proxy_config.hpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#pragma once
 
#include <string>
#include <vector>
#include <cstdlib>
#include <iostream>
#include <fstream>
#include <sstream>
#include <filesystem>
#include <algorithm>
#include <cctype>
 
#include <glib/gi18n.h>
#include "../SafeProcess.hpp"
namespace BrowserProxy {
 
namespace fs = std::filesystem;
 
struct Settings {
    std::string host;
    int         port;
};
 
// =============================================================================
//  Bypass list LAN — in vari formati richiesti da browser e desktop env.
//
//  Copre tutto quanto rilevato anche da DomainFilter::is_local_network():
//    - localhost / *.local / *.lan / *.intranet / *.home.arpa / ...
//    - 127.0.0.0/8, 10.0.0.0/8, 172.16/12, 192.168/16, 169.254/16, 100.64/10
//    - ::1, fe80::/10, fc00::/7
//
//  Note sui formati:
//    - Firefox `network.proxy.no_proxies_on`: stringa CSV, supporta CIDR e
//      pattern *.suffix.
//    - Chromium `ProxyBypassList`: CSV, supporta CIDR + il magic <-loopback>.
//    - GNOME `org.gnome.system.proxy.ignore-hosts`: array GVariant di stringhe,
//      supporta CIDR e domini.
//    - KDE `NoProxyFor`: CSV.
//    - Variabili d'ambiente `no_proxy` / `NO_PROXY`: CSV "tradizionale", non
//      supporta CIDR ma supporta hostname e suffissi `.example.com`.
// =============================================================================
 
// CSV completo con CIDR (per Firefox / Chromium / GNOME / KDE)
static constexpr const char* LAN_BYPASS_CIDR =
    "localhost,"
    "127.0.0.0/8,"
    "10.0.0.0/8,"
    "172.16.0.0/12,"
    "192.168.0.0/16,"
    "169.254.0.0/16,"
    "100.64.0.0/10,"
    "::1,"
    "fe80::/10,"
    "fc00::/7,"
    "*.local,*.lan,*.intranet,*.internal,*.home.arpa,*.corp,*.private";
 
// Versione "no-CIDR" per env vars (no_proxy classico). Niente CIDR (non
// supportato da curl/wget/glibc), ma copriamo i prefissi più comuni.
static constexpr const char* LAN_BYPASS_NOCIDR =
    "localhost,"
    "127.0.0.1,"
    "::1,"
    "10.,"
    "192.168.,"
    "172.16.,172.17.,172.18.,172.19.,"
    "172.20.,172.21.,172.22.,172.23.,"
    "172.24.,172.25.,172.26.,172.27.,"
    "172.28.,172.29.,172.30.,172.31.,"
    "169.254.,"
    ".local,.lan,.intranet,.internal,.home.arpa,.corp,.private";
 
// Array GVariant per GNOME gsettings: "['x','y',...]" — usa virgolette singole.
static constexpr const char* LAN_BYPASS_GVARIANT =
    "['localhost',"
    "'127.0.0.0/8',"
    "'10.0.0.0/8',"
    "'172.16.0.0/12',"
    "'192.168.0.0/16',"
    "'169.254.0.0/16',"
    "'100.64.0.0/10',"
    "'::1','fe80::/10','fc00::/7',"
    "'*.local','*.lan','*.intranet','*.internal','*.home.arpa']";
 
static std::string home_dir() {
    const char* h = std::getenv("HOME");
    return h ? h : "";
}
 
static void write_file(const fs::path& p, const std::string& content) {
    std::ofstream f(p);
    if (f) f << content;
}
 
static void remove_lines_containing(const fs::path& p, const std::string& needle) {
    if (!fs::exists(p)) return;
    std::ifstream in(p);
    std::ostringstream out;
    std::string line;
    while (std::getline(in, line))
        if (line.find(needle) == std::string::npos)
            out << line << "\n";
    in.close();
    write_file(p, out.str());
}
 
static constexpr const char* FF_MARKER = "// BastionGuard-proxy";
 
static fs::path firefox_active_profile(const fs::path& profiles_dir) {
 
    const fs::path ini = profiles_dir / "profiles.ini";
    if (!fs::exists(ini)) return {};
 
    struct Profile {
        std::string path;
        bool        is_relative = true;
        bool        is_default  = false;
    };
 
    std::vector<Profile> profiles;
    std::string          install_default;
    bool                 in_install = false;
    bool                 in_profile = false;
 
    std::ifstream f(ini);
    std::string line;
 
    while (std::getline(f, line)) {
        line.erase(0, line.find_first_not_of(" \t\r\n"));
        if (!line.empty()) line.erase(line.find_last_not_of(" \t\r\n") + 1);
        if (line.empty() || line[0] == ';') continue;
 
        if (line[0] == '[') {
            in_install = (line.rfind("[Install", 0) == 0);
            in_profile = (line.rfind("[Profile", 0) == 0);
            if (in_profile) profiles.push_back({});
        } else if (in_install) {
            if (line.rfind("Default=", 0) == 0)
                install_default = line.substr(8);
        } else if (in_profile && !profiles.empty()) {
            auto& p = profiles.back();
            if (line.rfind("Default=1", 0) == 0)         p.is_default  = true;
            else if (line.rfind("Path=", 0) == 0)        p.path        = line.substr(5);
            else if (line.rfind("IsRelative=0", 0) == 0) p.is_relative = false;
        }
    }
    if (!install_default.empty()) {
        for (const auto& p : profiles) {
            if (p.path == install_default) {
                fs::path full = p.is_relative
                    ? profiles_dir / p.path
                    : fs::path(p.path);
                if (fs::exists(full)) return full;
            }
        }
 
        fs::path full = profiles_dir / install_default;
        if (fs::exists(full)) return full;
    }
    for (const auto& p : profiles) {
        if (!p.path.empty() && p.path.find("default-release") != std::string::npos) {
            fs::path full = p.is_relative ? profiles_dir / p.path : fs::path(p.path);
            if (fs::exists(full)) return full;
        }
    }
 
    for (const auto& p : profiles) {
        if (p.is_default && !p.path.empty()) {
            fs::path full = p.is_relative ? profiles_dir / p.path : fs::path(p.path);
            if (fs::exists(full)) return full;
        }
    }
 
    std::error_code ec;
    for (auto& e : fs::directory_iterator(profiles_dir, ec))
        if (e.is_directory() && e.path().filename().string().find('.') != std::string::npos)
            return e.path();
 
    return {};
}
 
static void firefox_set_profile(const fs::path& profile, const Settings& s) {
    if (profile.empty() || !fs::exists(profile)) return;
 
    const fs::path user_js = profile / "user.js";
    remove_lines_containing(user_js, FF_MARKER);
 
    std::ofstream f(user_js, std::ios::app);
    if (!f) return;
 
    f << "\n" << FF_MARKER << "\n"
      << "user_pref(\"network.proxy.type\", 1); " << FF_MARKER << "\n"
      << "user_pref(\"network.proxy.http\", \"" << s.host << "\"); " << FF_MARKER << "\n"
      << "user_pref(\"network.proxy.http_port\", " << s.port << "); " << FF_MARKER << "\n"
      << "user_pref(\"network.proxy.ssl\", \"" << s.host << "\"); " << FF_MARKER << "\n"
      << "user_pref(\"network.proxy.ssl_port\", " << s.port << "); " << FF_MARKER << "\n"
      << "user_pref(\"network.proxy.no_proxies_on\", \"" << LAN_BYPASS_CIDR << "\"); " << FF_MARKER << "\n"
      // Importante: Firefox di default proxy-a anche le risoluzioni DNS, e
      // questo rompe Avahi/mDNS. Forziamo le LAN a NON essere proxate.
      << "user_pref(\"network.proxy.allow_hijacking_localhost\", false); " << FF_MARKER << "\n";
 
    char buf[256];
    std::snprintf(buf, sizeof(buf),
        _("[browser-proxy] Firefox profile configured: %s\n"), profile.c_str());
    std::cerr << buf;
}
 
static void firefox_clear_profile(const fs::path& profile) {
    if (profile.empty()) return;
    remove_lines_containing(profile / "user.js", FF_MARKER);
}
 
static void configure_firefox_family(const Settings& s, bool clear) {
    const std::string home = home_dir();
    if (home.empty()) return;
 
    const std::vector<fs::path> roots = {
        fs::path(home) / ".mozilla/firefox",
        fs::path(home) / ".librewolf",
        fs::path(home) / ".waterfox",
        fs::path(home) / "snap/firefox/common/.mozilla/firefox",
        fs::path(home) / ".var/app/org.mozilla.firefox/.mozilla/firefox",
        fs::path(home) / ".var/app/io.gitlab.librewolf-community/.librewolf",
    };
 
    for (const auto& root : roots) {
        if (!fs::exists(root)) continue;
        const fs::path profile = firefox_active_profile(root);
        if (profile.empty()) continue;
        if (clear) firefox_clear_profile(profile);
        else       firefox_set_profile(profile, s);
    }
}
 
static std::string make_chromium_policy(const Settings& s) {
    return "{\n"
           "  \"ProxyMode\": \"fixed_servers\",\n"
           "  \"ProxyServer\": \"http://" + s.host + ":" + std::to_string(s.port) + "\",\n"
           "  \"ProxyBypassList\": \"<-loopback>," + std::string(LAN_BYPASS_CIDR) + "\"\n"
           "}\n";
}
 
static void chromium_set_policy(const fs::path& dir, const Settings& s) {
    std::error_code ec;
    fs::create_directories(dir, ec);
    if (ec) return;
 
    write_file(dir / "bastionguard_proxy.json", make_chromium_policy(s));
 
    char buf[256];
    std::snprintf(buf, sizeof(buf),
        _("[browser-proxy] Chromium policy written: %s\n"), dir.c_str());
    std::cerr << buf;
}
 
static void chromium_clear_policy(const fs::path& dir) {
    std::error_code ec;
    fs::remove(dir / "bastionguard_proxy.json", ec);
}
 
static void configure_chromium_family(const Settings& s, bool clear) {
    const std::string home = home_dir();
    if (home.empty()) return;
 
    const std::vector<fs::path> dirs = {
        fs::path(home) / ".config/chromium/policies/managed",
        fs::path(home) / ".config/google-chrome/policies/managed",
        fs::path(home) / ".config/BraveSoftware/Brave-Browser/policies/managed",
        fs::path(home) / ".config/microsoft-edge/policies/managed",
        fs::path(home) / ".config/vivaldi/policies/managed",
        fs::path(home) / ".config/opera/policies/managed",
        fs::path(home) / ".var/app/org.chromium.Chromium/config/chromium/policies/managed",
        fs::path(home) / ".var/app/com.google.Chrome/config/google-chrome/policies/managed",
        fs::path(home) / ".var/app/com.brave.Browser/config/BraveSoftware/Brave-Browser/policies/managed",
        fs::path(home) / "snap/chromium/current/.config/chromium/policies/managed",
    };
 
    for (const auto& dir : dirs) {
        if (clear) {
            chromium_clear_policy(dir);
        } else {
            if (fs::exists(dir.parent_path().parent_path()))
                chromium_set_policy(dir, s);
        }
    }
}
 
static constexpr const char* BG_CA_CERT = "/etc/BastionGuard/certs/BastionGuard-ca.crt.pem";
static constexpr const char* BG_CA_NICK = "BastionGuard-CA";
 
 
static bool nss_contains_ca(const std::string& database) {
    const auto list = bg_process::run({"certutil", "-L", "-d", database});
    return list.ok() && list.output.find(BG_CA_NICK) != std::string::npos;
}
 
static void install_ca_firefox_profile(const fs::path& profile) {
    if (profile.empty() || !fs::exists(profile) || !fs::exists(BG_CA_CERT)) return;
    if (nss_contains_ca(profile.string())) return;
    (void)bg_process::run({"certutil", "-A", "-d", profile.string(),
                           "-n", BG_CA_NICK, "-t", "CT,C,C", "-i", BG_CA_CERT});
}
 
static void install_ca_firefox_family() {
    const std::string home = home_dir();
    if (home.empty()) return;
 
    const std::vector<fs::path> roots = {
        fs::path(home) / ".mozilla/firefox",
        fs::path(home) / ".librewolf",
        fs::path(home) / ".waterfox",
        fs::path(home) / "snap/firefox/common/.mozilla/firefox",
        fs::path(home) / ".var/app/org.mozilla.firefox/.mozilla/firefox",
        fs::path(home) / ".var/app/io.gitlab.librewolf-community/.librewolf",
    };
 
    for (const auto& root : roots) {
        if (!fs::exists(root)) continue;
        const fs::path profile = firefox_active_profile(root);
        if (!profile.empty())
            install_ca_firefox_profile(profile);
    }
}
 
static void install_ca_nssdb() {
    if (!fs::exists(BG_CA_CERT)) return;
    const std::string home = home_dir();
    if (home.empty()) return;
 
    const fs::path nssdb = fs::path(home) / ".pki/nssdb";
    if (!fs::exists(nssdb)) {
        std::error_code ec;
        fs::create_directories(nssdb, ec);
        if (!ec) (void)bg_process::run({"certutil", "-N", "--empty-password", "-d", nssdb.string()});
    }
    for (const fs::path& database : {nssdb,
                      fs::path(home) / "snap/chromium/current/.pki/nssdb"}) {
        if (fs::exists(database) && !nss_contains_ca(database.string())) {
            (void)bg_process::run({"certutil", "-A", "-d", database.string(),
                                   "-n", BG_CA_NICK, "-t", "CT,C,C", "-i", BG_CA_CERT});
        }
    }
}
 
static void install_ca_all_browsers() {
    if (!fs::exists(BG_CA_CERT)) {
        std::cerr << _("[ca-install] CA cert not found, skipping\n");
        return;
    }
 
    std::cerr << _("[ca-install] installing BastionGuard CA in browsers\n");
    install_ca_firefox_family();
    install_ca_nssdb();
}
 
static void apply(const Settings& s) {
    std::cerr << _("[browser-proxy] configuring browsers\n");
    configure_firefox_family(s, false);
    configure_chromium_family(s, false);
}
 
static void restore() {
    std::cerr << _("[browser-proxy] restoring browser proxy settings\n");
    configure_firefox_family({}, true);
    configure_chromium_family({}, true);
}
 
} // namespace BrowserProxy
 
 
namespace ProxyConfig {
 
struct Settings {
    std::string host;
    int port;
};
 
static bool run(const std::vector<std::string>& args, bool silent = false) {
    const auto result = bg_process::run(args, true, 256U * 1024U);
    if (!result.ok() && !silent)
        std::cerr << "[proxy-config] command failed: " << args.front() << " ("
                  << result.exit_code << ")\n";
    return result.ok();
}
 
enum class DE { GNOME, KDE, XFCE, MATE, CINNAMON, LXQT, OTHER };
 
static DE detect() {
    const char* xdg = std::getenv("XDG_CURRENT_DESKTOP");
    if (xdg) {
        std::string d(xdg);
        for (auto& c : d) c = static_cast<char>(std::toupper(static_cast<unsigned char>(c)));
        if (d.find("GNOME")    != std::string::npos) return DE::GNOME;
        if (d.find("KDE")      != std::string::npos) return DE::KDE;
        if (d.find("XFCE")     != std::string::npos) return DE::XFCE;
        if (d.find("MATE")     != std::string::npos) return DE::MATE;
        if (d.find("CINNAMON") != std::string::npos) return DE::CINNAMON;
        if (d.find("LXQT")     != std::string::npos) return DE::LXQT;
    }
    if (std::getenv("KDE_FULL_SESSION"))         return DE::KDE;
    if (std::getenv("GNOME_DESKTOP_SESSION_ID")) return DE::GNOME;
    return DE::OTHER;
}
 
static void gnome_set(const Settings& s) {
    const std::string port = std::to_string(s.port);
    run({"gsettings", "set", "org.gnome.system.proxy", "mode", "manual"});
    for (const char* scheme : {"http", "https"}) {
        const std::string schema = std::string("org.gnome.system.proxy.") + scheme;
        run({"gsettings", "set", schema, "host", s.host});
        run({"gsettings", "set", schema, "port", port});
    }
    run({"gsettings", "set", "org.gnome.system.proxy.socks", "host", ""});
    run({"gsettings", "set", "org.gnome.system.proxy.socks", "port", "0"});
    run({"gsettings", "set", "org.gnome.system.proxy", "ignore-hosts",
         BrowserProxy::LAN_BYPASS_GVARIANT});
}
 
static void gnome_clear() {
    run({"gsettings", "set", "org.gnome.system.proxy", "mode", "none"});
}
 
static void kde_refresh() {
    // Either kioclient version may be installed; failures are harmless.
    if (!run({"kioclient6", "clear"}, true))
        (void)run({"kioclient5", "clear"}, true);
}
 
static void kde_set(const Settings& s) {
    const std::string hp = "http://" + s.host + ":" + std::to_string(s.port);
    for (const char* bin : {"kwriteconfig6", "kwriteconfig5"}) {
        const std::vector<std::string> common = {bin, "--file", "kioslaverc", "--group", "Proxy Settings"};
        auto set = [&](const std::string& key, const std::string& val) {
            std::vector<std::string> args = common;
            args.insert(args.end(), {"--key", key, val});
            (void)run(args, true);
        };
        set("ProxyType", "1");
        set("httpProxy", hp);
        set("httpsProxy", hp);
        set("NoProxyFor", BrowserProxy::LAN_BYPASS_CIDR);
        set("ReversedException", "false");
    }
    kde_refresh();
}
 
static void kde_clear() {
    for (const char* bin : {"kwriteconfig6", "kwriteconfig5"})
        (void)run({bin, "--file", "kioslaverc", "--group", "Proxy Settings",
                   "--key", "ProxyType", "0"}, true);
    kde_refresh();
}
 
static void xfce_set(const Settings& s) {
    const std::string port = std::to_string(s.port);
    (void)run({"xfconf-query", "-c", "xfce4-settings-editor", "-p", "/Net/ProxyMode", "-s", "manual"}, true);
    for (const char* scheme : {"http", "https"}) {
        const std::string key = std::string("/Net/") + scheme + "-proxy/";
        (void)run({"xfconf-query", "-c", "xfce4-settings-editor", "-p", key + "host", "-s", s.host}, true);
        (void)run({"xfconf-query", "-c", "xfce4-settings-editor", "-p", key + "port", "-s", port}, true);
    }
    (void)run({"gsettings", "set", "org.gnome.system.proxy", "ignore-hosts",
               BrowserProxy::LAN_BYPASS_GVARIANT}, true);
}
 
static void xfce_clear() {
    (void)run({"xfconf-query", "-c", "xfce4-settings-editor", "-p", "/Net/ProxyMode", "-s", "none"}, true);
}
 
static void mate_set(const Settings& s) {
    const std::string port = std::to_string(s.port);
    for (const auto& [key, value] : std::vector<std::pair<std::string, std::string>>{
            {"proxy-mode", "manual"}, {"http-host", s.host}, {"http-port", port},
            {"https-host", s.host}, {"https-port", port},
            {"ignore-hosts", BrowserProxy::LAN_BYPASS_GVARIANT}}) {
        (void)run({"gsettings", "set", "org.mate.network-preferences", key, value}, true);
    }
}
 
static void mate_clear() {
    (void)run({"gsettings", "set", "org.mate.network-preferences", "proxy-mode", "none"}, true);
}
 
static void lxqt_set(const Settings& s) {
    const char* home = std::getenv("HOME");
    if (!home) return;
 
    namespace fs = std::filesystem;
    std::ofstream f(fs::path(home) / ".config/lxqt/session.conf", std::ios::app);
    if (f) {
        const std::string val = "http://" + s.host + ":" + std::to_string(s.port);
        f << "\n[Environment]\n"
          << "http_proxy="  << val << "\n"
          << "https_proxy=" << val << "\n"
          << "no_proxy="    << BrowserProxy::LAN_BYPASS_NOCIDR << "\n";
    }
}
 
static void env_set(const Settings& s) {
    const std::string val = "http://" + s.host + ":" + std::to_string(s.port);
    const char* nopx = BrowserProxy::LAN_BYPASS_NOCIDR;
 
    setenv("http_proxy",  val.c_str(), 1);
    setenv("HTTP_PROXY",  val.c_str(), 1);
    setenv("https_proxy", val.c_str(), 1);
    setenv("HTTPS_PROXY", val.c_str(), 1);
    setenv("all_proxy",   val.c_str(), 1);
    setenv("ALL_PROXY",   val.c_str(), 1);
    setenv("no_proxy",    nopx, 1);
    setenv("NO_PROXY",    nopx, 1);
 
    const char* home = std::getenv("HOME");
    if (home) {
        namespace fs = std::filesystem;
        const fs::path conf_dir = fs::path(home) / ".config/environment.d";
        std::error_code ec;
        fs::create_directories(conf_dir, ec);
        if (!ec) {
            std::ofstream f(conf_dir / "bastionguard-proxy.conf");
            if (f) {
                f << "http_proxy="  << val << "\n"
                  << "HTTP_PROXY="  << val << "\n"
                  << "https_proxy=" << val << "\n"
                  << "HTTPS_PROXY=" << val << "\n"
                  << "all_proxy="   << val << "\n"
                  << "ALL_PROXY="   << val << "\n"
                  << "no_proxy="    << nopx << "\n"
                  << "NO_PROXY="    << nopx << "\n";
            }
        }
    }
}
 
static void env_clear() {
    unsetenv("http_proxy");
    unsetenv("HTTP_PROXY");
    unsetenv("https_proxy");
    unsetenv("HTTPS_PROXY");
    unsetenv("all_proxy");
    unsetenv("ALL_PROXY");
    unsetenv("no_proxy");
    unsetenv("NO_PROXY");
 
    const char* home = std::getenv("HOME");
    if (home) {
        std::error_code ec;
        std::filesystem::remove(
            std::filesystem::path(home) / ".config/environment.d/bastionguard-proxy.conf", ec);
    }
}
 
static void apply(const Settings& s) {
    // Validate addresses before persisting them to configuration files.
    const bool valid_host = !s.host.empty() && s.host.size() <= 253 &&
        std::all_of(s.host.begin(), s.host.end(), [](unsigned char c) {
            return std::isalnum(c) || c == '.' || c == '-' || c == ':' || c == '[' || c == ']';
        });
    if (!valid_host || s.port < 1 || s.port > 65535) {
        std::cerr << "[proxy-config] refusing unsafe host or port\n";
        return;
    }
    char msg[256];
    std::snprintf(msg, sizeof(msg), _("[proxy-config] setting system proxy → %s:%d\n"),
        s.host.c_str(), s.port);
    std::cerr << msg;
 
    env_set(s);
 
    switch (detect()) {
        case DE::GNOME:
        case DE::CINNAMON: gnome_set(s); break;
        case DE::KDE:      kde_set(s);   break;
        case DE::XFCE:     xfce_set(s);  break;
        case DE::MATE:     gnome_set(s); mate_set(s); break;
        case DE::LXQT:     lxqt_set(s);  break;
        case DE::OTHER:                    break;
    }
    BrowserProxy::install_ca_all_browsers();
 
    BrowserProxy::apply({ s.host, s.port });
}
 
static void restore() {
    std::cerr << _("[proxy-config] restoring system proxy\n");
 
    env_clear();
 
    switch (detect()) {
        case DE::GNOME:
        case DE::CINNAMON: gnome_clear(); break;
        case DE::KDE:      kde_clear();   break;
        case DE::XFCE:     xfce_clear();  break;
        case DE::MATE:     gnome_clear(); mate_clear(); break;
        case DE::LXQT:                      break;
        case DE::OTHER:                     break;
    }
 
    BrowserProxy::restore();
}
 
} // namespace ProxyConfig