ca_installer.hpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#pragma once
 
#include <string>
#include <vector>
#include <filesystem>
#include <iostream>
#include <fstream>
#include <cstdlib>
#include <pwd.h>
#include <unistd.h>
#include <glob.h>
 
#include "../DistroUtils.hpp"
#include "../SafeProcess.hpp"
 
#include <glib/gi18n.h>
 
namespace fs = std::filesystem;
 
namespace CaInstaller {
 
static constexpr const char* CA_NAME = "BastionGuard-CA";
 
static constexpr const char* HELPER  =
    "/usr/share/BastionGuard/data/scripts/install-ca-system.sh";
 
static inline fs::path ca_src_path() {
    const char* h = std::getenv("HOME");
    return fs::path(h ? h : "/tmp")
           / ".local/share/BastionGuard/certs/intercept-ca.crt.pem";
}
 
static inline fs::path stamp_path() {
    const char* h = std::getenv("HOME");
    return fs::path(h ? h : "/tmp")
           / ".local/share/BastionGuard/ca-installed.stamp";
}
 
static inline std::string ca_fingerprint(const fs::path& ca_path) {
    const auto result = bg_process::run({"openssl", "x509", "-in", ca_path.string(),
                                         "-noout", "-fingerprint", "-sha1"});
    if (!result.ok()) return {};
    const auto eq = result.output.find('=');
    if (eq == std::string::npos) return {};
    std::string fingerprint = result.output.substr(eq + 1);
    while (!fingerprint.empty() && (fingerprint.back() == '\n' || fingerprint.back() == '\r'))
        fingerprint.pop_back();
    return fingerprint;
}
 
static inline bool stamp_is_valid() {
    if (!fs::exists(stamp_path())) return false;
    std::ifstream f(stamp_path());
    std::string stamped_fp;
    std::getline(f, stamped_fp);
    const std::string current_fp = ca_fingerprint(ca_src_path());
    return !current_fp.empty() && (stamped_fp == current_fp);
}
 
static inline void write_stamp() {
    try {
        fs::create_directories(stamp_path().parent_path());
        std::ofstream f(stamp_path());
        f << ca_fingerprint(ca_src_path()) << "\n";
    } catch (...) {}
}
 
static inline bool run(const std::vector<std::string>& args) {
    return bg_process::run(args).ok();
}
 
static inline std::string current_home() {
    const char* h = std::getenv("HOME");
    if (h && *h) return h;
    const passwd* pw = getpwuid(getuid());
    return pw ? pw->pw_dir : "";
}
 
static inline std::vector<std::string> glob_expand(const std::string& pat) {
    std::vector<std::string> out;
    glob_t g{};
    if (glob(pat.c_str(), GLOB_NOSORT | GLOB_TILDE, nullptr, &g) == 0)
        for (size_t i = 0; i < g.gl_pathc; ++i)
            out.emplace_back(g.gl_pathv[i]);
    globfree(&g);
    return out;
}
 
static inline bool is_system_trusted() {
    const std::string ca = ca_src_path().string();
    if (!fs::exists(ca)) return false;
    for (const auto& bundle : {
            std::string("/etc/ssl/certs/ca-certificates.crt"),
            std::string("/etc/pki/tls/certs/ca-bundle.crt"),
            std::string("/etc/ssl/ca-bundle.pem"),
            std::string("/etc/pki/tls/cacert.pem"),
            std::string("/usr/share/ca-certificates/ca-bundle.crt"),
            std::string("/etc/ssl/certs/ca-bundle.crt"),
        })
    {
        if (fs::exists(bundle) &&
            run({"openssl", "verify", "-CAfile", bundle, ca}))
            return true;
    }
    return false;
}
 
static inline void nss_add(const std::string& nssdb) {
    if (!fs::exists(nssdb)) return;
    const std::string ca = ca_src_path().string();
    if (!fs::exists(ca)) return;
    const std::string prefix = fs::exists(nssdb + "/cert9.db") ? "sql:" : "dbm:";
    run({"certutil", "-A", "-d", prefix + nssdb,
         "-n", CA_NAME, "-t", "CT,,", "-i", ca});
}
 
static inline void install_nss_user(const std::string& home) {
    if (home.empty() || !fs::exists(ca_src_path())) return;
 
    for (const auto& pat : std::vector<std::string>{
            home + "/.mozilla/firefox/*.default",
            home + "/.mozilla/firefox/*.default-release",
            home + "/.mozilla/firefox/*.default-esr",
            home + "/.var/app/org.mozilla.firefox/.mozilla/firefox/*.default",
            home + "/.var/app/org.mozilla.firefox/.mozilla/firefox/*.default-release",
            home + "/.pki/nssdb",
            home + "/snap/chromium/current/.pki/nssdb",
        })
    {
        for (const auto& match : glob_expand(pat))
            nss_add(match);
    }
 
    std::cerr << _("[ca-installer] NSS utente aggiornato\n");
}
 
static inline bool install_system_via_pkexec() {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[ca-installer] CA di sistema disabilitata su Fedora/RHEL/Alma/Rocky\n");
        return false;
    }
    if (!fs::exists(HELPER)) {
        std::cerr << _("[ca-installer] ❌ helper non trovato: ") << HELPER << "\n";
        return false;
    }
 
    std::cerr << _("[ca-installer] 🔐 Richiesta autorizzazione installazione CA...\n");
    if (!run({"pkexec", HELPER, ca_src_path().string()})) {
        std::cerr << _("[ca-installer] ❌ pkexec fallito o rifiutato dall'utente\n");
        return false;
    }
 
    write_stamp();
 
    std::cerr << _("[ca-installer] ✅ CA installata nel sistema via pkexec\n");
    return true;
}
 
static inline bool ensure_trusted() {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[ca-installer] CEF/CA disabilitati su Fedora/RHEL/Alma/Rocky\n");
        return false;
    }
    const fs::path ca_path = ca_src_path();
 
    if (!fs::exists(ca_path)) {
        std::cerr << _("[ca-installer] ❌ CA intercept non trovata: ") << ca_path << "\n";
        std::cerr << _("[ca-installer] ℹ️  Verrà generata al primo avvio del proxy TLS\n");
        return false;
    }
 
    const std::string home = current_home();
    if (stamp_is_valid() && is_system_trusted()) {
        std::cerr << _("[ca-installer] ✅ CA già trusted (sentinel valido)\n");
        install_nss_user(home);
        return true;
    }
 
    std::cerr << _("[ca-installer] 🔄 CA nuova o non ancora trusted — installazione...\n");
    if (!install_system_via_pkexec()) {
        std::cerr << _("[ca-installer] ⚠️  Fallback sudo...\n");
        const bool sudo_ok =
            run({"sudo", HELPER, ca_path.string()});
        if (!sudo_ok) {
            std::cerr << _("[ca-installer] ❌ Impossibile installare CA nel sistema\n");
            install_nss_user(home);
            return false;
        }
        write_stamp();
    }
 
    install_nss_user(home);
    return true;
}
 
} // namespace CaInstaller