bastionguard_cef.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include <boost/asio.hpp>
#include <boost/asio/signal_set.hpp>
#include <boost/asio/thread_pool.hpp>
#include <boost/asio/ssl.hpp>
 
#include <include/cef_app.h>
#include <include/cef_command_line.h>
#include <glib/gi18n.h>
#include <libsoup/soup.h>
#include <glib.h>
 
#include <algorithm>
#include <array>
#include <atomic>
#include <chrono>
#include <cerrno>
#include <cstdlib>
#include <cstring>
#include <functional>
#include <iostream>
#include <memory>
#include <mutex>
#include <sstream>
#include <string>
#include <string_view>
#include <thread>
#include <unordered_map>
#include <unordered_set>
#include <vector>
#include <cctype>
#include <fstream>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/wait.h>
 
#include "bank_filter.hpp"
#include "proxy_config.hpp"
#include "block_page.hpp"
#include "Resource.hpp"
#include "SecureBrowser.hpp"
#include "../phishing/local_warning_server.hpp"
#include "ca_installer.hpp"
#include "tls_intercept.hpp"
#include "SettingsStore.hpp"
 
#ifndef LOCALEDIR
#  define LOCALEDIR "/usr/share/BastionGuard/locale"
#endif
#ifndef BG_WARNING_HTTP_PORT
#  define BG_WARNING_HTTP_PORT  81
#endif
#ifndef BG_WARNING_HTTPS_PORT
#  define BG_WARNING_HTTPS_PORT 444
#endif
#ifndef BG_WARNING_ADDR
#  define BG_WARNING_ADDR "127.0.0.2"
#endif
 
static constexpr auto SESSION_TTL = std::chrono::minutes(30);
 
static const unsigned int IO_THREADS =
    std::max(2u, std::thread::hardware_concurrency());
 
namespace asio = boost::asio;
using tcp      = asio::ip::tcp;
using Clock    = std::chrono::steady_clock;
 
static asio::io_context g_io{static_cast<int>(IO_THREADS)};
 
static std::string root_domain(const std::string& host) {
    const auto dots = std::count(host.begin(), host.end(), '.');
    if (dots <= 1) return host;
    const auto p1 = host.rfind('.');
    const auto p2 = host.rfind('.', p1 - 1);
    return host.substr(p2 + 1);
}
 
struct SessionEntry {
    Clock::time_point opened_at;
    std::string       type;
    pid_t             child_pid = -1;
};
 
static std::mutex                                    g_session_mutex;
static std::unordered_map<std::string, SessionEntry> g_sessions;
 
// Definita più avanti (gate anti-doppia-apertura della sandbox). La
// dichiariamo qui perché alla scadenza del TTL di sessione dobbiamo anche
// liberare il gate, così una nuova visita al sito dopo i 30 minuti può
// riaprire legittimamente la sandbox.
static void sandbox_close(const std::string& root);
static void sandbox_bind_pid(const std::string& root, pid_t pid);
static void sandbox_close_if_pid(const std::string& root, pid_t pid);
 
static bool session_active(const std::string& root, std::string& out_type) {
    bool expired = false;
    {
        std::lock_guard<std::mutex> lock(g_session_mutex);
        auto it = g_sessions.find(root);
        if (it == g_sessions.end()) return false;
        if (Clock::now() - it->second.opened_at > SESSION_TTL) {
            g_sessions.erase(it);
            expired = true;
        } else {
            out_type = it->second.type;
            return true;
        }
    }
    // Sessione scaduta: libera anche il gate sandbox (fuori dal lock di
    // sessione per evitare di tenere due mutex insieme).
    if (expired) sandbox_close(root);
    return false;
}
 
// Apertura atomica usata dopo che il MITM ha verificato che la richiesta e'
// davvero una navigazione top-level. Gli iframe/POST non creano sessioni.
static bool session_try_open(const std::string& root, const std::string& type) {
    std::lock_guard<std::mutex> lock(g_session_mutex);
    auto [it, inserted] = g_sessions.emplace(
        root, SessionEntry{Clock::now(), type, -1});
    return inserted;
}
 
static void session_bind_pid(const std::string& root, pid_t pid) {
    std::lock_guard<std::mutex> lock(g_session_mutex);
    auto it = g_sessions.find(root);
    if (it != g_sessions.end())
        it->second.child_pid = pid;
}
 
static void session_close(const std::string& root) {
    bool removed = false;
    {
        std::lock_guard<std::mutex> lock(g_session_mutex);
        removed = g_sessions.erase(root) != 0;
    }
    if (removed) {
        char msg[256];
        std::snprintf(msg, sizeof(msg),
            _("[bastionguard] session closed for root: %s — browser proxy restored\n"),
            root.c_str());
        std::cerr << msg;
    }
}
 
static void session_close_if_pid(const std::string& root, pid_t pid) {
    bool removed = false;
    {
        std::lock_guard<std::mutex> lock(g_session_mutex);
        auto it = g_sessions.find(root);
        if (it != g_sessions.end() && it->second.child_pid == pid) {
            g_sessions.erase(it);
            removed = true;
        }
    }
    if (removed) {
        char msg[320];
        std::snprintf(msg, sizeof(msg),
            _("[bastionguard] secure browser pid %ld closed for root: %s — browser proxy restored\n"),
            static_cast<long>(pid), root.c_str());
        std::cerr << msg;
    }
}
 
struct TunnelSession : std::enable_shared_from_this<TunnelSession> {
    tcp::socket client_;
    tcp::socket remote_;
    std::array<char, 64 * 1024> cbuf_{};
    std::array<char, 64 * 1024> rbuf_{};
 
    TunnelSession(tcp::socket c, tcp::socket r)
        : client_(std::move(c)), remote_(std::move(r)) {}
 
    void start() { pump_c2r(); pump_r2c(); }
 
private:
    void pump_c2r() {
        auto self = shared_from_this();
        client_.async_read_some(asio::buffer(cbuf_),
            [this, self](boost::system::error_code ec, std::size_t n) {
                if (ec || n == 0) { shutdown(); return; }
                asio::async_write(remote_, asio::buffer(cbuf_.data(), n),
                    [this, self](boost::system::error_code wec, std::size_t) {
                        if (wec) { shutdown(); return; }
                        pump_c2r();
                    });
            });
    }
 
    void pump_r2c() {
        auto self = shared_from_this();
        remote_.async_read_some(asio::buffer(rbuf_),
            [this, self](boost::system::error_code ec, std::size_t n) {
                if (ec || n == 0) { shutdown(); return; }
                asio::async_write(client_, asio::buffer(rbuf_.data(), n),
                    [this, self](boost::system::error_code wec, std::size_t) {
                        if (wec) { shutdown(); return; }
                        pump_r2c();
                    });
            });
    }
 
    void shutdown() {
        if (closed_.exchange(true)) return;
        boost::system::error_code ignore;
        client_.close(ignore);
        remote_.close(ignore);
    }
 
    std::atomic<bool> closed_{false};
};
 
static void launch_sandbox(const std::string& url,
                           bool is_bank,
                           const std::string& root) {
    const std::string binary = is_bank ? "/usr/bin/BastionGuard-bankopener"
                                       : "/usr/bin/BastionGuard-secure";
 
    // Mantieni il processo reale come figlio del proxy. In questo modo il
    // proxy conosce il PID della sandbox e può liberare sessione/gate appena
    // l'utente chiude il Secure Browser. waitpid viene eseguito in un thread
    // dedicato, quindi nessun io-thread asio viene bloccato.
    pid_t pid = fork();
    if (pid < 0) {
        std::cerr << _("[bastionguard] fork() fallita per launch_sandbox\n");
        sandbox_close(root);
        session_close(root);
        return;
    }
 
    if (pid == 0) {
        setenv("BG_SANDBOX", "1", 1);
        execl(binary.c_str(), binary.c_str(), url.c_str(), (char*)nullptr);
        _exit(127);
    }
 
    // Associa il PID alla generazione corrente della sessione/gate PRIMA di
    // avviare il watcher. Le varianti *_if_pid evitano che un vecchio processo
    // possa chiudere per errore una sessione nuova dello stesso dominio.
    session_bind_pid(root, pid);
    sandbox_bind_pid(root, pid);
 
    {
        char msg[384];
        std::snprintf(msg, sizeof(msg),
            _("[bastionguard] secure browser started: pid=%ld root=%s binary=%s\n"),
            static_cast<long>(pid), root.c_str(), binary.c_str());
        std::cerr << msg;
    }
 
    std::thread([pid, root]() {
        int status = 0;
        pid_t rc;
        do {
            rc = waitpid(pid, &status, 0);
        } while (rc < 0 && errno == EINTR);
 
        if (rc < 0) {
            const int wait_err = errno;
            char msg[320];
            std::snprintf(msg, sizeof(msg),
                _("[bastionguard] waitpid(%ld) failed for root %s: %s; uso TTL fallback\n"),
                static_cast<long>(pid), root.c_str(), std::strerror(wait_err));
            std::cerr << msg;
            // Non liberare alla cieca: se non siamo riusciti a osservare la
            // morte del figlio, il vecchio TTL resta il fallback sicuro.
            return;
        }
 
        // Prima libera il gate e poi la sessione. Se Firefox ritenta proprio
        // in questa piccola finestra, vede ancora la sessione attiva e non può
        // creare un doppio browser. Subito dopo la sessione viene rimossa e il
        // tentativo successivo riapre normalmente la sandbox.
        sandbox_close_if_pid(root, pid);
        session_close_if_pid(root, pid);
    }).detach();
}
 
struct ParsedRequest {
    bool        is_connect = false;
    bool        is_http_plain = false;
    std::string host;
    std::string port;
    std::string method;
    std::string path;
    std::string raw_headers;
};
 
static bool parse_request(const std::string& first_line, ParsedRequest& out) {
    std::istringstream ss(first_line);
    std::string method, target, ver;
    ss >> method >> target >> ver;
    if (method.empty() || target.empty()) return false;
 
    out.method = method;
 
    if (method == "CONNECT") {
        const auto p = target.find(':');
        if (p == std::string::npos) return false;
        out.host       = target.substr(0, p);
        out.port       = target.substr(p + 1);
        out.is_connect = true;
        return !out.host.empty() && !out.port.empty();
    }
 
    if (target.size() > 7 && target.substr(0, 7) == "http://") {
        std::string rest = target.substr(7);
        const auto slash = rest.find('/');
        const std::string authority = slash != std::string::npos ? rest.substr(0, slash) : rest;
        out.path = slash != std::string::npos ? rest.substr(slash) : "/";
 
        const auto colon = authority.rfind(':');
        if (colon != std::string::npos) {
            out.host = authority.substr(0, colon);
            out.port = authority.substr(colon + 1);
        } else {
            out.host = authority;
            out.port = "80";
        }
 
        out.is_http_plain = true;
        return !out.host.empty();
    }
 
    return false;
}
 
static void async_tunnel(tcp::socket sock, const std::string& host, const std::string& port) {
    auto resolver = std::make_shared<tcp::resolver>(g_io);
    auto psock    = std::make_shared<tcp::socket>(std::move(sock));
 
    resolver->async_resolve(host, port,
        [resolver, psock](boost::system::error_code ec, tcp::resolver::results_type eps) mutable {
            if (ec) {
                static constexpr char bad[] =
                    "HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n";
                asio::async_write(*psock, asio::buffer(bad, sizeof(bad) - 1), [psock](auto, auto) {});
                return;
            }
 
            auto remote = std::make_shared<tcp::socket>(g_io);
            asio::async_connect(*remote, eps,
                [remote, psock](boost::system::error_code ec, const tcp::endpoint&) mutable {
                    if (ec) {
                        static constexpr char bad[] =
                            "HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n";
                        asio::async_write(*psock, asio::buffer(bad, sizeof(bad) - 1), [psock](auto, auto) {});
                        return;
                    }
 
                    static constexpr char ok[] =
                        "HTTP/1.1 200 Connection Established\r\n\r\n";
 
                    auto ok_buf = std::make_shared<std::string>(ok);
                    asio::async_write(*psock, asio::buffer(*ok_buf),
                        [ok_buf, psock, remote](boost::system::error_code ec, std::size_t) mutable {
                            if (ec) return;
                            auto session = std::make_shared<TunnelSession>(std::move(*psock), std::move(*remote));
                            session->start();
                        });
                });
        });
}
 
static void async_forward_http(tcp::socket sock,
                               const ParsedRequest& req,
                               const std::string& full_request)
{
    std::string rewritten = req.method + " " + req.path + " HTTP/1.1\r\n";
 
    static const std::vector<std::string> strip_headers = {
        "via:",
        "x-forwarded-for:",
        "x-forwarded-host:",
        "x-forwarded-proto:",
        "x-real-ip:",
        "forwarded:",
        "proxy-connection:",
        "proxy-authorization:",
        "proxy-authenticate:",
    };
 
    auto header_should_strip = [](const std::string& line) -> bool {
        std::string lower = line;
        for (auto& c : lower) c = static_cast<char>(std::tolower(static_cast<unsigned char>(c)));
        for (const auto& h : strip_headers) {
            if (lower.rfind(h, 0) == 0) return true;
        }
        return false;
    };
 
    const auto first_crlf = full_request.find("\r\n");
    if (first_crlf != std::string::npos) {
        std::istringstream ss(full_request.substr(first_crlf + 2));
        std::string hdr_line;
        while (std::getline(ss, hdr_line)) {
            if (!hdr_line.empty() && hdr_line.back() == '\r')
                hdr_line.pop_back();
            if (hdr_line.empty()) {
                rewritten += "\r\n";
                break;
            }
            if (!header_should_strip(hdr_line))
                rewritten += hdr_line + "\r\n";
        }
    } else {
        rewritten += "\r\n";
    }
 
    auto resolver = std::make_shared<tcp::resolver>(g_io);
    auto psock    = std::make_shared<tcp::socket>(std::move(sock));
    auto req_buf  = std::make_shared<std::string>(std::move(rewritten));
 
    resolver->async_resolve(req.host, req.port,
        [resolver, psock, req_buf](boost::system::error_code ec, tcp::resolver::results_type eps) mutable {
            if (ec) {
                static constexpr char bad[] =
                    "HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n";
                asio::async_write(*psock, asio::buffer(bad, sizeof(bad) - 1), [psock](auto, auto) {});
                return;
            }
 
            auto remote = std::make_shared<tcp::socket>(g_io);
            asio::async_connect(*remote, eps,
                [remote, psock, req_buf](boost::system::error_code ec, const tcp::endpoint&) mutable {
                    if (ec) {
                        static constexpr char bad[] =
                            "HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n";
                        asio::async_write(*psock, asio::buffer(bad, sizeof(bad) - 1), [psock](auto, auto) {});
                        return;
                    }
 
                    asio::async_write(*remote, asio::buffer(*req_buf),
                        [remote, psock, req_buf](boost::system::error_code ec, std::size_t) mutable {
                            if (ec) return;
                            auto session = std::make_shared<TunnelSession>(std::move(*psock), std::move(*remote));
                            session->start();
                        });
                });
        });
}
 
static std::string warning_url_for(const std::string& host, const std::string& type) {
    return "https://bastionguard.eu/secure.html?host=" + host + "&type=" + type;
}
 
static std::string local_warning_url_for(const std::string& host, const std::string& type) {
    return std::string("http://") + BG_WARNING_ADDR + ":"
         + std::to_string(BG_WARNING_HTTP_PORT)
         + "/" + host + "?type=" + type;
}
 
 
static std::mutex                      g_notify_mutex;
static std::unordered_set<std::string> g_notify_open;
 
static void open_notify_window(const std::string& root,
                               const std::string& host,
                               const std::string& type,
                               int argc,
                               char** argv)
{
    {
        std::lock_guard<std::mutex> lock(g_notify_mutex);
        if (g_notify_open.count(root)) return;
        g_notify_open.insert(root);
    }
 
    const std::string url = warning_url_for(host, type);
 
    std::thread([root, url, argc, argv]() {
        try {
            SecureBrowser::open_notify(url, argc, argv);
        } catch (const std::exception& e) {
            char buf[512];
            std::snprintf(buf, sizeof(buf),
                _("[bastionguard] open_notify exception: %s\n"), e.what());
            std::cerr << buf;
        } catch (...) {
            std::cerr << _("[bastionguard] open_notify unknown exception\n");
        }
        std::lock_guard<std::mutex> lock(g_notify_mutex);
        g_notify_open.erase(root);
    }).detach();
}
 
 
static std::mutex                             g_sandbox_mutex;
static std::unordered_set<std::string>        g_sandbox_open;
static std::unordered_map<std::string, pid_t> g_sandbox_pid;
 
static bool sandbox_try_open(const std::string& root) {
    std::lock_guard<std::mutex> lock(g_sandbox_mutex);
    const bool inserted = g_sandbox_open.insert(root).second;
    if (inserted)
        g_sandbox_pid[root] = -1;
    return inserted;
}
 
static void sandbox_bind_pid(const std::string& root, pid_t pid) {
    std::lock_guard<std::mutex> lock(g_sandbox_mutex);
    if (g_sandbox_open.count(root))
        g_sandbox_pid[root] = pid;
}
 
static void sandbox_close_if_pid(const std::string& root, pid_t pid) {
    std::lock_guard<std::mutex> lock(g_sandbox_mutex);
    auto it = g_sandbox_pid.find(root);
    if (it != g_sandbox_pid.end() && it->second == pid) {
        g_sandbox_pid.erase(it);
        g_sandbox_open.erase(root);
    }
}
 
static void sandbox_close(const std::string& root) {
    std::lock_guard<std::mutex> lock(g_sandbox_mutex);
    g_sandbox_pid.erase(root);
    g_sandbox_open.erase(root);
}
 
static void block_active_session(std::shared_ptr<tcp::socket> sock,
                                 const ParsedRequest& req,
                                 const std::string& type)
{
    if (req.is_connect) {
        static constexpr char ok200[] =
            "HTTP/1.1 200 Connection Established\r\n\r\n";
 
        const std::string intercept_host = req.host;
        const std::string intercept_type = type;
 
        auto ok_buf = std::make_shared<std::string>(ok200);
        asio::async_write(*sock, asio::buffer(*ok_buf),
            [sock, ok_buf, intercept_host, intercept_type](
                boost::system::error_code ec, std::size_t) mutable {
                if (ec) return;
                std::thread([s = std::move(*sock),
                             host = intercept_host,
                             t    = intercept_type]() mutable {
                    // Nessun on_url_ready: la sandbox è già aperta.
                    TlsIntercept::do_intercept(std::move(s), host, t);
                }).detach();
            });
    } else {
        const std::string loc = warning_url_for(req.host, type);
        auto redir = std::make_shared<std::string>(
            "HTTP/1.1 302 Found\r\n"
            "Cache-Control: no-store\r\n"
            "Pragma: no-cache\r\n"
            "Location: " + loc + "\r\n"
            "Connection: close\r\n\r\n");
        asio::async_write(*sock, asio::buffer(*redir), [sock, redir](auto, auto) {});
    }
}
 
static void block_secure_request(std::shared_ptr<tcp::socket> sock,
                                 const ParsedRequest& req,
                                 const std::string& type,
                                 const std::string& root,
                                 int argc, char** argv)
{
    if (req.is_connect) {
        static constexpr char ok200[] =
            "HTTP/1.1 200 Connection Established\r\n\r\n";
 
        const std::string intercept_host = req.host;
        const std::string intercept_type = type;
        const bool        is_bank_type   = (type == "bank");
 
        auto ok_buf = std::make_shared<std::string>(ok200);
        asio::async_write(*sock, asio::buffer(*ok_buf),
            [sock, ok_buf, intercept_host, intercept_type, is_bank_type, root, argc, argv](
                boost::system::error_code ec, std::size_t) mutable {
                if (ec) return;
 
                std::thread([s = std::move(*sock),
                             host = intercept_host,
                             t    = intercept_type,
                             bank = is_bank_type,
                             r    = root,
                             argc, argv]() mutable {
                    auto on_url_ready = [bank, r, t, host, argc, argv](const std::string& full_url) {
                        // Questo callback viene invocato SOLO da do_intercept
                        // per top-level GET/HEAD. Iframe/fetch/POST vengono
                        // inoltrati in-place e non devono aprire una sandbox.
                        if (!session_try_open(r, t)) return;
 
                        open_notify_window(r, host, t, argc, argv);
 
                        if (!sandbox_try_open(r)) {
                            // Stato incoerente/stale: non lasciare una sessione
                            // attiva senza un browser reale.
                            session_close(r);
                            return;
                        }
 
                        launch_sandbox(full_url, bank, r);
                    };
                    TlsIntercept::do_intercept(std::move(s), host, t,
                                               std::move(on_url_ready));
                }).detach();
            });
    } else {
        const std::string full_url = "https://" + req.host + req.path;
        if (session_try_open(root, type)) {
            open_notify_window(root, req.host, type, argc, argv);
            if (sandbox_try_open(root)) {
                std::thread([full_url, type, root]() {
                    launch_sandbox(full_url, type == "bank", root);
                }).detach();
            } else {
                session_close(root);
            }
        }
 
        const std::string loc = warning_url_for(req.host, type);
        auto redir = std::make_shared<std::string>(
            "HTTP/1.1 302 Found\r\n"
            "Cache-Control: no-store\r\n"
            "Pragma: no-cache\r\n"
            "Location: " + loc + "\r\n"
            "Connection: close\r\n\r\n");
        asio::async_write(*sock, asio::buffer(*redir), [sock, redir](auto, auto) {});
    }
}
 
static void handle_client(tcp::socket client, int argc, char** argv) {
    auto sbuf = std::make_shared<asio::streambuf>();
    auto sock = std::make_shared<tcp::socket>(std::move(client));
 
    asio::async_read_until(*sock, *sbuf, "\r\n\r\n",
        [sock, sbuf, argc, argv](boost::system::error_code ec, std::size_t) mutable {
            if (ec) return;
 
            std::string full_request{
                asio::buffers_begin(sbuf->data()),
                asio::buffers_end(sbuf->data())
            };
 
            std::istringstream is(full_request);
            std::string first_line;
            std::getline(is, first_line);
            if (!first_line.empty() && first_line.back() == '\r')
                first_line.pop_back();
 
            ParsedRequest req;
            if (!parse_request(first_line, req)) {
                static constexpr char resp[] =
                    "HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n";
                asio::async_write(*sock, asio::buffer(resp, sizeof(resp) - 1), [sock](auto, auto) {});
                return;
            }
 
            // -----------------------------------------------------------------
            //  FAST-PATH: traffico LAN/loopback non passa MAI dal MITM CEF.
            //
            //  Anche se il browser è configurato col proxy del sistema, per:
            //    - 127.0.0.0/8, 10.0.0.0/8, 172.16/12, 192.168/16,
            //      169.254/16, 100.64/10, ::1, fe80::/10, fc00::/7
            //    - hostname *.local, *.lan, *.intranet, *.internal, ...
            //    - hostname brevi senza punti (router, nas, printer)
            //  facciamo tunnel diretto e basta. Niente lookup banca/payment,
            //  niente notify, niente block: il traffico interno alla LAN
            //  resta affare dell'utente, BastionGuard non lo vede.
            // -----------------------------------------------------------------
            if (DomainFilter::is_local_network(req.host)) {
                {
                    char dbg[256];
                    std::snprintf(dbg, sizeof(dbg),
                        "[bastionguard] LAN/loopback bypass: %s\n",
                        req.host.c_str());
                    std::cerr << dbg;
                }
                if (req.is_connect)
                    async_tunnel(std::move(*sock), req.host, req.port);
                else
                    async_forward_http(std::move(*sock), req, full_request);
                return;
            }
 
            const std::string root        = root_domain(req.host);
            const bool        bypass      = domain_filter().is_proxy_bypass(req.host);
            const bool        secure      = domain_filter().is_secure(req.host);
            const bool        bank        = domain_filter().is_bank(req.host);
 
            {
                char dbg[256];
                std::snprintf(dbg, sizeof(dbg),
                    "[bastionguard] request host=%s bypass=%d intercept=%d bank=%d method=%s\n",
                    req.host.c_str(),
                    static_cast<int>(bypass),
                    static_cast<int>(secure),
                    static_cast<int>(bank),
                    req.method.c_str());
                std::cerr << dbg;
            }
 
            if (bypass) {
                {
                    char dbg[256];
                    std::snprintf(dbg, sizeof(dbg),
                        "[bastionguard] PROXY-BYPASS (user configured): %s\n",
                        req.host.c_str());
                    std::cerr << dbg;
                }
                if (req.is_connect)
                    async_tunnel(std::move(*sock), req.host, req.port);
                else
                    async_forward_http(std::move(*sock), req, full_request);
                return;
            }
 
            std::string active_type;
            const bool has_active_session = session_active(root, active_type);
            if (!secure) {
                {
                    char dbg[256];
                    std::snprintf(dbg, sizeof(dbg),
                        "[bastionguard] TUNNEL-ONLY (no MITM): %s\n",
                        req.host.c_str());
                    std::cerr << dbg;
                }
                if (req.is_connect)
                    async_tunnel(std::move(*sock), req.host, req.port);
                else
                    async_forward_http(std::move(*sock), req, full_request);
                return;
            }
            if (has_active_session) {
                char msg[256];
                std::snprintf(msg, sizeof(msg),
                    _("[bastionguard] secure domain already active, blocking again: %s (session: %s)\n"),
                    req.host.c_str(), root.c_str());
                std::cerr << msg;
                block_active_session(sock, req, active_type);
                return;
            }
            const std::string type = bank ? "bank" : "payment";
 
            {
                char msg[256];
                std::snprintf(msg, sizeof(msg),
                    _("[bastionguard] %s intercepted: %s (root: %s)\n"),
                    type.c_str(), req.host.c_str(), root.c_str());
                std::cerr << msg;
            }
 
            // Non aprire ancora sessione/gate: per HTTPS dobbiamo prima
            // vedere i Fetch Metadata dentro TLS e distinguere top-level da
            // iframe/POST. Solo la vera navigazione top-level apre CEF.
            block_secure_request(sock, req, type, root, argc, argv);
        });
}
 
 
static void do_accept(tcp::acceptor& acceptor, int argc, char** argv) {
    acceptor.async_accept(g_io,
        [&acceptor, argc, argv](boost::system::error_code ec, tcp::socket client) {
            if (ec == asio::error::operation_aborted) return;
 
            if (!ec) {
                handle_client(std::move(client), argc, argv);
            } else {
                char buf[256];
                std::snprintf(buf, sizeof(buf), _("[cef] accept error: %s\n"), ec.message().c_str());
                std::cerr << buf;
            }
 
            do_accept(acceptor, argc, argv);
        });
}
 
static bool running_confined();
 
class BastionApp : public CefApp, public CefBrowserProcessHandler {
public:
    BastionApp() : no_sandbox_(running_confined()) {}
 
    CefRefPtr<CefBrowserProcessHandler> GetBrowserProcessHandler() override {
        return this;
    }
 
    void OnBeforeCommandLineProcessing(const CefString&, CefRefPtr<CefCommandLine> cmd) override {
        cmd->AppendSwitch("incognito");
        cmd->AppendSwitch("disable-extensions");
        cmd->AppendSwitch("no-first-run");
        cmd->AppendSwitch("no-default-browser-check");
        cmd->AppendSwitch("disable-gpu");
        cmd->AppendSwitch("disable-gpu-compositing");
        cmd->AppendSwitch("disable-software-rasterizer");
        cmd->AppendSwitch("disable-gpu-process-crash-limit");
        cmd->AppendSwitch("in-process-gpu");
        cmd->AppendSwitch("disable-accelerated-2d-canvas");
        cmd->AppendSwitch("disable-accelerated-video-decode");
        cmd->AppendSwitch("disable-webgl");
 
        // ANTI-CRASH IN SANDBOX: settings.no_sandbox copre il processo
        // browser, ma i sottoprocessi (zygote, renderer, gpu, utility)
        // leggono i flag dalla command line. In ambiente confinato dobbiamo
        // propagare esplicitamente --no-sandbox a tutti, altrimenti la zygote
        // tenta comunque clone(CLONE_NEWUSER) e aborta.
        if (no_sandbox_) {
            if (!cmd->HasSwitch("no-sandbox"))
                cmd->AppendSwitch("no-sandbox");
            if (!cmd->HasSwitch("disable-setuid-sandbox"))
                cmd->AppendSwitch("disable-setuid-sandbox");
            if (!cmd->HasSwitch("disable-namespace-sandbox"))
                cmd->AppendSwitch("disable-namespace-sandbox");
        }
    }
 
    // Impostato dal processo browser prima di CefInitialize. I sottoprocessi
    // ereditano il flag via command line (--no-sandbox), quindi qui basta
    // riflettere la decisione presa in main().
    void set_no_sandbox(bool v) { no_sandbox_ = v; }
 
    IMPLEMENT_REFCOUNTING(BastionApp);
 
private:
    bool no_sandbox_ = false;
};
 
static bool parse_args(int argc, char** argv, std::string& listen_host, int& listen_port) {
    for (int i = 1; i < argc; ++i) {
        const std::string_view a = argv[i];
 
        if (a.starts_with("--type=") || a.starts_with("--lang=") ||
            a.starts_with("--user-data-dir=") || a.starts_with("--enable-") ||
            a.starts_with("--disable-") || a.starts_with("--service-") ||
            a.starts_with("--utility-") || a.starts_with("--ozone-") ||
            a.starts_with("--render-node-") || a.starts_with("--change-stack-") ||
            a.starts_with("--no-zygote"))
            continue;
 
        if (a == "--listen" && i + 1 < argc) {
            listen_host = argv[++i];
        } else if (a == "--port" && i + 1 < argc) {
            try {
                const int p = std::stoi(argv[++i]);
                if (p < 1 || p > 65535) throw std::out_of_range("port");
                listen_port = p;
            } catch (...) {
                std::cerr << _("[args] invalid --port value\n");
                return false;
            }
        }
    }
 
    return true;
}
 
 
// ---------------------------------------------------------------------------
// Rilevazione ambiente sandbox/confinato.
//
// Il sandbox interno di Chromium/CEF (no_sandbox=false) richiede o il binario
// chrome-sandbox SUID-root, oppure i namespace utente non privilegiati
// (kernel.unprivileged_userns_clone=1). Quando bastionguard_cef gira già
// dentro un confinamento (Flatpak, Snap, AppImage/bubblewrap, container, o
// avviato con BG_SANDBOX=1 dal launch_sandbox() qui sopra), il sandbox
// ANNIDATO non può inizializzarsi: clone(CLONE_NEWUSER) fallisce con EPERM
// e la zygote di Chromium aborta → CRASH dell'intero processo.
//
// In questi casi dobbiamo forzare no_sandbox=true. Questo è esattamente ciò
// che fa già SecureBrowser.cpp (settings.no_sandbox = true).
// ---------------------------------------------------------------------------
static bool running_confined() {
    // 1) Flag esplicito impostato da launch_sandbox() / dal wrapper.
    if (std::getenv("BG_SANDBOX"))            return true;
    if (std::getenv("BG_NO_CEF_SANDBOX"))     return true;
 
    // 2) Flatpak / Snap.
    if (std::getenv("FLATPAK_ID"))            return true;
    if (std::getenv("SNAP"))                  return true;
    if (access("/.flatpak-info", F_OK) == 0)  return true;
 
    // 3) Container generico (Docker/Podman/systemd-nspawn ecc.).
    if (access("/run/.containerenv", F_OK) == 0) return true;
    {
        std::ifstream cg("/proc/1/cgroup");
        std::string line;
        while (std::getline(cg, line)) {
            if (line.find("docker")  != std::string::npos ||
                line.find("libpod")  != std::string::npos ||
                line.find("/lxc")    != std::string::npos) {
                return true;
            }
        }
    }
 
    // 4) Namespace utente non privilegiati disabilitati nel kernel:
    //    senza di essi il sandbox di Chromium non parte (a meno del SUID
    //    helper, che in molte installazioni/portali non è disponibile).
    {
        std::ifstream f("/proc/sys/kernel/unprivileged_userns_clone");
        if (f.good()) {
            int v = 1;
            f >> v;
            if (v == 0) return true;
        }
    }
 
    // 5) Il SUID sandbox helper di CEF non è presente/eseguibile: senza di
    //    esso e senza userns, il sandbox non può attivarsi.
    //    (Percorsi tipici di installazione CEF di BastionGuard.)
    {
        static const char* helpers[] = {
            "/usr/share/BastionGuard/cef/chrome-sandbox",
            "/usr/lib/BastionGuard/chrome-sandbox",
        };
        bool any_helper = false;
        for (const char* h : helpers) {
            struct stat st{};
            if (stat(h, &st) == 0) {
                any_helper = true;
                // Deve essere SUID-root per funzionare.
                if ((st.st_mode & S_ISUID) && st.st_uid == 0) {
                    any_helper = true;
                }
            }
        }
        // Se nessun helper SUID valido e nessun userns, meglio disattivare.
        if (!any_helper) {
            std::ifstream f("/proc/sys/kernel/unprivileged_userns_clone");
            int v = 1;
            if (f.good()) f >> v;
            if (v == 0) return true;
        }
    }
 
    return false;
}
 
 
int main(int argc, char** argv) {
    if (!BastionGuard::Platform::cef_available()) {
        std::cerr << "[bastionguard-cef] CEF disabilitato su questa build o distribuzione.\n";
        return 78;
    }
 
    SettingsStore::apply_language();
 
    bindtextdomain("bastionguard", LOCALEDIR);
    bind_textdomain_codeset("bastionguard", "UTF-8");
    textdomain("bastionguard");
 
    CefMainArgs main_args(argc, argv);
    CefRefPtr<CefApp> app = new BastionApp();
 
    const int exit_code = CefExecuteProcess(main_args, app, nullptr);
    if (exit_code >= 0) return exit_code;
 
    std::string listen_host = "127.0.0.1";
    int         listen_port = 3130;
    if (!parse_args(argc, argv, listen_host, listen_port)) return 2;
 
    CefSettings settings;
 
    // ANTI-CRASH IN SANDBOX: il sandbox interno di Chromium non può
    // annidarsi dentro un altro confinamento. Se siamo confinati, lo
    // disabilitiamo per evitare l'abort della zygote (vedi running_confined()).
    // La decisione è preventiva: CefInitialize non si può ri-eseguire nello
    // stesso processo, quindi NON tentiamo un retry in-process (inefficace);
    // ci affidiamo alla rilevazione a monte, come fa SecureBrowser.
    const bool confined = running_confined();
    settings.no_sandbox = confined;
    settings.multi_threaded_message_loop = true;
    settings.windowless_rendering_enabled = false;
 
    if (confined) {
        std::cerr << _("[cef] ambiente confinato rilevato → sandbox CEF disabilitato\n");
    }
 
    if (!CefInitialize(main_args, settings, app, nullptr)) {
        std::cerr << _("[cef] CefInitialize failed\n");
        return 1;
    }
 
    std::cerr << (settings.no_sandbox
                  ? _("[cef] initialized (sandbox OFF)\n")
                  : _("[cef] initialized (sandbox ON)\n"));
    CaInstaller::ensure_trusted();
 
    domain_filter().load();
    LocalWarningServer warning_server(
        BG_WARNING_HTTP_PORT,
        BG_WARNING_HTTPS_PORT,
        BG_WARNING_ADDR);
    warning_server.start();
 
    ProxyConfig::apply({ listen_host, listen_port });
 
    struct Guard {
        LocalWarningServer& ws;
        ~Guard() {
            ProxyConfig::restore();
            ws.stop();
        }
    } guard{warning_server};
 
    std::vector<std::thread> io_threads;
    io_threads.reserve(IO_THREADS);
 
    {
        char buf[128];
        std::snprintf(buf, sizeof(buf), _("[cef] starting %u I/O threads\n"), IO_THREADS);
        std::cerr << buf;
    }
 
    asio::signal_set sig(g_io, SIGINT, SIGTERM);
    sig.async_wait([&](const boost::system::error_code&, int) {
        std::cerr << _("[cef] signal received, exiting\n");
        ProxyConfig::restore();
        guard.ws.stop();
        g_io.stop();
    });
 
    asio::signal_set sighup(g_io, SIGHUP);
    std::function<void()> arm_sighup = [&]() {
        sighup.async_wait([&](const boost::system::error_code& ec, int) {
            if (ec) return;
            std::cerr << _("[filter] SIGHUP: reloading domain lists\n");
            domain_filter().load();
            arm_sighup();
        });
    };
    arm_sighup();
 
    tcp::acceptor acceptor(g_io);
    {
        boost::system::error_code ec;
        tcp::endpoint ep(asio::ip::make_address(listen_host),
                         static_cast<unsigned short>(listen_port));
 
        acceptor.open(ep.protocol(), ec);
        if (!ec) acceptor.set_option(asio::socket_base::reuse_address(true), ec);
        if (!ec) acceptor.bind(ep, ec);
        if (!ec) acceptor.listen(asio::socket_base::max_listen_connections, ec);
 
        if (ec) {
            char buf[256];
            std::snprintf(buf, sizeof(buf), _("[cef] acceptor error: %s\n"), ec.message().c_str());
            std::cerr << buf;
            ProxyConfig::restore();
            warning_server.stop();
            CefShutdown();
            return 1;
        }
    }
 
    {
        char buf[256];
        std::snprintf(buf, sizeof(buf), _("[cef] backend proxy listening on %s:%d\n"),
                      listen_host.c_str(), listen_port);
        std::cerr << buf;
    }
 
    do_accept(acceptor, argc, argv);
 
    for (unsigned int i = 1; i < IO_THREADS; ++i)
        io_threads.emplace_back([]() { g_io.run(); });
 
    g_io.run();
 
    for (auto& t : io_threads)
        if (t.joinable()) t.join();
 
    CefShutdown();
    return 0;
}