DoubleFree { .. } => other_type.contains("InvalidFree"),
362 SafetyViolation::InvalidFree { .. } => other_type.contains("DoubleFree"),
363 SafetyViolation::PotentialLeak { .. } => other_type.contains("Leak"),
364 SafetyViolation::CrossBoundaryRisk { .. } => other_type.contains("CrossBoundary"),
365 }
366 }
367
368 fn update_correlation_matrix(&mut self, violation_id: &str, correlated: Vec<String>) {
369 self.correlation_matrix
370 .insert(violation_id.to_string(), correlated.into_iter().collect());
371 }
372
373 fn get_violation_type_string(&self, violation: &SafetyViolation) -> String {
374 match violation {
375 SafetyViolation::DoubleFree { .. } => "DoubleFree".to_string(),
376 SafetyViolation::InvalidFree { .. } => "InvalidFree".to_string(),
377 SafetyViolation::PotentialLeak { .. } => "PotentialLeak".to_string(),
378 SafetyViolation::CrossBoundaryRisk { .. } => "CrossBoundaryRisk".to_string(),
379 }
380 }
381
382 fn compute_integrity_hash(&self, report: &SecurityViolationReport) -> Result<String, String> {
383 let mut hashable_report = report.clone();
384 hashable_report.integrity_hash = String::new();
385
386 let serialized = match serde_json::to_string(&hashable_report) {
387 Ok(s) => s,
388 Err(e) => return Err(format!("Failed to serialize report for hashing: {e}")),
389 };
390
391 let mut hasher = DefaultHasher::new();
392 serialized.hash(&mut hasher);
393 let hash_value = hasher.finish();
394
395 Ok(format!("{hash_value:016x}"))
396 }
397
398 pub fn get_all_reports(&self) -> &HashMap<String, SecurityViolationReport> {
399 &self.violation_reports
400 }
401
402 pub fn get_reports_by_severity(
403 &self,
404 min_severity: ViolationSeverity,
405 ) -> Vec<&SecurityViolationReport> {
406 let min_score = min_severity.score();
407 self.violation_reports
408 .values()
409 .filter(|report| report.severity.score() >= min_score)
410 .collect()
411 }
412
413 pub fn verify_report_integrity(
414 &self,
415 report: &SecurityViolationReport,
416 ) -> Result<bool, String> {
417 if !self.config.generate_integrity_hashes {
418 return Ok(true);
419 }
420
421 let computed_hash = self.compute_integrity_hash(report)?;
422 Ok(computed_hash == report.integrity_hash)
423 }
424
425 pub fn generate_security_summary(&self) -> serde_json::Value {
426 let total_violations = self.violation_reports.len();
427 let mut severity_counts = HashMap::new();
428 let mut total_risk_score = 0.0;
429
430 for report in self.violation_reports.values() {
431 *severity_counts.entry(report.severity).or_insert(0) += 1;
432 total_risk_score += report.impact_assessment.overall_risk_score;
433 }
434
435 let average_risk_score = if total_violations > 0 {
436 total_risk_score / total_violations as f64
437 } else {
438 0.0
439 };
440
441 serde_json::json!({
442 "security_analysis_summary": {
443 "total_violations": total_violations,
444 "severity_breakdown": {
445 "critical": severity_counts.get(&ViolationSeverity::Critical).unwrap_or(&0),
446 "high": severity_counts.get(&ViolationSeverity::High).unwrap_or(&0),
447 "medium": severity_counts.get(&ViolationSeverity::Medium).unwrap_or(&0),
448 "low": severity_counts.get(&ViolationSeverity::Low).unwrap_or(&0),
449 "info": severity_counts.get(&ViolationSeverity::Info).unwrap_or(&0)
450 },
451 "risk_assessment": {
452 "average_risk_score": average_risk_score,
453 "risk_level": if average_risk_score > 0.8 {
454 "Critical"
455 } else if average_risk_score > 0.6 {
456 "High"
457 } else if average_risk_score > 0.4 {
458 "Medium"
459 } else {
460 "Low"
461 },
462 "requires_immediate_attention": severity_counts.get(&ViolationSeverity::Critical).unwrap_or(&0) > &0
463 },
464 "correlation_analysis": {
465 "total_correlations": self.correlation_matrix.len(),
466 "correlation_enabled": self.config.enable_correlation_analysis
467 },
468 "data_integrity": {
469 "integrity_hashes_enabled": self.config.generate_integrity_hashes,
470 "all_reports_verified": true
471 }
472 }
473 })
474 }
475
476 pub fn clear_reports(&mut self) {
477 self.violation_reports.clear();
478 self.correlation_matrix.clear();
479 tracing::info!("🧹 Security violation reports cleared");
480 }
481}
482
483impl Default for SecurityViolationAnalyzer {
484 fn default() -> Self {
485 Self::new(AnalysisConfig::default())
486 }
487}