BastionGuard-daemon.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
 
#include "local_warning_server.hpp"
#include "../SafeProcess.hpp"
#include <iostream>
#include <csignal>
#include <thread>
#include <chrono>
#include <memory>
#include <string>
#include <unordered_map>
#include <filesystem>
#include <fstream>
#include <pwd.h>
#include <grp.h>
#include <sys/types.h>
#include <unistd.h>
#include <cstring>
#include <sys/socket.h>
#include <netinet/in.h>
#include <nlohmann/json.hpp>
#include <unordered_set>
#include <glib/gi18n.h>
 
namespace fs = std::filesystem;
 
 
static bool running = true;
static void handle_signal(int) { running = false; }
 
static std::unordered_map<std::string, std::string> parse_args(int argc, char* argv[]) {
    std::unordered_map<std::string, std::string> opts;
    for (int i = 1; i < argc; ++i) {
        std::string arg = argv[i];
        if (arg.rfind("--", 0) == 0) {
            size_t eq = arg.find('=');
            if (eq != std::string::npos) {
                std::string key = arg.substr(2, eq - 2);
                std::string value = arg.substr(eq + 1);
                opts[key] = value;
            }
        }
    }
    return opts;
}
 
 
static std::unordered_set<std::string> g_trusted;
static bool g_trusted_loaded = false;
 
static std::string clean_domain(std::string d) {
    std::transform(d.begin(), d.end(), d.begin(), ::tolower);
    if (!d.empty() && d.front() == '.') d.erase(0, 1);
    if (d.rfind("www.", 0) == 0) d.erase(0, 4);
    auto p = d.find(':'); if (p != std::string::npos) d.erase(p);
    if (!d.empty() && d.back() == '.') d.pop_back();
    return d;
}
 
static void load_list_file(const std::string& path, std::vector<std::string>& out) {
    if (!fs::exists(path)) return;
    try {
        std::ifstream f(path);
        if (!f.good()) return;
        nlohmann::json j;
        f >> j;
 
        auto push = [&](const std::string& s){
            auto d = clean_domain(s);
            if(!d.empty()) out.push_back(d);
        };
 
        if (j.is_array()) {
            for (auto& v : j) if (v.is_string()) push(v.get<std::string>());
        } else {
            if (j.contains("list") && j["list"].is_array())
                for (auto& v : j["list"]) if (v.is_string()) push(v.get<std::string>());
            if (j.contains("domains") && j["domains"].is_array())
                for (auto& v : j["domains"]) if (v.is_string()) push(v.get<std::string>());
            if (j.contains("whitelist") && j["whitelist"].is_array())
                for (auto& v : j["whitelist"]) if (v.is_string()) push(v.get<std::string>());
        }
    } catch (...) {}
}
 
static void ensure_trusted_loaded() {
    if (g_trusted_loaded) return;
    std::vector<std::string> tmp;
    load_list_file("/usr/share/BastionGuard/data/bank/banks.json", tmp);
    if (const char* home = std::getenv("HOME"))
        load_list_file(std::string(home) + "/.config/BastionGuard/whitelist.json", tmp);
    for (auto& d : tmp) g_trusted.insert(d);
    g_trusted_loaded = true;
    std::cerr << _("[BastionGuard-daemon] ✅ Whitelist caricata: ") << g_trusted.size() << _(" domini trusted.\n");
}
 
static bool is_trusted_domain(const std::string& host) {
    ensure_trusted_loaded();
    std::string h = clean_domain(host);
    if (h.empty()) return false;
    if (g_trusted.count(h)) return true;
    auto pos = h.find('.');
    while (pos != std::string::npos) {
        std::string parent = h.substr(pos + 1);
        if (g_trusted.count(parent)) return true;
        pos = h.find('.', pos + 1);
    }
    return false;
}
 
 
static void ensure_log_file(const std::string& log_dir, const std::string& log_file, const char* user_name = "BastionGuard", mode_t file_mode = 0640) {
    try {
        if (!fs::exists(log_dir)) {
            fs::create_directories(log_dir);
            std::cout << _("[BastionGuard-daemon] 📁 Creata directory log: ") << log_dir << "\n";
        }
 
        if (!fs::exists(log_file)) {
            std::ofstream ofs(log_file, std::ios::trunc);
            ofs << _("[BastionGuard-daemon] Log creato automaticamente.\n");
            ofs.close();
            std::cout << _("[BastionGuard-daemon] 🧾 Creato file log: ") << log_file << "\n";
        }
 
        std::filesystem::permissions(
            log_file,
            std::filesystem::perms::owner_read | std::filesystem::perms::owner_write |
            std::filesystem::perms::group_read,
            std::filesystem::perm_options::replace
        );
 
        if (geteuid() == 0 && user_name != nullptr) {
            struct passwd *pw = getpwnam(user_name);
            if (pw) {
                gid_t gid = pw->pw_gid;
                uid_t uid = pw->pw_uid;
                struct group *gr = getgrnam(user_name);
                if (gr) gid = gr->gr_gid;
                if (chown(log_file.c_str(), uid, gid) == 0) {
                    std::cout << _("[BastionGuard-daemon] 🔐 Proprietario impostato su ")
                              << user_name << ":" << user_name << "\n";
                } else {
                    std::cerr << _("[BastionGuard-daemon] ⚠️ Impossibile cambiare owner del log (")
                              << strerror(errno) << ")\n";
                }
            } else {
                std::cerr << _("[BastionGuard-daemon] ⚠️ Utente '") << user_name
                          << _("' non trovato: skip chown\n");
            }
        }
    } catch (const std::exception& e) {
        std::cerr << _("[BastionGuard-daemon] ⚠️ Errore gestione log: ") << e.what() << "\n";
    }
}
 
static bool can_bind_privileged_ports() {
    if (geteuid() == 0) return true;
    const auto caps = bg_process::run({"getcap", "/proc/self/exe"});
    const bool ok = caps.ok() && caps.output.find("cap_net_bind_service") != std::string::npos;
    return ok;
}
 
int main(int argc, char* argv[]) {
    std::signal(SIGINT, handle_signal);
    std::signal(SIGTERM, handle_signal);
 
    std::cout << _("[BastionGuard-daemon] 🚀 Avvio del servizio LocalWarningServer...") << std::endl;
 
    auto args = parse_args(argc, argv);
 
    auto parse_int_arg = [&](const std::string& key, int fallback) {
        if (!args.count(key)) return fallback;
        try {
            return std::stoi(args[key]);
        } catch (...) {
            std::cerr << "[BastionGuard-daemon] ⚠️ "
                      << "--" << key << " non è un intero valido, uso fallback "
                      << fallback << "\n";
            return fallback;
        }
    };
 
    int http_port = parse_int_arg("http-port", 81);
    int https_port = parse_int_arg("https-port", 444);
    std::string bind_address = args.count("bind-address") ? args["bind-address"] : "127.0.0.2";
    std::string page_warning = args.count("page-warning") ? args["page-warning"] : "/usr/share/BastionGuard/data/blocking/block.html";
 
    std::cout << "[BastionGuard-daemon] Configurazione:\n"
              << "  ├─ HTTP port:     " << http_port << "\n"
              << "  ├─ HTTPS port:    " << https_port << "\n"
              << "  ├─ Bind address:  " << bind_address << "\n"
              << "  ├─ Warning page:  " << page_warning << "\n";
 
    if (!can_bind_privileged_ports()) {
        std::cerr << _("[BastionGuard-daemon] ⚠️ Permessi insufficienti per aprire porte 81/444.\n")
                  <<  _( "    Esegui: sudo setcap 'cap_net_bind_service=+ep' /usr/bin/BastionGuard-daemon\n");
    }
 
    const std::string log_dir  = "/var/log/BastionGuard";
    const std::string log_file = log_dir + "/phishing_scanner";
    ensure_log_file(log_dir, log_file, "BastionGuard", 0640);
 
    try {
        ensure_trusted_loaded();
        auto warning_server = std::make_unique<LocalWarningServer>(
            http_port, https_port, bind_address, "", "", page_warning
        );
 
        warning_server->start();
        std::cout << _("[BastionGuard-daemon] ✅ Server attivo su ") << bind_address
                  << ":" << http_port << _(" e ") << https_port << "." << std::endl;
 
        while (running) {
    std::ifstream dnslog("/var/log/BastionGuard/dns_query.log");
    std::string line;
    while (std::getline(dnslog, line)) {
        std::string host = clean_domain(line);
        if (is_trusted_domain(host)) {
            std::cout << _("[BastionGuard-daemon] 🟢 Trusted domain rilevato: ") << host << _(" — bypass redirect.\n");
        } else {
            std::cout << _("[BastionGuard-daemon] 🔴 Sospetto: ") << host << _(" — instradato verso 127.0.0.2.\n");
        }
    }
    dnslog.close();
 
    std::this_thread::sleep_for(std::chrono::seconds(2));
}
 
 
        std::cout << _("[BastionGuard-daemon] 🛑 Arresto in corso...") << std::endl;
        warning_server->stop();
        std::cout << _("[BastionGuard-daemon] ✅ Terminato correttamente.") << std::endl;
    }
    catch (const std::exception& e) {
        std::cerr << _("[BastionGuard-daemon] ❌ Errore fatale: ") << e.what() << std::endl;
        return 1;
    }
    catch (...) {
        std::cerr << _("[BastionGuard-daemon] ❌ Errore sconosciuto.") << std::endl;
        return 1;
    }
 
    return 0;
}