bank_filter.hpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#pragma once
 
#include <string>
#include <string_view>
#include <unordered_set>
#include <fstream>
#include <sstream>
#include <iostream>
#include <cstdlib>
#include <cstdint>
#include <cstring>
#include <filesystem>
#include <mutex>
#include <shared_mutex>
#include <cstdio>
#include <algorithm>
#include <cctype>
 
#include <arpa/inet.h>   // inet_pton per riconoscere indirizzi LAN/loopback
 
#include <glib/gi18n.h>
 
 
static std::unordered_set<std::string> extract_list(const std::string& json) {
    std::unordered_set<std::string> result;
 
    // Trova "list" : [
    auto list_pos = json.find("\"list\"");
    if (list_pos == std::string::npos) return result;
 
    auto bracket = json.find('[', list_pos);
    if (bracket == std::string::npos) return result;
 
 
    std::size_t depth = 1;
    std::size_t pos   = bracket + 1;
    bool in_string    = false;
 
    while (pos < json.size() && depth > 0) {
        char c = json[pos];
        if (in_string) {
            if (c == '\\') ++pos;
            else if (c == '"') in_string = false;
        } else {
            if      (c == '"') in_string = true;
            else if (c == '[') ++depth;
            else if (c == ']') --depth;
        }
        ++pos;
    }
 
    if (depth != 0) return result;
 
    std::size_t i = bracket + 1;
    const std::size_t end = pos - 1;
 
    while (i < end) {
        auto q1 = json.find('"', i);
        if (q1 == std::string::npos || q1 >= end) break;
 
        auto q2 = q1 + 1;
 
        while (q2 < end) {
            if (json[q2] == '\\') {
                q2 += 2;
                continue;
            }
            if (json[q2] == '"') break;
            ++q2;
        }
 
        if (q2 >= end) break;
 
        std::string entry = json.substr(q1 + 1, q2 - q1 - 1);
        if (!entry.empty()) result.insert(std::move(entry));
 
        i = q2 + 1;
    }
 
    return result;
}
 
static std::string read_file(const std::filesystem::path& p) {
    std::ifstream f(p);
    if (!f) return {};
 
    std::ostringstream ss;
    ss << f.rdbuf();
    return ss.str();
}
 
 
class DomainFilter {
public:
    void load() {
        const char* home = std::getenv("HOME");
        if (!home) {
            std::cerr << _("[filter] HOME variable not set\n");
            return;
        }
 
        namespace fs = std::filesystem;
        fs::path data_base   = fs::path(home) / ".local/share/BastionGuard";
        fs::path config_base = fs::path(home) / ".config/BastionGuard";
 
        std::unordered_set<std::string> new_banks;
        std::unordered_set<std::string> new_payments;
        std::unordered_set<std::string> new_trusted;
        std::unordered_set<std::string> new_exclusions;
        std::unordered_set<std::string> new_user_banks;
        std::unordered_set<std::string> new_proxy_bypass;
        std::vector<CidrEntry>          new_proxy_bypass_cidrs;
 
        load_file(data_base   / "banks.json",      new_banks,        _("banks"));
        load_file(config_base / "payments.json",   new_payments,     _("payments"));
        load_file(config_base / "exclusions.json", new_exclusions,   _("exclusions"));
        load_file(config_base / "whitelist.json",  new_user_banks,   _("user-banks"));
        load_file(config_base / "proxy_bypass.json", new_proxy_bypass, _("proxy-bypass"));
 
        // Separiamo i CIDR (es. "93.55.84.0/24") dal set di stringhe esatte.
        // Il set string-based serve solo per match esatto/suffisso; i CIDR
        // vanno gestiti col bit-mask in match_cidr().
        {
            std::vector<std::string> to_strip;
            for (const auto& entry : new_proxy_bypass) {
                if (entry.find('/') == std::string::npos) continue;
                CidrEntry ce;
                if (parse_cidr(entry, ce)) {
                    new_proxy_bypass_cidrs.push_back(ce);
                    to_strip.push_back(entry);
                }
            }
            for (const auto& s : to_strip) new_proxy_bypass.erase(s);
        }
 
        for (const auto& d : get_builtin_exclusions())
            new_exclusions.insert(d);
 
        {
            std::unique_lock lock(mutex_);
            banks_              = std::move(new_banks);
            payments_           = std::move(new_payments);
            trusted_            = std::move(new_trusted);
            exclusions_         = std::move(new_exclusions);
            user_banks_         = std::move(new_user_banks);
            proxy_bypass_       = std::move(new_proxy_bypass);
            proxy_bypass_cidrs_ = std::move(new_proxy_bypass_cidrs);
 
            char msg[256];
            std::snprintf(msg, sizeof(msg),
                _("[filter] loaded %zu bank, %zu user-bank, %zu payment, %zu exclusion, %zu proxy-bypass (+%zu CIDR)\n"),
                banks_.size(), user_banks_.size(), payments_.size(),
                exclusions_.size(), proxy_bypass_.size(), proxy_bypass_cidrs_.size());
            std::cerr << msg;
        }
    }
 
    bool is_proxy_bypass(const std::string& host) const {
        std::shared_lock lock(mutex_);
        // 1) match esatto/suffisso DNS (incluso IP letterale "93.55.84.43")
        if (match(host, proxy_bypass_)) return true;
        // 2) match CIDR (host deve essere un IP letterale che cade in un range)
        return match_cidr(host, proxy_bypass_cidrs_);
    }
 
    // -----------------------------------------------------------------------
    //  is_local_network
    //
    //  True per qualunque host che non deve passare dal proxy/MITM CEF:
    //    - hostname locali:    "localhost", *.local (mDNS), *.lan,
    //                          *.internal, *.intranet, *.home.arpa
    //    - hostname brevi      (senza punti) tipici di reti aziendali
    //    - IPv4 letterali in:
    //        127.0.0.0/8       loopback
    //        10.0.0.0/8        RFC1918 privato
    //        172.16.0.0/12     RFC1918 privato
    //        192.168.0.0/16    RFC1918 privato
    //        169.254.0.0/16    link-local
    //        100.64.0.0/10     CGNAT (RFC6598, spesso usato dai router)
    //    - IPv6 letterali:
    //        ::1               loopback
    //        fe80::/10         link-local
    //        fc00::/7          unique local (ULA)
    //
    //  Non richiede stato → è un metodo statico, può essere chiamato anche
    //  senza istanziare DomainFilter.
    // -----------------------------------------------------------------------
    static bool is_local_network(const std::string& host_raw) {
        if (host_raw.empty()) return false;
 
        // Strip eventuali bracket IPv6: [::1] → ::1
        std::string h = host_raw;
        if (h.size() >= 2 && h.front() == '[' && h.back() == ']')
            h = h.substr(1, h.size() - 2);
 
        // Lowercase per il match hostname (DNS è case-insensitive)
        std::string h_lower = h;
        std::transform(h_lower.begin(), h_lower.end(), h_lower.begin(),
            [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
 
        // 1) Hostname speciali
        if (h_lower == "localhost") return true;
        if (h_lower == "ip6-localhost") return true;
        if (h_lower == "ip6-loopback")  return true;
 
        // 2) TLD locali standard (mDNS/zeroconf, RFC6762, RFC8375, RFC2606)
        static const char* local_suffixes[] = {
            ".local", ".localhost", ".lan", ".intranet",
            ".internal", ".private", ".corp", ".home", ".home.arpa",
            nullptr
        };
        for (int i = 0; local_suffixes[i]; ++i) {
            const std::string suf = local_suffixes[i];
            if (h_lower.size() >= suf.size() &&
                h_lower.compare(h_lower.size() - suf.size(), suf.size(), suf) == 0) {
                return true;
            }
        }
 
        // 3) IPv4 letterale → check per range
        {
            in_addr v4{};
            if (::inet_pton(AF_INET, h_lower.c_str(), &v4) == 1) {
                const std::uint32_t a = ntohl(v4.s_addr);
                const std::uint8_t b1 = (a >> 24) & 0xFF;
                const std::uint8_t b2 = (a >> 16) & 0xFF;
 
                // 127.0.0.0/8 loopback
                if (b1 == 127) return true;
                // 10.0.0.0/8 RFC1918
                if (b1 == 10)  return true;
                // 172.16.0.0/12 RFC1918
                if (b1 == 172 && (b2 >= 16 && b2 <= 31)) return true;
                // 192.168.0.0/16 RFC1918
                if (b1 == 192 && b2 == 168) return true;
                // 169.254.0.0/16 link-local
                if (b1 == 169 && b2 == 254) return true;
                // 100.64.0.0/10 CGNAT (RFC6598)
                if (b1 == 100 && (b2 & 0xC0) == 0x40) return true;
                // 0.0.0.0/8 "this network"
                if (b1 == 0)   return true;
 
                return false; // IPv4 pubblico
            }
        }
 
        // 4) IPv6 letterale → check per range
        {
            in6_addr v6{};
            if (::inet_pton(AF_INET6, h_lower.c_str(), &v6) == 1) {
                // ::1 loopback
                static const std::uint8_t loopback[16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1};
                if (std::memcmp(v6.s6_addr, loopback, 16) == 0) return true;
 
                // fe80::/10 link-local: i primi 10 bit = 1111 1110 10
                if (v6.s6_addr[0] == 0xFE && (v6.s6_addr[1] & 0xC0) == 0x80) return true;
 
                // fc00::/7 unique local: i primi 7 bit = 1111 110
                if ((v6.s6_addr[0] & 0xFE) == 0xFC) return true;
 
                // ::ffff:0:0/96 IPv4-mapped → estraiamo l'IPv4 dentro e ricorriamo
                static const std::uint8_t v4mapped_prefix[12] =
                    {0,0,0,0,0,0,0,0,0,0,0xFF,0xFF};
                if (std::memcmp(v6.s6_addr, v4mapped_prefix, 12) == 0) {
                    char buf[INET_ADDRSTRLEN];
                    in_addr v4inner{};
                    std::memcpy(&v4inner.s_addr, v6.s6_addr + 12, 4);
                    if (::inet_ntop(AF_INET, &v4inner, buf, sizeof(buf)))
                        return is_local_network(buf);
                }
 
                return false; // IPv6 pubblico
            }
        }
 
        // 5) Hostname senza punti = nome NetBIOS / LAN tipico (es. "router",
        //    "nas", "printer") — lo trattiamo come locale per sicurezza.
        if (h_lower.find('.') == std::string::npos) return true;
 
        return false;
    }
 
    bool is_secure(const std::string& host) const {
        if (is_local_network(host)) return false;
        std::shared_lock lock(mutex_);
 
        if (match(host, proxy_bypass_)) return false;
        if (match(host, exclusions_)) return false;
        if (match(host, banks_) || match(host, user_banks_) || match(host, payments_))
            return true;
        // Provider di pagamento noti: intercetta anche senza payments.json,
        // così Stripe/PayPal/ecc. si aprono in sandbox e non nel browser.
        return match(host, get_builtin_payment_providers());
    }
 
    bool is_trusted(const std::string& host) const {
        std::shared_lock lock(mutex_);
        return match(host, trusted_);
    }
 
    bool is_bank(const std::string& host) const {
        if (is_local_network(host)) return false;
        std::shared_lock lock(mutex_);
        if (match(host, proxy_bypass_)) return false;
        if (match(host, exclusions_))   return false;
        return match(host, banks_) || match(host, user_banks_);
    }
 
    bool is_payment(const std::string& host) const {
        if (is_local_network(host)) return false;
        std::shared_lock lock(mutex_);
        if (match(host, proxy_bypass_)) return false;
        if (match(host, exclusions_))   return false;
        if (match(host, payments_)) return true;
        return match(host, get_builtin_payment_providers());
    }
 
private:
    mutable std::shared_mutex mutex_;
 
    std::unordered_set<std::string> banks_;
    std::unordered_set<std::string> user_banks_;
    std::unordered_set<std::string> payments_;
    std::unordered_set<std::string> trusted_;
    std::unordered_set<std::string> exclusions_;
    std::unordered_set<std::string> proxy_bypass_;
 
    // ----- CIDR di bypass: parsati da proxy_bypass.json (es. "93.55.84.0/24") -----
    struct CidrEntry {
        bool is_v6 = false;
        std::uint8_t addr[16] = {0};   // IPv4 nei primi 4 byte se !is_v6
        int          prefix  = 0;       // 0..32 per v4, 0..128 per v6
    };
    std::vector<CidrEntry> proxy_bypass_cidrs_;
 
    // Provider di pagamento "navigabili" (pagine di checkout/login/dashboard)
    // che vanno SEMPRE intercettati e aperti in sandbox, anche se l'utente non
    // li ha messi in payments.json. NON includere qui gli endpoint tecnici
    // (js.*, api.*, hooks.*, cdn.*): quelli stanno nelle esclusioni perché
    // sono iframe/API caricati dentro le pagine dei merchant e intercettarli
    // romperebbe il checkout. Le esclusioni hanno comunque priorità (vengono
    // controllate prima), quindi js.stripe.com resta passante mentre
    // checkout.stripe.com viene aperto in sandbox.
    static const std::unordered_set<std::string>& get_builtin_payment_providers() {
        static const std::unordered_set<std::string> pp = {
            "stripe.com",
            "paypal.com",
            "paypalobjects.com",
            "adyen.com",
            "checkout.com",
            "klarna.com",
            "worldpay.com",
            "braintreegateway.com",
            "nexi.it",
            "nexigroup.com",
            "sisalpay.it",
            "satispay.com",
            "sumup.com",
            "square.com",
            "squareup.com",
            "mollie.com",
            "gocardless.com",
            "wise.com",
            "revolut.com",
            "skrill.com",
            "neteller.com",
            "paysafecard.com",
            "amazonpay.com",
            "wallet.google.com",
            "pay.google.com",
        };
        return pp;
    }
 
    static const std::unordered_set<std::string>& get_builtin_exclusions() {
        static const std::unordered_set<std::string> ex = {
            "js.stripe.com",
            "api.stripe.com",
            "m.stripe.com",
            "r.stripe.com",
            "b.stripe.com",
            "q.stripe.com",
            "hooks.stripe.com",
            "cdn.stripe.com",
            "errors.stripe.com",
            "stripe.network",
            "api.paypal.com",
            "t.paypal.com",
            "c.paypal.com",
            "pics.paypal.com",
            "history.paypal.com",
            "stats.paypal.com",
            "api-m.paypal.com",
            "api-m.sandbox.paypal.com",
            "www.sandbox.paypal.com",
            "api.sandbox.paypal.com",
            "payments.amazon.com",
            "static.payments.amazon.com",
            "widgets.amazon.com",
            "fls-eu.amazon.com",
            "google.com/pay",
            "tpay.google.com",
            "pay-sandbox.google.com",
            "apple-pay-gateway.apple.com",
            "apple-pay-gateway-cert.apple.com",
            "cn-apple-pay-gateway.apple.com",
            "live.adyen.com",
            "checkoutshopper-live.adyen.com",
            "checkoutshopper-test.adyen.com",
            "ca-live.adyen.com",
            "analytics.adyen.com",
            "js.klarna.com",
            "api.klarna.com",
            "x.klarnacdn.net",
            "klarnaservices.com",
            "osm.klarnaservices.com",
            "api.checkout.com",
            "cdn.checkout.com",
            "events.checkout.com",
            "api.worldpay.com",
            "access.worldpay.com",
            "cdn.worldpay.com",
            "api.braintreegateway.com",
            "assets.braintreegateway.com",
            "payments.braintree-api.com",
            "client-analytics.braintreegateway.com",
            "api.braintreepayments.com",
            "api.nexi.it",
            "xpay.nexigroup.com",
            "ecommerce.nexi.it",
            "api.sisalpay.it",
            "facebook.com",
            "www.facebook.com",
            "m.facebook.com",
            "graph.facebook.com",
            "connect.facebook.net",
            "staticxx.facebook.com",
            "static.xx.fbcdn.net",
            "accounts.facebook.com",
            "web.facebook.com",
            "business.facebook.com",
            "developers.facebook.com",
            "l.facebook.com",
            "fbcdn.net",
            "akamaihd.net",
            "instagram.com",
            "www.instagram.com",
            "cdninstagram.com",
            "whatsapp.com",
            "web.whatsapp.com",
            "api.whatsapp.com",
            "messenger.com",
            "www.messenger.com",
            "accounts.google.com",
            "oauth2.googleapis.com",
            "apis.google.com",
            "recaptcha.google.com",
            "www.recaptcha.net",
            "recaptcha.net",
            "www.gstatic.com",
            "gstatic.com",
            "google.com",
            "www.google.com",
            "google.it",
            "www.google.it",
            "id.google.com",
            "myaccount.google.com",
            "signin.google.com",
            "login.microsoftonline.com",
            "login.live.com",
            "login.windows.net",
            "account.microsoft.com",
            "microsoftonline.com",
            "appleid.apple.com",
            "idmsa.apple.com",
            "gsa.apple.com",
            "challenges.cloudflare.com",
            "cloudflare.com",
            "twitter.com",
            "x.com",
            "api.twitter.com",
            "t.co",
        };
 
        return ex;
    }
 
    static void load_file(const std::filesystem::path& path,
                          std::unordered_set<std::string>& target,
                          const char* label)
    {
        target.clear();
 
        std::string json = read_file(path);
        if (json.empty()) {
            char msg[512];
            std::snprintf(msg, sizeof(msg),
                _("[filter] cannot read %s list: %s\n"),
                label, path.c_str());
            std::cerr << msg;
            return;
        }
 
        target = extract_list(json);
    }
 
    static bool match(const std::string& host,
                      const std::unordered_set<std::string>& set)
    {
        if (set.count(host)) return true;
        if (set.count("." + host)) return true;
        std::string h = host;
 
        while (true) {
            auto dot = h.find('.');
            if (dot == std::string::npos) break;
 
            std::string with_dot = h.substr(dot);
            std::string without  = h.substr(dot + 1);
 
            if (without.find('.') != std::string::npos) {
                if (set.count(with_dot)) return true;
                if (set.count(without))  return true;
            }
 
            h = without;
        }
 
        return false;
    }
 
    // -----------------------------------------------------------------------
    //  parse_cidr / match_cidr
    //
    //  Supporto per voci CIDR nella proxy_bypass list.
    //  Es.: "93.55.84.0/24" matcha 93.55.84.0..93.55.84.255.
    //       "2a01:4f8::/29" matcha tutto il blocco /29.
    //
    //  parse_cidr ritorna true se la stringa è un CIDR valido e popola 'out'.
    //  match_cidr controlla se 'host' (deve essere un IP letterale) cade
    //  in uno dei CIDR del vector.
    // -----------------------------------------------------------------------
    static bool parse_cidr(const std::string& s, CidrEntry& out) {
        auto slash = s.find('/');
        if (slash == std::string::npos) return false;
        const std::string addr = s.substr(0, slash);
        const std::string mask = s.substr(slash + 1);
        if (addr.empty() || mask.empty()) return false;
 
        // mask numerica
        for (char c : mask)
            if (!std::isdigit(static_cast<unsigned char>(c))) return false;
        const int m = std::atoi(mask.c_str());
 
        in_addr v4{};
        if (::inet_pton(AF_INET, addr.c_str(), &v4) == 1) {
            if (m < 0 || m > 32) return false;
            out.is_v6  = false;
            std::memset(out.addr, 0, 16);
            std::memcpy(out.addr, &v4.s_addr, 4);
            out.prefix = m;
            return true;
        }
        in6_addr v6{};
        if (::inet_pton(AF_INET6, addr.c_str(), &v6) == 1) {
            if (m < 0 || m > 128) return false;
            out.is_v6  = true;
            std::memcpy(out.addr, v6.s6_addr, 16);
            out.prefix = m;
            return true;
        }
        return false;
    }
 
    static bool match_cidr(const std::string& host_raw,
                           const std::vector<CidrEntry>& cidrs)
    {
        if (cidrs.empty() || host_raw.empty()) return false;
 
        // Strip bracket "[::1]" → "::1"
        std::string h = host_raw;
        if (h.size() >= 2 && h.front() == '[' && h.back() == ']')
            h = h.substr(1, h.size() - 2);
 
        std::uint8_t hbytes[16] = {0};
        bool host_is_v6 = false;
 
        in_addr v4{};
        in6_addr v6{};
        if (::inet_pton(AF_INET, h.c_str(), &v4) == 1) {
            std::memcpy(hbytes, &v4.s_addr, 4);
            host_is_v6 = false;
        } else if (::inet_pton(AF_INET6, h.c_str(), &v6) == 1) {
            std::memcpy(hbytes, v6.s6_addr, 16);
            host_is_v6 = true;
        } else {
            // Hostname (non IP): non possiamo confrontare con CIDR senza DNS.
            return false;
        }
 
        for (const auto& c : cidrs) {
            if (c.is_v6 != host_is_v6) continue;
            const int total_bits = c.is_v6 ? 128 : 32;
            int rem = c.prefix;
            bool ok = true;
            for (int i = 0; i < (total_bits / 8) && rem > 0; ++i) {
                const std::uint8_t mask =
                    (rem >= 8) ? 0xFF : static_cast<std::uint8_t>(0xFF << (8 - rem));
                if ((hbytes[i] & mask) != (c.addr[i] & mask)) {
                    ok = false;
                    break;
                }
                rem -= 8;
            }
            if (ok) return true;
        }
        return false;
    }
};
 
inline DomainFilter& domain_filter() {
    static DomainFilter f;
    return f;
}