local_warning_server.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "local_warning_server.hpp"
#include <iostream>
#include <sstream>
#include <cstring>
#include <fstream>
#include <filesystem>
#include <algorithm>
#include <cctype>
#include <glib/gi18n.h>
#include <gio/gio.h>
#include <array>
#include <sys/stat.h>
#include <unistd.h>
#include <vector>
#include <unordered_set>
#include <libintl.h>
 
#include <nlohmann/json.hpp>
 
namespace fs = std::filesystem;
 
 
#ifndef BastionGuard_WARNING_DEFAULT_HTTP
#  define BastionGuard_WARNING_DEFAULT_HTTP 81
#endif
#ifndef BastionGuard_WARNING_DEFAULT_HTTPS
#  define BastionGuard_WARNING_DEFAULT_HTTPS 444
#endif
#ifndef BastionGuard_LOCAL_WARNING_IP
#  define BastionGuard_LOCAL_WARNING_IP "127.0.0.2"
#endif
 
 
static std::string to_lower(std::string s) {
    std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c){ return std::tolower(c); });
    return s;
}
 
static std::string clean_domain(std::string d) {
    d = to_lower(d);
    if (!d.empty() && d.front() == '.') d.erase(0, 1);
    if (d.rfind("www.", 0) == 0) d.erase(0, 4);
    auto p = d.find(':'); if (p != std::string::npos) d.erase(p);
    if (!d.empty() && d.back() == '.') d.pop_back();
    return d;
}
 
static std::string read_last_lines(const std::string& path, size_t max_lines = 50) {
    std::ifstream file(path, std::ios::binary);
    if (!file.is_open()) return _("(Log non disponibile)");
    std::string content;
    file.seekg(0, std::ios::end);
    auto size = file.tellg();
    if (size <= 0) return _("(Log vuoto)");
    file.seekg(0);
    content.assign(std::istreambuf_iterator<char>(file), std::istreambuf_iterator<char>());
 
    std::vector<std::string> lines;
    size_t start = 0;
    for (size_t i = 0; i < content.size(); ++i) {
        if (content[i] == '\n') {
            lines.emplace_back(content.substr(start, i - start));
            start = i + 1;
        }
    }
    if (start < content.size()) lines.emplace_back(content.substr(start));
 
    std::ostringstream out;
    size_t from = lines.size() > max_lines ? lines.size() - max_lines : 0;
    for (size_t i = from; i < lines.size(); ++i) out << lines[i] << '\n';
    std::string res = out.str();
    return res.empty() ? _("(Nessuna attività recente)") : res;
}
 
static std::string html_escape(const std::string& s) {
    std::string o;
    o.reserve(s.size());
    for (char c : s) {
        switch (c) {
            case '&': o += "&amp;"; break;
            case '<': o += "&lt;"; break;
            case '>': o += "&gt;"; break;
            case '"': o += "&quot;"; break;
            case '\'': o += "&#39;"; break;
            case '\n': o += "<br/>"; break;
            default: o += c;
        }
    }
    return o;
}
 
 
static std::string extract_host(const std::string& raw) {
    if (raw.empty()) return {};
    std::string s = raw;
 
    auto notspace = [](int ch){ return !std::isspace(ch); };
    s.erase(s.begin(), std::find_if(s.begin(), s.end(), notspace));
    s.erase(std::find_if(s.rbegin(), s.rend(), notspace).base(), s.end());
    if (s.empty()) return {};
 
    std::transform(s.begin(), s.end(), s.begin(), ::tolower);
 
    auto strip_scheme = [&](const char* prefix) {
        size_t n = std::strlen(prefix);
        if (s.rfind(prefix, 0) == 0) s.erase(0, n);
    };
    strip_scheme("http://");
    strip_scheme("https://");
    strip_scheme("ftp://");
 
    auto atpos = s.find('@');
    if (atpos != std::string::npos) s.erase(0, atpos + 1);
 
    size_t pos = s.find_first_of("/?#");
    if (pos != std::string::npos) s = s.substr(0, pos);
 
    size_t colon = s.rfind(':');
    if (colon != std::string::npos) {
        std::string after = s.substr(colon + 1);
        bool all_digits = !after.empty() && std::all_of(after.begin(), after.end(), ::isdigit);
        if (all_digits) s = s.substr(0, colon);
    }
    if (!s.empty() && s.back() == '.') s.pop_back();
    return s;
}
 
 
static std::unordered_set<std::string> g_trusted;
static bool g_trusted_loaded = false;
 
static void load_list_file(const std::string& path, std::vector<std::string>& out) {
    if (!fs::exists(path)) return;
    try {
        std::ifstream f(path);
        if (!f.good()) return;
 
        nlohmann::json j;
        f >> j;
 
        auto push = [&](const std::string& s){
            auto d = clean_domain(s);
            if(!d.empty()) out.push_back(d);
        };
 
        if (j.is_array()) {
            for (auto& v : j) if (v.is_string()) push(v.get<std::string>());
        } else {
            if (j.contains("list") && j["list"].is_array())
                for (auto& v : j["list"]) if (v.is_string()) push(v.get<std::string>());
            if (j.contains("domains") && j["domains"].is_array())
                for (auto& v : j["domains"]) if (v.is_string()) push(v.get<std::string>());
            if (j.contains("whitelist") && j["whitelist"].is_array())
                for (auto& v : j["whitelist"]) if (v.is_string()) push(v.get<std::string>());
        }
    } catch (...) {
    }
}
 
static void ensure_trusted_loaded() {
    if (g_trusted_loaded) return;
 
    std::vector<std::string> tmp;
    load_list_file("/usr/share/BastionGuard/data/bank/banks.json", tmp);
    if (const char* home = std::getenv("HOME")) {
        load_list_file(std::string(home) + "/.config/BastionGuard/whitelist.json", tmp);
    }
    for (auto& d : tmp) g_trusted.insert(d);
    g_trusted_loaded = true;
 
    std::cerr << _("[LocalWarningServer] ✅ Whitelist caricata: ")
              << g_trusted.size() << _(" domini trusted\n");
}
 
static bool is_trusted_domain(const std::string& host) {
    ensure_trusted_loaded();
    std::string h = clean_domain(host);
    if (h.empty()) return false;
 
    if (g_trusted.count(h)) return true;
    auto pos = h.find('.');
    while (pos != std::string::npos) {
        std::string parent = h.substr(pos + 1);
        if (g_trusted.count(parent)) return true;
        pos = h.find('.', pos + 1);
    }
    return false;
}
 
static bool listen_one(SoupServer* srv, const char* addr_str, int port, bool https, GError** error) {
    if (!srv || !addr_str) return false;
 
    GInetAddress* ia4 = g_inet_address_new_from_string(addr_str);
    GSocketAddress* sa4 = ia4 ? g_inet_socket_address_new(ia4, port) : nullptr;
    if (ia4) g_object_unref(ia4);
 
    bool ok = false;
    if (sa4) {
        ok = soup_server_listen(srv, sa4,
            https ? SOUP_SERVER_LISTEN_HTTPS : (SoupServerListenOptions)0, error);
        g_object_unref(sa4);
    }
 
    if (!ok && error && *error) {
        std::cerr << _("[LocalWarningServer] ⚠️ Porta ")
                  << port << _(" non disponibile: ") << (*error)->message << "\n";
        g_error_free(*error);
        *error = nullptr;
    }
    return ok;
}
 
 
LocalWarningServer::LocalWarningServer(int http_port,
                                       int https_port,
                                       const std::string& bind_address,
                                       const std::string& cert_file,
                                       const std::string& key_file,
                                       const std::string& page_warning_path)
    : server_(nullptr),
      http_port_(http_port > 0 ? http_port : BastionGuard_WARNING_DEFAULT_HTTP),
      https_port_(https_port > 0 ? https_port : BastionGuard_WARNING_DEFAULT_HTTPS),
      bind_address_(bind_address.empty() ? BastionGuard_LOCAL_WARNING_IP : bind_address),
      cert_file_(cert_file),
      key_file_(key_file),
      page_warning_path_(page_warning_path),
      running_(false),
      loop_(nullptr)
{}
 
LocalWarningServer::~LocalWarningServer() {
    stop();
}
 
void LocalWarningServer::start() {
    if (running_) return;
 
    server_ = soup_server_new(nullptr, nullptr);
    if (!server_) {
        std::cerr << _("[LocalWarningServer] ❌ Errore creazione SoupServer\n");
        return;
    }
 
    g_object_set(server_, "server-header", "BastionGuard-warning-server", nullptr);
    soup_server_add_handler(server_, "/", LocalWarningServer::on_request, this, nullptr);
 
    // HTTPS opzionale
    bool have_cert = false;
    if (!cert_file_.empty() && !key_file_.empty()) {
        GError* cert_err = nullptr;
        GTlsCertificate* cert = g_tls_certificate_new_from_files(cert_file_.c_str(), key_file_.c_str(), &cert_err);
        if (cert) {
            soup_server_set_tls_certificate(server_, cert);
            have_cert = true;
            g_object_unref(cert);
        } else if (cert_err) {
            std::cerr << _("[LocalWarningServer] TLS error: ") << cert_err->message << "\n";
            g_error_free(cert_err);
        }
    }
 
    GError* err = nullptr;
    bool ok_http = listen_one(server_, bind_address_.c_str(), http_port_, false, &err);
    if (!ok_http && err) { g_error_free(err); err = nullptr; }
    bool ok_https = have_cert && listen_one(server_, bind_address_.c_str(), https_port_, true, &err);
    if (!ok_https && err) { g_error_free(err); err = nullptr; }
 
    if (!(ok_http || ok_https)) {
        g_object_unref(server_);
        server_ = nullptr;
        std::cerr << _("[LocalWarningServer] ⚠️ Nessuna porta disponibile su ") << bind_address_ << "\n";
        return;
    }
 
    loop_ = g_main_loop_new(nullptr, FALSE);
    loop_thread_ = std::thread([this]() { g_main_loop_run(loop_); });
    running_ = true;
    std::cout << _("[LocalWarningServer] ✅ Avviato su ") << bind_address_
              << " (" << http_port_ << (have_cert ? ", HTTPS " + std::to_string(https_port_) : "") << ")\n";
}
 
void LocalWarningServer::stop() {
    if (!running_) return;
    running_ = false;
    if (loop_) {
        g_main_loop_quit(loop_);
        if (loop_thread_.joinable()) loop_thread_.join();
        g_main_loop_unref(loop_);
        loop_ = nullptr;
    }
    if (server_) {
        soup_server_disconnect(server_);
        g_object_unref(server_);
        server_ = nullptr;
    }
    std::cout << _("[LocalWarningServer] 🛑 Arrestato\n");
}
 
void LocalWarningServer::on_request(SoupServer*, SoupServerMessage* msg,
                                    const char* path, GHashTable*, gpointer user_data)
{
    auto* self = static_cast<LocalWarningServer*>(user_data);
    if (!self || !msg) return;
 
    SoupMessageHeaders* req_headers =
        const_cast<SoupMessageHeaders*>(soup_server_message_get_request_headers(msg));
    const char* host_header = req_headers ? soup_message_headers_get_one(req_headers, "Host") : nullptr;
 
    std::string requested_host = host_header ? extract_host(host_header) : _("dominio-sconosciuto");
 
    if (requested_host.empty() || requested_host == BastionGuard_LOCAL_WARNING_IP) {
        if (path && *path) {
            std::string p = path;
            if (!p.empty() && p.front() == '/') p.erase(0,1);
            requested_host = p;
        } else {
            requested_host = _("dominio-sconosciuto");
        }
    }
 
    if (is_trusted_domain(requested_host)) {
        std::string location = "https://" + clean_domain(requested_host) + "/";
        SoupMessageHeaders* res_headers =
            const_cast<SoupMessageHeaders*>(soup_server_message_get_response_headers(msg));
        soup_message_headers_append(res_headers, "Location", location.c_str());
        soup_server_message_set_status(msg, SOUP_STATUS_TEMPORARY_REDIRECT, nullptr); // 307
        std::cout << "[BastionGuard-DNS] 🟢 Trusted: redirect a " << location << "\n";
        return;
    }
 
    std::cout << "[BastionGuard-DNS] ⚠️ Dominio bloccato: " << requested_host << std::endl;
 
    std::ostringstream html;
 
html << R"HTML(<!DOCTYPE html>
<html lang="it">
<head>
<meta charset="UTF-8">
<title>⚠️ )HTML" << _("Accesso bloccato - BastionGuard DNS") << R"HTML(</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<style>
body {
  background: linear-gradient(135deg, #ff6f61, #d6a4a4);
  color: #fff;
  display: flex;
  justify-content: center;
  align-items: center;
  height: 100vh;
  margin: 0;
  font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
  text-align: center;
}
.container {
  background: rgba(0, 0, 0, 0.55);
  border-radius: 15px;
  padding: 3rem 2rem;
  max-width: 720px;
  box-shadow: 0 0 20px rgba(0,0,0,0.4);
}
h1 { font-size: 2rem; margin-bottom: 1rem; }
p { font-size: 1.1rem; margin-bottom: 1.5rem; }
.btn {
  display: inline-block;
  background: #fff;
  color: #ff6f61;
  text-decoration: none;
  padding: 0.7rem 1.4rem;
  border-radius: 6px;
  font-weight: 600;
}
.btn:hover { background: #f8f9fa; }
small { opacity: .8; }
</style>
</head>
<body>
<div class="container">
  <h1>⚠️ )HTML" << _("Dominio bloccato") << R"HTML(</h1>
  <p>)HTML"
     << _("L'accesso al dominio") << " <strong>"
     << html_escape(requested_host)
     << "</strong> "
     << _("è stato bloccato dal sistema DNS di BastionGuard (dnsmasq).")
     << R"HTML(</p>
  <a href="about:blank" class="btn">🔒 )HTML" << _("Torna al sicuro") << R"HTML(</a>
  <p><small>)HTML" << _("BastionGuard — protezione DNS attiva") << R"HTML(</small></p>
</div>
</body>
</html>)HTML";
 
    std::string body = html.str();
    soup_server_message_set_response(msg, "text/html", SOUP_MEMORY_COPY, body.c_str(), body.size());
    soup_server_message_set_status(msg, SOUP_STATUS_OK, nullptr);
}