BastionGuard-pac.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
 
#include "../DistroUtils.hpp"
#include "../SafeProcess.hpp"
 
#include <boost/asio.hpp>
#include <boost/asio/signal_set.hpp>
 
#include <nlohmann/json.hpp>
 
#include <algorithm>
#include <atomic>
#include <cctype>
#include <chrono>
#include <cstdlib>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <mutex>
#include <sstream>
#include <string>
#include <thread>
#include <vector>
 
namespace fs   = std::filesystem;
namespace asio = boost::asio;
using tcp      = asio::ip::tcp;
using json     = nlohmann::json;
 
 
static std::string home_dir() {
    const char* h = std::getenv("HOME");
    return (h && *h) ? std::string(h) : std::string();
}
 
static fs::path xdg_data_home() {
    if (const char* xdg = std::getenv("XDG_DATA_HOME"); xdg && *xdg) {
        return fs::path(xdg);
    }
    const std::string h = home_dir();
    if (!h.empty()) return fs::path(h) / ".local" / "share";
    return {};
}
 
static fs::path payments_json_user_path() {
    fs::path base = xdg_data_home();
    if (base.empty()) return {};
    return base / "BastionGuard" / "payments" / "payments.json";
}
 
static fs::path payments_json_system_path() {
    return fs::path("/usr/share/BastionGuard/data/payments/payments.json");
}
 
static bool read_all(const fs::path& p, std::string& out) {
    std::ifstream in(p, std::ios::binary);
    if (!in.good()) return false;
    std::ostringstream ss;
    ss << in.rdbuf();
    out = ss.str();
    return true;
}
 
static bool write_all_atomic(const fs::path& p, const std::string& data) {
    std::error_code ec;
    fs::create_directories(p.parent_path(), ec);
 
    fs::path tmp = p;
    tmp += ".tmp";
 
    std::ofstream out(tmp, std::ios::binary | std::ios::trunc);
    if (!out.good()) return false;
    out.write(data.data(), (std::streamsize)data.size());
    out.close();
    if (!out.good()) return false;
 
    fs::rename(tmp, p, ec);
    if (!ec) return true;
 
    try {
        std::ofstream out2(p, std::ios::binary | std::ios::trunc);
        if (!out2.good()) return false;
        out2.write(data.data(), (std::streamsize)data.size());
        out2.close();
        std::error_code ec2;
        fs::remove(tmp, ec2);
        return out2.good();
    } catch (...) {
        return false;
    }
}
 
static std::string to_lower(std::string s) {
    std::transform(s.begin(), s.end(), s.begin(),
                   [](unsigned char c){ return (char)std::tolower(c); });
    return s;
}
 
static std::string normalize_domain_or_url(std::string in) {
    auto l = in.find_first_not_of(" \t\r\n");
    auto r = in.find_last_not_of(" \t\r\n");
    if (l == std::string::npos) return {};
    in = in.substr(l, r - l + 1);
 
    auto p = in.find("://");
    if (p != std::string::npos) in.erase(0, p + 3);
 
    p = in.find('/');
    if (p != std::string::npos) in.erase(p);
 
    p = in.find('@');
    if (p != std::string::npos) in = in.substr(p + 1);
 
    p = in.find(':');
    if (p != std::string::npos) in.erase(p);
 
    if (in.rfind("www.", 0) == 0) in.erase(0, 4);
 
    in = to_lower(in);
 
    auto is_ok = [](char c){
        return (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '.' || c == '-';
    };
    if (in.size() < 4) return {};
    for (char c : in) if (!is_ok(c)) return {};
    if (in.find('.') == std::string::npos) return {};
    if (in.front() == '.' || in.back() == '.') return {};
    return in;
}
 
static void seed_user_payments_from_system_if_missing() {
    fs::path u = payments_json_user_path();
    fs::path s = payments_json_system_path();
    if (u.empty()) return;
 
    std::error_code ec;
    bool u_exists = fs::exists(u, ec) && !ec;
    ec.clear();
    bool s_exists = fs::exists(s, ec) && !ec;
 
    if (u_exists) return;
 
    if (s_exists) {
        std::string data;
        if (read_all(s, data)) {
            (void)write_all_atomic(u, data);
        }
        return;
    }
 
    json j;
    j["version"] = 1;
    j["updated_at"] = "1970-01-01";
    j["enabled"] = false;
    j["list"] = json::array({
        "paypal.com",
        "stripe.com",
        "adyen.com",
        "klarna.com",
        "checkout.com",
        "worldpay.com",
        "braintreepayments.com",
        "braintreegateway.com",
        "amazonpay.com",
        "pay.google.com",
        "pay.apple.com",
        "amazon.com"
    });
    (void)write_all_atomic(u, j.dump(2));
}
 
static std::vector<std::string> load_payments_domains_from_user_json() {
    seed_user_payments_from_system_if_missing();
    fs::path u = payments_json_user_path();
 
    std::vector<std::string> out;
    try {
        std::ifstream in(u, std::ios::binary);
        if (!in.good()) return out;
 
        json j; in >> j;
        if (j.contains("list") && j["list"].is_array()) {
            for (const auto& v : j["list"]) {
                if (!v.is_string()) continue;
                auto d = normalize_domain_or_url(v.get<std::string>());
                if (!d.empty()) out.push_back(d);
            }
        }
 
        std::sort(out.begin(), out.end());
        out.erase(std::unique(out.begin(), out.end()), out.end());
    } catch (...) {
    }
    return out;
}
 
struct PaymentsCache {
    std::vector<std::string> domains;
    fs::file_time_type       last_mtime{};
    bool                     loaded = false;
};
 
static std::string generate_pac(const std::vector<std::string>& pay_domains,
                               const std::string& stub_proxy_host,
                               int stub_proxy_port)
{
    std::ostringstream pac;
 
    pac << "// BastionGuard - Secure Payments PAC\n";
    pac << "// Generated from payments.json (served by bastionguard-pacd)\n\n";
 
    pac << "function dnsDomainIs(host, domain) {\n";
    pac << "  return host === domain || (host.length > domain.length && host.substring(host.length - domain.length - 1) === \".\" + domain);\n";
    pac << "}\n\n";
 
    pac << "function FindProxyForURL(url, host) {\n";
    pac << "  host = host.toLowerCase();\n\n";
 
    pac << "  // bypass locali\n";
    pac << "  if (isPlainHostName(host) ||\n";
    pac << "      shExpMatch(host, \"localhost\") ||\n";
    pac << "      shExpMatch(host, \"127.*\") ||\n";
    pac << "      shExpMatch(host, \"10.*\") ||\n";
    pac << "      shExpMatch(host, \"192.168.*\") ||\n";
    pac << "      shExpMatch(host, \"172.16.*\") || shExpMatch(host, \"172.17.*\") || shExpMatch(host, \"172.18.*\") ||\n";
    pac << "      shExpMatch(host, \"172.19.*\") || shExpMatch(host, \"172.2?.*\") || shExpMatch(host, \"172.3?.*\")) {\n";
    pac << "    return \"DIRECT\";\n";
    pac << "  }\n\n";
 
    pac << "  var pay = [\n";
    for (size_t i = 0; i < pay_domains.size(); ++i) {
        pac << "    \"" << pay_domains[i] << "\"";
        if (i + 1 < pay_domains.size()) pac << ",";
        pac << "\n";
    }
    pac << "  ];\n\n";
 
    pac << "  for (var i = 0; i < pay.length; i++) {\n";
    pac << "    if (dnsDomainIs(host, pay[i])) {\n";
    pac << "      return \"PROXY " << stub_proxy_host << ":" << stub_proxy_port << "\";\n";
    pac << "    }\n";
    pac << "  }\n\n";
 
    pac << "  return \"DIRECT\";\n";
    pac << "}\n";
 
    return pac.str();
}
 
 
static std::string http_response_200(const std::string& body, const std::string& content_type) {
    std::ostringstream oss;
    oss << "HTTP/1.1 200 OK\r\n";
    oss << "Content-Type: " << content_type << "\r\n";
    oss << "Cache-Control: no-cache, no-store, must-revalidate\r\n";
    oss << "Pragma: no-cache\r\n";
    oss << "Expires: 0\r\n";
    oss << "Content-Length: " << body.size() << "\r\n";
    oss << "Connection: close\r\n\r\n";
    oss << body;
    return oss.str();
}
 
static std::string http_response_404() {
    const std::string body = "Not Found\n";
    std::ostringstream oss;
    oss << "HTTP/1.1 404 Not Found\r\n";
    oss << "Content-Type: text/plain\r\n";
    oss << "Content-Length: " << body.size() << "\r\n";
    oss << "Connection: close\r\n\r\n";
    oss << body;
    return oss.str();
}
 
static std::string http_response_405() {
    const std::string body = "Method Not Allowed\n";
    std::ostringstream oss;
    oss << "HTTP/1.1 405 Method Not Allowed\r\n";
    oss << "Content-Type: text/plain\r\n";
    oss << "Content-Length: " << body.size() << "\r\n";
    oss << "Connection: close\r\n\r\n";
    oss << body;
    return oss.str();
}
 
 
static int run_trigger_cmd(const std::string& cmd) {
    // A trigger is reached from a localhost TCP listener. Never pass its
    // configurable command string to /bin/sh. Only allow the packaged action.
    if (cmd.empty()) return 0;
    if (cmd != "/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service")
        return 64;
    return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--user",
                            "start", "BastionGuard-cef.service"}).exit_code;
}
 
static bool wait_backend_up(const std::string& backend_host, int backend_port, int wait_ms) {
    try {
        asio::io_context io;
        tcp::resolver res(io);
        auto eps = res.resolve(backend_host, std::to_string(backend_port));
 
        auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(wait_ms);
        while (std::chrono::steady_clock::now() < deadline) {
            for (auto& ep : eps) {
                tcp::socket s(io);
                boost::system::error_code ec;
                s.connect(ep.endpoint(), ec);
                if (!ec) return true;
            }
            std::this_thread::sleep_for(std::chrono::milliseconds(50));
        }
    } catch (...) {}
    return false;
}
 
static void forward_bidirectional(tcp::socket a, tcp::socket b) {
    auto pump = [](tcp::socket& src, tcp::socket& dst) {
        try {
            std::array<char, 16 * 1024> buf{};
            for (;;) {
                boost::system::error_code ec;
                std::size_t n = src.read_some(asio::buffer(buf), ec);
                if (ec || n == 0) break;
                asio::write(dst, asio::buffer(buf.data(), n));
            }
        } catch (...) {}
        // chiusura best-effort
        boost::system::error_code ignore;
        dst.shutdown(tcp::socket::shutdown_send, ignore);
    };
 
    std::thread t1(pump, std::ref(a), std::ref(b));
    std::thread t2(pump, std::ref(b), std::ref(a));
    t1.join();
    t2.join();
 
    boost::system::error_code ignore;
    a.close(ignore);
    b.close(ignore);
}
 
struct TriggerState {
    std::atomic<bool> started{false};
    std::mutex        mtx;
    std::chrono::steady_clock::time_point last_start{};
};
 
static void handle_proxy_client(tcp::socket client,
                                TriggerState& trig,
                                const std::string& trigger_cmd,
                                const std::string& backend_host,
                                int backend_port,
                                int backend_wait_ms)
{
    {
        std::lock_guard<std::mutex> lk(trig.mtx);
        auto now = std::chrono::steady_clock::now();
        bool should_start = !trig.started.load();
 
        if (!should_start) {
            if (trig.last_start.time_since_epoch().count() != 0 &&
                now - trig.last_start < std::chrono::seconds(1)) {
                should_start = false;
            }
        }
 
        if (should_start) {
            trig.last_start = now;
            int rc = run_trigger_cmd(trigger_cmd);
            if (rc == 0) {
                trig.started.store(true);
                std::cerr << "[pacd] trigger executed: " << trigger_cmd << "\n";
            } else {
                std::cerr << "[pacd] trigger failed rc=" << rc << ": " << trigger_cmd << "\n";
            }
        }
    }
 
    if (!wait_backend_up(backend_host, backend_port, backend_wait_ms)) {
        std::cerr << "[pacd] backend not ready " << backend_host << ":" << backend_port
                  << " after " << backend_wait_ms << "ms\n";
        boost::system::error_code ignore;
        client.close(ignore);
        return;
    }
 
    try {
        asio::io_context io;
        tcp::resolver res(io);
        auto eps = res.resolve(backend_host, std::to_string(backend_port));
 
        tcp::socket backend(io);
        boost::system::error_code ec;
        asio::connect(backend, eps, ec);
        if (ec) {
            std::cerr << "[pacd] connect backend failed: " << ec.message() << "\n";
            boost::system::error_code ignore;
            client.close(ignore);
            return;
        }
 
        forward_bidirectional(std::move(client), std::move(backend));
    } catch (const std::exception& ex) {
        std::cerr << "[pacd] forward fatal: " << ex.what() << "\n";
        boost::system::error_code ignore;
        client.close(ignore);
    }
}
 
 
static void serve_pac_one(tcp::socket sock,
                          PaymentsCache& cache,
                          std::mutex& cache_mtx,
                          const std::string& stub_proxy_host,
                          int stub_proxy_port)
{
    try {
        asio::streambuf buf;
        asio::read_until(sock, buf, "\r\n\r\n");
 
        std::istream is(&buf);
        std::string request_line;
        std::getline(is, request_line);
        if (!request_line.empty() && request_line.back() == '\r')
            request_line.pop_back();
 
        std::string method, path, ver;
        {
            std::istringstream rl(request_line);
            rl >> method >> path >> ver;
        }
 
        if (method != "GET") {
            auto resp = http_response_405();
            asio::write(sock, asio::buffer(resp));
            return;
        }
        if (path != "/proxy.pac") {
            auto resp = http_response_404();
            asio::write(sock, asio::buffer(resp));
            return;
        }
 
        seed_user_payments_from_system_if_missing();
        fs::path pj = payments_json_user_path();
 
        std::error_code ec;
        fs::file_time_type mtime = fs::last_write_time(pj, ec);
 
        std::vector<std::string> domains;
        {
            std::lock_guard<std::mutex> lk(cache_mtx);
            if (!cache.loaded || (!ec && mtime != cache.last_mtime)) {
                cache.domains = load_payments_domains_from_user_json();
                cache.last_mtime = mtime;
                cache.loaded = true;
            }
            domains = cache.domains;
        }
 
        std::string pac = generate_pac(domains, stub_proxy_host, stub_proxy_port);
        auto resp = http_response_200(pac, "application/x-ns-proxy-autoconfig");
        asio::write(sock, asio::buffer(resp));
    } catch (...) {
    }
}
 
 
 
int main(int argc, char** argv) {
    // PAC server
    std::string listen_host = "127.0.0.1";
    int listen_port = 8765;
 
    std::string stub_host = "127.0.0.1";
    int stub_port = 3129;
 
    std::string backend_host = "127.0.0.1";
    int backend_port = 3130;
 
    std::string trigger_cmd = "/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service";
 
    int backend_wait_ms = 2000;
 
    // args
    for (int i = 1; i < argc; ++i) {
        std::string a = argv[i];
        auto take = [&](std::string& s){ if (i + 1 < argc) s = argv[++i]; };
        auto take_int = [&](int& v){
            if (i + 1 < argc) {
                try {
                    v = std::stoi(argv[++i]);
                } catch (...) {
                    std::cerr << "[pacd] ⚠️ argomento non numerico per " << a
                              << ": " << argv[i] << " (uso default " << v << ")\n";
                }
            }
        };
 
        if (a == "--listen") take(listen_host);
        else if (a == "--port") take_int(listen_port);
        else if (a == "--stub-host") take(stub_host);
        else if (a == "--stub-port") take_int(stub_port);
        else if (a == "--backend-host") take(backend_host);
        else if (a == "--backend-port") take_int(backend_port);
        else if (a == "--trigger-cmd") take(trigger_cmd);
        else if (a == "--backend-wait-ms") take_int(backend_wait_ms);
        else if (a == "--help") {
            std::cout <<
                "bastionguard-pacd\n"
                "  --listen 127.0.0.1 --port 8765                (PAC server)\n"
                "  --stub-host 127.0.0.1 --stub-port 3129        (stub proxy - PAC points here)\n"
                "  --backend-host 127.0.0.1 --backend-port 3130  (CEF proxy backend)\n"
                "  --trigger-cmd \"/usr/libexec/bastionguard/bastionguard-service --user start BastionGuard-cef.service\"\n"
                "  --backend-wait-ms 2000\n";
            return 0;
        }
    }
 
    if (!BastionGuard::Platform::cef_available()) {
        trigger_cmd.clear();
        std::cerr << "[pacd] CEF disabilitato: il comando di avvio backend è stato rimosso.\n";
    }
 
    seed_user_payments_from_system_if_missing();
    fs::path u = payments_json_user_path();
    std::cerr << "[pacd] using payments file: " << u.string() << "\n";
    std::cerr << "[pacd] PAC: http://" << listen_host << ":" << listen_port << "/proxy.pac\n";
    std::cerr << "[pacd] stub proxy listening " << stub_host << ":" << stub_port << "\n";
    std::cerr << "[pacd] backend proxy target " << backend_host << ":" << backend_port << "\n";
    std::cerr << "[pacd] trigger: " << trigger_cmd << "\n";
 
    std::atomic<bool> running{true};
 
    // Gestione segnali (stop pulito)
    asio::io_context sigio;
    asio::signal_set signals(sigio, SIGINT, SIGTERM, SIGHUP);
    signals.async_wait([&](const boost::system::error_code&, int sig){
        if (sig == SIGHUP) {
            std::cerr << "[pacd] SIGHUP received, exiting for restart\n";
        }
        running.store(false);
        sigio.stop();
    });
    std::thread signal_thread([&]{ sigio.run(); });
 
    PaymentsCache cache;
    std::mutex cache_mtx;
 
    TriggerState trig;
 
    std::thread pac_thread([&]{
        try {
            asio::io_context io;
            tcp::endpoint ep(asio::ip::make_address(listen_host), (unsigned short)listen_port);
            tcp::acceptor acceptor(io, ep);
 
            while (running.load()) {
                tcp::socket sock(io);
                boost::system::error_code ec;
                acceptor.accept(sock, ec);
                if (ec) {
                    if (!running.load()) break;
                    continue;
                }
                serve_pac_one(std::move(sock), cache, cache_mtx, stub_host, stub_port);
            }
        } catch (const std::exception& ex) {
            std::cerr << "[pacd] PAC server fatal: " << ex.what() << "\n";
        }
    });
 
    std::thread proxy_thread([&]{
        try {
            asio::io_context io;
            tcp::endpoint ep(asio::ip::make_address(stub_host), (unsigned short)stub_port);
            tcp::acceptor acceptor(io, ep);
 
            while (running.load()) {
                tcp::socket client(io);
                boost::system::error_code ec;
                acceptor.accept(client, ec);
                if (ec) {
                    if (!running.load()) break;
                    continue;
                }
                std::thread(
                    handle_proxy_client,
                    std::move(client),
                    std::ref(trig),
                    trigger_cmd,
                    backend_host,
                    backend_port,
                    backend_wait_ms
                ).detach();
            }
        } catch (const std::exception& ex) {
            std::cerr << "[pacd] proxy stub fatal: " << ex.what() << "\n";
        }
    });
 
    pac_thread.join();
    proxy_thread.join();
 
    if (signal_thread.joinable()) signal_thread.join();
    return 0;
}