BastionGuard-ransomware-realtime-alert.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "AlertWindowRealtime.hpp"
#include "Resource.hpp"
 
#include <gtkmm.h>
#include <glib/gi18n.h>
#include <clocale>
 
#include <queue>
#include <thread>
#include <atomic>
#include <memory>
#include <string>
#include <fstream>
#include <filesystem>
#include <system_error>
 
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <pwd.h>
#include <cerrno>
#include <cstring>
#include <sys/stat.h>
 
#ifndef LOCALEDIR
#error "LOCALEDIR non definita per questo target"
#endif
 
 
 
static std::string resolve_theme_css() {
    const std::string conf =
        Glib::get_home_dir() + "/.config/BastionGuard/theme.conf";
    std::ifstream tf(conf);
    std::string theme;
    if (tf >> theme && theme == "dark")
        return "BastionGuard-dark.css";
    return "BastionGuard.css";
}
namespace fs = std::filesystem;
 
class AlertApp {
public:
    AlertApp()
        : app(Gtk::Application::create("org.BastionGuard.realtime.alert"))
    {
        app->hold();
 
        resolve_paths();
        ensure_user_token();
        load_token();
 
        app->signal_shutdown().connect(
            sigc::mem_fun(*this, &AlertApp::stop_listener)
        );
    }
 
    ~AlertApp()
    {
        stop_listener();
    }
 
    int run(int argc, char* argv[])
    {
        load_css();
        start_tcp_listener();
        return app->run(argc, argv);
    }
 
private:
    Glib::RefPtr<Gtk::Application> app;
 
    std::queue<std::pair<std::string, std::string>> alertQueue;
    std::unique_ptr<AlertWindowRealtime> current_window;
 
    std::string SECURITY_TOKEN;
    std::string TOKEN_PATH;
    std::string LOG_PATH;
 
    std::atomic<bool> running{false};
    std::thread listener_thread;
    int server_fd{-1};
 
    void resolve_paths()
    {
        const char* home = std::getenv("HOME");
        if (!home) {
            if (passwd* pw = getpwuid(getuid())) {
                home = pw->pw_dir;
            }
        }
 
        if (!home) {
            home = "/tmp";
        }
 
        const std::string base = std::string(home) + "/.local/share/BastionGuard";
        std::error_code ec;
        fs::create_directories(base, ec);
 
        TOKEN_PATH = base + "/ransomware.token";
        LOG_PATH   = base + "/alert-gui.log";
    }
 
    void log_user(const std::string& msg)
    {
        std::ofstream f(LOG_PATH, std::ios::app);
        if (f.is_open()) {
            f << msg << '\n';
        }
    }
 
    void ensure_user_token()
    {
        const std::string system_token = "/etc/BastionGuard/ransomware.token";
        const std::string user_token   = TOKEN_PATH;
 
        if (!fs::exists(system_token)) {
            log_user(_("[ERRORE] Token root NON trovato: ") + system_token);
            return;
        }
 
        if (fs::exists(user_token)) {
            std::error_code ec;
            fs::remove(user_token, ec);
            if (!ec) {
                log_user(_("[INFO] Vecchio token utente rimosso"));
            } else {
                log_user(_("[ERRORE] Non posso rimuovere vecchio token utente"));
            }
        }
 
        std::ifstream src(system_token, std::ios::binary);
        if (!src.is_open()) {
            log_user(_("[ERRORE] Non posso aprire token root"));
            return;
        }
 
        std::ofstream dst(user_token, std::ios::binary | std::ios::trunc);
        if (!dst.is_open()) {
            log_user(_("[ERRORE] Non posso creare token utente"));
            return;
        }
 
        dst << src.rdbuf();
        dst.close();
 
        ::chmod(user_token.c_str(), 0600);
        ::chown(user_token.c_str(), getuid(), getgid());
 
        log_user(_("[OK] Token copiato nella home: ") + user_token);
    }
 
    void load_token()
    {
        std::ifstream f(TOKEN_PATH);
        if (!f.is_open()) {
            log_user(_("[ERRORE] Non posso aprire token utente"));
            return;
        }
 
        std::getline(f, SECURITY_TOKEN);
        if (SECURITY_TOKEN.empty()) {
            log_user(_("[ERRORE] Token utente vuoto"));
        } else {
            log_user(_("[OK] Token caricato"));
        }
    }
 
    void load_css()
    {
        try {
            auto css = Gtk::CssProvider::create();
            css->load_from_path(resource(resolve_theme_css()));
 
            auto display = Gdk::Display::get_default();
            if (display) {
                Gtk::StyleContext::add_provider_for_display(
                    display,
                    css,
                    GTK_STYLE_PROVIDER_PRIORITY_APPLICATION
                );
            }
        } catch (const std::exception& e) {
            log_user(std::string("[WARN] load_css exception: ") + e.what());
        } catch (...) {
            log_user("[WARN] load_css exception sconosciuta");
        }
    }
 
    void start_tcp_listener()
    {
        if (running.load()) {
            return;
        }
 
        running = true;
 
        listener_thread = std::thread([this]() {
            log_user(_("[INFO] Avvio listener TCP..."));
 
            server_fd = ::socket(AF_INET, SOCK_STREAM, 0);
            if (server_fd < 0) {
                log_user(_("[ERRORE] socket fallita"));
                running = false;
                return;
            }
 
            int opt = 1;
            ::setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
 
            sockaddr_in addr{};
            addr.sin_family = AF_INET;
            addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
            addr.sin_port = htons(1025);
 
            if (::bind(server_fd, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) < 0) {
                log_user(_("[ERRORE] bind fallita: ") + std::string(std::strerror(errno)));
                ::close(server_fd);
                server_fd = -1;
                running = false;
                return;
            }
 
            log_user(_("[OK] Bind su 127.0.0.1:1025"));
 
            if (::listen(server_fd, 5) < 0) {
                log_user(_("[ERRORE] listen fallita"));
                ::close(server_fd);
                server_fd = -1;
                running = false;
                return;
            }
 
            log_user(_("[OK] Listener avviato"));
 
            while (running.load()) {
                int client = ::accept(server_fd, nullptr, nullptr);
                if (client < 0) {
                    if (!running.load()) {
                        break;
                    }
 
                    if (errno == EINTR) {
                        continue;
                    }
 
                    log_user(_("[WARN] accept fallita: ") + std::string(std::strerror(errno)));
                    continue;
                }
 
                char buf[2048];
                const ssize_t n = ::read(client, buf, sizeof(buf) - 1);
                ::close(client);
 
                if (n <= 0) {
                    continue;
                }
 
                buf[n] = '\0';
                std::string msg(buf);
 
                const auto p1 = msg.find('|');
                const auto p2 = (p1 == std::string::npos) ? std::string::npos : msg.find('|', p1 + 1);
 
                if (p1 == std::string::npos || p2 == std::string::npos) {
                    continue;
                }
 
                const std::string token  = msg.substr(0, p1);
                const std::string file   = msg.substr(p1 + 1, p2 - p1 - 1);
                const std::string family = msg.substr(p2 + 1);
 
                if (file.find("antiransom_inotify.log") != std::string::npos) {
                    log_user(_("[IGNORATO] Alert proveniente dal log interno"));
                    continue;
                }
 
                if (token != SECURITY_TOKEN) {
                    log_user(_("[SCARTATO] Token non valido"));
                    continue;
                }
 
                // Il percorso ricevuto dal processo realtime deve indicare
                // esclusivamente un file regolare assoluto. Non seguire
                // symlink e non mostrare azioni di quarantena per directory.
                const fs::path alert_path(file);
                std::error_code path_ec;
                const fs::file_status path_status =
                    fs::symlink_status(alert_path, path_ec);
 
                if (!alert_path.is_absolute() || path_ec ||
                    !fs::exists(path_status) ||
                    !fs::is_regular_file(path_status)) {
                    log_user(_("[SCARTATO] Percorso alert non regolare: ") + file);
                    continue;
                }
 
                Glib::signal_idle().connect_once([this, file, family]() {
                    if (!running.load()) {
                        return;
                    }
                    enqueue_alert(file, family);
                });
            }
 
            if (server_fd >= 0) {
                ::close(server_fd);
                server_fd = -1;
            }
 
            log_user(_("[INFO] Listener TCP terminato"));
        });
    }
 
    void stop_listener()
    {
        const bool was_running = running.exchange(false);
        if (!was_running) {
            if (listener_thread.joinable()) {
                listener_thread.join();
            }
            return;
        }
 
        if (server_fd >= 0) {
            ::shutdown(server_fd, SHUT_RDWR);
            ::close(server_fd);
            server_fd = -1;
        }
 
        if (listener_thread.joinable()) {
            listener_thread.join();
        }
    }
 
    void enqueue_alert(const std::string& file, const std::string& family)
    {
        alertQueue.push({file, family});
 
        if (!current_window) {
            show_next();
        }
    }
 
    void show_next()
    {
        if (current_window || alertQueue.empty()) {
            return;
        }
 
        auto [file, family] = alertQueue.front();
        alertQueue.pop();
 
        current_window = std::make_unique<AlertWindowRealtime>(file, family, alertQueue.size());
 
        current_window->signal_ignore_all.connect([this]() {
            std::queue<std::pair<std::string, std::string>> empty;
            std::swap(alertQueue, empty);
 
            if (current_window) {
                current_window->hide();
            }
        });
 
        current_window->signal_hide().connect([this]() {
            Glib::signal_idle().connect_once([this]() {
                current_window.reset();
                show_next();
            });
        });
 
        current_window->present();
    }
};
 
static bool load_lang_conf()
{
    const std::string lang_conf =
        Glib::get_home_dir() + "/.config/BastionGuard/lang.conf";
 
    std::ifstream f(lang_conf);
    if (!f.is_open()) {
        return false;
    }
 
    std::string line;
    bool any = false;
 
    while (std::getline(f, line)) {
        if (line.empty() || line[0] == '#') {
            continue;
        }
 
        const auto pos = line.find('=');
        if (pos == std::string::npos) {
            continue;
        }
 
        std::string key = line.substr(0, pos);
        std::string val = line.substr(pos + 1);
 
        auto ltrim = [](std::string& s) {
            const auto p = s.find_first_not_of(" \t\r\n");
            if (p == std::string::npos) {
                s.clear();
            } else {
                s.erase(0, p);
            }
        };
 
        auto rtrim = [](std::string& s) {
            const auto p = s.find_last_not_of(" \t\r\n");
            if (p == std::string::npos) {
                s.clear();
            } else {
                s.erase(p + 1);
            }
        };
 
        ltrim(key);
        rtrim(key);
        ltrim(val);
        rtrim(val);
 
        if (!key.empty() && !val.empty()) {
            ::setenv(key.c_str(), val.c_str(), 1);
            any = true;
        }
    }
 
    return any;
}
 
int main(int argc, char* argv[])
{
    const bool loaded = load_lang_conf();
 
    std::setlocale(LC_ALL, "");
    bindtextdomain("BastionGuard", LOCALEDIR);
    bind_textdomain_codeset("BastionGuard", "UTF-8");
    textdomain("BastionGuard");
 
    if (loaded) {
        std::cerr << _("[Lang] Config caricata da ~/.config/BastionGuard/lang.conf") << '\n';
    } else {
        std::cerr << _("[Lang] Nessuna config trovata, uso locale di sistema") << '\n';
    }
 
    AlertApp app;
    return app.run(argc, argv);
}