Backend.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "Resource.hpp"
#include "Backend.hpp"
#include "SafeProcess.hpp"
#include "DistroUtils.hpp"
#include "Utils.hpp"
#include "Quarantine.hpp"
#include "firewall/FirewallRuleManager.hpp"
#include "firewall/BlacklistIpExtractor.hpp"
#include "firewall/FirewallDetector.hpp"
#include <gtkmm.h>
#include <thread>
#include <chrono>
#include <cstdlib>
#include <cstdio>
#include <array>
#include <vector>
#include <memory>
#include <stdexcept>
#include <fstream>
#include <unistd.h>
#include <cerrno>
#include <sys/stat.h>
#include <sys/wait.h>
#include <algorithm>
#include <unordered_set>
#include <regex>
#include <filesystem>
#include <iostream>
#include <glib/gi18n.h>
#include <cstring>
#include <sstream>
#include <pwd.h>
#include <random>
#include <curl/curl.h>
#include <nlohmann/json.hpp>
#include <giomm/dbusconnection.h>
#include <giomm/dbusinterface.h>
#include <giomm/dbusownname.h>
#include <giomm/file.h>
#include <giomm/fileenumerator.h>
#include <giomm/fileinfo.h>
#include <glibmm/i18n.h>
#include <iomanip>
#include <ctime>
#include <glibmm/miscutils.h>
#include <libsmbclient.h>
 
namespace fs = std::filesystem;
 
std::string Backend::getAppVersion() {
#ifdef BASTIONGUARD_VERSION
    return BASTIONGUARD_VERSION;
#else
    return "0.0.0";
#endif
}
 
int Backend::getAppBuild() {
#ifdef BASTIONGUARD_BUILD
    return BASTIONGUARD_BUILD;
#else
    return 0;
#endif
}
 
static std::string b64_encode(const std::string& s) {
    return Glib::Base64::encode(s);
}
 
static std::string b64_decode(const std::string& s) {
    return Glib::Base64::decode(s);
}
 
static const std::string SMB_KEY = "BastionGuard0101SecretKey";
 
static std::string xor_crypt(const std::string& input) {
    std::string out = input;
    for (size_t i = 0; i < input.size(); ++i)
        out[i] = input[i] ^ SMB_KEY[i % SMB_KEY.size()];
    return out;
}
 
static std::string encrypt_pass(const std::string& pass) {
    return b64_encode(xor_crypt(pass));
}
 
static std::string decrypt_pass(const std::string& enc) {
    return xor_crypt(b64_decode(enc));
}
 
 
static inline std::string trim(const std::string& s)
{
    size_t start = s.find_first_not_of(" \t\r\n");
    if (start == std::string::npos) return "";
 
    size_t end = s.find_last_not_of(" \t\r\n");
    return s.substr(start, end - start + 1);
}
 
 
static std::string extract_path_from_clamav_line(const std::string& line)
{
    auto pos = line.find(':');
    if (pos == std::string::npos)
        return line;
 
    return line.substr(0, pos);
}
 
 
static std::vector<std::string> clamDbDirs()
{
    std::vector<std::string> dirs = {
        "/var/lib/clamav",
        Glib::get_home_dir() + "/.local/share/clamav",
        "/usr/local/share/clamav"
    };
    return dirs;
}
 
struct DbInfo {
    std::string file;
    long long version = -1;
    long long epoch   = -1;
};
 
 
static std::time_t filetime_to_time_t(fs::file_time_type ft)
{
    using namespace std::chrono;
    auto sctp = time_point_cast<system_clock::duration>(
        ft - fs::file_time_type::clock::now() + system_clock::now()
    );
    return system_clock::to_time_t(sctp);
}
 
 
static bool read_cvd_header(const std::string& path, DbInfo& out)
{
    std::ifstream f(path, std::ios::binary);
    if (!f.is_open()) return false;
 
    std::string line;
    if (!std::getline(f, line)) return false;
 
 
    std::vector<std::string> toks;
    {
        std::stringstream ss(line);
        std::string seg;
        while (std::getline(ss, seg, ':')) {
            auto l = seg.find_first_not_of(" \t\r\n");
            auto r = seg.find_last_not_of(" \t\r\n");
            if (l == std::string::npos) toks.push_back("");
            else toks.push_back(seg.substr(l, r - l + 1));
        }
    }
 
    int nameIdx = -1;
    for (int i = 0; i < (int)toks.size(); ++i) {
        if (toks[i].find(".cvd") != std::string::npos ||
            toks[i].find(".cld") != std::string::npos) {
            nameIdx = i;
            break;
        }
    }
    if (nameIdx < 0) return false;
 
    out.file = fs::path(path).filename().string();
 
    // Versione = primo intero dopo nome file
    for (int i = nameIdx + 1; i < (int)toks.size(); ++i) {
        try {
            long long v = std::stoll(toks[i]);
            if (v > 0) { out.version = v; break; }
        } catch (...) {}
    }
 
    for (int i = nameIdx + 1; i < (int)toks.size(); ++i) {
        const std::string& t = toks[i];
        if (std::all_of(t.begin(), t.end(), ::isdigit)) {
            if (t.size() >= 10 && t.size() <= 13) {
                try {
                    long long e = std::stoll(t);
                    if (t.size() > 10) e /= 1000;
                    if (e > 631152000LL && e < 4102444800LL) {
                        out.epoch = e;
                        break;
                    }
                } catch (...) {}
            }
        }
    }
 
 
    if (out.epoch < 0) {
        try {
            auto ft = fs::last_write_time(path);
            out.epoch = (long long)filetime_to_time_t(ft);
        } catch (...) {}
    }
 
    return (out.version > 0);
}
 
static std::string first_existing(const std::vector<std::string>& names)
{
    for (const auto& dir : clamDbDirs()) {
        for (const auto& n : names) {
            std::string p = dir + "/" + n;
            if (fs::exists(p)) return p;
        }
    }
    return {};
}
 
 
 
 
bool Backend::isSambaScanRunning()
{
 
    int ret = (bg_process::run({"pgrep", "-f", "clamdscan"}).exit_code);
    return (ret == 0);
}
 
std::string Backend::getSambaCredsPath() const {
    const char* home = getenv("HOME");
    if (!home)
        return "/tmp/BastionGuard/cred.conf";
 
    std::string dir = std::string(home) + "/.config/BastionGuard";
    std::filesystem::create_directories(dir);
 
    return dir + "/cred.conf";
}
 
 
bool Backend::isSambaEnabled() {
    std::ifstream f(getSambaConfigPath());
    if (!f.is_open()) return false;
 
    std::string line;
    while (std::getline(f, line)) {
        if (line.find("enabled=true") != std::string::npos)
            return true;
    }
    return false;
}
 
void Backend::setSambaEnabled(bool enabled) {
    std::ofstream f(getSambaConfigPath(), std::ios::trunc);
    if (!f.is_open()) {
        std::cerr << "⚠️ " << _("Impossibile scrivere la configurazione Samba") << "\n";
        return;
    }
 
    f << "enabled=" << (enabled ? "true" : "false") << "\n";
    f.close();
 
    std::cout << "ℹ️ " << _("Stato Samba salvato: ")
              << (enabled ? _("abilitato") : _("disabilitato")) << "\n";
}
 
 
 
std::pair<int,int> read_ports_from_conf()
{
    constexpr int default_http_port = 81;
    constexpr int default_https_port = 444;
 
    std::ifstream f("/etc/BastionGuard/webports.conf");
    if (!f.is_open())
        return {default_http_port, default_https_port};
 
    int http_port = default_http_port;
    int https_port = default_https_port;
    if ((f >> http_port >> https_port) &&
        http_port > 0 && http_port < 65536 &&
        https_port > 0 && https_port < 65536) {
        return {http_port, https_port};
    }
 
    return {default_http_port, default_https_port};
}
 
static void restart_clamd() {
    if ((bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-active", "clamav-daemon.service"}).exit_code) == 0) {
        (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "restart", "clamav-daemon.service"}).exit_code);
        std::cout << _("✔ Riavviato clamav-daemon\n");
    } else if ((bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-active", "clamd.service"}).exit_code) == 0) {
        (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "restart", "clamd.service"}).exit_code);
        std::cout << _("✔ Riavviato clamd\n");
    } else {
        std::cerr << _("⚠ Nessun servizio clamd/clamav-daemon trovato\n");
    }
}
 
 
static bool install_to_system_data(const std::string& src, const std::string& dest) {
    try {
        // One fixed privileged executable, with src/dest as literal argv entries.
        const auto installation = bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644", src, dest});
        if (!installation.ok()) {
            std::cerr << _("⚠ install_to_system_data: pkexec failed (code ")
                      << installation.exit_code << ")\n";
            return false;
        }
        restart_clamd();
        return true;
    } catch (const std::exception& e) {
        std::cerr << _("❌ install_to_system_data exception: ") << e.what() << "\n";
        return false;
    }
}
 
 
static std::string quarantinePath = Glib::get_home_dir() + "/.local/share/BastionGuard/quarantine";
 
static std::string getUserConfigDir() {
    const char* xdg = std::getenv("XDG_CONFIG_HOME");
    if (xdg && std::strlen(xdg) > 0) {
        return std::string(xdg);
    }
    const char* home = std::getenv("HOME");
    if (home) return std::string(home) + "/.config";
    return std::string("/tmp");
}
 
static std::string getConfigFilePath() {
    return getUserConfigDir() + "/BastionGuard/config.ini";
}
 
static void persistQuarantinePath(const std::string& path) {
    try {
        std::string cfgDir = getUserConfigDir() + "/BastionGuard";
        std::filesystem::create_directories(cfgDir);
 
        std::string cfgPath = cfgDir + "/config.ini";
        std::ofstream f(cfgPath, std::ios::trunc);
        if (!f.is_open()) {
            std::cerr << "⚠️ " << _("Impossibile aprire il file di configurazione per scrittura: ")
                      << cfgPath << std::endl;
            return;
        }
 
        f << "quarantinePath=" << path << "\n";
        f.close();
 
        std::cout << "💾 " << _("Percorso quarantena salvato in configurazione: ") << path << std::endl;
    } catch (const std::exception& e) {
        std::cerr << "❌ " << _("Errore durante la scrittura della configurazione: ") << e.what() << std::endl;
    }
}
 
 
static void loadQuarantinePathFromConfig() {
    std::string cfg = getConfigFilePath();
    if (!fs::exists(cfg)) return;
 
    std::ifstream f(cfg);
    if (!f.is_open()) return;
 
    std::string line;
    while (std::getline(f, line)) {
        auto pos = line.find('=');
        if (pos == std::string::npos) continue;
        std::string key = line.substr(0, pos);
        std::string val = line.substr(pos + 1);
        if (key == "quarantinePath" && !val.empty()) {
            quarantinePath = val;
            break;
        }
    }
    f.close();
}
 
static void ensureQuarantinePath() {
    try {
        fs::create_directories(quarantinePath);
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore creazione cartella quarantena: ") << e.what() << std::endl;
    }
}
 
static const char* CLAMONACC_SERVICES[] = {
    "clamav-clamonacc.service",
    "clamonacc.service"
};
 
 
static std::string getRuntimeDataDir() {
    const char* xdg_data = std::getenv("XDG_DATA_HOME");
    if (xdg_data && std::strlen(xdg_data) > 0) {
        return std::string(xdg_data) + "/BastionGuard";
    }
 
    const char* home = std::getenv("HOME");
    if (home)
        return std::string(home) + "/.local/share/BastionGuard";
 
    return "/tmp/BastionGuard";
}
 
 
 
 
 
 
static bool copy_to_final(const std::string& src, const std::string& dest) {
    try {
        fs::create_directories(fs::path(dest).parent_path());
        fs::copy_file(src, dest, fs::copy_options::overwrite_existing);
        return true;
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore copia ") << src << " -> " << dest << ": " << e.what() << std::endl;
        return false;
    }
}
 
 
static std::string findClamonaccService() {
    for (auto service : CLAMONACC_SERVICES) {
        if (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                             "--system", "is-active", service}).ok()) {
            return service;
        }
    }
    return CLAMONACC_SERVICES[0];
}
 
 
 
bool Backend::enableClamonacc() {
    auto service = findClamonaccService();
    return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                            "--system", "enable", "--now", service}).ok();
}
 
bool Backend::disableClamonacc() {
    auto service = findClamonaccService();
    return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                            "--system", "disable", "--now", service}).ok();
}
 
bool Backend::isClamonaccActive() {
    for (auto service : CLAMONACC_SERVICES) {
        const auto check = bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                                            "--system", "is-active", service});
        if (!check.started) continue;
        std::string result = check.output;
 
        // Normalizza
        result.erase(std::remove(result.begin(), result.end(), '\n'), result.end());
        result.erase(std::remove(result.begin(), result.end(), '\r'), result.end());
 
        if (result == "active")
            return true;
    }
    return false;
}
 
std::string Backend::getClamonaccStatus() {
    return isClamonaccActive() ? _("Abilitata") : _("Disabilitata");
}
 
 
 
void Backend::setQuarantinePath(const std::string& path) {
    quarantinePath = path;
    persistQuarantinePath(quarantinePath);
    ::ensureQuarantinePath();  //
}
 
std::string Backend::getQuarantinePath() {
    loadQuarantinePathFromConfig();
    ::ensureQuarantinePath();  //
    return quarantinePath;
}
 
 
 
 
std::vector<std::string> Backend::getClamonaccLogs() {
    std::vector<std::string> lines;
    for (auto service : CLAMONACC_SERVICES) {
        const auto logs = bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                                          "--system", "logs", service, "100"});
        if (!logs.started) continue;
        std::istringstream stream(logs.output);
        std::string line;
        while (std::getline(stream, line)) lines.push_back(line + "\n");
 
        if (!lines.empty()) break;
    }
    return lines;
}
 
 
 
std::string Backend::getLastUpdateDate() {
    namespace fs = std::filesystem;
    std::vector<std::string> db_files = {
        "/var/lib/clamav/daily.cvd",
        "/var/lib/clamav/main.cvd",
        "/var/lib/clamav/bytecode.cvd",
        "/var/lib/clamav/daily.cld",
        "/var/lib/clamav/main.cld",
        "/var/lib/clamav/bytecode.cld"
    };
 
    std::time_t newest = 0;
    for (const auto& file : db_files) {
        if (fs::exists(file)) {
            auto ftime = fs::last_write_time(file);
            auto sctp = std::chrono::time_point_cast<std::chrono::system_clock::duration>(
                ftime - fs::file_time_type::clock::now() + std::chrono::system_clock::now());
            std::time_t t = std::chrono::system_clock::to_time_t(sctp);
            if (t > newest) newest = t;
        }
    }
 
    if (newest == 0)
        return _("sconosciuta");
 
    char buf[64];
    std::tm tmbuf{};
    localtime_r(&newest, &tmbuf);  // thread-safe
    std::strftime(buf, sizeof(buf), "%d %B %Y %H:%M", &tmbuf);
    return buf;
}
 
 
 
std::string Backend::getDbVersion() {
    namespace fs = std::filesystem;
 
 
    std::vector<std::string> db_files = {
        "/var/lib/clamav/daily.cld",
        "/var/lib/clamav/daily.cvd",
        "/var/lib/clamav/main.cld",
        "/var/lib/clamav/main.cvd"
    };
 
    for (const auto &file : db_files) {
        if (!fs::exists(file))
            continue;
 
        std::ifstream f(file, std::ios::binary);
        if (!f.is_open())
            continue;
 
        std::string line;
        std::getline(f, line);
 
 
        size_t first_colon = line.find(':');
        size_t second_colon = line.find(':', first_colon + 1);
        size_t third_colon = line.find(':', second_colon + 1);
 
        if (first_colon == std::string::npos || second_colon == std::string::npos)
            continue;
 
        std::string date_part = line.substr(first_colon + 1, second_colon - first_colon - 1);
        std::string version = line.substr(second_colon + 1, third_colon - second_colon - 1);
 
        std::ostringstream out;
        out << "daily.cvd v" << version << " (" << date_part << ")";
        return out.str();
    }
 
    return _("sconosciuta");
}
 
 
 
 
 
 
 
std::vector<std::string> Backend::getOnAccessPaths() {
    std::vector<std::string> paths;
    std::ifstream f("/etc/clamav/clamd.conf");
    if (!f.is_open()) return paths;
 
    std::string line;
    while (std::getline(f, line)) {
        if (line.find("OnAccessIncludePath") == 0) {
            auto pos = line.find(' ');
            if (pos != std::string::npos) {
                paths.push_back(line.substr(pos + 1));
            }
        }
    }
    return paths;
}
 
std::vector<std::string> Backend::getOnAccessEvents() {
    std::vector<std::string> events;
    for (auto service : CLAMONACC_SERVICES) {
        const auto logs = bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                                          "--system", "logs", service, "50"});
        if (!logs.started) continue;
        std::istringstream stream(logs.output);
        std::string line;
        while (std::getline(stream, line)) {
            if (line.find("Scanned file") != std::string::npos ||
                line.find("FOUND") != std::string::npos ||
                line.find("Access denied") != std::string::npos ||
                line.find("ERROR") != std::string::npos) {
                events.push_back(line);
            }
        }
 
        if (!events.empty()) break;
    }
    return events;
}
 
 
 
// Install packages via an explicit allowlisted command; never pass an arbitrary
// command string to pexec or a privileged shell.
static int installPackages(const std::vector<std::string>& args) {
    if (args.empty()) return 127;
    std::vector<std::string> argv = {"pkexec"};
    argv.insert(argv.end(), args.begin(), args.end());
    return bg_process::run(argv, true).exit_code;
}
 
static std::string detectDistro() {
    const std::string id = BastionGuard::Platform::distribution_id();
    return id.empty() ? "unknown" : id;
}
 
static bool isClamdInstalled() {
    return ((bg_process::exists_on_path("clamd") ? 0 : 1) == 0) ||
           (std::filesystem::exists("/usr/sbin/clamd") ||
            std::filesystem::exists("/usr/bin/clamd"));
}
 
bool Backend::installClamdIfMissing() {
    if (isClamdInstalled()) {
        std::cout << _("✔ clamd già installato\n");
        return true;
    }
 
    std::string distro = detectDistro();
    std::cout << _("⚠ clamd non trovato, tentativo installazione per ") << distro << "...\n";
 
    int ret = -1;
    if (distro == "debian" || distro == "ubuntu" || distro == "linuxmint") {
        ret = installPackages({"apt-get", "update"});
        if (ret == 0) ret = installPackages({"apt-get", "install", "-y", "clamav", "clamav-daemon"});
    } else if (distro == "fedora") {
        ret = installPackages({"dnf", "install", "-y", "clamav", "clamav-update"});
    } else if (distro == "centos" || distro == "rhel") {
        ret = installPackages({"yum", "install", "-y", "clamav", "clamav-update"});
    } else if (distro == "opensuse" || distro == "suse") {
        ret = installPackages({"zypper", "install", "-y", "clamav"});
    } else if (distro == "arch" || distro == "manjaro" || distro == "endeavouros") {
        ret = installPackages({"pacman", "-S", "--needed", "--noconfirm", "clamav"});
    } else if (distro == "gentoo" || distro == "funtoo") {
        ret = installPackages({"emerge", "app-antivirus/clamav"});
    } else if (distro == "slackware") {
        ret = installPackages({"slackpkg", "install", "clamav"});
    } else {
        std::cerr << _("❌ Distribuzione non riconosciuta: ") << distro << "\n";
        return false;
    }
 
    if (ret == 0) {
        std::cout << _("✔ clamd installato correttamente\n");
        return true;
    } else {
        std::cerr << _("❌ Errore durante l’installazione di clamd\n");
        return false;
    }
}
 
Backend::Backend()
    : antiransom_()
{
    loadQuarantinePathFromConfig();
    ::ensureQuarantinePath();
    initSambaClient();
    loadSMBCredentials();
    loadFirewallConfig();
 
 
 
    firewallType_ = FirewallDetector::detectFirewall();
 
 
    try {
        std::string fwCfg =
            Glib::get_home_dir() + "/.config/BastionGuard/firewall.conf";
 
        if (std::filesystem::exists(fwCfg)) {
            std::ifstream fin(fwCfg);
            std::string line;
            std::getline(fin, line);
 
            if (line.find("firewalld") != std::string::npos)
                firewallType_ = FirewallType::FIREWALLD;
            else if (line.find("ufw") != std::string::npos)
                firewallType_ = FirewallType::UFW;
            else
                firewallType_ = FirewallType::NONE;
 
            std::cout << "[Backend] Firewall caricato da config: "
                      << line << std::endl;
        } else {
            std::cout << "[Backend] Firewall autodetect: "
                      << static_cast<int>(firewallType_) << std::endl;
        }
    } catch (...) {
        std::cerr << _("[Backend] ⚠ Errore lettura configurazione firewall\n");
    }
 
 
    try {
        setupAlertListener();
        std::cout << _("[Backend] 🛰️ Listener D-Bus ransomware attivo\n");
    } catch (const std::exception& e) {
        std::cerr << _("[Backend] ⚠ Impossibile avviare listener D-Bus ransomware: ")
                  << e.what() << std::endl;
    }
 
 
    googleSafeEnabled_ = false;
    googleSafeApiKey_.clear();
 
 
    try {
        const char* home = getenv("HOME");
        std::string cfgPath = std::string(home) + "/.config/BastionGuard/googlesafe.conf";
        if (std::filesystem::exists(cfgPath)) {
            std::ifstream fin(cfgPath);
            std::string line;
            while (std::getline(fin, line)) {
                if (line.find("google_safe_enabled=true") != std::string::npos)
                    googleSafeEnabled_ = true;
                if (line.find("google_safe_key=") != std::string::npos) {
                    auto pos = line.find('=');
                    if (pos != std::string::npos)
                        googleSafeApiKey_ = line.substr(pos + 1);
                }
            }
            std::cout << _("[Backend] Configurazione Google Safe caricata da ") << cfgPath << "\n";
        }
    } catch (...) {
        std::cerr << _("[Backend] ⚠ Impossibile leggere config Google Safe\n");
    }
 
    if (googleSafeEnabled_)
        std::cout << Glib::ustring::compose(
            _("[Backend] Google Safe Browsing attivo (API Key: %1)\n"),
            googleSafeApiKey_.empty() ? _("vuota") : _("presente")
        );
 
    else
        std::cout << _("[Backend] Google Safe Browsing disattivato.\n");
 
 
    std::string blacklist = resource("phishing/blacklist.txt");
 
    if (!std::filesystem::exists(blacklist)) {
        std::cerr << _("[Backend] Blacklist non trovata in ") << blacklist
                  << _(" — provo a scaricarla con updatePhishLists()\n");
        if (updatePhishLists()) {
            blacklist = resource("phishing/blacklist.txt");
            std::cout << _("[Backend] Blacklist aggiornata e trovata in ") << blacklist << std::endl;
        } else {
            std::cerr << _("[Backend] updatePhishLists() fallita, continuerò senza WebProbe\n");
        }
    }
 
    const auto [warning_port, warning_https_port] = read_ports_from_conf();
    (void)warning_https_port;
 
    if (!blacklist.empty() && std::filesystem::exists(blacklist)) {
        try {
            webprobe_ = std::make_unique<WebProbe>(blacklist, warning_port);
            std::cout << _("[Backend] WebProbe avviato su porta ") << warning_port
                      << _(" con blacklist: ") << blacklist << std::endl;
        } catch (const std::exception& ex) {
            std::cerr << _("[Backend] Errore inizializzazione WebProbe: ") << ex.what() << std::endl;
            webprobe_.reset();
        }
    } else {
        std::cerr << _("[Backend] Nessuna blacklist disponibile, WebProbe non inizializzato\n");
    }
 
 
    try {
        loadWhitelist();
        std::cout << _("[Backend] Whitelist caricata con ")
                  << whitelist_.size() << " voci.\n";
    } catch (const std::exception& e) {
        std::cerr << _("[Backend] ⚠ Errore caricamento whitelist: ")
                  << e.what() << std::endl;
    }
 
  }
 
 
Backend& Backend::instance() {
    static Backend inst;
    return inst;
}
 
 
 
void Backend::start_antiransom() {
    const int ret = bg_process::run({"runuser", "-u", Glib::get_user_name(), "--",
                                    "/usr/libexec/bastionguard/bastionguard-service",
                                    "--user", "start", "BastionGuard-ransomware-scanner.service"}).exit_code;
    if (ret == 0)
        std::cout << _("✔ Servizio Anti-Ransomware avviato\n");
    else
        std::cerr << _("❌ Errore avvio servizio Anti-Ransomware\n");
}
 
void Backend::stop_antiransom() {
    const int ret = bg_process::run({"runuser", "-u", Glib::get_user_name(), "--",
                                    "/usr/libexec/bastionguard/bastionguard-service",
                                    "--user", "stop", "BastionGuard-ransomware-scanner.service"}).exit_code;
    if (ret == 0)
        std::cout << _("✔ Servizio Anti-Ransomware fermato\n");
    else
        std::cerr << _("⚠ Impossibile fermare il servizio Anti-Ransomware\n");
}
 
bool Backend::updateYaraRules(std::function<void(int, int, const std::string&)> progressCallback)
{
    namespace fs = std::filesystem;
 
    std::string userYaraDir = getRuntimeDataDir() + "/data/yara";
    std::string systemYaraDir = "/usr/share/BastionGuard/data/yara";
 
    fs::create_directories(userYaraDir);
 
    std::vector<std::string> files = {
        "ByteCode.MSIL.Ransomware.Apis.yara",
        "ByteCode.MSIL.Ransomware.Thanos.yara",
        "Linux.Ransomware.KillDisk.yara",
        "Win32.Ransomware.WannaCry.yara",
        "Win32.Ransomware.LockBit.yara",
        "Win64.Ransomware.BlackBasta.yara",
        "ByteCode.MSIL.Ransomware.ChupaCabra.yara",
        "ByteCode.MSIL.Ransomware.Cring.yara",
        "ByteCode.MSIL.Ransomware.Dusk.yara",
        "ByteCode.MSIL.Ransomware.EAF.yara",
        "ByteCode.MSIL.Ransomware.Eternity.yara",
        "ByteCode.MSIL.Ransomware.Fantom.yara",
        "ByteCode.MSIL.Ransomware.GhosTEncryptor.yara",
        "ByteCode.MSIL.Ransomware.Ghostbin.yara",
        "ByteCode.MSIL.Ransomware.GoodWill.yara",
        "ByteCode.MSIL.Ransomware.HarpoonLocker.yara",
        "ByteCode.MSIL.Ransomware.Hog.yara",
        "ByteCode.MSIL.Ransomware.Invert.yara",
        "ByteCode.MSIL.Ransomware.Janelle.yara",
        "ByteCode.MSIL.Ransomware.Khonsari.yara",
        "ByteCode.MSIL.Ransomware.McBurglar.yara",
        "ByteCode.MSIL.Ransomware.Moisha.yara",
        "ByteCode.MSIL.Ransomware.Namaste.yara",
        "ByteCode.MSIL.Ransomware.Oct.yara",
        "ByteCode.MSIL.Ransomware.Pacman.yara",
        "ByteCode.MSIL.Ransomware.PoliceRecords.yara",
        "ByteCode.MSIL.Ransomware.Povlsomware.yara",
        "ByteCode.MSIL.Ransomware.Retis.yara",
        "ByteCode.MSIL.Ransomware.TaRRaK.yara",
        "ByteCode.MSIL.Ransomware.TimeCrypt.yara",
        "ByteCode.MSIL.Ransomware.TimeTime.yara",
        "ByteCode.MSIL.Ransomware.Venom.yara",
        "ByteCode.MSIL.Ransomware.WildFire.yara",
        "ByteCode.MSIL.Ransomware.WormLocker.yara",
        "ByteCode.MSIL.Ransomware.ZeroLocker.yara",
        "Bytecode.MSIL.Ransomware.CobraLocker.yara",
        "Linux.Ransomware.GwisinLocker.yara",
        "Linux.Ransomware.Helldown.yara",
        "Linux.Ransomware.LuckyJoe.yara",
        "Linux.Ransomware.RedAlert.yara",
        "Win32.Ransomware.Conti.yara",
        "Win32.Ransomware.BlackCat.yara",
        "Win32.Ransomware.Clop.yara",
        "Win32.Ransomware.Ryuk.yara",
        "Win64.Ransomware.Cactus.yara",
        "Win64.Ransomware.Pandora.yara",
        "Win64.Ransomware.HermeticRansom.yara"
    };
 
    std::string baseUrl =
        "https://raw.githubusercontent.com/reversinglabs/reversinglabs-yara-rules/develop/yara/ransomware";
 
    int total = files.size();
    int index = 0;
    int successCount = 0;
    int failCount = 0;
    bool blockedDetected = false;
 
    std::cout << _("⬇ Inizio aggiornamento delle regole YARA...") << "\n";
 
    for (const auto& file : files) {
        ++index;
 
        if (progressCallback)
            progressCallback(index, total, file);
 
        std::string url = baseUrl + "/" + file;
        std::string dest = userYaraDir + "/" + file;
 
        const auto download = bg_process::run({"curl", "--fail", "--silent", "--show-error",
                                              "--location", "--max-time", "10", "-o", dest, "--", url}, true);
        const std::string& output = download.output;
        if (!download.ok()) {
            std::error_code ec;
            fs::remove(dest, ec);
            failCount++;
            continue;
        }
 
        if (fs::exists(dest)) {
            auto size = fs::file_size(dest);
 
            if (size < 100 ||
                output.find("redirect_to_local_warning_server") != std::string::npos) {
                blockedDetected = true;
                fs::remove(dest);
                failCount++;
                continue;
            }
 
            std::cout << _("✔ Aggiornato: ") << file << "\n";
            successCount++;
 
        } else {
            failCount++;
        }
    }
 
    std::cout << "\n📊 " << _("Totale riusciti: ") << successCount
              << " | " << _("Falliti: ") << failCount << "\n";
 
    if (blockedDetected) {
        std::cerr << _("⚠ Alcuni download sono stati bloccati dall'AntiPhishing.") << "\n";
    }
 
    std::cout << _("📁 Regole salvate in: ") << userYaraDir << "\n";
 
 
    if (successCount > 0) {
 
        // Install each downloaded rule by argv, never interpolate file paths
        // into a root shell script.
        bool copied_all = true;
        for (const auto& file : files) {
            const fs::path src_path = fs::path(userYaraDir) / file;
            if (!fs::exists(src_path)) continue;
            const fs::path dst_path = fs::path(systemYaraDir) / file;
            if (!bg_process::run({"pkexec", "/usr/bin/install", "-D", "-m", "0644",
                                  src_path.string(), dst_path.string()}).ok())
                copied_all = false;
        }
        if (copied_all)
            std::cout << _("✔ Copiate anche in /usr/share/BastionGuard/data/yara") << "\n";
        else
            std::cerr << _("⚠ Alcune regole YARA non sono state installate nel sistema") << "\n";
    }
 
    return successCount > 0;
}
 
 
 
 
 
// ---------------------------------------------------------------------------
// Helper: esegue lo script privilegiato dopo autorizzazione esplicita via pkexec
// Lo script si trova in /usr/share/BastionGuard/data/scripts/
// ---------------------------------------------------------------------------
static bool run_phishing_updater_script(const std::string& staging_dir) {
    const std::string helper =
        "/usr/share/BastionGuard/data/scripts/BastionGuard-phishing-updater.sh";
 
    if (!std::filesystem::exists(helper)) {
        std::cerr << _("[Phishing] Helper non trovato: ") << helper << "\n";
        return false;
    }
 
    // No shell and no passwordless sudo rule: pkexec performs the explicit
    // administrator authorization, while the staging directory is passed as
    // one opaque argv element.
    const pid_t pid = ::fork();
    if (pid < 0) {
        std::cerr << _("[Phishing] fork() fallita per helper privilegiato.\n");
        return false;
    }
 
    if (pid == 0) {
        const char* argv[] = {
            "pkexec", helper.c_str(), staging_dir.c_str(), nullptr
        };
        ::execvp("pkexec", const_cast<char* const*>(argv));
        _exit(127);
    }
 
    int status = 0;
    if (::waitpid(pid, &status, 0) < 0) return false;
    return WIFEXITED(status) && WEXITSTATUS(status) == 0;
}
 
// ---------------------------------------------------------------------------
// mergeWhitelistSources: unifica whitelist.json e whitelist.txt evitando dup
// ---------------------------------------------------------------------------
void Backend::mergeWhitelistSources() {
    // Ricarica whitelist.json in whitelist_
    loadWhitelist();
 
    const std::string txtPath =
        Glib::get_home_dir() +
        "/.local/share/BastionGuard/phishing/whitelist.txt";
 
    if (!std::filesystem::exists(txtPath)) return;
 
    std::ifstream f(txtPath);
    if (!f.is_open()) return;
 
    bool changed = false;
    std::string line;
    while (std::getline(f, line)) {
        // trim
        const char* ws = " \t\r\n\f\v";
        size_t s = line.find_first_not_of(ws);
        if (s == std::string::npos) continue;
        size_t e = line.find_last_not_of(ws);
        line = line.substr(s, e - s + 1);
        if (line.empty() || line[0] == '#') continue;
 
        if (std::find(whitelist_.begin(), whitelist_.end(), line)
                == whitelist_.end()) {
            whitelist_.push_back(line);
            changed = true;
        }
    }
    f.close();
 
    if (changed) {
        // Risalva JSON unificato
        saveWhitelist();
 
        // Riscrive anche il .txt con il contenuto unificato
        std::ofstream out(txtPath, std::ios::trunc);
        if (out.is_open())
            for (const auto& d : whitelist_)
                out << d << "\n";
 
        std::cout << _("[Backend] ✅ Whitelist merged: ")
                  << whitelist_.size() << " voci totali\n";
    }
}
 
bool Backend::updatePhishLists() {
    // Unifica whitelist.json + whitelist.txt prima di procedere
    mergeWhitelistSources();
 
    namespace fs = std::filesystem;
 
    std::string userBase = getRuntimeDataDir();
    std::string baseDir   = userBase + "/data/phishing";
    std::string finalPath = baseDir + "/blacklist.txt";
    std::string finalReduce = baseDir + "/blacklist-reduce.txt";
 
    // Use a private per-update directory instead of predictable /tmp names.
    // The privileged helper verifies owner/mode before consuming it.
    std::string stage_template = "/tmp/bastionguard-phish.XXXXXX";
    std::vector<char> stage_buf(stage_template.begin(), stage_template.end());
    stage_buf.push_back('\0');
    char* stage_ptr = ::mkdtemp(stage_buf.data());
    if (!stage_ptr) {
        std::cerr << _("[Phishing] Impossibile creare staging directory sicura.\n");
        return false;
    }
    std::string stagingDir(stage_ptr);
    ::chmod(stagingDir.c_str(), 0700);
 
    std::string tmpPath    = stagingDir + "/blacklist.txt";
    std::string tmpReduce  = stagingDir + "/blacklist-reduce.txt";
    std::string tmpDnsmasq = stagingDir + "/dnsmasq-blacklist.conf";
 
    fs::create_directories(baseDir);
 
    struct Cleanup {
        std::vector<std::string> paths;
        ~Cleanup() {
            for (auto &p : paths) {
                try {
                    if (!p.empty() && std::filesystem::exists(p))
                        std::filesystem::remove(p);
                } catch(...) {}
            }
        }
    };
    Cleanup cleanup;
    cleanup.paths.push_back(tmpPath);
    cleanup.paths.push_back(tmpReduce);
    cleanup.paths.push_back(tmpDnsmasq);
    cleanup.paths.push_back(stagingDir);
 
    std::vector<std::string> sources = {
        "https://phishing.army/download/phishing_army_blocklist.txt",
        "https://openphish.com/feed.txt",
        "https://urlhaus.abuse.ch/downloads/text/",
    };
 
    auto trim = [](std::string &s) {
        const char *ws = " \t\n\r\f\v";
        size_t start = s.find_first_not_of(ws);
        if (start == std::string::npos) { s.clear(); return; }
        size_t end = s.find_last_not_of(ws);
        s = s.substr(start, end - start + 1);
    };
 
    const std::regex re_ipv4(R"((?:(?:25[0-5]|2[0-4]\d|1?\d{1,2})(?:\.(?:25[0-5]|2[0-4]\d|1?\d{1,2})){3}))");
    const std::regex re_ipv6(R"((?:[0-9a-fA-F]{1,4}(?::[0-9a-fA-F]{1,4}){2,7}))");
 
    auto looks_like_ip = [&](const std::string &s)->bool{
        return std::regex_search(s, re_ipv4) || std::regex_search(s, re_ipv6);
    };
 
    auto looks_like_url_or_domain = [](const std::string &s) -> bool {
        if (s.empty()) return false;
        if (s.find("http://") != std::string::npos || s.find("https://") != std::string::npos) return true;
        if (s.find('.') != std::string::npos) {
            bool all_digits = true;
            for (char c : s) {
                if (!std::isdigit(static_cast<unsigned char>(c)) && c != '.') { all_digits = false; break; }
            }
            return !all_digits;
        }
        return false;
    };
 
 
    {
        std::ofstream out(tmpPath, std::ios::trunc);
        if (!out.is_open()) {
            std::cerr << _("❌ Impossibile scrivere ") << tmpPath << "\n";
            return false;
        }
 
        for (const auto& url : sources) {
            const auto download = bg_process::run({"curl", "--fail", "--silent", "--max-time", "30",
                                                   "--user-agent", "BastionGuard-PhishUpdater/1.0",
                                                   "--", url}, false, 16U * 1024U * 1024U);
            if (!download.ok()) { std::cerr << _("⚠ Impossibile aprire ") << url << "\n"; continue; }
 
            bool any = false;
            std::string acc;
            std::istringstream fetched(download.output);
            std::string fragment;
            while (std::getline(fetched, fragment)) {
                acc.append(fragment).append("\n");
                while (true) {
                    size_t nl = acc.find('\n');
                    if (nl == std::string::npos) break;
                    std::string line = acc.substr(0, nl);
                    acc.erase(0, nl + 1);
                    if (!line.empty() && line.back() == '\r') line.pop_back();
                    trim(line);
                    if (line.empty() || line[0] == '#') continue;
 
                    if (looks_like_ip(line) || looks_like_url_or_domain(line)) {
                        out << line << "\n";
                        any = true;
                    }
                }
            }
            if (!any) std::cerr << _("⚠ Nessun dato da ") << url << "\n";
            else out << "\n";
        }
        out.close();
        ::chmod(tmpPath.c_str(), 0600);
    }
 
 
    {
        std::ifstream fin(tmpPath);
        if (!fin.is_open()) return false;
 
        std::unordered_set<std::string> seen;
        std::vector<std::string> lines;
        std::string line;
        while (std::getline(fin, line)) {
            if (!line.empty() && line.back() == '\r') line.pop_back();
            trim(line);
            if (line.empty() || line[0] == '#') continue;
            if (seen.insert(line).second) lines.push_back(line);
        }
        fin.close();
 
        const size_t maxLines = 30;
        std::ofstream fout(tmpReduce, std::ios::trunc);
        for (size_t i = 0; i < std::min(lines.size(), maxLines); ++i)
            fout << lines[i] << "\n";
        fout << _("# ... lista completa salvata in blacklist.txt\n");
        fout.close();
        ::chmod(tmpReduce.c_str(), 0600);
    }
 
    copy_to_final(tmpPath, finalPath);
    copy_to_final(tmpReduce, finalReduce);
 
    try {
        std::ifstream fin(finalPath);
        if (!fin.is_open()) {
            std::cerr << _("❌ Impossibile aprire la blacklist per generare dnsmasq.") << std::endl;
        } else {
            std::ofstream fout(tmpDnsmasq, std::ios::trunc);
            if (!fout.is_open()) {
                std::cerr << _("❌ Impossibile creare file temporaneo dnsmasq.") << std::endl;
            } else {
 
 
                static const std::unordered_set<std::string> infra_whitelist = {
                    "github.com",
                    "githubusercontent.com",
                    "gitlab.com",
                    "bitbucket.org",
                    "sourceforge.net",
 
 
                    "archive.org",
 
 
                    "npmjs.com",
                    "jsdelivr.net",
                    "unpkg.com",
 
 
                    "cloudflare.com",
                    "cloudfront.net",
                    "amazonaws.com",
                    "azurewebsites.net",
                    "windows.net",
                    "vercel.app",
                    "netlify.app",
                    "herokuapp.com",
 
 
                    "googleapis.com",
                    "googleusercontent.com",
                    "gstatic.com",
                    "firebaseapp.com",
                    "firebasestorage.googleapis.com",
 
                    "microsoft.com",
                    "office.com",
                    "live.com"
                };
 
 
                std::unordered_set<std::string> trusted;
 
                auto load_json_list = [&](const std::string& path) {
                    if (!fs::exists(path)) return;
                    try {
                        std::ifstream f(path);
                        nlohmann::json j;
                        f >> j;
 
                        auto push_str = [&](const nlohmann::json& arr) {
                            for (auto& v : arr) {
                                if (v.is_string()) trusted.insert(v.get<std::string>());
                            }
                        };
 
                        if (j.is_array()) {
                            push_str(j);
                        } else if (j.contains("list") && j["list"].is_array()) {
                            push_str(j["list"]);
                        } else if (j.contains("whitelist") && j["whitelist"].is_array()) {
                            push_str(j["whitelist"]);
                        }
                    } catch (...) {}
                };
 
                auto load_text_list = [&](const std::string& path) {
                    if (!fs::exists(path)) return;
 
                    try {
                        std::ifstream f(path);
                        std::string line;
                        while (std::getline(f, line)) {
                            line.erase(std::remove(line.begin(), line.end(), '\r'), line.end());
                            line.erase(std::remove(line.begin(), line.end(), '\n'), line.end());
 
                            const char* ws = " \t\f\v";
                            size_t start = line.find_first_not_of(ws);
                            if (start == std::string::npos) continue;
                            size_t end = line.find_last_not_of(ws);
                            line = line.substr(start, end - start + 1);
 
                            if (line.empty() || line[0] == '#')
                                continue;
 
                            trusted.insert(line);
                        }
                    } catch (...) {}
                };
 
                load_json_list("/usr/share/BastionGuard/data/bank/banks.json");
 
                if (const char* home = std::getenv("HOME")) {
                    load_json_list(std::string(home) + "/.config/BastionGuard/whitelist.json");
                    load_text_list(std::string(home) + "/.local/share/BastionGuard/phishing/whitelist.txt");
                }
 
                auto clean_domain = [](std::string s) {
                std::transform(s.begin(), s.end(), s.begin(),
                            [](unsigned char c){ return (char)std::tolower(c); });
 
                const char* ws = " \t\r\n\f\v";
                size_t start = s.find_first_not_of(ws);
                if (start == std::string::npos) return std::string{};
                size_t end = s.find_last_not_of(ws);
                s = s.substr(start, end - start + 1);
 
                if (auto pos = s.find("://"); pos != std::string::npos)
                    s = s.substr(pos + 3);
 
                for (char c : {'/', ' ', ';', '"', '\'', '%', '&', '(', ')', '=', '?', '*', '#'})
                    if (auto p = s.find(c); p != std::string::npos)
                        s = s.substr(0, p);
 
                if (auto at = s.rfind('@'); at != std::string::npos)
                    s = s.substr(at + 1);
 
                if (auto colon = s.find(':'); colon != std::string::npos)
                    s = s.substr(0, colon);
 
                if (s.rfind("www.", 0) == 0)
                    s.erase(0, 4);
 
                while (!s.empty() && s.front() == '.')
                    s.erase(0, 1);
                while (!s.empty() && s.back() == '.')
                    s.pop_back();
 
                return s;
            };
 
 
                auto is_whitelisted_domain = [&](const std::string& domain,
                                                const std::unordered_set<std::string>& wl) -> bool {
                    if (domain.empty()) return false;
                    if (wl.count(domain)) return true;
 
                    size_t dot = domain.find('.');
                    while (dot != std::string::npos) {
                        std::string parent = domain.substr(dot + 1);
                        if (wl.count(parent)) return true;
                        dot = domain.find('.', dot + 1);
                    }
                    return false;
                };
 
 
                if (!trusted.empty()) {
                    std::unordered_set<std::string> normalized;
                    normalized.reserve(trusted.size());
                    for (const auto& d : trusted) normalized.insert(clean_domain(d));
                    trusted.swap(normalized);
                }
 
                std::cerr << _("[Backend] ✅ Whitelist utente/banca caricata: ")
                          << trusted.size() << " domini.\n";
                std::cerr << _("[Backend] ✅ Whitelist infrastrutturale: ")
                          << infra_whitelist.size() << _(" domini.\n");
 
                size_t written = 0, skipped = 0, skipped_ip = 0;
                std::string line;
 
                while (std::getline(fin, line)) {
                    line.erase(std::remove(line.begin(), line.end(), '\r'), line.end());
                    line.erase(std::remove(line.begin(), line.end(), '\n'), line.end());
                    if (line.empty() || line[0] == '#') continue;
 
 
                    std::string host = line;
 
                    if (auto pos = host.find("://"); pos != std::string::npos)
                        host = host.substr(pos + 3);
 
 
                    for (char c : {'/', ' ', ';', '"', '\'', '%', '&', '(', ')', '=', '?', '*', '#'})
                        if (auto p = host.find(c); p != std::string::npos)
                            host = host.substr(0, p);
 
 
                    if (auto at = host.rfind('@'); at != std::string::npos)
                        host = host.substr(at + 1);
 
 
                    if (auto colon = host.find(':'); colon != std::string::npos)
                        host = host.substr(0, colon);
 
                    std::string clean_host = clean_domain(host);
                    if (clean_host.empty()) continue;
 
                    if (looks_like_ip(clean_host)) {
                        skipped_ip++;
                        continue;
                    }
 
 
                    if (is_whitelisted_domain(clean_host, infra_whitelist)) {
                        skipped++;
                        continue;
                    }
                    if (is_whitelisted_domain(clean_host, trusted)) {
                        skipped++;
                        continue;
                    }
 
                    fout << "address=/" << clean_host << "/127.0.0.2\n";
                    written++;
 
                    if (written % 1000 == 0) fout.flush();
                    if (written > 1000000) break;
                }
 
                fout.close();
                ::chmod(tmpDnsmasq.c_str(), 0600);
                fin.close();
 
                std::cout << _("✔ File dnsmasq generato: ") << written
                          << _(" voci. Skipped whitelist: ") << skipped
                          << _(" | Skipped IP: ") << skipped_ip << "\n";
 
                bool script_ok = run_phishing_updater_script(stagingDir);
                if (!script_ok) {
                    std::cerr << _("[Phishing] Installazione privilegiata annullata o fallita; ")
                              << _("nessun fallback insicuro viene eseguito.\n");
                    return false;
                }
                fs::remove(tmpDnsmasq);
            }
        }
    } catch (const std::exception& e) {
        std::cerr << _("⚠ Errore generazione dnsmasq blocklist: ") << e.what() << std::endl;
    }
 
 
 
 
    try {
        if (!isFirewallEnabled()) {
            std::cout << _("[Firewall] Blocco IP disabilitato — salto applicazione regole.\n");
        } else if (firewallType_ == FirewallType::NONE) {
            std::cout << _("[Firewall] Nessun firewall supportato rilevato.\n");
        } else {
            std::ifstream fin(finalPath);
            std::vector<std::string> lines;
            std::string line;
 
            while (std::getline(fin, line))
                lines.push_back(line);
 
            const auto before = lines.size();
 
            applyFirewallFromBlacklist(lines);
 
            std::cout << _("[Firewall] Tentata applicazione regole da ")
                    << before << _(" righe blacklist ")
                    << "(firewall=" << static_cast<int>(firewallType_) << ")\n";
        }
    }
    catch (const std::exception& e) {
        std::cerr << _("[Firewall] Errore applicazione regole firewall: ")
                << e.what() << std::endl;
    }
    catch (...) {
        std::cerr << _("[Firewall] Errore sconosciuto applicazione regole firewall.\n");
    }
 
 
    std::cout << _("✔ Blacklist phishing aggiornata in ") << finalPath
              << _(" e ridotta in ") << finalReduce << "\n";
    return true;
}
 
 
 
 
 
void Backend::start_antiphish() {
    std::cout << _("▶ Avvio protezione Anti-Phishing...\n");
    int ret = (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "start", "BastionGuard-phishing-scanner.service"}).exit_code);
    if (ret == 0) {
        std::cout << _("✔ Servizio Anti-Phishing avviato\n");
    } else {
        std::cerr << _("❌ Errore avvio servizio Anti-Phishing\n");
    }
}
 
void Backend::stop_antiphish() {
    std::cout << _("⏹ Arresto protezione Anti-Phishing...\n");
    int ret = (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "stop", "BastionGuard-phishing-scanner.service"}).exit_code);
    if (ret == 0) {
        std::cout << _("✔ Servizio Anti-Phishing fermato\n");
    } else {
        std::cerr << _("⚠ Errore arresto BastionGuard-phishing-scanner.service\n");
    }
}
 
 
 
bool Backend::updateSanesecurityDB(std::function<void(int, int, const std::string&)> progressCallback)
{
    namespace fs = std::filesystem;
 
    std::string userBase = getRuntimeDataDir();
    std::string baseDir  = userBase + "/data/sanesecurity";
    std::string tmpDir   = "/tmp/sanesecurity";
 
    fs::create_directories(tmpDir);
    fs::create_directories(baseDir);
 
    std::vector<std::string> dbs = {
        "scamsigs.hdb",
        "scam.ndb",
        "phish.ndb",
        "rogue.hdb",
        "ransomware.ndb"
    };
 
    int total = static_cast<int>(dbs.size());
    int current = 0;
 
    std::cout << _("⬇ Inizio aggiornamento Sanesecurity DB...") << "\n";
 
    for (const auto& db : dbs) {
        ++current;
        if (progressCallback)
            progressCallback(current - 1, total, db);
 
        std::string url = "https://sanesecurity.com/clamav/" + db;
        std::string dest = tmpDir + "/" + db;
        std::string finalPath = baseDir + "/" + db;
        std::string systemDest = "/usr/share/BastionGuard/data/sanesecurity/" + db;
 
        std::cout << _("⬇ Scarico ") << db << " ...\n";
 
        const auto download = bg_process::run({"curl", "--fail", "--silent", "--location",
                                               "--max-time", "30", "-o", dest, "--", url});
        const int ret = download.exit_code;
 
        if (ret != 0 || !fs::exists(dest) || fs::file_size(dest) < 100) {
            std::cerr << _("⚠ Errore download o file vuoto: ") << db << "\n";
            if (progressCallback)
                progressCallback(current, total, db);
            continue;
        }
 
 
        if (!copy_to_final(dest, finalPath)) {
            std::cerr << _("❌ Errore copia locale ") << finalPath << "\n";
            return false;
        }
 
 
        if (install_to_system_data(dest, systemDest)) {
            std::cout << _("✔ ") << db << _(" installato system-wide in ") << systemDest << "\n";
        } else {
            std::cout << _("ℹ ") << db << _(" disponibile solo in ") << finalPath << "\n";
        }
 
        if (progressCallback)
            progressCallback(current, total, db);
    }
 
    std::cout << _("✔ Database Sanesecurity aggiornato in ") << baseDir << "\n";
    return true;
}
 
 
 
 
bool Backend::isAntiransomActive() {
    return bg_process::run({"/usr/libexec/bastionguard/bastionguard-service",
                            "--user", "is-active", "BastionGuard-ransomware-scanner.service"}).ok();
}
 
bool Backend::isAntiphishActive() {
    int ret = (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-active", "BastionGuard-phishing-scanner.service"}).exit_code);
    return (ret == 0);
}
 
sigc::signal<void(const std::string&)>& Backend::signal_antiransom_event() {
    return antiransom_signal_;
}
 
sigc::signal<void(const std::string&)> antiphish_signal_;
 
std::string Backend::checkUrl(const std::string& url) {
    if (!webprobe_) return url;
    std::string result = webprobe_->check_url(url);
 
    if (result != url) {
 
        antiphish_signal_.emit(url);
    }
 
    return result;
}
 
sigc::signal<void(const std::string&)>& Backend::signal_antiphish_event() {
    return antiphish_signal_;
}
 
 
 
 
void Backend::saveGoogleSafeConfig() {
    try {
        const char* home = getenv("HOME");
        if (!home) {
            std::cerr << "[Backend] ❌ " << _("Variabile HOME non trovata") << "\n";
            return;
        }
 
        std::string cfgDir = std::string(home) + "/.config/BastionGuard";
        std::string cfgPath = cfgDir + "/googlesafe.conf";
 
        std::filesystem::create_directories(cfgDir);
 
        std::ofstream fout(cfgPath, std::ios::trunc);
        if (!fout.is_open()) {
            std::cerr << "[Backend] ❌ " << _("Impossibile aprire il file di configurazione per scrittura: ")
                      << cfgPath << "\n";
            return;
        }
 
        fout << "# " << _("Configurazione Google Safe Browsing") << "\n";
        fout << "google_safe_enabled=" << (googleSafeEnabled_ ? "true" : "false") << "\n";
        fout << "google_safe_key=" << googleSafeApiKey_ << "\n";
        fout.close();
 
        std::cout << "[Backend] ✔ " << _("Configurazione Google Safe salvata in ") << cfgPath << "\n";
    } catch (const std::exception& ex) {
        std::cerr << "[Backend] ⚠ " << _("Errore durante il salvataggio della configurazione Google Safe: ")
                  << ex.what() << "\n";
    }
}
 
bool Backend::testGoogleSafeKey() {
    if (googleSafeApiKey_.empty()) {
        std::cerr << "[Backend] ❌ " << _("Nessuna chiave API Google Safe impostata") << "\n";
        return false;
    }
 
    CURL* curl = curl_easy_init();
    if (!curl) {
        std::cerr << "[Backend] ⚠ " << _("Impossibile inizializzare la libreria CURL") << "\n";
        return false;
    }
 
    std::string url = "https://safebrowsing.googleapis.com/v4/threatLists?key=" + googleSafeApiKey_;
    std::string response;
 
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L);
    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
    curl_easy_setopt(curl, CURLOPT_USERAGENT, "BastionGuard/1.0");
 
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,
        +[](void* contents, size_t size, size_t nmemb, void* userp) -> size_t {
            ((std::string*)userp)->append((char*)contents, size * nmemb);
            return size * nmemb;
        });
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response);
 
    CURLcode res = curl_easy_perform(curl);
 
    if (res != CURLE_OK) {
        std::cerr << "[Backend] ⚠ " << _("Errore nella richiesta HTTP a Google Safe: ")
                  << curl_easy_strerror(res) << "\n";
        curl_easy_cleanup(curl);
        return false;
    }
 
    curl_easy_cleanup(curl);
 
    if (response.find("threatType") != std::string::npos) {
        std::cout << "[Backend] ✔ " << _("Chiave Google Safe valida e attiva") << "\n";
        return true;
    } else {
        std::cerr << "[Backend] ❌ " << _("Chiave API non valida o risposta inattesa dal server") << "\n";
        return false;
    }
}
 
bool Backend::isPhishAutoUpdateEnabled() {
    int ret = (bg_process::run({"/usr/libexec/bastionguard/bastionguard-service", "--system", "is-enabled", "BastionGuard-phishing-updater.timer"}).exit_code);
    return (ret == 0);
}
 
bool Backend::enablePhishAutoUpdate(bool enable) {
    int ret = bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service",
        "--system", enable ? "enable" : "disable", "--now", "BastionGuard-phishing-updater.timer"}).exit_code;
 
    if (ret == 0) {
        if (enable) {
            std::cout << "✔ " << _("Timer aggiornamento phishing attivato correttamente.") << std::endl;
        } else {
            std::cout << "ℹ️ " << _("Timer aggiornamento phishing disattivato.") << std::endl;
        }
        return true;
    } else {
        if (enable) {
            std::cerr << "❌ " << _("Errore durante l’attivazione del timer di aggiornamento phishing!") << std::endl;
        } else {
            std::cerr << "⚠️ " << _("Errore durante la disattivazione del timer di aggiornamento phishing!") << std::endl;
        }
        return false;
    }
}
 
 
std::string Backend::getSambaConfigPath() const {
    const char* home = getenv("HOME");
    if (!home) return "/tmp/BastionGuard/samba.conf";
 
    std::string cfgDir = std::string(home) + "/.config/BastionGuard";
    std::filesystem::create_directories(cfgDir);
 
    return cfgDir + "/samba.conf";
}
 
std::vector<std::string> Backend::getSambaDirs()
{
    std::vector<std::string> out;
    std::ifstream f(getSambaConfigPath());
    if (!f.is_open()) return out;
 
    std::string line;
    while (std::getline(f, line))
    {
        line = trim(line);
        if (line.empty()) continue;
        if (line == "enabled=true" || line == "enabled=false") continue;
 
        out.push_back(line);
    }
    return out;
}
 
 
static bool is_writable_dir(const std::filesystem::path& dir)
{
    namespace fs = std::filesystem;
    std::error_code ec;
 
    if (!fs::exists(dir, ec) || !fs::is_directory(dir, ec))
        return false;
 
    // Prova a creare un file temporaneo (probe)
    auto probe = dir / ".bastionguard_write_test";
    {
        std::ofstream out(probe, std::ios::out | std::ios::trunc);
        if (!out.is_open())
            return false;
        out << "ok\n";
    }
    fs::remove(probe, ec);
    return true;
}
 
static std::filesystem::path make_temp_scan_dir()
{
    namespace fs = std::filesystem;
    std::error_code ec;
 
 
    fs::path candidates[] = {
        fs::temp_directory_path(),
        fs::path("/var/tmp")
    };
 
    auto ensure_dir_ok = [&](const fs::path& p) -> bool {
        ec.clear();
        if (!fs::exists(p, ec))
            return false;
        if (!fs::is_directory(p, ec))
            return false;
 
 
        return is_writable_dir(p);
    };
 
    fs::path base;
    for (const auto& c : candidates) {
        if (ensure_dir_ok(c)) {
            base = c;
            break;
        }
    }
    if (base.empty())
        return {};
 
    std::random_device rd;
    std::mt19937_64 gen(rd());
    std::uniform_int_distribution<unsigned long long> dis(1, ULLONG_MAX);
 
    for (int tries = 0; tries < 60; ++tries) {
        fs::path tmp = base / ("BastionGuard_samba_" + std::to_string(dis(gen)));
 
        ec.clear();
        if (!fs::create_directories(tmp, ec) || ec)
            continue;
 
 
        fs::permissions(tmp,
                        fs::perms::owner_all |
                        fs::perms::group_read | fs::perms::group_exec |
                        fs::perms::others_read | fs::perms::others_exec,
                        fs::perm_options::replace,
                        ec);
 
        if (ec) {
            fs::remove_all(tmp, ec);
            continue;
        }
 
        if (is_writable_dir(tmp))
            return tmp;
 
        fs::remove_all(tmp, ec);
    }
 
    return {};
}
 
 
 
 
SMBCCTX* Backend::createThreadSmbContext()
{
    SMBCCTX* ctx = smbc_new_context();
    if (!ctx) return nullptr;
 
    smbc_setOptionUseKerberos(ctx, false);
    smbc_setFunctionAuthDataWithContext(ctx, Backend::smb_auth_fn);
    smbc_setOptionUserData(ctx, this);
 
    if (!smbc_init_context(ctx)) {
        smbc_free_context(ctx, 1);
        return nullptr;
    }
 
    return ctx;
}
 
 
 
 
void Backend::smb_auth_fn(SMBCCTX* ctx,
                          const char* srv,
                          const char* shr,
                          char* wg, int wglen,
                          char* un, int unlen,
                          char* pw, int pwlen)
{
    std::string key = "smb://" + std::string(srv) + "/" + std::string(shr);
 
    auto creds = Backend::instance().getCreds(key);
 
    std::string user = creds.first;
    std::string pass = creds.second;
 
    if (user.empty()) user = "guest";
    if (pass.empty()) pass = "";
 
    strncpy(un, user.c_str(), unlen - 1);
    un[unlen - 1] = '\0';
 
    strncpy(pw, pass.c_str(), pwlen - 1);
    pw[pwlen - 1] = '\0';
 
    strncpy(wg, "WORKGROUP", wglen - 1);
    wg[wglen - 1] = '\0';
}
 
 
bool Backend::isValidSMB(const std::string& url)
{
 
    if (url.rfind("smb://", 0) != 0)
        return false;
 
 
    std::regex re(R"(smb:\/\/[^\/]+\/[^\/]+)");
    return std::regex_search(url, re);
}
 
void Backend::saveSMBCredentials(const std::string& url,
                                 const std::string& user,
                                 const std::string& pass)
{
 
    std::regex re(R"(smb:\/\/([^\/]+)\/([^\/]+))");
    std::smatch m;
 
    std::string key = url;
    if (std::regex_search(url, m, re)) {
        key = "smb://" + m[1].str() + "/" + m[2].str();
    }
 
    smb_credentials[key] = { user, pass };
 
 
    std::string path = getSambaCredsPath();
    std::ifstream fin(path);
 
    std::map<std::string,std::pair<std::string,std::string>> all;
 
    // Carica file esistente
    if (fin.is_open()) {
        std::string line;
        std::string cur;
 
        while (std::getline(fin, line)) {
            if (line.empty()) continue;
 
            if (line[0] == '[' && line.back() == ']') {
                cur = line.substr(1, line.size()-2);
                all[cur] = {"",""};
            }
            else if (line.find("user=") == 0) {
                all[cur].first = b64_decode(line.substr(5));
            }
            else if (line.find("pass=") == 0) {
                all[cur].second = decrypt_pass(line.substr(5));
            }
        }
    }
    fin.close();
 
 
    all[key] = { user, pass };
 
 
    std::ofstream fout(path, std::ios::trunc);
    if (!fout.is_open()) {
        std::cerr << _("❌ Impossibile scrivere credenziali SMB\n");
        return;
    }
 
    for (auto &kv : all) {
        fout << "[" << kv.first << "]\n";
        fout << "user=" << b64_encode(kv.second.first) << "\n";
        fout << "pass=" << encrypt_pass(kv.second.second) << "\n\n";
    }
 
    fout.close();
    std::cout << _("✔ Credenziali SMB salvate in modo sicuro (XOR + Base64)\n");
}
 
void Backend::loadSMBCredentials()
{
    smb_credentials.clear();
 
    std::string path = getSambaCredsPath();
    std::ifstream fin(path);
    if (!fin.is_open())
        return;
 
    std::string line, cur;
 
    while (std::getline(fin, line)) {
        if (line.empty()) continue;
 
        if (line[0] == '[' && line.back() == ']') {
            cur = line.substr(1, line.size()-2);
            smb_credentials[cur] = {"",""};
        }
        else if (line.find("user=") == 0) {
            smb_credentials[cur].first = b64_decode(line.substr(5));
        }
        else if (line.find("pass=") == 0) {
            smb_credentials[cur].second = b64_decode(line.substr(5));
        }
    }
 
    fin.close();
 
    std::cout << _("✔ Credenziali SMB caricate: ")
              << smb_credentials.size() << " share\n";
}
 
 
 
std::pair<std::string,std::string>
Backend::getCreds(const std::string& url)
{
    std::string path = getSambaCredsPath();
    std::ifstream f(path);
 
    if (!f.is_open())
        return {"",""};
 
    std::string line;
    std::string cur;
    bool found = false;
    std::string user, pass;
 
    while (std::getline(f, line)) {
        if (line.empty()) continue;
 
        if (line == "[" + url + "]") {
            found = true;
            continue;
        }
 
        if (found) {
            if (line.rfind("user=", 0) == 0)
                user = b64_decode(line.substr(5));
 
            else if (line.rfind("pass=", 0) == 0)
                pass = decrypt_pass(line.substr(5));
 
            if (!user.empty() && !pass.empty())
                return { user, pass };
        }
    }
 
    return {"",""};
}
 
 
std::string Backend::resolveSambaDir(const std::string& path)
{
 
    if (path.rfind("smb://", 0) == 0)
        return path;
 
 
    return path;
}
 
 
void Backend::smb_collect_files(SMBCCTX* ctx,
                                const std::string& url,
                                std::vector<std::string>& out)
{
    if (!ctx) {
        std::cerr << _("SMB ERROR: contesto SMB nullo\n");
        return;
    }
 
    smb_collect_files_impl(ctx, url, out);
}
 
 
 
 
void Backend::smb_collect_files_impl(
        SMBCCTX* ctx,
        const std::string& url,
        std::vector<std::string>& out)
{
    if (!ctx) {
        std::cerr << "SMB ERROR: ctx NULL in smb_collect_files_impl\n";
        return;
    }
 
 
    auto fn_opendir  = smbc_getFunctionOpendir(ctx);
    auto fn_readdir  = smbc_getFunctionReaddir(ctx);
    auto fn_closedir = smbc_getFunctionClosedir(ctx);
 
    if (!fn_opendir || !fn_readdir || !fn_closedir) {
        std::cerr << _("SMB ERROR: funzioni SMB mancanti (contesto non valido)\n");
        return;
    }
 
 
    SMBCFILE* dir = fn_opendir(ctx, url.c_str());
    if (!dir) {
        int err = errno;
        std::cerr << _("SMB ERROR: impossibile aprire ") << url
                  << " (errno=" << err << ")\n";
        return;
    }
 
    struct smbc_dirent* ent = nullptr;
 
 
    while ((ent = fn_readdir(ctx, dir)) != nullptr)
    {
        if (!ent) continue;
 
        const char* name = ent->name;
        if (!name || name[0] == '.') continue; // ignora . e ..
 
        std::string full = url;
        if (full.back() != '/')
            full += "/";
        full += name;
 
        switch (ent->smbc_type)
        {
            case SMBC_FILE:
                out.push_back(full);
                break;
 
            case SMBC_DIR:
                smb_collect_files_impl(ctx, full, out);
                break;
 
            default:
                break;
        }
    }
 
    fn_closedir(ctx, dir);
}
 
bool Backend::smb_read_file_with_ctx(
    SMBCCTX* ctx,
    const std::string& smbPath,
    std::function<bool(const char*, size_t)> onChunk)
{
    if (!ctx) {
        std::cerr << _("SMB ERROR: ctx nullo\n");
        return false;
    }
 
 
    auto fn_open  = smbc_getFunctionOpen   (ctx);
    auto fn_read  = smbc_getFunctionRead   (ctx);
    auto fn_close = smbc_getFunctionClose  (ctx);
 
    if (!fn_open || !fn_read || !fn_close)
    {
        std::cerr << _("SMB ERROR: funzioni SMB non disponibili\n");
        return false;
    }
 
 
    SMBCFILE* fd = fn_open(ctx, smbPath.c_str(), O_RDONLY, 0);
    if (!fd) {
        std::cerr << _("SMB ERROR: impossibile aprire file: ") << smbPath << "\n";
        return false;
    }
 
    char buffer[8192];
    ssize_t n = 0;
 
    while ((n = fn_read(ctx, fd, buffer, sizeof(buffer))) > 0)
    {
        if (!onChunk(buffer, (size_t)n))
        {
            std::cerr << _("SMB ERROR: callback fallita\n");
            fn_close(ctx, fd);
            return false;
        }
    }
 
    fn_close(ctx, fd);
    return true;
}
 
 
 
bool Backend::smb_copy_file(const std::string& smbPath,
                            const std::filesystem::path& dest)
{
    namespace fs = std::filesystem;
 
    SMBCCTX* ctx = createThreadSmbContext();
    if (!ctx) {
        std::cerr << _("SMB ERROR: impossibile creare contesto SMB\n");
        return false;
    }
 
    // Crea directory destinazione
    std::error_code ec;
    fs::create_directories(dest.parent_path(), ec);
    if (ec) {
        std::cerr << _("SMB ERROR: impossibile creare directory ")
                  << dest.parent_path().string()
                  << " (" << ec.message() << ")\n";
        smbc_free_context(ctx, 1);
        return false;
    }
 
    fs::permissions(dest.parent_path(),
                    fs::perms::owner_all |
                    fs::perms::group_read | fs::perms::group_exec |
                    fs::perms::others_read | fs::perms::others_exec,
                    fs::perm_options::add,
                    ec);
 
 
    std::ofstream out(dest, std::ios::binary | std::ios::trunc);
    if (!out.is_open()) {
        std::cerr << _("SMB ERROR: impossibile aprire file locale ")
                  << dest.string() << _(" per scrittura\n");
        smbc_free_context(ctx, 1);
        return false;
    }
 
    bool ok = smb_read_file_with_ctx(
        ctx,
        smbPath,
        [&](const char* data, size_t n) -> bool
        {
            out.write(data, static_cast<std::streamsize>(n));
            return out.good();
        }
    );
 
    out.flush();
    out.close();
 
    smbc_free_context(ctx, 1);
 
    if (!ok) {
        std::cerr << _("SMB ERROR: copia fallita per: ") << smbPath << "\n";
        std::error_code ec2;
        fs::remove(dest, ec2);
        return false;
    }
 
 
    fs::permissions(dest,
                    fs::perms::owner_read | fs::perms::owner_write |
                    fs::perms::group_read |
                    fs::perms::others_read,
                    fs::perm_options::replace,
                    ec);
 
    return true;
}
 
 
 
void Backend::initSambaClient()
{
 
}
 
 
 
void Backend::scanSambaDir(const std::string& dirInput)
{
    namespace fs = std::filesystem;
 
    samba_stop_requested = false;
    samba_scan_state = {};
    samba_scan_state.scan_active = true;
    samba_last_progress = 0.0f;
 
 
    std::string scanPath = trim(dirInput);
 
    // Mantieni copia originale SENZA "/" finale (serve per FOUND)
    std::string originalSmbRoot = scanPath;
    if (!originalSmbRoot.empty() && originalSmbRoot.back() == '/')
        originalSmbRoot.pop_back();
 
    // Aggiungi "/" finale per scansione interna
    if (scanPath.rfind("smb://", 0) == 0)
    {
        if (scanPath.back() != '/')
            scanPath += '/';
    }
 
    auto push_log = [&](const std::string& s)
    {
        samba_scan_state.log.push_back(s);
        if (samba_progress_callback)
            samba_progress_callback(s, samba_last_progress);
    };
 
    push_log(_("=== Scansione Samba: ") + scanPath + " ===");
 
    bool isSmb = scanPath.rfind("smb://", 0) == 0;
 
    std::vector<fs::path> files;
    std::vector<std::string> smbFiles;
 
    SMBCCTX* ctx = nullptr;
 
 
    if (isSmb)
    {
        push_log(_("Percorso SMB rilevato. Creo contesto SMB..."));
 
        ctx = createThreadSmbContext();
        if (!ctx)
        {
            push_log(_("ERRORE: impossibile creare contesto SMB."));
            samba_scan_state.scan_active = false;
            return;
        }
 
        smb_collect_files(ctx, scanPath, smbFiles);
 
        if (smbFiles.empty())
        {
            push_log(_("ERRORE: impossibile elencare la share SMB."));
            samba_scan_state.scan_active = false;
            return;
        }
 
        for (auto& f : smbFiles)
            files.push_back(f);
 
        push_log(_("File trovati via SMB: ") + std::to_string(files.size()));
    }
 
    else
    {
        if (!fs::exists(scanPath))
        {
            push_log(_("ERRORE: directory locale non trovata."));
            samba_scan_state.scan_active = false;
            return;
        }
 
        try
        {
            for (auto& e :
                 fs::recursive_directory_iterator(scanPath, fs::directory_options::skip_permission_denied))
            {
                if (e.is_regular_file())
                    files.push_back(e.path());
            }
        }
        catch (...)
        {
            push_log(_("ERRORE: impossibile scansionare la directory locale."));
        }
 
        if (files.empty())
        {
            push_log(_("Nessun file da scansionare."));
            samba_scan_state.scan_active = false;
            return;
        }
 
        push_log(_("File trovati localmente: ") + std::to_string(files.size()));
    }
 
 
 
    std::string clamdscanPath;
    const char* paths[] = {
        "/usr/bin/clamdscan",
        "/usr/local/bin/clamdscan",
        "/bin/clamdscan"
    };
    for (auto p : paths)
        if (fs::exists(p)) { clamdscanPath = p; break; }
 
    if (clamdscanPath.empty()) {
        push_log(_("ERRORE: clamdscan non trovato."));
        samba_scan_state.scan_active = false;
        return;
    }
 
 
    if ((bg_process::run({"pgrep", "-f", "clamd"}).exit_code) != 0 &&
        (bg_process::run({"pgrep", "-f", "clamav-daemon"}).exit_code) != 0)
    {
        push_log(_("ERRORE: il demone clamd non è attivo."));
        samba_scan_state.scan_active = false;
        return;
    }
 
    push_log(_("Demone ClamAV rilevato."));
 
 
    //-----------------------------------------------------------
    // Temp directory
    //-----------------------------------------------------------
    fs::path tempDir = make_temp_scan_dir();
 
    if (tempDir.empty()) {
        push_log(_("ERRORE: impossibile determinare una directory temporanea valida (path vuoto)."));
        samba_scan_state.scan_active = false;
        return;
    }
 
    std::error_code ec;
    if (!fs::exists(tempDir, ec) || ec) {
        push_log(_("ERRORE: directory temporanea non esistente o non accessibile: ") + tempDir.string());
        if (ec) push_log(std::string("std::filesystem error: ") + ec.message());
        samba_scan_state.scan_active = false;
        return;
    }
 
    if (!fs::is_directory(tempDir, ec) || ec) {
        push_log(_("ERRORE: path temporaneo non è una directory valida: ") + tempDir.string());
        if (ec) push_log(std::string("std::filesystem error: ") + ec.message());
        samba_scan_state.scan_active = false;
        return;
    }
 
    samba_last_temp_dir = tempDir.string();
    push_log("Temp dir: " + samba_last_temp_dir);
 
 
 
    //-----------------------------------------------------------
    // Copia file
    //-----------------------------------------------------------
    size_t total = files.size();
    size_t copied = 0;
 
    push_log(_("Trovati ") + std::to_string(total) + _(" file da copiare."));
 
    for (const auto& src : files)
    {
        if (samba_stop_requested) goto end_scan;
 
        fs::path dest;
 
        if (!isSmb)
        {
            fs::path rel = fs::relative(src, scanPath);
            dest = tempDir / rel;
 
            fs::create_directories(dest.parent_path());
 
            std::error_code ec;
            fs::copy_file(src, dest, fs::copy_options::overwrite_existing, ec);
            if (ec)
            {
                push_log(_("ERRORE copia locale: ") + rel.string());
                continue;
            }
        }
        else
        {
            std::string smbFile = src.string();
 
            std::string relative = smbFile.substr(scanPath.size());
            if (!relative.empty() && relative[0] == '/')
                relative.erase(0,1);
 
            dest = tempDir / relative;
            fs::create_directories(dest.parent_path());
 
            bool ok = smb_read_file_with_ctx(
                ctx,
                smbFile,
                [&](const char* data, size_t n)
                {
                    std::ofstream out(dest, std::ios::binary | std::ios::app);
                    if (!out.is_open()) return false;
                    out.write(data, n);
                    return true;
                }
            );
 
            if (!ok)
            {
                push_log(_("ERRORE lettura SMB: ") + smbFile);
                continue;
            }
        }
 
        samba_scan_state.current_file = src.string();
        copied++;
 
        samba_last_progress = float(copied) / float(total) * 0.30f;
        push_log(_("Copiato: ") + src.string());
    }
 
    if (samba_stop_requested)
        goto end_scan;
 
 
 
    {
        // Paths are supplied as distinct argv entries and cannot alter command syntax.
        push_log(_("Eseguo scansione ClamAV: ") + tempDir.string());
        size_t scanned = 0;
        auto scan = bg_process::run({clamdscanPath, "--fdpass", "--no-summary", "--multiscan",
                                    "--", tempDir.string()}, true, 32U * 1024U * 1024U, {},
                                   [&](const std::string& line) {
            if (samba_stop_requested) return false;
 
            push_log("ClamAV: " + line);
 
            std::string filename = line.substr(0, line.find(':'));
            samba_scan_state.current_file = filename;
 
            if (line.find("FOUND") != std::string::npos)
            {
                fs::path tmpFile = filename;
                fs::path rel = fs::relative(tmpFile, tempDir);
 
 
                std::string orig = originalSmbRoot + "/" + rel.string();
 
                samba_scan_state.infected++;
                push_log("INFETTO: " + orig);
 
                sendRansomwareAlert(orig, "Virus");
            }
 
            scanned++;
            samba_last_progress = 0.30f + 0.70f * (float(scanned) / float(total));
            return true;
        });
        if (!scan.started || scan.truncated) push_log(_("ERRORE: scansione ClamAV non completata."));
        std::this_thread::sleep_for(std::chrono::milliseconds(300));
    }
 
 
    end_scan:
 
    samba_scan_state.scan_active = false;
 
    push_log(_("=== Scansione completata ==="));
    push_log(_("File analizzati: ") + std::to_string(files.size()));
    push_log(_("File infetti: ") + std::to_string(samba_scan_state.infected));
 
    if (samba_progress_callback)
        samba_progress_callback(_("Scansione completata."), 1.0f);
 
    try { fs::remove_all(tempDir); } catch (...) {}
 
    samba_last_temp_dir.clear();
}
 
 
 
 
void Backend::resetSambaStop() {
    samba_stop_requested = false;
}
 
void Backend::requestStopSambaScan() {
    samba_stop_requested = true;
}
 
 
bool Backend::removeSambaDir(const std::string& dir) {
    auto dirs = getSambaDirs();
 
    auto it = std::remove(dirs.begin(), dirs.end(), dir);
    if (it == dirs.end()) {
        std::cerr << "⚠️ " << _("Directory Samba non trovata: ") << dir << "\n";
        return false;
    }
 
    dirs.erase(it, dirs.end());
 
 
    bool enabled = isSambaEnabled();
 
 
    std::ofstream f(getSambaConfigPath(), std::ios::trunc);
    if (!f.is_open()) {
        std::cerr << _("⚠️ Impossibile riscrivere la configurazione Samba\n");
        return false;
    }
 
    f << "enabled=" << (enabled ? "true" : "false") << "\n";
 
 
    for (const auto& d : dirs)
        f << d << "\n";
 
    std::cout << "✔ " << _("Rimossa directory Samba: ") << dir << "\n";
    return true;
}
 
void Backend::saveSambaConfig(bool enabled, const std::vector<std::string>& dirs)
{
    std::ofstream f(getSambaConfigPath(), std::ios::trunc);
    f << "enabled=" << (enabled ? "true" : "false") << "\n";
 
    for (auto& d : dirs)
        f << trim(d) << "\n";
}
 
 
 
 
void Backend::setupAlertListener()
{
    std::cout << _("🔧 Inizializzazione canale D-Bus per invio alert...") << std::endl;
 
    try {
        auto connection = Gio::DBus::Connection::get_sync(Gio::DBus::BusType::SESSION);
 
 
        auto result = connection->call_sync(
            "/org/freedesktop/DBus",
            "org.freedesktop.DBus",
            "NameHasOwner",
            Glib::VariantContainerBase::create_tuple({
                Glib::Variant<Glib::ustring>::create("org.BastionGuard.Ransomware.Alert")
            }),
            "org.freedesktop.DBus",
            -1,
            Gio::DBus::CallFlags::NONE,
            Glib::VariantType()
        );
 
        bool listener_attivo = false;
        if (result.gobj() != nullptr) {
            Glib::Variant<bool> active;
            result.get_child(active, 0);
            listener_attivo = active.get();
        }
 
        if (listener_attivo)
            std::cout << _("🟢 Servizio BastionGuard-ransomware-alert trovato su D-Bus.") << std::endl;
        else
            std::cerr << _("⚠️ Servizio BastionGuard-ransomware-alert non attivo. Gli avvisi non verranno mostrati.") << std::endl;
 
    } catch (const Glib::Error& ex) {
        std::cerr << _("❌ Errore inizializzazione D-Bus: ") << ex.what() << std::endl;
    }
}
 
void Backend::sendRansomwareAlert(const std::string& path, const std::string& family)
{
    try {
        auto conn = Gio::DBus::Connection::get_sync(Gio::DBus::BusType::SESSION);
 
 
        auto args = Glib::VariantContainerBase::create_tuple({
            Glib::Variant<Glib::ustring>::create("org.BastionGuard.Ransomware.Alert")
        });
 
        bool nameHasOwner = false;
        try {
            auto reply = conn->call_sync(
                "/org/freedesktop/DBus",
                "org.freedesktop.DBus",
                "NameHasOwner",
                args,
                "org.freedesktop.DBus"
            );
 
            Glib::Variant<bool> result;
            reply.get_child(result, 0);
            nameHasOwner = result.get();
        } catch (const Glib::Error& ex) {
            std::cerr << _("⚠️ Impossibile verificare il listener D-Bus: ")
                      << ex.what() << std::endl;
        }
 
        if (!nameHasOwner) {
            std::cerr << _("⚠️ Listener org.BastionGuard.Ransomware.Alert non attivo — nessun popup verrà mostrato.") << std::endl;
            return;
        }
 
 
        auto parameters = Glib::VariantContainerBase::create_tuple({
            Glib::Variant<Glib::ustring>::create(path),
            Glib::Variant<Glib::ustring>::create(family)
        });
 
 
        conn->call_sync(
            "/org/BastionGuard/ransomware/alert",
            "org.BastionGuard.Ransomware.Alert",
            "ShowAlert",
            parameters,
            "org.BastionGuard.Ransomware.Alert",
            -1,
            Gio::DBus::CallFlags::NONE,
            Glib::VariantType()
        );
 
        std::cout << Glib::ustring::compose(
            _("📢 Alert ransomware inviato via D-Bus:\n - File: %1\n - Famiglia: %2"),
            path, family
        ) << std::endl;
    }
    catch (const Glib::Error& ex) {
        std::cerr << _("❌ Errore nell'invio alert D-Bus: ") << ex.what() << std::endl;
    }
}
 
 
 
 
void Backend::moveToQuarantine(const std::string& path) {
    // Tutte le richieste passano dalla stessa implementazione validata.
    // Quarantine::move() accetta esclusivamente file regolari e rifiuta
    // directory, symlink e altri oggetti del filesystem.
    const bool moved = Quarantine::move(path);
 
    Glib::signal_idle().connect_once([path, moved]() {
        if (moved) {
            Utils::show_message(
                nullptr,
                _("File spostato in quarantena con successo:\n") + path,
                Gtk::MessageType::INFO);
        } else {
            Utils::show_message(
                nullptr,
                _("Impossibile spostare l'elemento in quarantena. "
                  "Sono accettati esclusivamente file regolari:\n") + path,
                Gtk::MessageType::ERROR);
        }
    });
}
 
 
void Backend::ensureQuarantinePath() {
    try {
        std::string quarantineDir = Backend::getQuarantinePath();
 
        if (quarantineDir.empty()) {
            quarantineDir = "/var/lib/clamav/quarantine";
        }
 
        std::filesystem::path qPath(quarantineDir);
 
        if (!std::filesystem::exists(qPath)) {
            std::filesystem::create_directories(qPath);
            std::cout << _("📁 Creata directory di quarantena: ") << qPath << "\n";
        }
 
 
        std::filesystem::permissions(qPath,
            std::filesystem::perms::owner_all |
            std::filesystem::perms::group_read |
            std::filesystem::perms::group_write,
            std::filesystem::perm_options::replace
        );
    } catch (const std::exception& ex) {
        std::cerr << _("❌ Errore in ensureQuarantinePath(): ") << ex.what() << "\n";
    }
}
 
 
void Backend::scanAllSambaDirs()
{
    samba_stop_requested = false;
 
    auto dirs = getSambaDirs();
    if (dirs.empty()) {
        if (samba_progress_callback)
            samba_progress_callback("Nessuna directory Samba configurata.", 1.0f);
        return;
    }
 
    for (const auto& dir : dirs)
    {
        if (samba_stop_requested)
            break;
 
        scanSambaDir(dir);
    }
 
    if (samba_progress_callback)
        samba_progress_callback("Tutte le scansioni completate.", 1.0f);
}
 
 
 
 
static size_t write_cb(void* c, size_t s, size_t n, std::string* o) {
    o->append((char*)c, s * n);
    return s * n;
}
 
 
bool Backend::updateBankListFromURL(const std::string& url) {
    if (url.rfind("https://", 0) != 0) {
        std::cerr << _("[Backend] ❌ La lista banche deve essere scaricata via HTTPS.\n");
        return false;
    }
 
    std::string dir  = Glib::get_home_dir() + "/.local/share/BastionGuard";
    std::string path = dir + "/banks.json";
    std::string tmp_path = path + ".download";
    std::filesystem::create_directories(dir);
    std::error_code cleanup_ec;
    std::filesystem::remove(tmp_path, cleanup_ec);
 
    CURL* curl = curl_easy_init();
    if (!curl) {
        std::cerr << _("[Backend] ❌ Errore: init cURL\n");
        return false;
    }
 
    std::ofstream outfile(tmp_path, std::ios::binary | std::ios::trunc);
    if (!outfile.is_open()) {
        std::cerr << _("[Backend] ❌ Errore apertura file temporaneo ") << tmp_path << "\n";
        curl_easy_cleanup(curl);
        return false;
    }
 
    std::cout << _("[Backend] 🌍 Download da URL: ") << url << std::endl;
 
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
    curl_easy_setopt(curl, CURLOPT_USERAGENT, "BastionGuard/1.0");
    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L);
    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 25L);
    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L);
    curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTPS);
 
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, &outfile);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,
        +[](void* ptr, size_t size, size_t nmemb, void* stream) -> size_t {
            std::ofstream* out = static_cast<std::ofstream*>(stream);
            out->write(static_cast<const char*>(ptr), size * nmemb);
            return size * nmemb;
        });
 
    CURLcode res = curl_easy_perform(curl);
    long response_code = 0;
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
    outfile.flush();
    outfile.close();
    curl_easy_cleanup(curl);
 
    std::cout << _("[Backend] Risultato cURL: ") << res << " (" << curl_easy_strerror(res) << "), HTTP " << response_code << "\n";
 
    if (res != CURLE_OK || response_code != 200) {
        std::cerr << _("[Backend] ❌ Errore rete o HTTP (") << curl_easy_strerror(res) << ")\n";
        std::error_code ec; std::filesystem::remove(tmp_path, ec);
        return false;
    }
 
    if (!std::filesystem::exists(tmp_path) || std::filesystem::file_size(tmp_path) < 50) {
        std::cerr << _("[Backend] ⚠ banks.json scaricato ma vuoto.\n");
        std::error_code ec; std::filesystem::remove(tmp_path, ec);
        return false;
    }
 
    // Validate the trust-list structure before replacing the last known-good copy.
    try {
        std::ifstream check(tmp_path);
        nlohmann::json j;
        check >> j;
        if (!j.is_object() || !j.contains("list") || !j["list"].is_array() || j["list"].empty()) {
            std::cerr << _("[Backend] ❌ banks.json non ha una struttura valida.\n");
            std::error_code ec; std::filesystem::remove(tmp_path, ec);
            return false;
        }
        for (const auto& item : j["list"]) {
            if (item.is_string()) continue;
            if (item.is_object() && item.contains("value") && item["value"].is_string()) continue;
            std::cerr << _("[Backend] ❌ banks.json contiene una voce non valida.\n");
            std::error_code ec; std::filesystem::remove(tmp_path, ec);
            return false;
        }
    } catch (...) {
        std::cerr << _("[Backend] ❌ banks.json non è JSON valido.\n");
        std::error_code ec; std::filesystem::remove(tmp_path, ec);
        return false;
    }
 
    std::error_code replace_ec;
    std::filesystem::rename(tmp_path, path, replace_ec);
    if (replace_ec) {
        std::cerr << _("[Backend] ❌ Impossibile sostituire banks.json: ") << replace_ec.message() << "\n";
        std::filesystem::remove(tmp_path, cleanup_ec);
        return false;
    }
 
    std::cout << _("[Backend] ✅ Lista banche aggiornata (") << std::filesystem::file_size(path) << " bytes)\n";
    return true;
}
 
 
using json = nlohmann::json;
std::vector<std::string> Backend::getWhitelist() const {
    return whitelist_;
}
 
void Backend::addToWhitelist(const std::string& domain) {
    if (domain.empty()) return;
    // evita duplicati
    if (std::find(whitelist_.begin(), whitelist_.end(), domain) == whitelist_.end()) {
        whitelist_.push_back(domain);
        saveWhitelist();
    }
}
 
void Backend::removeFromWhitelist(const std::string& domain) {
    whitelist_.erase(
        std::remove(whitelist_.begin(), whitelist_.end(), domain),
        whitelist_.end()
    );
    saveWhitelist();
}
 
void Backend::saveWhitelist() const {
    try {
        std::filesystem::create_directories(Glib::get_home_dir() + "/.config/BastionGuard");
        std::ofstream f(Glib::get_home_dir() + "/.config/BastionGuard/whitelist.json", std::ios::trunc);
        json j(whitelist_);
        f << j.dump(2);
        f.close();
        std::cout << _("✔ Whitelist salvata (") << whitelist_.size() << " voci)\n";
    } catch (const std::exception& e) {
        std::cerr << _("❌ Errore salvataggio whitelist: ") << e.what() << std::endl;
    }
}
 
void Backend::loadWhitelist() {
    whitelist_.clear();
    std::string path = Glib::get_home_dir() + "/.config/BastionGuard/whitelist.json";
    if (!std::filesystem::exists(path)) return;
 
    try {
        std::ifstream f(path);
        json j;
        f >> j;
        if (j.is_array()) {
            for (auto& item : j)
                whitelist_.push_back(item.get<std::string>());
        }
        std::cout << _("✔ Whitelist caricata (") << whitelist_.size() << " voci)\n";
    } catch (const std::exception& e) {
        std::cerr << _("⚠ Errore caricamento whitelist: ") << e.what() << std::endl;
    }
}
 
bool Backend::isBankDomain(const std::string& host) const {
    return std::find(whitelist_.begin(), whitelist_.end(), host) != whitelist_.end();
}
 
bool Backend::reload_dnsmasq() {
    int ret = (bg_process::run({"pkexec", "/usr/libexec/bastionguard/bastionguard-service", "--system", "reload", "dnsmasq.service"}).exit_code);
    if (ret == 0) {
        std::cout << _("✔ dnsmasq ricaricato correttamente.\n");
        return true;
    } else {
        std::cerr << _("⚠️ Errore nel reload di dnsmasq.\n");
        return false;
    }
}
 
void Backend::setPhishingPort(int port) {
    std::cout << _("[Backend] setPhishingPort(") << port << _(") — funzione non più usata.") << std::endl;
}
 
int Backend::getPhishingPort() const {
    return 5353;
}
 
Backend::ScanStatus Backend::get_current_scan_files()
{
    ScanStatus st;
 
    st.scan_active      = samba_scan_state.scan_active;
    st.current_scanning = samba_scan_state.current_file;
    st.files            = samba_scan_state.log;
    st.progress         = samba_last_progress;
    st.infected         = samba_scan_state.infected;
    st.temp_dir         = samba_last_temp_dir;
    return st;
}
 
 
 
 
namespace {
 
bool create_secure_firewall_input(
    const std::vector<std::string>& blacklistLines,
    std::string& outPath
) {
    std::string pathTemplate = "/tmp/bastionguard-firewall-ips-XXXXXX";
    std::vector<char> pathBuffer(pathTemplate.begin(), pathTemplate.end());
    pathBuffer.push_back('\0');
 
    const int fd = ::mkstemp(pathBuffer.data());
    if (fd < 0) {
        std::cerr << _("[Firewall] Impossibile creare il file temporaneo sicuro\n");
        return false;
    }
 
    outPath.assign(pathBuffer.data());
 
    if (::fchmod(fd, S_IRUSR | S_IWUSR) != 0) {
        ::close(fd);
        ::unlink(outPath.c_str());
        outPath.clear();
        std::cerr << _("[Firewall] Impossibile proteggere il file temporaneo\n");
        return false;
    }
 
    ::close(fd);
 
    if (!BlacklistIpExtractor::extractAndWrite(blacklistLines, outPath)) {
        ::unlink(outPath.c_str());
        outPath.clear();
        return false;
    }
 
    // extractAndWrite() riapre il file: imponiamo nuovamente 0600 e
    // verifichiamo che il pathname indichi ancora un singolo file regolare
    // appartenente all'utente che ha avviato BastionGuard.
    if (::chmod(outPath.c_str(), S_IRUSR | S_IWUSR) != 0) {
        ::unlink(outPath.c_str());
        outPath.clear();
        std::cerr << _("[Firewall] Impossibile impostare i permessi del file temporaneo\n");
        return false;
    }
 
    struct stat st {};
    if (::lstat(outPath.c_str(), &st) != 0 ||
        !S_ISREG(st.st_mode) ||
        st.st_uid != ::getuid() ||
        st.st_nlink != 1 ||
        (st.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
        ::unlink(outPath.c_str());
        outPath.clear();
        std::cerr << _("[Firewall] File temporaneo non sicuro\n");
        return false;
    }
 
    return true;
}
 
int run_firewall_helper(const std::string& inputPath) {
    const pid_t pid = ::fork();
    if (pid < 0)
        return -1;
 
    if (pid == 0) {
        ::execl(
            "/usr/bin/pkexec",
            "pkexec",
            "/usr/bin/bastionguard-firewall",
            "apply",
            inputPath.c_str(),
            static_cast<char*>(nullptr)
        );
        _exit(127);
    }
 
    int status = 0;
    while (::waitpid(pid, &status, 0) < 0) {
        if (errno == EINTR)
            continue;
        return -1;
    }
 
    if (!WIFEXITED(status))
        return -1;
 
    return WEXITSTATUS(status);
}
 
} // namespace
 
void Backend::applyFirewallFromBlacklist(
    const std::vector<std::string>& blacklistLines
) {
    if (!firewallEnabled_ || firewallType_ == FirewallType::NONE)
        return;
 
    std::string outPath;
    if (!create_secure_firewall_input(blacklistLines, outPath)) {
        std::cout << _("[Firewall] Nessun IP valido estratto\n");
        return;
    }
 
    scheduleFirewallApply(outPath);
}
 
 
 
 
 
 
void Backend::setFirewallType(FirewallType fw) {
    firewallType_ = fw;
 
    if (fw != FirewallType::NONE)
        firewallEnabled_ = true;
 
    saveFirewallConfig();
}
 
 
FirewallType Backend::getFirewallType() const {
    return firewallType_;
}
 
void Backend::setFirewallEnabled(bool enabled) {
    firewallEnabled_ = enabled;
    saveFirewallConfig();
}
 
bool Backend::isFirewallEnabled() const {
    return firewallEnabled_;
}
 
void Backend::loadFirewallConfig() {
    const char* home = std::getenv("HOME");
    if (!home) return;
 
    std::ifstream fin(std::string(home) + "/.config/BastionGuard/firewall.conf");
    if (!fin) return;
 
    std::string line;
    while (std::getline(fin, line)) {
        if (line == "firewall_enabled=true")
            firewallEnabled_ = true;
        else if (line == "firewall_enabled=false")
            firewallEnabled_ = false;
        else if (line == "firewall_type=firewalld")
            firewallType_ = FirewallType::FIREWALLD;
        else if (line == "firewall_type=ufw")
            firewallType_ = FirewallType::UFW;
    }
}
 
void Backend::saveFirewallConfig() const {
    const char* home = std::getenv("HOME");
    if (!home) return;
 
    std::ofstream fout;
    fout.open(std::string(home) + "/.config/BastionGuard/firewall.conf");
 
    fout << "firewall_enabled=" << (firewallEnabled_ ? "true" : "false") << "\n";
 
    switch (firewallType_) {
        case FirewallType::FIREWALLD:
            fout << "firewall_type=firewalld\n"; break;
        case FirewallType::UFW:
            fout << "firewall_type=ufw\n"; break;
        default:
            break;
    }
}
 
void Backend::applyFirewallFromPhishingBlacklist()
{
    if (!firewallEnabled_ || firewallType_ == FirewallType::NONE)
        return;
 
    const std::string blacklistPath =
        "/usr/share/BastionGuard/data/phishing/blacklist.txt";
 
    std::ifstream fin(blacklistPath);
    if (!fin) {
        std::cerr << _("[Firewall] Impossibile aprire blacklist\n");
        return;
    }
 
    std::vector<std::string> lines;
    std::string line;
    while (std::getline(fin, line))
        lines.push_back(line);
 
    fin.close();
 
 
    std::string outPath;
    if (!create_secure_firewall_input(lines, outPath)) {
        std::cout << _("[Firewall] Nessun IP valido trovato\n");
        return;
    }
 
    scheduleFirewallApply(outPath);
}
 
 
 
void Backend::scheduleFirewallApply(const std::string& inputPath) {
    static std::atomic<bool> pending{false};
 
    if (pending.exchange(true)) {
        ::unlink(inputPath.c_str());
        return;
    }
 
    std::thread([inputPath] {
        std::this_thread::sleep_for(std::chrono::seconds(2));
 
        const int exitCode = run_firewall_helper(inputPath);
        if (exitCode != 0) {
            std::cerr << _("[Firewall] Applicazione helper fallita, codice: ")
                      << exitCode << "\n";
            ::unlink(inputPath.c_str());
        }
 
        pending.store(false);
    }).detach();
}
 
 
 
 
 
Backend::~Backend() = default;