Backend.cpp File Reference

Go to the source code of this file.

Classes
struct	DbInfo

Namespaces
namespace	anonymous_namespace{Backend.cpp}

Typedefs
using	json = nlohmann::json

Functions
static std::string	b64_encode (const std::string &s)
static std::string	b64_decode (const std::string &s)
static std::string	xor_crypt (const std::string &input)
static std::string	encrypt_pass (const std::string &pass)
static std::string	decrypt_pass (const std::string &enc)
static std::string	trim (const std::string &s)
static std::string	extract_path_from_clamav_line (const std::string &line)
static std::vector< std::string >	clamDbDirs ()
static std::time_t	filetime_to_time_t (fs::file_time_type ft)
static bool	read_cvd_header (const std::string &path, DbInfo &out)
static std::string	first_existing (const std::vector< std::string > &names)
std::pair< int, int >	read_ports_from_conf ()
static void	restart_clamd ()
static bool	install_to_system_data (const std::string &src, const std::string &dest)
static std::string	getUserConfigDir ()
static std::string	getConfigFilePath ()
static void	persistQuarantinePath (const std::string &path)
static void	loadQuarantinePathFromConfig ()
static void	ensureQuarantinePath ()
static std::string	getRuntimeDataDir ()
static bool	copy_to_final (const std::string &src, const std::string &dest)
static std::string	findClamonaccService ()
static int	installPackages (const std::vector< std::string > &args)
static std::string	detectDistro ()
static bool	isClamdInstalled ()
static bool	run_phishing_updater_script (const std::string &staging_dir)
static bool	is_writable_dir (const std::filesystem::path &dir)
static std::filesystem::path	make_temp_scan_dir ()
static size_t	write_cb (void *c, size_t s, size_t n, std::string *o)
bool	anonymous_namespace{Backend.cpp}::create_secure_firewall_input (const std::vector< std::string > &blacklistLines, std::string &outPath)
int	anonymous_namespace{Backend.cpp}::run_firewall_helper (const std::string &inputPath)

Variables
static const std::string	SMB_KEY = "BastionGuard0101SecretKey"
static std::string	quarantinePath = Glib::get_home_dir() + "/.local/share/BastionGuard/quarantine"
static const char *	CLAMONACC_SERVICES []
sigc::signal< void(const std::string &)>	antiphish_signal_

Typedef Documentation

json

using json = nlohmann::json

Definition at line 2908 of file Backend.cpp.

Function Documentation

b64_decode()

std::string b64_decode ( const std::string & s )

static

Definition at line 90 of file Backend.cpp.

                                                {
    return Glib::Base64::decode(s);
}

References b64_decode().

Referenced by b64_decode(), decrypt_pass(), Backend::getCreds(), Backend::loadSMBCredentials(), and Backend::saveSMBCredentials().

b64_encode()

std::string b64_encode ( const std::string & s )

static

Definition at line 86 of file Backend.cpp.

                                                {
    return Glib::Base64::encode(s);
}

References b64_encode().

Referenced by b64_encode(), encrypt_pass(), and Backend::saveSMBCredentials().

clamDbDirs()

std::vector< std::string > clamDbDirs ( )

static

Definition at line 132 of file Backend.cpp.

{
    std::vector<std::string> dirs = {
        "/var/lib/clamav",
        Glib::get_home_dir() + "/.local/share/clamav",
        "/usr/local/share/clamav"
    };
    return dirs;
}

References clamDbDirs().

Referenced by clamDbDirs(), and first_existing().

copy_to_final()

bool copy_to_final ( const std::string & src, const std::string & dest )

static

Definition at line 431 of file Backend.cpp.

                                                                       {
    try {
        fs::create_directories(fs::path(dest).parent_path());
        fs::copy_file(src, dest, fs::copy_options::overwrite_existing);
        return true;
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore copia ") << src << " -> " << dest << ": " << e.what() << std::endl;
        return false;
    }
}

References _, and copy_to_final().

Referenced by copy_to_final(), Backend::updatePhishLists(), and Backend::updateSanesecurityDB().

decrypt_pass()

std::string decrypt_pass ( const std::string & enc )

static

Definition at line 107 of file Backend.cpp.

                                                    {
    return xor_crypt(b64_decode(enc));
}

References b64_decode(), decrypt_pass(), and xor_crypt().

Referenced by decrypt_pass(), Backend::getCreds(), and Backend::saveSMBCredentials().

detectDistro()

std::string detectDistro ( )

static

Definition at line 653 of file Backend.cpp.

                                {
    const std::string id = BastionGuard::Platform::distribution_id();
    return id.empty() ? "unknown" : id;
}

References detectDistro(), and BastionGuard::Platform::distribution_id().

Referenced by detectDistro(), and Backend::installClamdIfMissing().

encrypt_pass()

std::string encrypt_pass ( const std::string & pass )

static

Definition at line 103 of file Backend.cpp.

                                                     {
    return b64_encode(xor_crypt(pass));
}

References b64_encode(), encrypt_pass(), and xor_crypt().

Referenced by encrypt_pass(), and Backend::saveSMBCredentials().

ensureQuarantinePath()

void ensureQuarantinePath ( )

static

Definition at line 399 of file Backend.cpp.

                                   {
    try {
        fs::create_directories(quarantinePath);
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore creazione cartella quarantena: ") << e.what() << std::endl;
    }
}

References _, ensureQuarantinePath(), and quarantinePath.

Referenced by ensureQuarantinePath().

extract_path_from_clamav_line()

std::string extract_path_from_clamav_line ( const std::string & line )

static

Definition at line 122 of file Backend.cpp.

{
    auto pos = line.find(':');
    if (pos == std::string::npos)
        return line;
 
    return line.substr(0, pos);
}

References extract_path_from_clamav_line().

Referenced by extract_path_from_clamav_line().

filetime_to_time_t()

std::time_t filetime_to_time_t ( fs::file_time_type ft )

static

Definition at line 149 of file Backend.cpp.

{
    using namespace std::chrono;
    auto sctp = time_point_cast<system_clock::duration>(
        ft - fs::file_time_type::clock::now() + system_clock::now()
    );
    return system_clock::to_time_t(sctp);
}

References filetime_to_time_t().

Referenced by filetime_to_time_t(), and read_cvd_header().

findClamonaccService()

std::string findClamonaccService ( )

static

Definition at line 443 of file Backend.cpp.

                                        {
    for (auto service : CLAMONACC_SERVICES) {
        if (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                             "--system", "is-active", service}).ok()) {
            return service;
        }
    }
    return CLAMONACC_SERVICES[0];
}

References CLAMONACC_SERVICES, findClamonaccService(), bg_process::Result::ok(), and bg_process::run().

Referenced by Backend::disableClamonacc(), Backend::enableClamonacc(), and findClamonaccService().

first_existing()

std::string first_existing ( const std::vector< std::string > & names )

static

Definition at line 227 of file Backend.cpp.

{
    for (const auto& dir : clamDbDirs()) {
        for (const auto& n : names) {
            std::string p = dir + "/" + n;
            if (fs::exists(p)) return p;
        }
    }
    return {};
}

References clamDbDirs(), and first_existing().

Referenced by first_existing().

getConfigFilePath()

std::string getConfigFilePath ( )

static

Definition at line 351 of file Backend.cpp.

                                     {
    return getUserConfigDir() + "/BastionGuard/config.ini";
}

References getConfigFilePath(), and getUserConfigDir().

Referenced by getConfigFilePath(), and loadQuarantinePathFromConfig().

getRuntimeDataDir()

std::string getRuntimeDataDir ( )

static

Definition at line 413 of file Backend.cpp.

                                     {
    const char* xdg_data = std::getenv("XDG_DATA_HOME");
    if (xdg_data && std::strlen(xdg_data) > 0) {
        return std::string(xdg_data) + "/BastionGuard";
    }
 
    const char* home = std::getenv("HOME");
    if (home)
        return std::string(home) + "/.local/share/BastionGuard";
 
    return "/tmp/BastionGuard";
}

References getRuntimeDataDir().

Referenced by getRuntimeDataDir(), Backend::updatePhishLists(), Backend::updateSanesecurityDB(), and Backend::updateYaraRules().

getUserConfigDir()

std::string getUserConfigDir ( )

static

Definition at line 341 of file Backend.cpp.

                                    {
    const char* xdg = std::getenv("XDG_CONFIG_HOME");
    if (xdg && std::strlen(xdg) > 0) {
        return std::string(xdg);
    }
    const char* home = std::getenv("HOME");
    if (home) return std::string(home) + "/.config";
    return std::string("/tmp");
}

References getUserConfigDir().

Referenced by getConfigFilePath(), getUserConfigDir(), and persistQuarantinePath().

install_to_system_data()

bool install_to_system_data ( const std::string & src, const std::string & dest )

static

Definition at line 321 of file Backend.cpp.

                                                                                {
    try {
        // One fixed privileged executable, with src/dest as literal argv entries.
        const auto installation = bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644", src, dest});
        if (!installation.ok()) {
            std::cerr << _("⚠ install_to_system_data: pkexec failed (code ")
                      << installation.exit_code << ")\n";
            return false;
        }
        restart_clamd();
        return true;
    } catch (const std::exception& e) {
        std::cerr << _("❌ install_to_system_data exception: ") << e.what() << "\n";
        return false;
    }
}

References _, install_to_system_data(), restart_clamd(), and bg_process::run().

Referenced by install_to_system_data(), and Backend::updateSanesecurityDB().

installPackages()

int installPackages ( const std::vector< std::string > & args )

static

Definition at line 646 of file Backend.cpp.

                                                             {
    if (args.empty()) return 127;
    std::vector<std::string> argv = {"pkexec"};
    argv.insert(argv.end(), args.begin(), args.end());
    return bg_process::run(argv, true).exit_code;
}

References bg_process::Result::exit_code, installPackages(), and bg_process::run().

Referenced by Backend::installClamdIfMissing(), and installPackages().

is_writable_dir()

bool is_writable_dir ( const std::filesystem::path & dir )

static

Definition at line 1783 of file Backend.cpp.

{
    namespace fs = std::filesystem;
    std::error_code ec;
 
    if (!fs::exists(dir, ec) || !fs::is_directory(dir, ec))
        return false;
 
    // Prova a creare un file temporaneo (probe)
    auto probe = dir / ".bastionguard_write_test";
    {
        std::ofstream out(probe, std::ios::out | std::ios::trunc);
        if (!out.is_open())
            return false;
        out << "ok\n";
    }
    fs::remove(probe, ec);
    return true;
}

References is_writable_dir().

Referenced by is_writable_dir(), and make_temp_scan_dir().

isClamdInstalled()

bool isClamdInstalled ( )

static

Definition at line 658 of file Backend.cpp.

                               {
    return ((bg_process::exists_on_path("clamd") ? 0 : 1) == 0) ||
           (std::filesystem::exists("/usr/sbin/clamd") ||
            std::filesystem::exists("/usr/bin/clamd"));
}

References bg_process::exists_on_path(), and isClamdInstalled().

Referenced by Backend::installClamdIfMissing(), and isClamdInstalled().

loadQuarantinePathFromConfig()

void loadQuarantinePathFromConfig ( )

static

Definition at line 378 of file Backend.cpp.

                                           {
    std::string cfg = getConfigFilePath();
    if (!fs::exists(cfg)) return;
 
    std::ifstream f(cfg);
    if (!f.is_open()) return;
 
    std::string line;
    while (std::getline(f, line)) {
        auto pos = line.find('=');
        if (pos == std::string::npos) continue;
        std::string key = line.substr(0, pos);
        std::string val = line.substr(pos + 1);
        if (key == "quarantinePath" && !val.empty()) {
            quarantinePath = val;
            break;
        }
    }
    f.close();
}

References getConfigFilePath(), loadQuarantinePathFromConfig(), and quarantinePath.

Referenced by Backend::Backend(), Backend::getQuarantinePath(), and loadQuarantinePathFromConfig().

make_temp_scan_dir()

std::filesystem::path make_temp_scan_dir ( )

static

Definition at line 1803 of file Backend.cpp.

{
    namespace fs = std::filesystem;
    std::error_code ec;
 
 
    fs::path candidates[] = {
        fs::temp_directory_path(),
        fs::path("/var/tmp")
    };
 
    auto ensure_dir_ok = [&](const fs::path& p) -> bool {
        ec.clear();
        if (!fs::exists(p, ec))
            return false;
        if (!fs::is_directory(p, ec))
            return false;
 
 
        return is_writable_dir(p);
    };
 
    fs::path base;
    for (const auto& c : candidates) {
        if (ensure_dir_ok(c)) {
            base = c;
            break;
        }
    }
    if (base.empty())
        return {};
 
    std::random_device rd;
    std::mt19937_64 gen(rd());
    std::uniform_int_distribution<unsigned long long> dis(1, ULLONG_MAX);
 
    for (int tries = 0; tries < 60; ++tries) {
        fs::path tmp = base / ("BastionGuard_samba_" + std::to_string(dis(gen)));
 
        ec.clear();
        if (!fs::create_directories(tmp, ec) || ec)
            continue;
 
 
        fs::permissions(tmp,
                        fs::perms::owner_all |
                        fs::perms::group_read | fs::perms::group_exec |
                        fs::perms::others_read | fs::perms::others_exec,
                        fs::perm_options::replace,
                        ec);
 
        if (ec) {
            fs::remove_all(tmp, ec);
            continue;
        }
 
        if (is_writable_dir(tmp))
            return tmp;
 
        fs::remove_all(tmp, ec);
    }
 
    return {};
}

References is_writable_dir(), and make_temp_scan_dir().

Referenced by make_temp_scan_dir(), and Backend::scanSambaDir().

persistQuarantinePath()

void persistQuarantinePath ( const std::string & path )

static

Definition at line 355 of file Backend.cpp.

                                                         {
    try {
        std::string cfgDir = getUserConfigDir() + "/BastionGuard";
        std::filesystem::create_directories(cfgDir);
 
        std::string cfgPath = cfgDir + "/config.ini";
        std::ofstream f(cfgPath, std::ios::trunc);
        if (!f.is_open()) {
            std::cerr << "⚠️ " << _("Impossibile aprire il file di configurazione per scrittura: ")
                      << cfgPath << std::endl;
            return;
        }
 
        f << "quarantinePath=" << path << "\n";
        f.close();
 
        std::cout << "💾 " << _("Percorso quarantena salvato in configurazione: ") << path << std::endl;
    } catch (const std::exception& e) {
        std::cerr << "❌ " << _("Errore durante la scrittura della configurazione: ") << e.what() << std::endl;
    }
}

References _, getUserConfigDir(), and persistQuarantinePath().

Referenced by persistQuarantinePath(), and Backend::setQuarantinePath().

read_cvd_header()

bool read_cvd_header ( const std::string & path, DbInfo & out )

static

Definition at line 159 of file Backend.cpp.

{
    std::ifstream f(path, std::ios::binary);
    if (!f.is_open()) return false;
 
    std::string line;
    if (!std::getline(f, line)) return false;
 
 
    std::vector<std::string> toks;
    {
        std::stringstream ss(line);
        std::string seg;
        while (std::getline(ss, seg, ':')) {
            auto l = seg.find_first_not_of(" \t\r\n");
            auto r = seg.find_last_not_of(" \t\r\n");
            if (l == std::string::npos) toks.push_back("");
            else toks.push_back(seg.substr(l, r - l + 1));
        }
    }
 
    int nameIdx = -1;
    for (int i = 0; i < (int)toks.size(); ++i) {
        if (toks[i].find(".cvd") != std::string::npos ||
            toks[i].find(".cld") != std::string::npos) {
            nameIdx = i;
            break;
        }
    }
    if (nameIdx < 0) return false;
 
    out.file = fs::path(path).filename().string();
 
    // Versione = primo intero dopo nome file
    for (int i = nameIdx + 1; i < (int)toks.size(); ++i) {
        try {
            long long v = std::stoll(toks[i]);
            if (v > 0) { out.version = v; break; }
        } catch (...) {}
    }
 
    for (int i = nameIdx + 1; i < (int)toks.size(); ++i) {
        const std::string& t = toks[i];
        if (std::all_of(t.begin(), t.end(), ::isdigit)) {
            if (t.size() >= 10 && t.size() <= 13) {
                try {
                    long long e = std::stoll(t);
                    if (t.size() > 10) e /= 1000;
                    if (e > 631152000LL && e < 4102444800LL) {
                        out.epoch = e;
                        break;
                    }
                } catch (...) {}
            }
        }
    }
 
 
    if (out.epoch < 0) {
        try {
            auto ft = fs::last_write_time(path);
            out.epoch = (long long)filetime_to_time_t(ft);
        } catch (...) {}
    }
 
    return (out.version > 0);
}

References DbInfo::epoch, DbInfo::file, filetime_to_time_t(), read_cvd_header(), and DbInfo::version.

Referenced by read_cvd_header().

read_ports_from_conf()

std::pair< int, int > read_ports_from_conf

(

)

Definition at line 288 of file Backend.cpp.

{
    constexpr int default_http_port = 81;
    constexpr int default_https_port = 444;
 
    std::ifstream f("/etc/BastionGuard/webports.conf");
    if (!f.is_open())
        return {default_http_port, default_https_port};
 
    int http_port = default_http_port;
    int https_port = default_https_port;
    if ((f >> http_port >> https_port) &&
        http_port > 0 && http_port < 65536 &&
        https_port > 0 && https_port < 65536) {
        return {http_port, https_port};
    }
 
    return {default_http_port, default_https_port};
}

References read_ports_from_conf().

Referenced by Backend::Backend(), and read_ports_from_conf().

restart_clamd()

void restart_clamd ( )

static

Definition at line 308 of file Backend.cpp.

                            {
    if ((bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-active", "clamav-daemon.service"}).exit_code) == 0) {
        (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "restart", "clamav-daemon.service"}).exit_code);
        std::cout << _("✔ Riavviato clamav-daemon\n");
    } else if ((bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-active", "clamd.service"}).exit_code) == 0) {
        (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "restart", "clamd.service"}).exit_code);
        std::cout << _("✔ Riavviato clamd\n");
    } else {
        std::cerr << _("⚠ Nessun servizio clamd/clamav-daemon trovato\n");
    }
}

References _, bg_process::Result::exit_code, restart_clamd(), and bg_process::run().

Referenced by install_to_system_data(), and restart_clamd().

run_phishing_updater_script()

bool run_phishing_updater_script ( const std::string & staging_dir )

static

Definition at line 1005 of file Backend.cpp.

                                                                      {
    const std::string helper =
        "/usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh";
 
    if (!std::filesystem::exists(helper)) {
        std::cerr << _("[Phishing] Helper non trovato: ") << helper << "\n";
        return false;
    }
 
    // No shell and no passwordless sudo rule: pkexec performs the explicit
    // administrator authorization, while the staging directory is passed as
    // one opaque argv element.
    const pid_t pid = ::fork();
    if (pid < 0) {
        std::cerr << _("[Phishing] fork() fallita per helper privilegiato.\n");
        return false;
    }
 
    if (pid == 0) {
        const char* argv[] = {
            "pkexec", helper.c_str(), staging_dir.c_str(), nullptr
        };
        ::execvp("pkexec", const_cast<char* const*>(argv));
        _exit(127);
    }
 
    int status = 0;
    if (::waitpid(pid, &status, 0) < 0) return false;
    return WIFEXITED(status) && WEXITSTATUS(status) == 0;
}

References _, and run_phishing_updater_script().

Referenced by run_phishing_updater_script(), and Backend::updatePhishLists().

trim()

std::string trim ( const std::string & s )

inlinestatic

Definition at line 112 of file Backend.cpp.

{
    size_t start = s.find_first_not_of(" \t\r\n");
    if (start == std::string::npos) return "";
 
    size_t end = s.find_last_not_of(" \t\r\n");
    return s.substr(start, end - start + 1);
}

References trim().

Referenced by fill_ext_set(), Backend::getSambaDirs(), load_allowlist(), load_config(), load_samba_dirs(), Backend::saveSambaConfig(), Backend::scanSambaDir(), split_semicolon_list(), trim(), trim(), trim(), trim(), and Backend::updatePhishLists().

write_cb()

size_t write_cb ( void * c, size_t s, size_t n, std::string * o )

static

Definition at line 2799 of file Backend.cpp.

                                                                  {
    o->append((char*)c, s * n);
    return s * n;
}

References write_cb().

Referenced by write_cb().

xor_crypt()

std::string xor_crypt ( const std::string & input )

static

Definition at line 96 of file Backend.cpp.

                                                   {
    std::string out = input;
    for (size_t i = 0; i < input.size(); ++i)
        out[i] = input[i] ^ SMB_KEY[i % SMB_KEY.size()];
    return out;
}

References SMB_KEY, and xor_crypt().

Referenced by decrypt_pass(), encrypt_pass(), and xor_crypt().

Variable Documentation

antiphish_signal_

sigc::signal<void(const std::string&)> antiphish_signal_

Definition at line 1627 of file Backend.cpp.

Referenced by Backend::checkUrl(), and Backend::signal_antiphish_event().

CLAMONACC_SERVICES

const char* CLAMONACC_SERVICES[]

static

Initial value:

                                     = {
    "clamav-clamonacc.service",
    "clamonacc.service"
}

Definition at line 407 of file Backend.cpp.

Referenced by findClamonaccService(), Backend::getClamonaccLogs(), Backend::getOnAccessEvents(), and Backend::isClamonaccActive().

quarantinePath

std::string quarantinePath = Glib::get_home_dir() + "/.local/share/BastionGuard/quarantine"

static

Definition at line 339 of file Backend.cpp.

Referenced by ensureQuarantinePath(), Backend::getQuarantinePath(), loadQuarantinePathFromConfig(), and Backend::setQuarantinePath().

SMB_KEY

const std::string SMB_KEY = "BastionGuard0101SecretKey"

static

Definition at line 94 of file Backend.cpp.

Referenced by xor_crypt().