dns_secure.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
// =============================================================================
//  dns_secure.cpp
//
//  Implementazione di reexec_inside_bwrap_with_custom_dns().
//  Questa unit è linkata sia da:
//     - BastionGuard-secure       (CLI - apre l'URL banca/payment)
//     - BastionGuard-secure-gui   (selettore grafico)
//  così che entrambi possano richiamare la stessa funzione di sandboxing.
//
//  Definendola qui (anziché in BastionGuard-secure-cli.cpp) si evita di
//  forzare i due target a condividere il main() del CLI.
// =============================================================================
 
#include "../SafeProcess.hpp"
#include "dns_secure.hpp"
 
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
 
#include <cstdlib>
#include <cstring>
#include <cstdio>
#include <iostream>
#include <fstream>
#include <vector>
#include <string>
 
#include <glib/gi18n.h>
 
 
// -----------------------------------------------------------------------------
//  write_resolv_conf
//
//  Scrive un /tmp/bastionguard-resolv.conf da bind-mountare dentro la sandbox
//  al posto del resolv.conf di sistema. Bypass del dnsmasq locale che
//  potrebbe interferire con il MITM CEF o con risoluzioni inattese.
// -----------------------------------------------------------------------------
static void write_resolv_conf(const std::string& path) {
    std::ofstream o(path, std::ios::trunc);
    if (!o) {
        std::perror("[BastionGuard-secure] write resolv.conf");
        return;
    }
    o << "nameserver 1.1.1.1\n";
    o << "nameserver 9.9.9.9\n";
    o << "nameserver 8.8.8.8\n";
    o << "options timeout:2 attempts:3 rotate\n";
    o.close();
}
 
 
// =============================================================================
//  Helper privati
// =============================================================================
namespace {
 
// Builder argv-style per bwrap che possiede le stringhe (niente const_cast su
// literal/temporanei): il vector di puntatori punta a strings stabili dentro
// 'store'. Importante: chiamare to_argv() solo DOPO aver finito di add().
struct BwrapArgs {
    std::vector<std::string> store;
    void add(const std::string& s) { store.push_back(s); }
 
    std::vector<char*> to_argv() {
        std::vector<char*> out;
        out.reserve(store.size() + 1);
        for (auto& s : store)
            out.push_back(s.data());
        out.push_back(nullptr);
        return out;
    }
};
 
// Un path è "pulito" abbastanza per essere passato a bwrap?
static bool path_safe(const char* p) {
    if (!p || !*p)            return false;
    if (p[0] != '/')          return false;
    if (std::strchr(p, '\n')) return false;
    if (std::strchr(p, '\r')) return false;
    return true;
}
 
static bool path_exists(const std::string& p) {
    struct stat st{};
    return ::stat(p.c_str(), &st) == 0;
}
 
} // namespace
 
 
// =============================================================================
//  reexec_inside_bwrap_with_custom_dns
//
//  Riesegue il processo corrente dentro un sandbox bubblewrap con:
//    - rootfs in read-only;
//    - /tmp tmpfs (privato, non vede nulla del /tmp dell'host);
//    - resolv.conf custom (bypass dnsmasq locale, force DoH-friendly DNS);
//    - bind del socket Wayland se sessione Wayland (passa via XDG_RUNTIME_DIR);
//    - bind del socket X11 (/tmp/.X11-unix), $XAUTHORITY e DISPLAY se X11;
//    - bind di ~/.cache/BastionGuard/cef_sandbox (cache CEF persistente);
//    - bind di ~/.config/BastionGuard (impostazioni: lettura).
//
//  Funziona sia in sessione Wayland che X11, sia in sessione ibrida
//  (XWayland). Se bwrap non è disponibile la funzione ritorna senza
//  fare nulla (best effort).
// =============================================================================
void reexec_inside_bwrap_with_custom_dns(int argc, char** argv) {
    if (std::getenv("BASTIONGUARD_IN_BWRAP")) return;
    if ((bg_process::exists_on_path("bwrap") ? 0 : 1) != 0) return;
 
    const std::string resolv = "/tmp/bastionguard-resolv.conf";
    write_resolv_conf(resolv);
 
    const char* home = std::getenv("HOME");
    if (!home || !*home) {
        std::cerr << _("[BastionGuard-secure] HOME non impostata.\n");
        return;
    }
 
    const std::string host_cache  = std::string(home) + "/.cache/BastionGuard/cef_sandbox";
    const std::string host_config = std::string(home) + "/.config/BastionGuard";
 
    // Assicurati che la cache esista (bwrap --bind richiede sorgente esistente).
    {
        ::mkdir((std::string(home) + "/.cache").c_str(), 0700);
        ::mkdir((std::string(home) + "/.cache/BastionGuard").c_str(), 0700);
        ::mkdir(host_cache.c_str(), 0700);
    }
 
    const char* xdg_rt   = std::getenv("XDG_RUNTIME_DIR");
    const char* wl_disp  = std::getenv("WAYLAND_DISPLAY");
    const char* x_disp   = std::getenv("DISPLAY");
    const char* xauth    = std::getenv("XAUTHORITY");
 
    const bool have_wayland = wl_disp && *wl_disp && xdg_rt && *xdg_rt;
    const bool have_x11     = x_disp  && *x_disp;
 
    BwrapArgs a;
    a.add("bwrap");
    a.add("--new-session");
    a.add("--die-with-parent");
 
    // Hostname dedicato dentro la sandbox
    a.add("--unshare-uts");
    a.add("--hostname"); a.add("BastionGuard-secure");
 
    // Root FS in RO
    a.add("--ro-bind"); a.add("/"); a.add("/");
 
    // /dev e /proc minimali
    a.add("--dev");  a.add("/dev");
    a.add("--proc"); a.add("/proc");
 
    // /tmp privato + bind del file resolv.conf custom
    a.add("--tmpfs"); a.add("/tmp");
    a.add("--ro-bind"); a.add(resolv); a.add("/etc/resolv.conf");
 
    // Cache CEF (rw)
    if (path_safe(host_cache.c_str())) {
        a.add("--bind"); a.add(host_cache); a.add(host_cache);
    }
 
    // Config BastionGuard (ro: legge whitelist, payments, ecc.)
    if (path_safe(host_config.c_str()) && path_exists(host_config)) {
        a.add("--ro-bind"); a.add(host_config); a.add(host_config);
    }
 
    // ---------------------------------------------------------------------
    //  Backend Wayland: serve XDG_RUNTIME_DIR (contiene il socket wayland-*)
    // ---------------------------------------------------------------------
    if (have_wayland) {
        if (path_safe(xdg_rt))
            a.add("--bind"), a.add(xdg_rt), a.add(xdg_rt);
        a.add("--setenv"); a.add("WAYLAND_DISPLAY"); a.add(wl_disp);
        std::cout << _("[BastionGuard-secure] bwrap: Wayland abilitato (")
                  << wl_disp << ")\n";
    } else if (xdg_rt && *xdg_rt && path_safe(xdg_rt)) {
        // Anche senza Wayland conviene avere XDG_RUNTIME_DIR (PulseAudio,
        // PipeWire, dbus user) — ma non strettamente necessario.
        a.add("--bind"); a.add(xdg_rt); a.add(xdg_rt);
    }
 
    // ---------------------------------------------------------------------
    //  Backend X11: /tmp/.X11-unix, $DISPLAY, $XAUTHORITY (cookie MIT-MAGIC)
    //  /tmp è già una tmpfs nuova qui dentro, quindi va re-bindata.
    // ---------------------------------------------------------------------
    if (have_x11) {
        if (path_exists("/tmp/.X11-unix")) {
            a.add("--ro-bind"); a.add("/tmp/.X11-unix"); a.add("/tmp/.X11-unix");
        }
 
        std::string xauth_path;
        if (xauth && *xauth && path_safe(xauth) && path_exists(xauth)) {
            xauth_path = xauth;
        } else {
            const std::string default_xauth = std::string(home) + "/.Xauthority";
            if (path_exists(default_xauth)) xauth_path = default_xauth;
        }
        if (!xauth_path.empty()) {
            a.add("--ro-bind"); a.add(xauth_path); a.add(xauth_path);
            a.add("--setenv"); a.add("XAUTHORITY"); a.add(xauth_path);
        }
 
        a.add("--setenv"); a.add("DISPLAY"); a.add(x_disp);
        std::cout << _("[BastionGuard-secure] bwrap: X11 abilitato (DISPLAY=")
                  << x_disp << ")\n";
    }
 
    if (!have_wayland && !have_x11) {
        std::cerr << _("[BastionGuard-secure] ⚠ Nessun display Wayland/X11 rilevato; "
                       "il browser non riuscirà ad aprirsi.\n");
    }
 
    // Evita re-entry
    a.add("--setenv"); a.add("BASTIONGUARD_IN_BWRAP"); a.add("1");
 
    // Pass-through di un eventuale forced backend (utile per debug)
    if (const char* fb = std::getenv("BastionGuard_CEF_BACKEND")) {
        a.add("--setenv"); a.add("BastionGuard_CEF_BACKEND"); a.add(fb);
    }
 
    // Programma originale + suoi argv
    if (argc < 1 || !argv[0]) {
        std::cerr << _("[BastionGuard-secure] argv[0] mancante, abort bwrap.\n");
        return;
    }
    a.add(argv[0]);
    for (int i = 1; i < argc; ++i) {
        if (argv[i]) a.add(argv[i]);
    }
 
    auto cargv = a.to_argv();
    execvp("bwrap", cargv.data());
    std::perror("execvp(bwrap)");
}