1086 {
1087
1089
1090 namespace fs = std::filesystem;
1091
1093 std::string baseDir = userBase + "/data/phishing";
1094 std::string finalPath = baseDir + "/blacklist.txt";
1095 std::string finalReduce = baseDir + "/blacklist-reduce.txt";
1096
1097
1098
1099 std::string stage_template = "/tmp/bastionguard-phish.XXXXXX";
1100 std::vector<char> stage_buf(stage_template.begin(), stage_template.end());
1101 stage_buf.push_back('\0');
1102 char* stage_ptr = ::mkdtemp(stage_buf.data());
1103 if (!stage_ptr) {
1104 std::cerr <<
_(
"[Phishing] Impossibile creare staging directory sicura.\n");
1105 return false;
1106 }
1107 std::string stagingDir(stage_ptr);
1108 ::chmod(stagingDir.c_str(), 0700);
1109
1110 std::string tmpPath = stagingDir + "/blacklist.txt";
1111 std::string tmpReduce = stagingDir + "/blacklist-reduce.txt";
1112 std::string tmpDnsmasq = stagingDir + "/dnsmasq-blacklist.conf";
1113
1114 fs::create_directories(baseDir);
1115
1116 struct Cleanup {
1117 std::vector<std::string> paths;
1118 ~Cleanup() {
1119 for (auto &p : paths) {
1120 try {
1121 if (!p.empty() && std::filesystem::exists(p))
1122 std::filesystem::remove(p);
1123 } catch(...) {}
1124 }
1125 }
1126 };
1127 Cleanup cleanup;
1128 cleanup.paths.push_back(tmpPath);
1129 cleanup.paths.push_back(tmpReduce);
1130 cleanup.paths.push_back(tmpDnsmasq);
1131 cleanup.paths.push_back(stagingDir);
1132
1133 std::vector<std::string> sources = {
1134 "https://phishing.army/download/phishing_army_blocklist.txt",
1135 "https://openphish.com/feed.txt",
1136 "https://urlhaus.abuse.ch/downloads/text/",
1137 };
1138
1139 auto trim = [](std::string &s) {
1140 const char *ws = " \t\n\r\f\v";
1141 size_t start = s.find_first_not_of(ws);
1142 if (start == std::string::npos) { s.clear(); return; }
1143 size_t end = s.find_last_not_of(ws);
1144 s = s.substr(start, end - start + 1);
1145 };
1146
1147 const std::regex re_ipv4(R"((?:(?:25[0-5]|2[0-4]\d|1?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|1?\d{1,2})){3}))");
1148 const std::regex re_ipv6(R"((?:[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){2,7}))");
1149
1150 auto looks_like_ip = [&](const std::string &s)->bool{
1151 return std::regex_search(s, re_ipv4) || std::regex_search(s, re_ipv6);
1152 };
1153
1154 auto looks_like_url_or_domain = [](const std::string &s) -> bool {
1155 if (s.empty()) return false;
1156 if (s.find("http://") != std::string::npos || s.find("https://") != std::string::npos) return true;
1157 if (s.find('.') != std::string::npos) {
1158 bool all_digits = true;
1159 for (char c : s) {
1160 if (!std::isdigit(static_cast<unsigned char>(c)) && c != '.') { all_digits = false; break; }
1161 }
1162 return !all_digits;
1163 }
1164 return false;
1165 };
1166
1167
1168 {
1169 std::ofstream out(tmpPath, std::ios::trunc);
1170 if (!out.is_open()) {
1171 std::cerr <<
_(
"❌ Impossibile scrivere ") << tmpPath <<
"\n";
1172 return false;
1173 }
1174
1175 for (const auto& url : sources) {
1176 const auto download =
bg_process::run({
"curl",
"--fail",
"--silent",
"--max-time",
"30",
1177 "--user-agent", "BastionGuard-PhishUpdater/1.0",
1178 "--", url}, false, 16U * 1024U * 1024U);
1179 if (!download.ok()) { std::cerr <<
_(
"⚠ Impossibile aprire ") << url <<
"\n";
continue; }
1180
1181 bool any = false;
1182 std::string acc;
1183 std::istringstream fetched(download.output);
1184 std::string fragment;
1185 while (std::getline(fetched, fragment)) {
1186 acc.append(fragment).append("\n");
1187 while (true) {
1188 size_t nl = acc.find('\n');
1189 if (nl == std::string::npos) break;
1190 std::string
line = acc.substr(0, nl);
1191 acc.erase(0, nl + 1);
1192 if (!
line.empty() &&
line.back() ==
'\r')
line.pop_back();
1194 if (
line.empty() || line[0] ==
'#')
continue;
1195
1196 if (looks_like_ip(line) || looks_like_url_or_domain(line)) {
1197 out <<
line <<
"\n";
1198 any = true;
1199 }
1200 }
1201 }
1202 if (!any) std::cerr <<
_(
"⚠ Nessun dato da ") << url <<
"\n";
1203 else out << "\n";
1204 }
1205 out.close();
1206 ::chmod(tmpPath.c_str(), 0600);
1207 }
1208
1209
1210 {
1211 std::ifstream fin(tmpPath);
1212 if (!fin.is_open()) return false;
1213
1214 std::unordered_set<std::string> seen;
1215 std::vector<std::string> lines;
1217 while (std::getline(fin, line)) {
1218 if (!
line.empty() &&
line.back() ==
'\r')
line.pop_back();
1220 if (
line.empty() || line[0] ==
'#')
continue;
1221 if (seen.insert(line).second) lines.push_back(line);
1222 }
1223 fin.close();
1224
1225 const size_t maxLines = 30;
1226 std::ofstream fout(tmpReduce, std::ios::trunc);
1227 for (size_t i = 0; i < std::min(lines.size(), maxLines); ++i)
1228 fout << lines[i] << "\n";
1229 fout <<
_(
"# ... lista completa salvata in blacklist.txt\n");
1230 fout.close();
1231 ::chmod(tmpReduce.c_str(), 0600);
1232 }
1233
1236
1237 try {
1238 std::ifstream fin(finalPath);
1239 if (!fin.is_open()) {
1240 std::cerr <<
_(
"❌ Impossibile aprire la blacklist per generare dnsmasq.") << std::endl;
1241 } else {
1242 std::ofstream fout(tmpDnsmasq, std::ios::trunc);
1243 if (!fout.is_open()) {
1244 std::cerr <<
_(
"❌ Impossibile creare file temporaneo dnsmasq.") << std::endl;
1245 } else {
1246
1247
1248 static const std::unordered_set<std::string> infra_whitelist = {
1249 "github.com",
1250 "githubusercontent.com",
1251 "gitlab.com",
1252 "bitbucket.org",
1253 "sourceforge.net",
1254
1255
1256 "archive.org",
1257
1258
1259 "npmjs.com",
1260 "jsdelivr.net",
1261 "unpkg.com",
1262
1263
1264 "cloudflare.com",
1265 "cloudfront.net",
1266 "amazonaws.com",
1267 "azurewebsites.net",
1268 "windows.net",
1269 "vercel.app",
1270 "netlify.app",
1271 "herokuapp.com",
1272
1273
1274 "googleapis.com",
1275 "googleusercontent.com",
1276 "gstatic.com",
1277 "firebaseapp.com",
1278 "firebasestorage.googleapis.com",
1279
1280 "microsoft.com",
1281 "office.com",
1282 "live.com"
1283 };
1284
1285
1286 std::unordered_set<std::string> trusted;
1287
1288 auto load_json_list = [&](const std::string& path) {
1289 if (!fs::exists(path)) return;
1290 try {
1291 std::ifstream f(path);
1292 nlohmann::json j;
1293 f >> j;
1294
1295 auto push_str = [&](const nlohmann::json& arr) {
1296 for (auto& v : arr) {
1297 if (v.is_string()) trusted.insert(v.get<std::string>());
1298 }
1299 };
1300
1301 if (j.is_array()) {
1302 push_str(j);
1303 } else if (j.contains("list") && j["list"].is_array()) {
1304 push_str(j["list"]);
1305 } else if (j.contains("whitelist") && j["whitelist"].is_array()) {
1306 push_str(j["whitelist"]);
1307 }
1308 } catch (...) {}
1309 };
1310
1311 auto load_text_list = [&](const std::string& path) {
1312 if (!fs::exists(path)) return;
1313
1314 try {
1315 std::ifstream f(path);
1317 while (std::getline(f, line)) {
1320
1321 const char* ws = " \t\f\v";
1322 size_t start =
line.find_first_not_of(ws);
1323 if (start == std::string::npos) continue;
1324 size_t end =
line.find_last_not_of(ws);
1325 line =
line.substr(start, end - start + 1);
1326
1327 if (
line.empty() || line[0] ==
'#')
1328 continue;
1329
1330 trusted.insert(line);
1331 }
1332 } catch (...) {}
1333 };
1334
1335 load_json_list("/usr/share/BastionGuard/data/bank/banks.json");
1336
1337 if (const char* home = std::getenv("HOME")) {
1338 load_json_list(std::string(home) + "/.config/BastionGuard/whitelist.json");
1339 load_text_list(std::string(home) + "/.local/share/BastionGuard/phishing/whitelist.txt");
1340 }
1341
1342 auto clean_domain = [](std::string s) {
1343 std::transform(s.begin(), s.end(), s.begin(),
1344 [](unsigned char c){ return (char)std::tolower(c); });
1345
1346 const char* ws = " \t\r\n\f\v";
1347 size_t start = s.find_first_not_of(ws);
1348 if (start == std::string::npos) return std::string{};
1349 size_t end = s.find_last_not_of(ws);
1350 s = s.substr(start, end - start + 1);
1351
1352 if (auto pos = s.find("://"); pos != std::string::npos)
1353 s = s.substr(pos + 3);
1354
1355 for (char c : {'/', ' ', ';', '"', '\'', '%', '&', '(', ')', '=', '?', '*', '#'})
1356 if (auto p = s.find(c); p != std::string::npos)
1357 s = s.substr(0, p);
1358
1359 if (auto at = s.rfind('@'); at != std::string::npos)
1360 s = s.substr(at + 1);
1361
1362 if (auto colon = s.find(':'); colon != std::string::npos)
1363 s = s.substr(0, colon);
1364
1365 if (s.rfind("www.", 0) == 0)
1366 s.erase(0, 4);
1367
1368 while (!s.empty() && s.front() == '.')
1369 s.erase(0, 1);
1370 while (!s.empty() && s.back() == '.')
1371 s.pop_back();
1372
1373 return s;
1374 };
1375
1376
1377 auto is_whitelisted_domain = [&](const std::string& domain,
1378 const std::unordered_set<std::string>& wl) -> bool {
1379 if (domain.empty()) return false;
1380 if (wl.count(domain)) return true;
1381
1382 size_t dot = domain.find('.');
1383 while (dot != std::string::npos) {
1384 std::string parent = domain.substr(dot + 1);
1385 if (wl.count(parent)) return true;
1386 dot = domain.find('.', dot + 1);
1387 }
1388 return false;
1389 };
1390
1391
1392 if (!trusted.empty()) {
1393 std::unordered_set<std::string> normalized;
1394 normalized.reserve(trusted.size());
1395 for (const auto& d : trusted) normalized.insert(clean_domain(d));
1396 trusted.swap(normalized);
1397 }
1398
1399 std::cerr <<
_(
"[Backend] ✅ Whitelist utente/banca caricata: ")
1400 << trusted.size() << " domini.\n";
1401 std::cerr <<
_(
"[Backend] ✅ Whitelist infrastrutturale: ")
1402 << infra_whitelist.size() <<
_(
" domini.\n");
1403
1404 size_t written = 0, skipped = 0, skipped_ip = 0;
1406
1407 while (std::getline(fin, line)) {
1410 if (
line.empty() || line[0] ==
'#')
continue;
1411
1412
1413 std::string host =
line;
1414
1415 if (auto pos = host.find("://"); pos != std::string::npos)
1416 host = host.substr(pos + 3);
1417
1418
1419 for (char c : {'/', ' ', ';', '"', '\'', '%', '&', '(', ')', '=', '?', '*', '#'})
1420 if (auto p = host.find(c); p != std::string::npos)
1421 host = host.substr(0, p);
1422
1423
1424 if (auto at = host.rfind('@'); at != std::string::npos)
1425 host = host.substr(at + 1);
1426
1427
1428 if (auto colon = host.find(':'); colon != std::string::npos)
1429 host = host.substr(0, colon);
1430
1431 std::string clean_host = clean_domain(host);
1432 if (clean_host.empty()) continue;
1433
1434 if (looks_like_ip(clean_host)) {
1435 skipped_ip++;
1436 continue;
1437 }
1438
1439
1440 if (is_whitelisted_domain(clean_host, infra_whitelist)) {
1441 skipped++;
1442 continue;
1443 }
1444 if (is_whitelisted_domain(clean_host, trusted)) {
1445 skipped++;
1446 continue;
1447 }
1448
1449 fout << "address=/" << clean_host << "/127.0.0.2\n";
1450 written++;
1451
1452 if (written % 1000 == 0) fout.flush();
1453 if (written > 1000000) break;
1454 }
1455
1456 fout.close();
1457 ::chmod(tmpDnsmasq.c_str(), 0600);
1458 fin.close();
1459
1460 std::cout <<
_(
"✔ File dnsmasq generato: ") << written
1461 <<
_(
" voci. Skipped whitelist: ") << skipped
1462 <<
_(
" | Skipped IP: ") << skipped_ip <<
"\n";
1463
1465 if (!script_ok) {
1466 std::cerr <<
_(
"[Phishing] Installazione privilegiata annullata o fallita; ")
1467 <<
_(
"nessun fallback insicuro viene eseguito.\n");
1468 return false;
1469 }
1470 fs::remove(tmpDnsmasq);
1471 }
1472 }
1473 } catch (const std::exception& e) {
1474 std::cerr <<
_(
"⚠ Errore generazione dnsmasq blocklist: ") << e.what() << std::endl;
1475 }
1476
1477
1478
1479
1480 try {
1482 std::cout <<
_(
"[Firewall] Blocco IP disabilitato — salto applicazione regole.\n");
1484 std::cout <<
_(
"[Firewall] Nessun firewall supportato rilevato.\n");
1485 } else {
1486 std::ifstream fin(finalPath);
1487 std::vector<std::string> lines;
1489
1490 while (std::getline(fin, line))
1491 lines.push_back(line);
1492
1493 const auto before = lines.size();
1494
1496
1497 std::cout <<
_(
"[Firewall] Tentata applicazione regole da ")
1498 << before <<
_(
" righe blacklist ")
1499 <<
"(firewall=" <<
static_cast<int>(
firewallType_) <<
")\n";
1500 }
1501 }
1502 catch (const std::exception& e) {
1503 std::cerr <<
_(
"[Firewall] Errore applicazione regole firewall: ")
1504 << e.what() << std::endl;
1505 }
1506 catch (...) {
1507 std::cerr <<
_(
"[Firewall] Errore sconosciuto applicazione regole firewall.\n");
1508 }
1509
1510
1511 std::cout <<
_(
"✔ Blacklist phishing aggiornata in ") << finalPath
1512 <<
_(
" e ridotta in ") << finalReduce <<
"\n";
1513 return true;
1514}
static bool copy_to_final(const std::string &src, const std::string &dest)
static bool run_phishing_updater_script(const std::string &staging_dir)
static std::string getRuntimeDataDir()
bool isFirewallEnabled() const
void applyFirewallFromBlacklist(const std::vector< std::string > &blacklistLines)
void mergeWhitelistSources()
