BastionGuard::wizard Namespace Reference

Classes
class	WizardWindow

Functions
std::string	shell_quote (const std::string &argument)
bool	run_all_elevated_steps (const std::vector< std::string > &commands, std::string *out_log)
void	gen_cert_commands (std::vector< std::string > &out)
void	gen_web_commands (std::vector< std::string > &out, int http_port, int https_port)
void	gen_blacklist_commands (std::vector< std::string > &out, const std::string &packaged_blacklist)
bool	setup_firewall_ports ()
bool	install_nftables_conf ()
bool	install_system_ca (const std::string &ca_crt_path)
bool	setup_certificates ()
bool	install_phishing_blacklist (const std::string &src, const std::string &dst)
bool	install_native_host (const std::string &, const std::string &extension_id)
bool	run_wizard_setup (const std::vector< std::string > &options)
void	gen_resolv_commands (std::vector< std::string > &out)
void	gen_firewall_commands (std::vector< std::string > &out)
bool	setup_resolv_override ()
bool	restore_resolv_backup ()
static std::vector< std::string >	elev_args (const std::string &inner)
static std::string	user_data_dir ()
std::string	detect_webserver ()

Function Documentation

detect_webserver()

std::string BastionGuard::wizard::detect_webserver

(

)

Definition at line 157 of file wizard_window.cpp.

                             {
    if (std::filesystem::exists("/usr/sbin/apache2") || std::filesystem::exists("/usr/sbin/httpd"))
        return "apache";
    if (std::filesystem::exists("/usr/sbin/nginx"))
        return "nginx";
    if (std::filesystem::exists("/usr/local/lsws/bin/lswsctrl"))
        return "litespeed";
    return "unknown";
}

References detect_webserver().

Referenced by detect_webserver().

elev_args()

std::vector< std::string > BastionGuard::wizard::elev_args ( const std::string & inner )

static

Definition at line 51 of file wizard_window.cpp.

                                                              {
    if (geteuid() == 0) return {"/bin/bash", "-c", inner};
    if (fs::exists("/usr/bin/pkexec")) return {"pkexec", "/bin/bash", "-c", inner};
    return {"sudo", "/bin/bash", "-c", inner};
}

References elev_args().

Referenced by BastionGuard::wizard::WizardWindow::configure_dnsmasq(), elev_args(), and BastionGuard::wizard::WizardWindow::run_enable_user_agents().

gen_blacklist_commands()

void BastionGuard::wizard::gen_blacklist_commands	(	std::vector< std::string > &	out,
		const std::string &	packaged_blacklist )

Definition at line 279 of file wizard_setup.cpp.

                                                                                            {
    if (fs::exists(packaged_blacklist)) {
        std::string dst = (fs::path(user_data_dir()) / "phishing/blacklist.txt").string();
        out.push_back("mkdir -p " + (fs::path(user_data_dir()) / "phishing").string());
        out.push_back("install -m 0644 " + packaged_blacklist + " " + dst + " || true");
    }
}

References gen_blacklist_commands().

Referenced by gen_blacklist_commands(), gen_firewall_commands(), and BastionGuard::wizard::WizardWindow::worker_run().

gen_cert_commands()

void BastionGuard::wizard::gen_cert_commands

(

std::vector< std::string > &

out

)

Definition at line 249 of file wizard_setup.cpp.

                                                  {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[wizard] Certificati e CA disabilitati su Fedora/RHEL/Alma/Rocky.\n");
        return;
    }
    out.push_back(_("echo '[BastionGuard] Generazione certificati...' >&2"));
    out.push_back("mkdir -p /etc/BastionGuard/certs && chmod 755 /etc/BastionGuard/certs");
    out.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/BastionGuard-ca.key.pem 4096");
    out.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.crt.pem ] || openssl req -x509 -new -nodes -key /etc/BastionGuard/certs/BastionGuard-ca.key.pem -sha256 -days 3650 -subj '/CN=BastionGuard Local CA' -out /etc/BastionGuard/certs/BastionGuard-ca.crt.pem");
    out.push_back("[ -f /etc/BastionGuard/certs/local-warning.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/local-warning.key.pem 2048");
    out.push_back("openssl req -new -key /etc/BastionGuard/certs/local-warning.key.pem -subj '/CN=localhost' -out /etc/BastionGuard/certs/local-warning.csr.pem");
    out.push_back("echo 'subjectAltName = DNS:localhost,IP:127.0.0.2' > /etc/BastionGuard/certs/v3ext.cnf");
    out.push_back("openssl x509 -req -in /etc/BastionGuard/certs/local-warning.csr.pem -CA /etc/BastionGuard/certs/BastionGuard-ca.crt.pem -CAkey /etc/BastionGuard/certs/BastionGuard-ca.key.pem -CAcreateserial -out /etc/BastionGuard/certs/local-warning.crt.pem -days 825 -sha256 -extfile /etc/BastionGuard/certs/v3ext.cnf");
    out.push_back("rm -f /etc/BastionGuard/certs/local-warning.csr.pem /etc/BastionGuard/certs/BastionGuard-ca.srl /etc/BastionGuard/certs/v3ext.cnf || true");
    out.push_back("chmod 600 /etc/BastionGuard/certs/*key.pem || true");
    out.push_back("chmod 644 /etc/BastionGuard/certs/*.crt.pem || true");
    out.push_back("if command -v update-ca-certificates >/dev/null 2>&1; then install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /usr/local/share/ca-certificates/BastionGuard-ca.crt && update-ca-certificates; "
                  "elif command -v trust >/dev/null 2>&1; then trust anchor --store /etc/BastionGuard/certs/BastionGuard-ca.crt.pem; "
                  "elif command -v update-ca-trust >/dev/null 2>&1; then install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt && update-ca-trust extract; fi");
}

References _, gen_cert_commands(), and BastionGuard::Platform::is_fedora_rhel_family().

Referenced by gen_cert_commands(), gen_firewall_commands(), and BastionGuard::wizard::WizardWindow::worker_run().

gen_firewall_commands()

void BastionGuard::wizard::gen_firewall_commands

(

std::vector< std::string > &

out

)

References gen_blacklist_commands(), gen_cert_commands(), gen_firewall_commands(), gen_web_commands(), run_all_elevated_steps(), and run_wizard_setup().

Referenced by gen_firewall_commands().

gen_resolv_commands()

void BastionGuard::wizard::gen_resolv_commands

(

std::vector< std::string > &

out

)

References gen_resolv_commands().

Referenced by gen_resolv_commands().

gen_web_commands()

void BastionGuard::wizard::gen_web_commands	(	std::vector< std::string > &	out,
		int	http_port,
		int	https_port )

Definition at line 270 of file wizard_setup.cpp.

                                                                                {
    out.push_back(_("echo '[BastionGuard] Configuro webserver (nginx) porte...' >&2"));
    out.push_back("mkdir -p /etc/BastionGuard");
    out.push_back("echo \"" + std::to_string(http_port) + " " + std::to_string(https_port) + "\" > /etc/BastionGuard/webports.conf");
    out.push_back("sed -i 's/listen [0-9]\\+/listen " + std::to_string(http_port) + "/g' /etc/nginx/conf.d/*.conf 2>/dev/null || true");
    out.push_back("sed -i 's/listen [0-9]\\+ ssl/listen " + std::to_string(https_port) + " ssl/g' /etc/nginx/conf.d/*.conf 2>/dev/null || true");
    out.push_back("nginx -t && /usr/libexec/bastionguard/bastionguard-service --system restart nginx.service || true");
}

References _, and gen_web_commands().

Referenced by gen_firewall_commands(), gen_web_commands(), and BastionGuard::wizard::WizardWindow::worker_run().

install_native_host()

bool BastionGuard::wizard::install_native_host	(	const std::string &	,
		const std::string &	extension_id )

Definition at line 691 of file wizard_setup.cpp.

                                                                            {
    try {
        namespace fs = std::filesystem;
 
        std::cout << "[wizard] " << _("Installazione native messaging host...") << std::endl;
        std::string bin_path = "/usr/bin/BastionGuard-native-host";
 
        if (fs::exists(bin_path)) {
            std::error_code ec;
            auto perms = fs::status(bin_path, ec).permissions();
            if (!ec && ((perms & fs::perms::owner_exec) == fs::perms::none)) {
                fs::permissions(
                    bin_path,
                    fs::perms::owner_exec | fs::perms::group_exec | fs::perms::others_exec,
                    fs::perm_options::add,
                    ec
                );
                if (ec) {
                    std::cerr << "[wizard] " << _("Impossibile impostare i permessi eseguibili: ")
                              << ec.message() << std::endl;
                }
            }
        } else {
            std::cerr << "[wizard] " << _("Avviso: binario native host non trovato: ") << bin_path << std::endl;
        }
 
        auto json_escape = [](const std::string& s) {
            std::string out;
            for (char c : s) {
                if (c == '\\') out += "\\\\";
                else if (c == '"') out += "\\\"";
                else out += c;
            }
            return out;
        };
 
        auto make_chrome_manifest = [&](const std::string& ext_id) {
            std::ostringstream o;
            o << "{\n"
              << "  \"name\": \"com.BastionGuard.native_host\",\n"
              << "  \"description\": \"BastionGuard native messaging host\",\n"
              << "  \"path\": \"" << json_escape(bin_path) << "\",\n"
              << "  \"type\": \"stdio\",\n"
              << "  \"allowed_origins\": [\n";
            if (!ext_id.empty())
                o << "    \"chrome-extension://" << ext_id << "/\"\n";
            o << "  ]\n"
              << "}\n";
            return o.str();
        };
 
        auto make_firefox_manifest = [&](const std::string& ext_id) {
            std::ostringstream o;
            o << "{\n"
              << "  \"name\": \"com.BastionGuard.native_host\",\n"
              << "  \"description\": \"BastionGuard native messaging host\",\n"
              << "  \"path\": \"" << json_escape(bin_path) << "\",\n"
              << "  \"type\": \"stdio\",\n"
              << "  \"allowed_extensions\": [\n";
            if (!ext_id.empty())
                o << "    \"" << ext_id << "\"\n";
            o << "  ]\n"
              << "}\n";
            return o.str();
        };
 
        const char* xdg = getenv("XDG_CONFIG_HOME");
        std::string config_base = (xdg && *xdg)
            ? std::string(xdg)
            : (std::string(getenv("HOME")) + "/.config");
 
        std::vector<std::pair<std::string,std::string>> manifest_targets;
 
        manifest_targets.emplace_back(config_base + "/google-chrome/NativeMessagingHosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back(config_base + "/chromium/NativeMessagingHosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back(config_base + "/BraveSoftware/Brave-Browser/NativeMessagingHosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back(config_base + "/microsoft-edge/NativeMessagingHosts", make_chrome_manifest(extension_id));
 
        manifest_targets.emplace_back(std::string(getenv("HOME")) + "/.mozilla/native-messaging-hosts", make_firefox_manifest("BastionGuard@local"));
        manifest_targets.emplace_back(std::string(getenv("HOME")) + "/.librewolf/native-messaging-hosts", make_firefox_manifest("BastionGuard@local"));
 
        manifest_targets.emplace_back("/etc/opt/chrome/native-messaging-hosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back("/etc/chromium/native-messaging-hosts", make_chrome_manifest(extension_id));
        manifest_targets.emplace_back("/usr/lib/mozilla/native-messaging-hosts", make_firefox_manifest("BastionGuard@local"));
 
        bool any_written = false;
        for (auto& t : manifest_targets) {
            const std::string& dir = t.first;
            const std::string& content = t.second;
            std::error_code ec;
            fs::create_directories(dir, ec);
            if (ec) {
                std::cerr << "[wizard] " << _("Impossibile creare la directory: ")
                          << dir << " (" << ec.message() << ")" << std::endl;
                continue;
            }
            std::string manifest_name = dir + "/com.BastionGuard.native_host.json";
 
            if (fs::exists(manifest_name)) {
                std::cout << "[wizard] " << _("Manifest già presente, salto: ") << manifest_name << std::endl;
                continue;
            }
 
            std::ofstream man(manifest_name, std::ios::trunc);
            if (man.is_open()) {
                man << content;
                man.close();
                std::cout << "[wizard] " << _("Manifest scritto in: ") << manifest_name << std::endl;
                any_written = true;
            } else {
                std::cerr << "[wizard] " << _("Impossibile scrivere manifest in: ") << manifest_name << std::endl;
            }
        }
 
        if (any_written) {
            std::cout << "[wizard] " << _("Native host configurato, manifest creati") << std::endl;
            return true;
        }
 
        std::cerr << "[wizard] " << _("Nessun manifest creato (tutti già presenti?)") << std::endl;
        return false;
 
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] " << _("Eccezione in install_native_host: ") << ex.what() << std::endl;
        return false;
    }
}

References _, and install_native_host().

Referenced by install_native_host(), BastionGuard::wizard::WizardWindow::install_native_host(), restore_resolv_backup(), and run_wizard_setup().

install_nftables_conf()

bool BastionGuard::wizard::install_nftables_conf

(

)

Definition at line 487 of file wizard_setup.cpp.

                             {
    try {
        std::cout << _("[wizard] 🔧 Configurazione rete e nftables (modalità agent)...\n");
 
        const std::string src_conf = "/usr/share/BastionGuard/data/config/nftables.conf";
        const std::string dst_conf = "/etc/nftables.conf";
        const std::string net_script = "/usr/share/BastionGuard/data/scripts/BastionGuard-net-setup.sh";
 
        if (!fs::exists(src_conf)) {
            std::cerr << _("[wizard] ⚠ File di configurazione nftables non trovato: ") << src_conf << "\n";
            return false;
        }
 
        std::ostringstream script;
        script << "#!/bin/bash\n";
        script << "set -euo pipefail\n";
        script << "export PATH=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"\n";
        script << "export XDG_RUNTIME_DIR=\"/run/user/0\"\n";
        script << "export DBUS_SESSION_BUS_ADDRESS=\"unix:path=/run/dbus/system_bus_socket\"\n";
        script << "export DISPLAY=${DISPLAY:-:0}\n";
        script << _("echo '[BastionGuard] ▶ Configurazione nftables e rete...'\n");
 
        script << "install -m 0644 \"" << src_conf << "\" \"" << dst_conf << "\"\n";
        script << "nft -f \"" << dst_conf << "\" || true\n";
        script << "if ! /usr/libexec/bastionguard/bastionguard-service --system is-active ufw.service 2>/dev/null && "
                  "! /usr/libexec/bastionguard/bastionguard-service --system is-active firewalld.service 2>/dev/null; then\n";
        script << _("  echo '[BastionGuard] Abilito e avvio nftables.service...'\n");
        script << "  /usr/libexec/bastionguard/bastionguard-service --system enable --now nftables.service || true\n";
        script << "else\n";
        script << _("  echo '[BastionGuard] UFW o Firewalld rilevati: mantengo configurazione esistente.'\n");
        script << "fi\n";
 
        if (fs::exists(net_script)) {
            script << _("echo '[BastionGuard] ▶ Eseguo BastionGuard-net-setup.sh (modalità agent)...'\n");
            script << "/usr/bin/env bash \"" << net_script << "\" || true\n";
        } else {
            script << _("echo '[BastionGuard] Nessuno script di rete trovato.'\n");
        }
 
        script << _("echo '[BastionGuard] ✅ Configurazione nftables + rete completata.'\n");
 
        std::string out;
        bool ok = write_temp_script_and_elevate(script.str(), &out);
 
        // 🔍 Diagnostica
        std::cerr << _("[wizard][DEBUG] Output BastionGuard-net-setup.sh:\n") << out << "\n";
 
        if (ok) {
            std::cout << _("[wizard] ✅ nftables e rete configurati con successo (agent mode)\n");
        } else {
            std::cerr << _("[wizard] ⚠ Errore configurando nftables o rete:\n") << out << "\n";
        }
 
        return ok;
    } catch (const std::exception& ex) {
        std::cerr << _("[wizard] ⚠ Eccezione in install_nftables_conf: ") << ex.what() << "\n";
        return false;
    }
}

References _, and install_nftables_conf().

Referenced by install_nftables_conf(), and restore_resolv_backup().

install_phishing_blacklist()

bool BastionGuard::wizard::install_phishing_blacklist	(	const std::string &	src,
		const std::string &	dst )

Definition at line 678 of file wizard_setup.cpp.

                                                                            {
    try {
        fs::create_directories(fs::path(dst).parent_path());
        fs::copy_file(src, dst, fs::copy_options::overwrite_existing);
        std::cout << "[wizard] " << _("Blacklist phishing copiata in:") << " " << dst << std::endl;
        return true;
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] " << _("Errore copiando blacklist:") << " " << ex.what() << std::endl;
        return false;
    }
}

References _, and install_phishing_blacklist().

Referenced by install_phishing_blacklist(), and restore_resolv_backup().

install_system_ca()

bool BastionGuard::wizard::install_system_ca

(

const std::string &

ca_crt_path

)

Definition at line 549 of file wizard_setup.cpp.

                                                     {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[wizard] Installazione CA di sistema bloccata su Fedora/RHEL/Alma/Rocky.\n");
        return false;
    }
    try {
        if (!fs::exists(ca_crt_path)) {
            std::cerr << "[wizard] " << _("File CA non trovato:") << " " << ca_crt_path << std::endl;
            return false;
        }
 
        std::ostringstream script;
        script << "#!/bin/sh\nset -e\n\n";
        script << "CA=\"" << ca_crt_path << "\"\n";
        script << "OK=0\n\n";
 
        script << "if command -v update-ca-certificates >/dev/null 2>&1; then\n";
        script << "  install -m 644 \"$CA\" /usr/local/share/ca-certificates/BastionGuard-ca.crt && update-ca-certificates && OK=1 || true\n";
        script << "fi\n\n";
 
 
        script << "if command -v trust >/dev/null 2>&1; then\n";
        script << "  trust anchor --store \"$CA\" && OK=1 || true\n";
        script << "fi\n\n";
 
        script << "if command -v update-ca-trust >/dev/null 2>&1; then\n";
        script << "  install -m 644 \"$CA\" /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt && update-ca-trust extract && OK=1 || true\n";
        script << "fi\n\n";
 
        script << "if [ -d /etc/ca-certificates/trust-source/anchors ]; then\n";
        script << "  install -m 644 \"$CA\" /etc/ca-certificates/trust-source/anchors/BastionGuard-ca.crt && \\\n";
        script << "  ( (command -v trust >/dev/null 2>&1 && trust extract-compat) || (trust anchor --store \"$CA\") ) && OK=1 || true\n";
        script << "fi\n\n";
        script << "install -m 644 \"$CA\" /usr/local/share/ca-certificates/BastionGuard-ca.crt || true\n";
        script << "install -m 644 \"$CA\" /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt || true\n";
        script << "if command -v update-ca-certificates >/dev/null 2>&1; then update-ca-certificates || true; fi\n";
        script << "if command -v update-ca-trust >/dev/null 2>&1; then update-ca-trust extract || true; fi\n";
        script << "if command -v trust >/dev/null 2>&1; then trust anchor --store \"$CA\" || true; fi\n\n";
 
        script << "if [ \"$OK\" -eq 1 ]; then\n";
        script << "  echo \"OK: CA installed into system trust\"\n";
        script << "  exit 0\n";
        script << "else\n";
        script << "  echo \"WARN: none of the system trust installers succeeded; CA copied to common paths\"\n";
        script << "  exit 2\n";
        script << "fi\n";
 
        std::string out;
        bool ok = write_temp_script_and_elevate(script.str(), &out);
 
        if (!ok) {
            std::cerr << "[wizard] " << _("Installazione CA: script restituisce warning o errore") << "\n" << out << std::endl;
            if (out.find("OK: CA installed") != std::string::npos) {
                std::cout << "[wizard] " << _("CA installata nel trust store di sistema") << std::endl;
                return true;
            }
            if (out.find("WARN:") != std::string::npos) {
                std::cout << "[wizard] " << _("CA copiata in directory comuni, ma potresti doverla abilitare manualmente") << std::endl;
                return true;
            }
            return false;
        }
 
        std::cout << "[wizard] " << _("CA installata nel trust store di sistema") << std::endl;
        return true;
 
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] " << _("Eccezione in install_system_ca:") << " " << ex.what() << std::endl;
        return false;
    }
}

References _, install_system_ca(), and BastionGuard::Platform::is_fedora_rhel_family().

Referenced by install_system_ca(), restore_resolv_backup(), and setup_certificates().

restore_resolv_backup()

bool BastionGuard::wizard::restore_resolv_backup

(

)

References install_native_host(), install_nftables_conf(), install_phishing_blacklist(), install_system_ca(), restore_resolv_backup(), setup_certificates(), and setup_firewall_ports().

Referenced by restore_resolv_backup().

run_all_elevated_steps()

bool BastionGuard::wizard::run_all_elevated_steps	(	const std::vector< std::string > &	commands,
		std::string *	out_log )

Definition at line 190 of file wizard_setup.cpp.

                                                                                      {
    if (commands.empty()) {
        if (out_log) *out_log = "No commands";
        return true;
    }
 
    char tmpl[] = "/tmp/BastionGuard_all_XXXXXX";
    int fd = mkstemp(tmpl);
    if (fd < 0) {
        if (out_log) *out_log = _("Impossibile creare file temporaneo");
        return false;
    }
    std::string tmpname = tmpl;
 
    FILE* f = fdopen(fd, "w");
    if (!f) {
        close(fd);
        if (out_log) *out_log = _("fdopen fallita");
        return false;
    }
 
    fputs("#!/bin/bash\nset -euo pipefail\n\n", f);
    fputs("echo \"[BastionGuard] start elevated script\" >&2\n", f);
    for (const auto &c : commands) {
        fputs(c.c_str(), f);
        fputc('\n', f);
    }
 
    fputs("echo \"[BastionGuard] end elevated script\" >&2\n", f);
    fclose(f);
    chmod(tmpname.c_str(), 0750);
 
    bool use_pkexec = fs::exists("/usr/bin/pkexec");
    bool has_action_id = run_cmd_capture("pkexec --help | grep -q action-id");
    std::ostringstream elev;
    if (use_pkexec) {
        if (has_action_id) {
            elev << "pkexec --disable-internal-agent --action-id org.BastionGuard.maintenance " << tmpname;
        } else {
            elev << "pkexec " << tmpname;
        }
    } else {
        elev << "sudo " << tmpname;
    }
 
    std::string out;
    int rc = 0;
    bool ok = run_cmd_capture(elev.str(), &out, &rc);
 
    // Pulizia
    std::error_code ec;
    fs::remove(tmpname, ec);
 
    if (out_log) *out_log = out;
    return ok && rc == 0;
}

References _, and run_all_elevated_steps().

Referenced by gen_firewall_commands(), run_all_elevated_steps(), run_wizard_setup(), and BastionGuard::wizard::WizardWindow::worker_run().

run_wizard_setup()

bool BastionGuard::wizard::run_wizard_setup

(

const std::vector< std::string > &

options

)

Definition at line 820 of file wizard_setup.cpp.

                                                           {
    bool run_all = options.empty();
    bool ok = true;
 
    auto has_opt = [&](const std::string& key) {
        return run_all || std::find(options.begin(), options.end(), key) != options.end();
    };
 
    std::vector<std::string> cmds;
 
    std::cout << _("[wizard] 🔁 Esecuzione privilegiata combinata (una sola autenticazione)...\n");
 
 
 
 
    if (has_opt("certs") && !BastionGuard::Platform::is_fedora_rhel_family()) {
        cmds.push_back(_("echo '[BastionGuard] Genero certificati locali...' >&2"));
        cmds.push_back("mkdir -p /etc/BastionGuard/certs && chmod 755 /etc/BastionGuard/certs");
        cmds.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/BastionGuard-ca.key.pem 4096");
        cmds.push_back("[ -f /etc/BastionGuard/certs/BastionGuard-ca.crt.pem ] || openssl req -x509 -new -nodes "
                       "-key /etc/BastionGuard/certs/BastionGuard-ca.key.pem -sha256 -days 3650 "
                       "-subj '/CN=BastionGuard Local CA' -out /etc/BastionGuard/certs/BastionGuard-ca.crt.pem");
        cmds.push_back("[ -f /etc/BastionGuard/certs/local-warning.key.pem ] || openssl genrsa -out /etc/BastionGuard/certs/local-warning.key.pem 2048");
        cmds.push_back("openssl req -new -key /etc/BastionGuard/certs/local-warning.key.pem "
                       "-subj '/CN=localhost' -out /etc/BastionGuard/certs/local-warning.csr.pem");
        cmds.push_back("echo 'subjectAltName = DNS:localhost,IP:127.0.0.2' > /etc/BastionGuard/certs/v3ext.cnf");
        cmds.push_back("openssl x509 -req -in /etc/BastionGuard/certs/local-warning.csr.pem "
                       "-CA /etc/BastionGuard/certs/BastionGuard-ca.crt.pem -CAkey /etc/BastionGuard/certs/BastionGuard-ca.key.pem "
                       "-CAcreateserial -out /etc/BastionGuard/certs/local-warning.crt.pem -days 825 "
                       "-sha256 -extfile /etc/BastionGuard/certs/v3ext.cnf");
        cmds.push_back("rm -f /etc/BastionGuard/certs/local-warning.csr.pem /etc/BastionGuard/certs/BastionGuard-ca.srl /etc/BastionGuard/certs/v3ext.cnf");
        cmds.push_back("chmod 600 /etc/BastionGuard/certs/*key.pem || true");
        cmds.push_back("chmod 644 /etc/BastionGuard/certs/*.crt.pem || true");
 
        cmds.push_back("if command -v update-ca-certificates >/dev/null 2>&1; then "
                       "install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /usr/local/share/ca-certificates/BastionGuard-ca.crt && "
                       "update-ca-certificates; "
                       "elif command -v trust >/dev/null 2>&1; then "
                       "trust anchor --store /etc/BastionGuard/certs/BastionGuard-ca.crt.pem; "
                       "elif command -v update-ca-trust >/dev/null 2>&1; then "
                       "install -m 644 /etc/BastionGuard/certs/BastionGuard-ca.crt.pem /etc/pki/ca-trust/source/anchors/BastionGuard-ca.crt && "
                       "update-ca-trust extract; fi");
    }
 
    if (has_opt("blacklist")) {
        std::string dst = user_data_dir() + "/blacklist/phishing-blacklist.txt";
        cmds.push_back(_("echo '[BastionGuard] Copio blacklist phishing...' >&2"));
        cmds.push_back("mkdir -p " + user_data_dir() + "/blacklist || true");
        cmds.push_back("install -m 0644 phishing-blacklist.txt " + dst + " || true");
    }
 
    cmds.push_back(_("echo '[BastionGuard] Riavvio BastionGuard-phishing-scanner...' >&2"));
    cmds.push_back("if [ -x /usr/libexec/bastionguard/bastionguard-service ] && "
                   "/usr/libexec/bastionguard/bastionguard-service --system exists BastionGuard-phishing-scanner.service >/dev/null 2>&1; then "
                   "/usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service || true; "
                   "else echo '[BastionGuard] Nessun servizio BastionGuard-phishing-scanner trovato.' >&2; fi");
 
    if (!cmds.empty()) {
        std::string log;
        bool ok_elev = run_all_elevated_steps(cmds, &log);
        if (!ok_elev) {
            std::cerr << _("[wizard] ⚠ Errore nello script privilegiato:\n") << log << std::endl;
            return false;
        }
        std::cout << _("[wizard] ✅ Tutte le operazioni privilegiate completate.") << std::endl;
    }
 
    if (has_opt("native-host")) {
        std::string ext_id;
        ok &= install_native_host("/usr/bin/BastionGuard-native-host", ext_id);
    }
 
    return ok;
}

References _, install_native_host(), BastionGuard::Platform::is_fedora_rhel_family(), run_all_elevated_steps(), and run_wizard_setup().

Referenced by gen_firewall_commands(), and run_wizard_setup().

setup_certificates()

bool BastionGuard::wizard::setup_certificates

(

)

Definition at line 622 of file wizard_setup.cpp.

                          {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[wizard] Generazione/installazione certificati disabilitata su Fedora/RHEL/Alma/Rocky.\n");
        return true;
    }
    try {
        std::cout << "[wizard] " << _("Generazione CA locale e certificato per il warning server...") << std::endl;
 
        std::ostringstream script;
        script << "#!/bin/sh\nset -e\n";
        script << "OUT=/etc/BastionGuard/certs\n";
        script << "mkdir -p \"$OUT\"\n";
        script << "chmod 755 \"$OUT\"\n\n";
 
        script << "if [ ! -f \"$OUT/BastionGuard-ca.key.pem\" ] || [ ! -f \"$OUT/BastionGuard-ca.crt.pem\" ]; then\n";
        script << "  openssl genrsa -out \"$OUT/BastionGuard-ca.key.pem\" 4096\n";
        script << "  openssl req -x509 -new -nodes -key \"$OUT/BastionGuard-ca.key.pem\" "
                  "-sha256 -days 3650 -subj \"/CN=BastionGuard Local CA\" -out \"$OUT/BastionGuard-ca.crt.pem\"\n";
        script << "fi\n\n";
 
        script << "if [ ! -f \"$OUT/local-warning.key.pem\" ] || [ ! -f \"$OUT/local-warning.crt.pem\" ]; then\n";
        script << "  openssl genrsa -out \"$OUT/local-warning.key.pem\" 2048\n";
        script << "  openssl req -new -key \"$OUT/local-warning.key.pem\" -subj \"/CN=localhost\" -out \"$OUT/local-warning.csr.pem\"\n";
        script << "  echo \"subjectAltName = DNS:localhost,IP:127.0.0.2\" > \"$OUT/v3ext.cnf\"\n";
        script << "  openssl x509 -req -in \"$OUT/local-warning.csr.pem\" "
                  "-CA \"$OUT/BastionGuard-ca.crt.pem\" -CAkey \"$OUT/BastionGuard-ca.key.pem\" -CAcreateserial "
                  "-out \"$OUT/local-warning.crt.pem\" -days 825 -sha256 -extfile \"$OUT/v3ext.cnf\"\n";
        script << "  rm -f \"$OUT/local-warning.csr.pem\" \"$OUT/BastionGuard-ca.srl\" \"$OUT/v3ext.cnf\"\n";
        script << "  chmod 600 \"$OUT/BastionGuard-ca.key.pem\" \"$OUT/local-warning.key.pem\"\n";
        script << "  chmod 644 \"$OUT/BastionGuard-ca.crt.pem\" \"$OUT/local-warning.crt.pem\"\n";
        script << "fi\n";
 
        std::string out;
        if (!write_temp_script_and_elevate(script.str(), &out)) {
            std::cerr << _("[wizard] Certificati: errore nello script\n") << out << std::endl;
            return false;
        }
 
        if (!install_system_ca("/etc/BastionGuard/certs/BastionGuard-ca.crt.pem")) {
            std::cerr << _("[wizard] ⚠️ Attenzione: installazione CA di sistema non riuscita.") << std::endl;
            std::cerr << _("[wizard] L'utente può installare manualmente il file: /etc/BastionGuard/certs/BastionGuard-ca.crt.pem") << std::endl;
            return false;
        }
 
        std::cout << _("[wizard] ✅ Certificati generati in /etc/BastionGuard/certs e CA installata nel sistema") << std::endl;
        return true;
 
    } catch (const std::exception& ex) {
        std::cerr << _("[wizard] Eccezione in setup_certificates: ") << ex.what() << std::endl;
        return false;
    }
}

References _, install_system_ca(), BastionGuard::Platform::is_fedora_rhel_family(), and setup_certificates().

Referenced by restore_resolv_backup(), and setup_certificates().

setup_firewall_ports()

bool BastionGuard::wizard::setup_firewall_ports

(

)

Definition at line 289 of file wizard_setup.cpp.

                            {
    bool group_modified = false;
 
    try {
        std::cout << "[wizard] " << _("Apro le porte firewall necessarie (53/udp, 81/tcp, 444/tcp, 4443/tcp)...") << std::endl;
 
        auto detect_distro_family = []() -> std::string {
            std::ifstream f("/etc/os-release");
            if (!f.is_open()) return "unknown";
            std::string line, content;
            while (std::getline(f, line)) content += line + "\n";
            f.close();
 
            if (content.find("ID=fedora") != std::string::npos ||
                content.find("ID_LIKE=fedora") != std::string::npos ||
                content.find("ID_LIKE=rhel") != std::string::npos)
                return "fedora";
            if (content.find("ID=arch") != std::string::npos ||
                content.find("ID_LIKE=arch") != std::string::npos)
                return "arch";
            if (content.find("ID=opensuse") != std::string::npos)
                return "suse";
            if (content.find("ID=debian") != std::string::npos ||
                content.find("ID_LIKE=debian") != std::string::npos ||
                content.find("ID=ubuntu") != std::string::npos)
                return "debian";
            return "generic";
        };
 
        std::string distro = detect_distro_family();
        std::cout << "[wizard] " << _("Rilevata distribuzione: ") << distro << std::endl;
 
        auto try_firewalld = [&]() -> bool {
            if (!fs::exists("/usr/bin/firewall-cmd")) return false;
            std::string cmd = elev_cmd(
                "firewall-cmd --permanent --add-port=53/udp && "
                "firewall-cmd --permanent --add-port=81/tcp && "
                "firewall-cmd --permanent --add-port=444/tcp && "
                "firewall-cmd --permanent --add-port=4443/tcp && "
                "firewall-cmd --reload"
            );
            std::string out; int rc = 0;
            bool ok = run_cmd_capture(cmd, &out, &rc);
            if (ok && rc == 0)
                std::cout << "[wizard] ✅ " << _("Porte aperte tramite firewalld.") << std::endl;
            return ok;
        };
 
        auto try_ufw = [&]() -> bool {
            if (!fs::exists("/usr/sbin/ufw") && !fs::exists("/usr/bin/ufw")) return false;
            std::ostringstream cmd;
            cmd << "ufw allow 53/udp && ufw allow 81/tcp && ufw allow 444/tcp && ufw allow 4443/tcp";
            std::string out; int rc = 0;
            bool ok = run_cmd_capture(elev_cmd(cmd.str(), "org.BastionGuard.nftables"), &out, &rc);
 
            if (ok && rc == 0)
                std::cout << "[wizard] ✅ " << _("Porte aperte tramite ufw.") << std::endl;
            return ok;
        };
 
        auto try_nft = [&]() -> bool {
            if (!fs::exists("/usr/sbin/nft") && !fs::exists("/usr/bin/nft")) return false;
 
            run_cmd_capture(elev_cmd("modprobe nf_nat 2>/dev/null || true"), nullptr, nullptr);
            run_cmd_capture(elev_cmd("sh -c 'echo nf_nat > /etc/modules-load.d/BastionGuard.conf 2>/dev/null || true'"), nullptr, nullptr);
 
            std::string cmd = elev_cmd(
                "nft add table inet BastionGuard_filter 2>/dev/null || true; "
                "nft add chain inet BastionGuard_filter input { type filter hook input priority 0; policy accept; } 2>/dev/null || true; "
                "nft add rule inet BastionGuard_filter input udp dport 53 accept || true; "
                "nft add rule inet BastionGuard_filter input tcp dport 81 accept || true; "
                "nft add rule inet BastionGuard_filter input tcp dport 444 accept || true; "
                "nft add rule inet BastionGuard_filter input tcp dport 4443 accept || true"
            );
            std::string out; int rc = 0;
            run_cmd_capture(cmd, &out, &rc);
            std::cout << "[wizard] ✅ " << _("Regole nftables applicate (best-effort).") << std::endl;
            return true;
        };
 
        auto try_iptables = [&]() -> bool {
            if (!fs::exists("/sbin/iptables") && !fs::exists("/usr/sbin/iptables")) return false;
            std::string cmd = elev_cmd(
                "iptables -I INPUT -p udp --dport 53 -j ACCEPT || true; "
                "iptables -I INPUT -p tcp --dport 81 -j ACCEPT || true; "
                "iptables -I INPUT -p tcp --dport 444 -j ACCEPT || true; "
                "iptables -I INPUT -p tcp --dport 4443 -j ACCEPT || true"
            );
            std::string out; int rc = 0;
            run_cmd_capture(cmd, &out, &rc);
            std::cout << "[wizard] ✅ " << _("Regole iptables applicate (best-effort).") << std::endl;
            return true;
        };
 
        bool ok = false;
        if (try_firewalld()) ok = true;
        else if (try_ufw()) ok = true;
        else if (try_nft()) ok = true;
        else if (try_iptables()) ok = true;
        else
            std::cerr << "[wizard] ⚠ " << _("Nessuno strumento firewall rilevato; apri manualmente le porte se necessario.") << std::endl;
 
        const char* user = getenv("SUDO_USER");
        if (!user || !*user) {
            const char* pk_uid = getenv("PKEXEC_UID");
            if (pk_uid && *pk_uid) {
                struct passwd* pwuid_entry = getpwuid(static_cast<uid_t>(std::stoi(pk_uid)));
                if (pwuid_entry)
                    user = pwuid_entry->pw_name;
            }
        }
        if (!user || !*user)
            user = getenv("USER");
 
        if (user && *user) {
            std::cout << "[wizard] " << _("Utente effettivo: ") << user << std::endl;
 
            const auto groups = bg_process::run({"id", "-nG", user});
            std::istringstream words(groups.output);
            std::string group;
            bool member = false;
            while (words >> group) {
                if (group == "adm" || group == "systemd-journal") { member = true; break; }
            }
            const int rc_check = groups.ok() && member ? 0 : 1;
 
            if (rc_check != 0) {
                std::ostringstream cmd;
                cmd << "gpasswd -a " << BastionGuard::wizard::shell_quote(user) << " adm; "
                    << "if getent group systemd-journal >/dev/null 2>&1; then "
                    << "gpasswd -a " << BastionGuard::wizard::shell_quote(user) << " systemd-journal; fi";
                std::string out;
                int rc = 0;
                std::cout << "[wizard] " << _("Aggiungo l'utente ai gruppi di log disponibili...") << std::endl;
                bool okgrp = run_cmd_capture(elev_cmd(cmd.str()), &out, &rc);
                if (okgrp && rc == 0) {
                    std::cout << "[wizard] ✅ " << _("Utente aggiunto ai gruppi richiesti.") << std::endl;
                    group_modified = true;
                } else {
                    std::cerr << "[wizard] ⚠ " << _("Errore aggiungendo l'utente ai gruppi: ") << out << std::endl;
                }
            } else {
                std::cout << "[wizard] " << _("Utente già presente in un gruppo di accesso ai log.") << std::endl;
            }
        } else {
            std::cerr << "[wizard] ⚠ " << _("Impossibile determinare l'utente effettivo; salto l'aggiunta ai gruppi.") << std::endl;
        }
 
        if (group_modified) {
            auto* dlg = new Gtk::MessageDialog(
                _("Per completare la configurazione,\ntermina e riavvia la sessione utente."),
                false,
                Gtk::MessageType::INFO,
                Gtk::ButtonsType::OK,
                true
            );
            dlg->set_title(_("BastionGuard - Permessi aggiornati"));
            dlg->set_secondary_text(
                _("I nuovi permessi di accesso ai log diventeranno attivi dopo il logout.\n"
                  "Chiudi e riapri la sessione per visualizzare correttamente l'avvio dell'applicazione BastionGuard.")
            );
            dlg->signal_response().connect([dlg](int) { dlg->hide(); delete dlg; });
            dlg->present();
        }
 
        if (ok) {
        std::cout << "[wizard] " << _("Riavvio del servizio BastionGuard-phishing-scanner...") << std::endl;
 
        {
            std::string out; int rc = 0;
            run_cmd_capture("test -x /usr/libexec/bastionguard/bastionguard-service", &out, &rc);
            if (rc != 0) {
                std::cout << "[wizard] " << _("Gestore servizi non presente: salto il riavvio del servizio.") << std::endl;
            } else {
 
                run_cmd_capture(elev_cmd("/usr/libexec/bastionguard/bastionguard-service --system exists BastionGuard-phishing-scanner.service >/dev/null 2>&1"), &out, &rc);
                if (rc == 0) {
                    run_cmd_capture(elev_cmd("/usr/libexec/bastionguard/bastionguard-service --system restart BastionGuard-phishing-scanner.service >/dev/null 2>&1 || true", "org.BastionGuard.service.manage"), &out, &rc);
 
                    if (rc == 0) {
                        std::cout << "[wizard] ✅ " << _("Servizio BastionGuard-phishing-scanner riavviato.") << std::endl;
                    } else {
                        std::cerr << "[wizard] ⚠ " << _("Tentativo di riavvio eseguito (codice ") << rc << _("). Verifica lo stato del servizio.") << std::endl;
                    }
                } else {
                    std::cout << "[wizard] " << _("Servizio BastionGuard-phishing-scanner non trovato: salto il riavvio.") << std::endl;
                }
            }
        }
    }
        return ok;
 
    } catch (const std::exception& ex) {
        std::cerr << "[wizard] ⚠ " << _("Eccezione in setup_firewall_ports: ") << ex.what() << std::endl;
        return false;
    }
}

References _, bg_process::run(), setup_firewall_ports(), and shell_quote().

Referenced by restore_resolv_backup(), and setup_firewall_ports().

setup_resolv_override()

bool BastionGuard::wizard::setup_resolv_override

(

)

References setup_resolv_override().

Referenced by setup_resolv_override().

shell_quote()

std::string BastionGuard::wizard::shell_quote ( const std::string & argument )

inline

Definition at line 10 of file shell_quote.hpp.

                                                        {
    std::string quoted;
    quoted.reserve(argument.size() + 2);
    quoted.push_back('\'');
    for (const char ch : argument) {
        if (ch == '\'') quoted += "'\"'\"'";
        else quoted.push_back(ch);
    }
    quoted.push_back('\'');
    return quoted;
}

References shell_quote().

Referenced by BastionGuard::wizard::WizardWindow::configure_dnsmasq(), anonymous_namespace{wizard_setup.cpp}::elev_cmd(), BastionGuard::wizard::WizardWindow::run_enable_user_agents(), setup_firewall_ports(), shell_quote(), and BastionGuard::wizard::WizardWindow::worker_run().

user_data_dir()

std::string BastionGuard::wizard::user_data_dir ( )

static

Definition at line 57 of file wizard_window.cpp.

                                 {
    return Glib::build_filename(Glib::get_user_data_dir(), "BastionGuard");
}

References user_data_dir().

Referenced by user_data_dir().