BastionGuard-pac.cpp File Reference

Go to the source code of this file.

Classes
struct	PaymentsCache
struct	TriggerState

Functions
static std::string	home_dir ()
static fs::path	xdg_data_home ()
static fs::path	payments_json_user_path ()
static fs::path	payments_json_system_path ()
static bool	read_all (const fs::path &p, std::string &out)
static bool	write_all_atomic (const fs::path &p, const std::string &data)
static std::string	to_lower (std::string s)
static std::string	normalize_domain_or_url (std::string in)
static void	seed_user_payments_from_system_if_missing ()
static std::vector< std::string >	load_payments_domains_from_user_json ()
static std::string	generate_pac (const std::vector< std::string > &pay_domains, const std::string &stub_proxy_host, int stub_proxy_port)
static std::string	http_response_200 (const std::string &body, const std::string &content_type)
static std::string	http_response_404 ()
static std::string	http_response_405 ()
static int	run_trigger_cmd (const std::string &cmd)
static bool	wait_backend_up (const std::string &backend_host, int backend_port, int wait_ms)
static void	forward_bidirectional (tcp::socket a, tcp::socket b)
static void	handle_proxy_client (tcp::socket client, TriggerState &trig, const std::string &trigger_cmd, const std::string &backend_host, int backend_port, int backend_wait_ms)
static void	serve_pac_one (tcp::socket sock, PaymentsCache &cache, std::mutex &cache_mtx, const std::string &stub_proxy_host, int stub_proxy_port)
int	main (int argc, char **argv)

Function Documentation

forward_bidirectional()

void forward_bidirectional ( tcp::socket a, tcp::socket b )

static

Definition at line 336 of file BastionGuard-pac.cpp.

                                                            {
    auto pump = [](tcp::socket& src, tcp::socket& dst) {
        try {
            std::array<char, 16 * 1024> buf{};
            for (;;) {
                boost::system::error_code ec;
                std::size_t n = src.read_some(asio::buffer(buf), ec);
                if (ec || n == 0) break;
                asio::write(dst, asio::buffer(buf.data(), n));
            }
        } catch (...) {}
        // chiusura best-effort
        boost::system::error_code ignore;
        dst.shutdown(tcp::socket::shutdown_send, ignore);
    };
 
    std::thread t1(pump, std::ref(a), std::ref(b));
    std::thread t2(pump, std::ref(b), std::ref(a));
    t1.join();
    t2.join();
 
    boost::system::error_code ignore;
    a.close(ignore);
    b.close(ignore);
}

References forward_bidirectional().

Referenced by forward_bidirectional(), and handle_proxy_client().

generate_pac()

std::string generate_pac ( const std::vector< std::string > & pay_domains, const std::string & stub_proxy_host, int stub_proxy_port )

static

Definition at line 222 of file BastionGuard-pac.cpp.

{
    std::ostringstream pac;
 
    pac << "// BastionGuard - Secure Payments PAC\n";
    pac << "// Generated from payments.json (served by bastionguard-pacd)\n\n";
 
    pac << "function dnsDomainIs(host, domain) {\n";
    pac << "  return host === domain || (host.length > domain.length && host.substring(host.length - domain.length - 1) === \".\" + domain);\n";
    pac << "}\n\n";
 
    pac << "function FindProxyForURL(url, host) {\n";
    pac << "  host = host.toLowerCase();\n\n";
 
    pac << "  // bypass locali\n";
    pac << "  if (isPlainHostName(host) ||\n";
    pac << "      shExpMatch(host, \"localhost\") ||\n";
    pac << "      shExpMatch(host, \"127.*\") ||\n";
    pac << "      shExpMatch(host, \"10.*\") ||\n";
    pac << "      shExpMatch(host, \"192.168.*\") ||\n";
    pac << "      shExpMatch(host, \"172.16.*\") || shExpMatch(host, \"172.17.*\") || shExpMatch(host, \"172.18.*\") ||\n";
    pac << "      shExpMatch(host, \"172.19.*\") || shExpMatch(host, \"172.2?.*\") || shExpMatch(host, \"172.3?.*\")) {\n";
    pac << "    return \"DIRECT\";\n";
    pac << "  }\n\n";
 
    pac << "  var pay = [\n";
    for (size_t i = 0; i < pay_domains.size(); ++i) {
        pac << "    \"" << pay_domains[i] << "\"";
        if (i + 1 < pay_domains.size()) pac << ",";
        pac << "\n";
    }
    pac << "  ];\n\n";
 
    pac << "  for (var i = 0; i < pay.length; i++) {\n";
    pac << "    if (dnsDomainIs(host, pay[i])) {\n";
    pac << "      return \"PROXY " << stub_proxy_host << ":" << stub_proxy_port << "\";\n";
    pac << "    }\n";
    pac << "  }\n\n";
 
    pac << "  return \"DIRECT\";\n";
    pac << "}\n";
 
    return pac.str();
}

References generate_pac().

Referenced by generate_pac(), and serve_pac_one().

handle_proxy_client()

void handle_proxy_client ( tcp::socket client, TriggerState & trig, const std::string & trigger_cmd, const std::string & backend_host, int backend_port, int backend_wait_ms )

static

Definition at line 368 of file BastionGuard-pac.cpp.

{
    {
        std::lock_guard<std::mutex> lk(trig.mtx);
        auto now = std::chrono::steady_clock::now();
        bool should_start = !trig.started.load();
 
        if (!should_start) {
            if (trig.last_start.time_since_epoch().count() != 0 &&
                now - trig.last_start < std::chrono::seconds(1)) {
                should_start = false;
            }
        }
 
        if (should_start) {
            trig.last_start = now;
            int rc = run_trigger_cmd(trigger_cmd);
            if (rc == 0) {
                trig.started.store(true);
                std::cerr << "[pacd] trigger executed: " << trigger_cmd << "\n";
            } else {
                std::cerr << "[pacd] trigger failed rc=" << rc << ": " << trigger_cmd << "\n";
            }
        }
    }
 
    if (!wait_backend_up(backend_host, backend_port, backend_wait_ms)) {
        std::cerr << "[pacd] backend not ready " << backend_host << ":" << backend_port
                  << " after " << backend_wait_ms << "ms\n";
        boost::system::error_code ignore;
        client.close(ignore);
        return;
    }
 
    try {
        asio::io_context io;
        tcp::resolver res(io);
        auto eps = res.resolve(backend_host, std::to_string(backend_port));
 
        tcp::socket backend(io);
        boost::system::error_code ec;
        asio::connect(backend, eps, ec);
        if (ec) {
            std::cerr << "[pacd] connect backend failed: " << ec.message() << "\n";
            boost::system::error_code ignore;
            client.close(ignore);
            return;
        }
 
        forward_bidirectional(std::move(client), std::move(backend));
    } catch (const std::exception& ex) {
        std::cerr << "[pacd] forward fatal: " << ex.what() << "\n";
        boost::system::error_code ignore;
        client.close(ignore);
    }
}

References forward_bidirectional(), handle_proxy_client(), TriggerState::last_start, TriggerState::mtx, run_trigger_cmd(), TriggerState::started, and wait_backend_up().

Referenced by handle_proxy_client(), and main().

home_dir()

std::string home_dir ( )

static

Definition at line 50 of file BastionGuard-pac.cpp.

                            {
    const char* h = std::getenv("HOME");
    return (h && *h) ? std::string(h) : std::string();
}

References home_dir().

Referenced by home_dir(), and xdg_data_home().

http_response_200()

std::string http_response_200 ( const std::string & body, const std::string & content_type )

static

Definition at line 270 of file BastionGuard-pac.cpp.

                                                                                         {
    std::ostringstream oss;
    oss << "HTTP/1.1 200 OK\r\n";
    oss << "Content-Type: " << content_type << "\r\n";
    oss << "Cache-Control: no-cache, no-store, must-revalidate\r\n";
    oss << "Pragma: no-cache\r\n";
    oss << "Expires: 0\r\n";
    oss << "Content-Length: " << body.size() << "\r\n";
    oss << "Connection: close\r\n\r\n";
    oss << body;
    return oss.str();
}

References http_response_200().

Referenced by http_response_200(), and serve_pac_one().

http_response_404()

std::string http_response_404 ( )

static

Definition at line 283 of file BastionGuard-pac.cpp.

                                     {
    const std::string body = "Not Found\n";
    std::ostringstream oss;
    oss << "HTTP/1.1 404 Not Found\r\n";
    oss << "Content-Type: text/plain\r\n";
    oss << "Content-Length: " << body.size() << "\r\n";
    oss << "Connection: close\r\n\r\n";
    oss << body;
    return oss.str();
}

References http_response_404().

Referenced by http_response_404(), and serve_pac_one().

http_response_405()

std::string http_response_405 ( )

static

Definition at line 294 of file BastionGuard-pac.cpp.

                                     {
    const std::string body = "Method Not Allowed\n";
    std::ostringstream oss;
    oss << "HTTP/1.1 405 Method Not Allowed\r\n";
    oss << "Content-Type: text/plain\r\n";
    oss << "Content-Length: " << body.size() << "\r\n";
    oss << "Connection: close\r\n\r\n";
    oss << body;
    return oss.str();
}

References http_response_405().

Referenced by http_response_405(), and serve_pac_one().

load_payments_domains_from_user_json()

std::vector< std::string > load_payments_domains_from_user_json ( )

static

Definition at line 191 of file BastionGuard-pac.cpp.

                                                                   {
    seed_user_payments_from_system_if_missing();
    fs::path u = payments_json_user_path();
 
    std::vector<std::string> out;
    try {
        std::ifstream in(u, std::ios::binary);
        if (!in.good()) return out;
 
        json j; in >> j;
        if (j.contains("list") && j["list"].is_array()) {
            for (const auto& v : j["list"]) {
                if (!v.is_string()) continue;
                auto d = normalize_domain_or_url(v.get<std::string>());
                if (!d.empty()) out.push_back(d);
            }
        }
 
        std::sort(out.begin(), out.end());
        out.erase(std::unique(out.begin(), out.end()), out.end());
    } catch (...) {
    }
    return out;
}

References load_payments_domains_from_user_json(), normalize_domain_or_url(), payments_json_user_path(), and seed_user_payments_from_system_if_missing().

Referenced by load_payments_domains_from_user_json(), and serve_pac_one().

main()

int main	(	int	argc,
		char **	argv )

Definition at line 490 of file BastionGuard-pac.cpp.

                                {
    // PAC server
    std::string listen_host = "127.0.0.1";
    int listen_port = 8765;
 
    std::string stub_host = "127.0.0.1";
    int stub_port = 3129;
 
    std::string backend_host = "127.0.0.1";
    int backend_port = 3130;
 
    std::string trigger_cmd = "/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service";
 
    int backend_wait_ms = 2000;
 
    // args
    for (int i = 1; i < argc; ++i) {
        std::string a = argv[i];
        auto take = [&](std::string& s){ if (i + 1 < argc) s = argv[++i]; };
        auto take_int = [&](int& v){
            if (i + 1 < argc) {
                try {
                    v = std::stoi(argv[++i]);
                } catch (...) {
                    std::cerr << "[pacd] ⚠️ argomento non numerico per " << a
                              << ": " << argv[i] << " (uso default " << v << ")\n";
                }
            }
        };
 
        if (a == "--listen") take(listen_host);
        else if (a == "--port") take_int(listen_port);
        else if (a == "--stub-host") take(stub_host);
        else if (a == "--stub-port") take_int(stub_port);
        else if (a == "--backend-host") take(backend_host);
        else if (a == "--backend-port") take_int(backend_port);
        else if (a == "--trigger-cmd") take(trigger_cmd);
        else if (a == "--backend-wait-ms") take_int(backend_wait_ms);
        else if (a == "--help") {
            std::cout <<
                "bastionguard-pacd\n"
                "  --listen 127.0.0.1 --port 8765                (PAC server)\n"
                "  --stub-host 127.0.0.1 --stub-port 3129        (stub proxy - PAC points here)\n"
                "  --backend-host 127.0.0.1 --backend-port 3130  (CEF proxy backend)\n"
                "  --trigger-cmd \"/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service\"\n"
                "  --backend-wait-ms 2000\n";
            return 0;
        }
    }
 
    if (!BastionGuard::Platform::cef_available()) {
        trigger_cmd.clear();
        std::cerr << "[pacd] CEF disabilitato: il comando di avvio backend è stato rimosso.\n";
    }
 
    seed_user_payments_from_system_if_missing();
    fs::path u = payments_json_user_path();
    std::cerr << "[pacd] using payments file: " << u.string() << "\n";
    std::cerr << "[pacd] PAC: http://" << listen_host << ":" << listen_port << "/proxy.pac\n";
    std::cerr << "[pacd] stub proxy listening " << stub_host << ":" << stub_port << "\n";
    std::cerr << "[pacd] backend proxy target " << backend_host << ":" << backend_port << "\n";
    std::cerr << "[pacd] trigger: " << trigger_cmd << "\n";
 
    std::atomic<bool> running{true};
 
    // Gestione segnali (stop pulito)
    asio::io_context sigio;
    asio::signal_set signals(sigio, SIGINT, SIGTERM, SIGHUP);
    signals.async_wait([&](const boost::system::error_code&, int sig){
        if (sig == SIGHUP) {
            std::cerr << "[pacd] SIGHUP received, exiting for restart\n";
        }
        running.store(false);
        sigio.stop();
    });
    std::thread signal_thread([&]{ sigio.run(); });
 
    PaymentsCache cache;
    std::mutex cache_mtx;
 
    TriggerState trig;
 
    std::thread pac_thread([&]{
        try {
            asio::io_context io;
            tcp::endpoint ep(asio::ip::make_address(listen_host), (unsigned short)listen_port);
            tcp::acceptor acceptor(io, ep);
 
            while (running.load()) {
                tcp::socket sock(io);
                boost::system::error_code ec;
                acceptor.accept(sock, ec);
                if (ec) {
                    if (!running.load()) break;
                    continue;
                }
                serve_pac_one(std::move(sock), cache, cache_mtx, stub_host, stub_port);
            }
        } catch (const std::exception& ex) {
            std::cerr << "[pacd] PAC server fatal: " << ex.what() << "\n";
        }
    });
 
    std::thread proxy_thread([&]{
        try {
            asio::io_context io;
            tcp::endpoint ep(asio::ip::make_address(stub_host), (unsigned short)stub_port);
            tcp::acceptor acceptor(io, ep);
 
            while (running.load()) {
                tcp::socket client(io);
                boost::system::error_code ec;
                acceptor.accept(client, ec);
                if (ec) {
                    if (!running.load()) break;
                    continue;
                }
                std::thread(
                    handle_proxy_client,
                    std::move(client),
                    std::ref(trig),
                    trigger_cmd,
                    backend_host,
                    backend_port,
                    backend_wait_ms
                ).detach();
            }
        } catch (const std::exception& ex) {
            std::cerr << "[pacd] proxy stub fatal: " << ex.what() << "\n";
        }
    });
 
    pac_thread.join();
    proxy_thread.join();
 
    if (signal_thread.joinable()) signal_thread.join();
    return 0;
}

References BastionGuard::Platform::cef_available(), handle_proxy_client(), main(), payments_json_user_path(), running, seed_user_payments_from_system_if_missing(), and serve_pac_one().

normalize_domain_or_url()

std::string normalize_domain_or_url ( std::string in )

static

Definition at line 118 of file BastionGuard-pac.cpp.

                                                       {
    auto l = in.find_first_not_of(" \t\r\n");
    auto r = in.find_last_not_of(" \t\r\n");
    if (l == std::string::npos) return {};
    in = in.substr(l, r - l + 1);
 
    auto p = in.find("://");
    if (p != std::string::npos) in.erase(0, p + 3);
 
    p = in.find('/');
    if (p != std::string::npos) in.erase(p);
 
    p = in.find('@');
    if (p != std::string::npos) in = in.substr(p + 1);
 
    p = in.find(':');
    if (p != std::string::npos) in.erase(p);
 
    if (in.rfind("www.", 0) == 0) in.erase(0, 4);
 
    in = to_lower(in);
 
    auto is_ok = [](char c){
        return (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '.' || c == '-';
    };
    if (in.size() < 4) return {};
    for (char c : in) if (!is_ok(c)) return {};
    if (in.find('.') == std::string::npos) return {};
    if (in.front() == '.' || in.back() == '.') return {};
    return in;
}

References normalize_domain_or_url(), and to_lower().

Referenced by load_payments_domains(), load_payments_domains_from_user_json(), normalize_domain_or_url(), normalize_domain_or_url(), and save_payments_domains().

payments_json_system_path()

fs::path payments_json_system_path ( )

static

Definition at line 70 of file BastionGuard-pac.cpp.

                                          {
    return fs::path("/usr/share/BastionGuard/data/payments/payments.json");
}

References payments_json_system_path().

Referenced by payments_json_system_path(), and seed_user_payments_from_system_if_missing().

payments_json_user_path()

fs::path payments_json_user_path ( )

static

Definition at line 64 of file BastionGuard-pac.cpp.

                                        {
    fs::path base = xdg_data_home();
    if (base.empty()) return {};
    return base / "BastionGuard" / "payments" / "payments.json";
}

References payments_json_user_path(), and xdg_data_home().

Referenced by load_payments_domains_from_user_json(), main(), payments_json_user_path(), seed_user_payments_from_system_if_missing(), and serve_pac_one().

read_all()

bool read_all ( const fs::path & p, std::string & out )

static

Definition at line 74 of file BastionGuard-pac.cpp.

                                                      {
    std::ifstream in(p, std::ios::binary);
    if (!in.good()) return false;
    std::ostringstream ss;
    ss << in.rdbuf();
    out = ss.str();
    return true;
}

References read_all().

Referenced by read_all(), and seed_user_payments_from_system_if_missing().

run_trigger_cmd()

int run_trigger_cmd ( const std::string & cmd )

static

Definition at line 306 of file BastionGuard-pac.cpp.

                                                 {
    // A trigger is reached from a localhost TCP listener. Never pass its
    // configurable command string to /bin/sh. Only allow the packaged action.
    if (cmd.empty()) return 0;
    if (cmd != "/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service")
        return 64;
    return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user",
                            "start", "BastionGuard-cef.service"}).exit_code;
}

References bg_process::run(), and run_trigger_cmd().

Referenced by handle_proxy_client(), and run_trigger_cmd().

seed_user_payments_from_system_if_missing()

void seed_user_payments_from_system_if_missing ( )

static

Definition at line 150 of file BastionGuard-pac.cpp.

                                                        {
    fs::path u = payments_json_user_path();
    fs::path s = payments_json_system_path();
    if (u.empty()) return;
 
    std::error_code ec;
    bool u_exists = fs::exists(u, ec) && !ec;
    ec.clear();
    bool s_exists = fs::exists(s, ec) && !ec;
 
    if (u_exists) return;
 
    if (s_exists) {
        std::string data;
        if (read_all(s, data)) {
            (void)write_all_atomic(u, data);
        }
        return;
    }
 
    json j;
    j["version"] = 1;
    j["updated_at"] = "1970-01-01";
    j["enabled"] = false;
    j["list"] = json::array({
        "paypal.com",
        "stripe.com",
        "adyen.com",
        "klarna.com",
        "checkout.com",
        "worldpay.com",
        "braintreepayments.com",
        "braintreegateway.com",
        "amazonpay.com",
        "pay.google.com",
        "pay.apple.com",
        "amazon.com"
    });
    (void)write_all_atomic(u, j.dump(2));
}

References payments_json_system_path(), payments_json_user_path(), read_all(), seed_user_payments_from_system_if_missing(), and write_all_atomic().

Referenced by load_payments_domains_from_user_json(), main(), seed_user_payments_from_system_if_missing(), and serve_pac_one().

serve_pac_one()

void serve_pac_one ( tcp::socket sock, PaymentsCache & cache, std::mutex & cache_mtx, const std::string & stub_proxy_host, int stub_proxy_port )

static

Definition at line 431 of file BastionGuard-pac.cpp.

{
    try {
        asio::streambuf buf;
        asio::read_until(sock, buf, "\r\n\r\n");
 
        std::istream is(&buf);
        std::string request_line;
        std::getline(is, request_line);
        if (!request_line.empty() && request_line.back() == '\r')
            request_line.pop_back();
 
        std::string method, path, ver;
        {
            std::istringstream rl(request_line);
            rl >> method >> path >> ver;
        }
 
        if (method != "GET") {
            auto resp = http_response_405();
            asio::write(sock, asio::buffer(resp));
            return;
        }
        if (path != "/proxy.pac") {
            auto resp = http_response_404();
            asio::write(sock, asio::buffer(resp));
            return;
        }
 
        seed_user_payments_from_system_if_missing();
        fs::path pj = payments_json_user_path();
 
        std::error_code ec;
        fs::file_time_type mtime = fs::last_write_time(pj, ec);
 
        std::vector<std::string> domains;
        {
            std::lock_guard<std::mutex> lk(cache_mtx);
            if (!cache.loaded || (!ec && mtime != cache.last_mtime)) {
                cache.domains = load_payments_domains_from_user_json();
                cache.last_mtime = mtime;
                cache.loaded = true;
            }
            domains = cache.domains;
        }
 
        std::string pac = generate_pac(domains, stub_proxy_host, stub_proxy_port);
        auto resp = http_response_200(pac, "application/x-ns-proxy-autoconfig");
        asio::write(sock, asio::buffer(resp));
    } catch (...) {
    }
}

References PaymentsCache::domains, generate_pac(), http_response_200(), http_response_404(), http_response_405(), PaymentsCache::last_mtime, load_payments_domains_from_user_json(), PaymentsCache::loaded, payments_json_user_path(), seed_user_payments_from_system_if_missing(), and serve_pac_one().

Referenced by main(), and serve_pac_one().

to_lower()

std::string to_lower ( std::string s )

static

Definition at line 112 of file BastionGuard-pac.cpp.

                                       {
    std::transform(s.begin(), s.end(), s.begin(),
                   [](unsigned char c){ return (char)std::tolower(c); });
    return s;
}

References to_lower().

Referenced by clean_domain(), clean_domain(), normalize_domain_or_url(), to_lower(), to_lower(), to_lower(), and to_lower().

wait_backend_up()

bool wait_backend_up ( const std::string & backend_host, int backend_port, int wait_ms )

static

Definition at line 316 of file BastionGuard-pac.cpp.

                                                                                          {
    try {
        asio::io_context io;
        tcp::resolver res(io);
        auto eps = res.resolve(backend_host, std::to_string(backend_port));
 
        auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(wait_ms);
        while (std::chrono::steady_clock::now() < deadline) {
            for (auto& ep : eps) {
                tcp::socket s(io);
                boost::system::error_code ec;
                s.connect(ep.endpoint(), ec);
                if (!ec) return true;
            }
            std::this_thread::sleep_for(std::chrono::milliseconds(50));
        }
    } catch (...) {}
    return false;
}

References wait_backend_up().

Referenced by handle_proxy_client(), and wait_backend_up().

write_all_atomic()

bool write_all_atomic ( const fs::path & p, const std::string & data )

static

Definition at line 83 of file BastionGuard-pac.cpp.

                                                                     {
    std::error_code ec;
    fs::create_directories(p.parent_path(), ec);
 
    fs::path tmp = p;
    tmp += ".tmp";
 
    std::ofstream out(tmp, std::ios::binary | std::ios::trunc);
    if (!out.good()) return false;
    out.write(data.data(), (std::streamsize)data.size());
    out.close();
    if (!out.good()) return false;
 
    fs::rename(tmp, p, ec);
    if (!ec) return true;
 
    try {
        std::ofstream out2(p, std::ios::binary | std::ios::trunc);
        if (!out2.good()) return false;
        out2.write(data.data(), (std::streamsize)data.size());
        out2.close();
        std::error_code ec2;
        fs::remove(tmp, ec2);
        return out2.good();
    } catch (...) {
        return false;
    }
}

References write_all_atomic().

Referenced by seed_user_payments_from_system_if_missing(), and write_all_atomic().

xdg_data_home()

fs::path xdg_data_home ( )

static

Definition at line 55 of file BastionGuard-pac.cpp.

                              {
    if (const char* xdg = std::getenv("XDG_DATA_HOME"); xdg && *xdg) {
        return fs::path(xdg);
    }
    const std::string h = home_dir();
    if (!h.empty()) return fs::path(h) / ".local" / "share";
    return {};
}

References home_dir(), and xdg_data_home().

Referenced by payments_json_user_path(), and xdg_data_home().