Public Member Functions
	AlertApp ()
int	run (int argc, char *argv[])
	AlertApp ()
	~AlertApp ()
int	run (int argc, char *argv[])

Private Member Functions
void	on_method_call (const Glib::RefPtr< Gio::DBus::Connection > &, const Glib::ustring &, const Glib::ustring &, const Glib::ustring &, const Glib::ustring &method, const Glib::VariantContainerBase &params, const Glib::RefPtr< Gio::DBus::MethodInvocation > &inv)
void	show_next ()
void	resolve_paths ()
void	log_user (const std::string &msg)
void	ensure_user_token ()
void	load_token ()
void	load_css ()
void	start_tcp_listener ()
void	stop_listener ()
void	enqueue_alert (const std::string &file, const std::string &family)
void	show_next ()

Private Attributes
Glib::RefPtr< Gtk::Application >	app
std::queue< std::pair< std::string, std::string > >	queue
AlertWindow *	current_window = nullptr
std::queue< std::pair< std::string, std::string > >	alertQueue
std::unique_ptr< AlertWindowRealtime >	current_window
std::string	SECURITY_TOKEN
std::string	TOKEN_PATH
std::string	LOG_PATH
std::atomic< bool >	running {false}
std::thread	listener_thread
int	server_fd {-1}

Detailed Description

Definition at line 201 of file BastionGuard-ransomware-alert.cpp.

Constructor & Destructor Documentation

◆ AlertApp() [1/2]

AlertApp::AlertApp ( )

inline

Definition at line 203 of file BastionGuard-ransomware-alert.cpp.

    : app(Gtk::Application::create(
        "org.BastionGuard.ransomware.alert"))
    {
        app->hold();
    }

References app.

◆ AlertApp() [2/2]

AlertApp::AlertApp ( )

inline

Definition at line 64 of file BastionGuard-ransomware-realtime-alert.cpp.

        : app(Gtk::Application::create("org.BastionGuard.realtime.alert"))
    {
        app->hold();
 
        resolve_paths();
        ensure_user_token();
        load_token();
 
        app->signal_shutdown().connect(
            sigc::mem_fun(*this, &AlertApp::stop_listener)
        );
    }

References app, ensure_user_token(), load_token(), resolve_paths(), and stop_listener().

◆ ~AlertApp()

AlertApp::~AlertApp ( )

inline

Definition at line 78 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        stop_listener();
    }

References stop_listener().

Member Function Documentation

◆ enqueue_alert()

void AlertApp::enqueue_alert	(	const std::string &	file,
		const std::string &	family )

inlineprivate

Definition at line 357 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        alertQueue.push({file, family});
 
        if (!current_window) {
            show_next();
        }
    }

References alertQueue, current_window, and show_next().

Referenced by start_tcp_listener().

◆ ensure_user_token()

void AlertApp::ensure_user_token ( )

inlineprivate

Definition at line 133 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        const std::string system_token = "/etc/BastionGuard/ransomware.token";
        const std::string user_token   = TOKEN_PATH;
 
        if (!fs::exists(system_token)) {
            log_user(_("[ERRORE] Token root NON trovato: ") + system_token);
            return;
        }
 
        if (fs::exists(user_token)) {
            std::error_code ec;
            fs::remove(user_token, ec);
            if (!ec) {
                log_user(_("[INFO] Vecchio token utente rimosso"));
            } else {
                log_user(_("[ERRORE] Non posso rimuovere vecchio token utente"));
            }
        }
 
        std::ifstream src(system_token, std::ios::binary);
        if (!src.is_open()) {
            log_user(_("[ERRORE] Non posso aprire token root"));
            return;
        }
 
        std::ofstream dst(user_token, std::ios::binary | std::ios::trunc);
        if (!dst.is_open()) {
            log_user(_("[ERRORE] Non posso creare token utente"));
            return;
        }
 
        dst << src.rdbuf();
        dst.close();
 
        ::chmod(user_token.c_str(), 0600);
        ::chown(user_token.c_str(), getuid(), getgid());
 
        log_user(_("[OK] Token copiato nella home: ") + user_token);
    }

References _, log_user(), and TOKEN_PATH.

Referenced by AlertApp().

◆ load_css()

void AlertApp::load_css ( )

inlineprivate

Definition at line 190 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        try {
            auto css = Gtk::CssProvider::create();
            css->load_from_path(resource(resolve_theme_css()));
 
            auto display = Gdk::Display::get_default();
            if (display) {
                Gtk::StyleContext::add_provider_for_display(
                    display,
                    css,
                    GTK_STYLE_PROVIDER_PRIORITY_APPLICATION
                );
            }
        } catch (const std::exception& e) {
            log_user(std::string("[WARN] load_css exception: ") + e.what());
        } catch (...) {
            log_user("[WARN] load_css exception sconosciuta");
        }
    }

References log_user(), resolve_theme_css(), and resource().

Referenced by run().

◆ load_token()

void AlertApp::load_token ( )

inlineprivate

Definition at line 174 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        std::ifstream f(TOKEN_PATH);
        if (!f.is_open()) {
            log_user(_("[ERRORE] Non posso aprire token utente"));
            return;
        }
 
        std::getline(f, SECURITY_TOKEN);
        if (SECURITY_TOKEN.empty()) {
            log_user(_("[ERRORE] Token utente vuoto"));
        } else {
            log_user(_("[OK] Token caricato"));
        }
    }

References _, log_user(), SECURITY_TOKEN, and TOKEN_PATH.

Referenced by AlertApp().

◆ log_user()

void AlertApp::log_user ( const std::string & msg )

inlineprivate

Definition at line 125 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        std::ofstream f(LOG_PATH, std::ios::app);
        if (f.is_open()) {
            f << msg << '\n';
        }
    }

References LOG_PATH.

Referenced by ensure_user_token(), load_css(), load_token(), and start_tcp_listener().

◆ on_method_call()

void AlertApp::on_method_call	(	const Glib::RefPtr< Gio::DBus::Connection > &	,
		const Glib::ustring &	,
		const Glib::ustring &	,
		const Glib::ustring &	,
		const Glib::ustring &	method,
		const Glib::VariantContainerBase &	params,
		const Glib::RefPtr< Gio::DBus::MethodInvocation > &	inv )

inlineprivate

Definition at line 252 of file BastionGuard-ransomware-alert.cpp.

    {
        if (method == "ShowAlert") {
            Glib::Variant<Glib::ustring> file, family;
            params.get_child(file, 0);
            params.get_child(family, 1);
 
            queue.push({file.get(), family.get()});
            inv->return_value({});
 
            if (!current_window)
                show_next();
        }
    }

References current_window, queue, and show_next().

Referenced by run().

◆ resolve_paths()

void AlertApp::resolve_paths ( )

inlineprivate

Definition at line 104 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        const char* home = std::getenv("HOME");
        if (!home) {
            if (passwd* pw = getpwuid(getuid())) {
                home = pw->pw_dir;
            }
        }
 
        if (!home) {
            home = "/tmp";
        }
 
        const std::string base = std::string(home) + "/.local/share/BastionGuard";
        std::error_code ec;
        fs::create_directories(base, ec);
 
        TOKEN_PATH = base + "/ransomware.token";
        LOG_PATH   = base + "/alert-gui.log";
    }

References LOG_PATH, and TOKEN_PATH.

Referenced by AlertApp().

◆ run() [1/2]

int AlertApp::run	(	int	argc,
		char *	argv[] )

inline

Definition at line 210 of file BastionGuard-ransomware-alert.cpp.

                                    {
        auto connection = Gio::DBus::Connection::get_sync(
            Gio::DBus::BusType::SESSION
        );
 
        auto node_info =
        Gio::DBus::NodeInfo::create_for_xml(introspection_xml);
        auto iface_info =
        node_info->lookup_interface(
            "org.BastionGuard.Ransomware.Alert");
 
        Gio::DBus::InterfaceVTable vtable(
            sigc::mem_fun(*this, &AlertApp::on_method_call)
        );
 
        connection->register_object(
            "/org/BastionGuard/ransomware/alert",
            iface_info,
            vtable
        );
        auto msg = Glib::VariantContainerBase::create_tuple({
            Glib::Variant<Glib::ustring>::create(
                "org.BastionGuard.Ransomware.Alert"),
                Glib::Variant<guint32>::create(0)
        });
 
        connection->call_sync(
            "/org/freedesktop/DBus",
            "org.freedesktop.DBus",
            "RequestName",
            msg,
            "org.freedesktop.DBus"
        );
 
        return app->run(argc, argv);
    }

References app, introspection_xml, and on_method_call().

Referenced by main().

◆ run() [2/2]

int AlertApp::run	(	int	argc,
		char *	argv[] )

inline

Definition at line 83 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        load_css();
        start_tcp_listener();
        return app->run(argc, argv);
    }

References app, load_css(), and start_tcp_listener().

◆ show_next() [1/2]

void AlertApp::show_next ( )

inlineprivate

Definition at line 274 of file BastionGuard-ransomware-alert.cpp.

                     {
        if (current_window || queue.empty())
            return;
 
        auto [file, family] = queue.front();
        queue.pop();
 
        current_window = new AlertWindow(
            file, family, queue.size());
 
        app->add_window(*current_window);
 
        current_window->signal_ignore_all.connect([this]() {
            std::queue<std::pair<std::string, std::string>> empty;
            std::swap(queue, empty);
        });
 
        current_window->signal_close_request().connect(
            [this]() -> bool {
                current_window = nullptr;
                show_next();
                return false;
            },
            false
        );
 
        current_window->present();
    }

References AlertWindow::AlertWindow(), app, current_window, queue, show_next(), and AlertWindow::signal_ignore_all.

Referenced by enqueue_alert(), on_method_call(), and show_next().

◆ show_next() [2/2]

void AlertApp::show_next ( )

inlineprivate

Definition at line 366 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        if (current_window || alertQueue.empty()) {
            return;
        }
 
        auto [file, family] = alertQueue.front();
        alertQueue.pop();
 
        current_window = std::make_unique<AlertWindowRealtime>(file, family, alertQueue.size());
 
        current_window->signal_ignore_all.connect([this]() {
            std::queue<std::pair<std::string, std::string>> empty;
            std::swap(alertQueue, empty);
 
            if (current_window) {
                current_window->hide();
            }
        });
 
        current_window->signal_hide().connect([this]() {
            Glib::signal_idle().connect_once([this]() {
                current_window.reset();
                show_next();
            });
        });
 
        current_window->present();
    }

References alertQueue, current_window, and show_next().

◆ start_tcp_listener()

void AlertApp::start_tcp_listener ( )

inlineprivate

Definition at line 211 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        if (running.load()) {
            return;
        }
 
        running = true;
 
        listener_thread = std::thread([this]() {
            log_user(_("[INFO] Avvio listener TCP..."));
 
            server_fd = ::socket(AF_INET, SOCK_STREAM, 0);
            if (server_fd < 0) {
                log_user(_("[ERRORE] socket fallita"));
                running = false;
                return;
            }
 
            int opt = 1;
            ::setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
 
            sockaddr_in addr{};
            addr.sin_family = AF_INET;
            addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
            addr.sin_port = htons(1025);
 
            if (::bind(server_fd, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) < 0) {
                log_user(_("[ERRORE] bind fallita: ") + std::string(std::strerror(errno)));
                ::close(server_fd);
                server_fd = -1;
                running = false;
                return;
            }
 
            log_user(_("[OK] Bind su 127.0.0.1:1025"));
 
            if (::listen(server_fd, 5) < 0) {
                log_user(_("[ERRORE] listen fallita"));
                ::close(server_fd);
                server_fd = -1;
                running = false;
                return;
            }
 
            log_user(_("[OK] Listener avviato"));
 
            while (running.load()) {
                int client = ::accept(server_fd, nullptr, nullptr);
                if (client < 0) {
                    if (!running.load()) {
                        break;
                    }
 
                    if (errno == EINTR) {
                        continue;
                    }
 
                    log_user(_("[WARN] accept fallita: ") + std::string(std::strerror(errno)));
                    continue;
                }
 
                char buf[2048];
                const ssize_t n = ::read(client, buf, sizeof(buf) - 1);
                ::close(client);
 
                if (n <= 0) {
                    continue;
                }
 
                buf[n] = '\0';
                std::string msg(buf);
 
                const auto p1 = msg.find('|');
                const auto p2 = (p1 == std::string::npos) ? std::string::npos : msg.find('|', p1 + 1);
 
                if (p1 == std::string::npos || p2 == std::string::npos) {
                    continue;
                }
 
                const std::string token  = msg.substr(0, p1);
                const std::string file   = msg.substr(p1 + 1, p2 - p1 - 1);
                const std::string family = msg.substr(p2 + 1);
 
                if (file.find("antiransom_inotify.log") != std::string::npos) {
                    log_user(_("[IGNORATO] Alert proveniente dal log interno"));
                    continue;
                }
 
                if (token != SECURITY_TOKEN) {
                    log_user(_("[SCARTATO] Token non valido"));
                    continue;
                }
 
                // Il percorso ricevuto dal processo realtime deve indicare
                // esclusivamente un file regolare assoluto. Non seguire
                // symlink e non mostrare azioni di quarantena per directory.
                const fs::path alert_path(file);
                std::error_code path_ec;
                const fs::file_status path_status =
                    fs::symlink_status(alert_path, path_ec);
 
                if (!alert_path.is_absolute() || path_ec ||
                    !fs::exists(path_status) ||
                    !fs::is_regular_file(path_status)) {
                    log_user(_("[SCARTATO] Percorso alert non regolare: ") + file);
                    continue;
                }
 
                Glib::signal_idle().connect_once([this, file, family]() {
                    if (!running.load()) {
                        return;
                    }
                    enqueue_alert(file, family);
                });
            }
 
            if (server_fd >= 0) {
                ::close(server_fd);
                server_fd = -1;
            }
 
            log_user(_("[INFO] Listener TCP terminato"));
        });
    }

References _, AF_INET, enqueue_alert(), listener_thread, log_user(), running, SECURITY_TOKEN, and server_fd.

Referenced by run().

◆ stop_listener()

void AlertApp::stop_listener ( )

inlineprivate

Definition at line 336 of file BastionGuard-ransomware-realtime-alert.cpp.

    {
        const bool was_running = running.exchange(false);
        if (!was_running) {
            if (listener_thread.joinable()) {
                listener_thread.join();
            }
            return;
        }
 
        if (server_fd >= 0) {
            ::shutdown(server_fd, SHUT_RDWR);
            ::close(server_fd);
            server_fd = -1;
        }
 
        if (listener_thread.joinable()) {
            listener_thread.join();
        }
    }