bastionguard-firewall.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include <arpa/inet.h>
#include <cerrno>
#include <cctype>
#include <cstdlib>
#include <cstring>
#include <fcntl.h>
#include <iostream>
#include <limits>
#include <optional>
#include <string>
#include <string_view>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <unordered_set>
#include <vector>
#include <glib/gi18n.h>
 
namespace {
 
constexpr std::string_view kInputPrefix = "/tmp/bastionguard-firewall-ips-";
constexpr off_t kMaxInputBytes = 16 * 1024 * 1024;
constexpr std::size_t kMaxEntries = 250000;
constexpr std::size_t kMaxLineLength = 128;
 
struct SecureInput {
    int fd{-1};
    std::string path;
 
    SecureInput() = default;
    SecureInput(int input_fd, std::string input_path)
        : fd(input_fd), path(std::move(input_path)) {}
 
    SecureInput(const SecureInput&) = delete;
    SecureInput& operator=(const SecureInput&) = delete;
 
    SecureInput(SecureInput&& other) noexcept
        : fd(other.fd), path(std::move(other.path)) {
        other.fd = -1;
    }
 
    SecureInput& operator=(SecureInput&& other) noexcept {
        if (this != &other) {
            if (fd >= 0) ::close(fd);
            fd = other.fd;
            path = std::move(other.path);
            other.fd = -1;
        }
        return *this;
    }
 
    ~SecureInput() {
        if (fd >= 0) ::close(fd);
    }
};
 
std::optional<uid_t> parse_uid(const char* value) {
    if (!value || !*value) return std::nullopt;
 
    unsigned long long parsed = 0;
    for (const unsigned char ch : std::string(value)) {
        if (!std::isdigit(ch)) return std::nullopt;
        parsed = parsed * 10 + static_cast<unsigned long long>(ch - '0');
        if (parsed > std::numeric_limits<uid_t>::max()) return std::nullopt;
    }
 
    return static_cast<uid_t>(parsed);
}
 
uid_t original_caller_uid() {
    if (const auto uid = parse_uid(std::getenv("PKEXEC_UID"))) {
        return *uid;
    }
    return ::getuid();
}
 
bool allowed_input_path(const std::string& path) {
    if (!path.starts_with(kInputPrefix)) return false;
 
    const std::string_view suffix(path.data() + kInputPrefix.size(),
                                  path.size() - kInputPrefix.size());
    return !suffix.empty() && suffix.find('/') == std::string_view::npos;
}
 
std::optional<SecureInput> open_input_securely(const std::string& path,
                                                uid_t caller_uid) {
    if (!allowed_input_path(path)) {
        std::cerr << _("[Firewall] Percorso input non autorizzato.\n");
        return std::nullopt;
    }
 
    const int fd = ::open(path.c_str(), O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
    if (fd < 0) {
        std::cerr << _("[Firewall] Impossibile aprire il file input: ")
                  << std::strerror(errno) << "\n";
        return std::nullopt;
    }
 
    struct stat st {};
    if (::fstat(fd, &st) != 0) {
        std::cerr << _("[Firewall] fstat fallita: ")
                  << std::strerror(errno) << "\n";
        ::close(fd);
        return std::nullopt;
    }
 
    const bool ownership_ok =
        (caller_uid == 0 && st.st_uid == 0) ||
        (caller_uid != 0 && st.st_uid == caller_uid);
 
    if (!S_ISREG(st.st_mode) ||
        st.st_nlink != 1 ||
        !ownership_ok ||
        (st.st_mode & (S_IWGRP | S_IWOTH)) != 0 ||
        st.st_size <= 0 ||
        st.st_size > kMaxInputBytes) {
        std::cerr << _("[Firewall] File input non sicuro o non valido.\n");
        ::close(fd);
        return std::nullopt;
    }
 
    // The descriptor remains valid after unlink and cannot be replaced through
    // the pathname while the privileged process is reading it.
    if (::unlink(path.c_str()) != 0) {
        std::cerr << _("[Firewall] Impossibile rimuovere il file temporaneo: ")
                  << std::strerror(errno) << "\n";
        ::close(fd);
        return std::nullopt;
    }
 
    return SecureInput(fd, path);
}
 
std::string trim(std::string value) {
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos) return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}
 
bool is_valid_ip(const std::string& value) {
    if (value.empty() || value.size() > kMaxLineLength) return false;
 
    in_addr ipv4 {};
    if (::inet_pton(AF_INET, value.c_str(), &ipv4) == 1) return true;
 
    in6_addr ipv6 {};
    return ::inet_pton(AF_INET6, value.c_str(), &ipv6) == 1;
}
 
std::vector<std::string> load_and_validate_ips(int fd) {
    std::string data;
    data.reserve(64 * 1024);
 
    char buffer[8192];
    while (true) {
        const ssize_t count = ::read(fd, buffer, sizeof(buffer));
        if (count == 0) break;
        if (count < 0) {
            if (errno == EINTR) continue;
            std::cerr << _("[Firewall] Errore lettura file input: ")
                      << std::strerror(errno) << "\n";
            return {};
        }
 
        if (data.size() + static_cast<std::size_t>(count) >
            static_cast<std::size_t>(kMaxInputBytes)) {
            std::cerr << _("[Firewall] File input troppo grande.\n");
            return {};
        }
        data.append(buffer, static_cast<std::size_t>(count));
    }
 
    std::vector<std::string> ips;
    std::unordered_set<std::string> seen;
    std::size_t start = 0;
 
    while (start <= data.size()) {
        const auto end = data.find('\n', start);
        std::string line = trim(data.substr(
            start,
            end == std::string::npos ? std::string::npos : end - start));
 
        if (!line.empty() && line.front() != '#') {
            if (!is_valid_ip(line)) {
                std::cerr << _("[Firewall] Voce IP rifiutata: ") << line << "\n";
                return {};
            }
 
            if (seen.insert(line).second) {
                ips.push_back(std::move(line));
                if (ips.size() > kMaxEntries) {
                    std::cerr << _("[Firewall] Troppe voci nel file input.\n");
                    return {};
                }
            }
        }
 
        if (end == std::string::npos) break;
        start = end + 1;
    }
 
    return ips;
}
 
std::optional<std::string> find_program(
    std::initializer_list<const char*> candidates) {
    for (const char* candidate : candidates) {
        if (::access(candidate, X_OK) == 0) return std::string(candidate);
    }
    return std::nullopt;
}
 
bool run_program(const std::string& executable,
                 const std::vector<std::string>& arguments,
                 bool silence_stderr = false) {
    std::vector<std::string> storage;
    storage.reserve(arguments.size() + 1);
    storage.push_back(executable);
    storage.insert(storage.end(), arguments.begin(), arguments.end());
 
    std::vector<char*> argv;
    argv.reserve(storage.size() + 1);
    for (auto& value : storage) argv.push_back(value.data());
    argv.push_back(nullptr);
 
    const pid_t pid = ::fork();
    if (pid < 0) return false;
 
    if (pid == 0) {
        if (silence_stderr) {
            const int null_fd = ::open("/dev/null", O_WRONLY | O_CLOEXEC);
            if (null_fd >= 0) {
                ::dup2(null_fd, STDERR_FILENO);
                if (null_fd != STDERR_FILENO) ::close(null_fd);
            }
        }
 
        ::execv(executable.c_str(), argv.data());
        _exit(127);
    }
 
    int status = 0;
    while (::waitpid(pid, &status, 0) < 0) {
        if (errno == EINTR) continue;
        return false;
    }
 
    return WIFEXITED(status) && WEXITSTATUS(status) == 0;
}
 
bool apply_ufw(const std::vector<std::string>& ips) {
    const auto ufw = find_program({"/usr/sbin/ufw", "/usr/bin/ufw"});
    if (!ufw) return false;
 
    if (!run_program(*ufw, {"--force", "enable"})) return false;
 
    bool success = true;
    for (const auto& ip : ips) {
        if (!run_program(*ufw, {"deny", "from", ip})) success = false;
    }
    return success;
}
 
bool apply_firewalld(const std::vector<std::string>& ips) {
    const auto firewall_cmd =
        find_program({"/usr/bin/firewall-cmd", "/usr/sbin/firewall-cmd"});
    if (!firewall_cmd) return false;
 
    // These operations are idempotent from BastionGuard's perspective. An
    // already existing ipset/source association is not fatal.
    run_program(*firewall_cmd,
                {"--permanent", "--new-ipset=bastionguard-blacklist",
                 "--type=hash:ip"},
                true);
    run_program(*firewall_cmd,
                {"--permanent", "--zone=public",
                 "--add-source-ipset=bastionguard-blacklist"},
                true);
 
    bool success = true;
    for (const auto& ip : ips) {
        if (!run_program(*firewall_cmd,
                         {"--permanent",
                          "--ipset=bastionguard-blacklist",
                          "--add-entry=" + ip},
                         true)) {
            // Duplicate entries may return a non-zero status. Continue and let
            // reload determine whether firewalld is operational.
            success = false;
        }
    }
 
    const bool reloaded = run_program(*firewall_cmd, {"--reload"});
    return reloaded && (success || !ips.empty());
}
 
void clear_firewall() {
    if (const auto ufw = find_program({"/usr/sbin/ufw", "/usr/bin/ufw"})) {
        run_program(*ufw, {"--force", "reset"});
    }
 
    if (const auto firewall_cmd =
            find_program({"/usr/bin/firewall-cmd", "/usr/sbin/firewall-cmd"})) {
        run_program(*firewall_cmd,
                    {"--permanent", "--delete-ipset=bastionguard-blacklist"},
                    true);
        run_program(*firewall_cmd, {"--reload"});
    }
}
 
} // namespace
 
int main(int argc, char* argv[]) {
    const uid_t caller_uid = original_caller_uid();
 
    ::clearenv();
    ::setenv("PATH", "/usr/sbin:/usr/bin:/sbin:/bin", 1);
 
    if (::geteuid() != 0) {
        std::cerr << _("[Firewall] Deve essere eseguito come root tramite pkexec.\n");
        return 10;
    }
 
    if (argc < 2) {
        std::cerr << "Uso: " << argv[0] << " apply <input-file>|clear\n";
        return 1;
    }
 
    const std::string action = argv[1];
 
    if (action == "clear") {
        if (argc != 2) return 1;
        clear_firewall();
        std::cout << _("[Firewall] Regole rimosse.\n");
        return 0;
    }
 
    if (action != "apply" || argc != 3) {
        std::cerr << _("[Firewall] Comando non valido.\n");
        return 2;
    }
 
    auto input = open_input_securely(argv[2], caller_uid);
    if (!input) return 3;
 
    auto ips = load_and_validate_ips(input->fd);
    if (ips.empty()) {
        std::cerr << _("[Firewall] Blacklist vuota o non valida.\n");
        return 4;
    }
 
    const bool ok = apply_firewalld(ips) || apply_ufw(ips);
 
    if (ok) {
        std::cout << _("[Firewall] Regole applicate (")
                  << ips.size() << _(" IP).\n");
        return 0;
    }
 
    std::cerr << _("[Firewall] Nessun firewall supportato o applicazione fallita.\n");
    return 5;
}