UIClient.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ Secure Connection
 * Copyright (C) 2025–2026 Calogero Scarnà
 * GPL-3.0
 */
 
#include "bsc/ui/UIClient.hpp"
#include "bsc/logging/Logger.hpp"
#include "bsc/proto/Wire.hpp"
 
#include <nlohmann/json.hpp>
 
#include <atomic>
#include <chrono>
#include <condition_variable>
#include <cstring>
#include <deque>
#include <errno.h>
#include <mutex>
#include <poll.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <thread>
#include <unistd.h>
#include <unordered_map>
 
namespace bsc::ui {
 
using json = nlohmann::json;
 
namespace {
 
// Serializza una Connection su un oggetto JSON.
void connection_to_json(const bsc::model::Connection& c, json& j) {
    j["protocol"]     = c.protocol;
    j["src_ip"]       = c.src_ip;
    j["src_port"]     = c.src_port;
    j["dst_ip"]       = c.dst_ip;
    j["dst_host"]     = c.dst_host;
    j["dst_port"]     = c.dst_port;
    j["user_id"]      = c.user_id;
    j["process_id"]   = c.process_id;
    j["process_path"] = c.process_path;
    j["process_comm"] = c.process_comm;
    j["process_cwd"]  = c.process_cwd;
    j["process_args"] = c.process_args;
    j["process_env"]  = c.process_env;
    j["process_checksums"] = c.process_checksums;
    json tree = json::array();
    for (const auto& [name, pid] : c.process_tree) {
        tree.push_back({{"name", name}, {"pid", pid}});
    }
    j["process_tree"] = std::move(tree);
}
 
// Helper di conversione del tipo operatore (serve solo per logging/rule).
bsc::rule::OperatorType op_type_from_string(const std::string& s) {
    if (s == "simple")  return bsc::rule::OperatorType::Simple;
    if (s == "regexp")  return bsc::rule::OperatorType::Regexp;
    if (s == "network") return bsc::rule::OperatorType::Network;
    if (s == "range")   return bsc::rule::OperatorType::Range;
    if (s == "list")    return bsc::rule::OperatorType::List;
    if (s == "lists")   return bsc::rule::OperatorType::Lists;
    return bsc::rule::OperatorType::Unknown;
}
 
bsc::rule::Operator operator_from_json(const json& j) {
    bsc::rule::Operator op;
    op.type    = op_type_from_string(j.value("type", std::string{"simple"}));
    op.operand = j.value("operand", std::string{});
    op.data    = j.value("data", std::string{});
    op.sensitive = j.value("sensitive", false);
    if (j.contains("list") && j["list"].is_array()) {
        for (const auto& item : j["list"]) op.list.push_back(operator_from_json(item));
    }
    return op;
}
 
bsc::rule::Rule rule_from_json(const json& j) {
    bsc::rule::Rule r;
    r.created     = j.value("created", std::int64_t{0});
    r.name        = j.value("name", std::string{});
    r.description = j.value("description", std::string{});
    r.enabled     = j.value("enabled", true);
    r.precedence  = j.value("precedence", false);
    r.nolog       = j.value("nolog", false);
    r.action      = j.value("action", std::string{"allow"});
    r.duration    = j.value("duration", std::string{"once"});
    if (j.contains("operator") && j["operator"].is_object()) {
        r.op = operator_from_json(j["operator"]);
    }
    return r;
}
 
} // namespace
 
class UIClient::Impl {
public:
    explicit Impl(std::string uri)
        : socket_path_(bsc::proto::resolve_socket_path(std::move(uri))) {}
 
    ~Impl() { stop(); }
 
    std::string socket_path_;
 
    // Stato connessione
    std::atomic_bool   running_{false};
    std::atomic_int    fd_{-1};               // -1 se disconnesso
    std::atomic_bool   handshake_done_{false};
    std::thread        reader_thread_;
 
    // Scrittore serializzato
    std::mutex write_mutex_;
 
    // ID auto-incrementale per i messaggi
    std::atomic_uint64_t next_id_{1};
 
    // Risposte pending a ask_rule (id -> promise-like)
    struct PendingAsk {
        std::mutex              mu;
        std::condition_variable cv;
        bool                    ready{false};
        json                    reply;
    };
    std::mutex pending_mutex_;
    std::unordered_map<std::uint64_t, std::shared_ptr<PendingAsk>> pending_asks_;
 
    // Handler notifications
    std::mutex handler_mutex_;
    std::function<void(const NotificationEvent&)> notif_handler_;
 
    // Coda alert da rispedire alla riconnessione
    std::mutex alerts_mutex_;
    std::deque<std::string> queued_alerts_;  // JSON-encoded frame payloads
 
    // ── Lifecycle ──────────────────────────────────────────────────────
 
    void start() {
        if (running_.exchange(true)) return;
        reader_thread_ = std::thread([this]() { reconnect_loop(); });
    }
 
    void stop() {
        running_ = false;
        int fd = fd_.exchange(-1);
        if (fd >= 0) {
            ::shutdown(fd, SHUT_RDWR);
            ::close(fd);
        }
        // Sblocca qualunque ask_rule bloccato
        {
            std::lock_guard<std::mutex> lk(pending_mutex_);
            for (auto& [id, p] : pending_asks_) {
                std::lock_guard<std::mutex> l2(p->mu);
                p->ready = true;
                p->reply = json::object();   // risposta vuota = timeout
                p->cv.notify_all();
            }
            pending_asks_.clear();
        }
        if (reader_thread_.joinable()) reader_thread_.join();
    }
 
    bool is_connected() const noexcept {
        return fd_.load() >= 0 && handshake_done_.load();
    }
 
    // ── Connessione ────────────────────────────────────────────────────
 
    // Prova una sola connessione al socket Unix. Ritorna fd >=0 se ok.
    int connect_once() const {
        int fd = ::socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
        if (fd < 0) return -1;
        sockaddr_un addr{};
        addr.sun_family = AF_UNIX;
        if (socket_path_.size() >= sizeof(addr.sun_path)) { ::close(fd); return -1; }
        std::memcpy(addr.sun_path, socket_path_.c_str(), socket_path_.size());
        if (::connect(fd, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) < 0) {
            ::close(fd);
            return -1;
        }
        return fd;
    }
 
    void reconnect_loop() {
        auto& log = bsc::logging::Logger::instance();
        bool previously_connected = false;
        while (running_) {
            int fd = connect_once();
            if (fd < 0) {
                if (previously_connected) {
                    log.warning("UI disconnessa, tento la riconnessione...");
                    previously_connected = false;
                }
                std::this_thread::sleep_for(std::chrono::seconds(1));
                continue;
            }
 
            fd_ = fd;
            handshake_done_ = false;
 
            // Invia hello immediatamente
            if (!send_hello()) {
                ::close(fd);
                fd_ = -1;
                std::this_thread::sleep_for(std::chrono::seconds(1));
                continue;
            }
 
            handshake_done_ = true;
            previously_connected = true;
            log.info("UI connessa su " + socket_path_);
            flush_queued_alerts();
 
            // Loop di lettura finche' il socket non si chiude
            read_until_eof();
 
            // Disconnesso: pulisci
            int old = fd_.exchange(-1);
            if (old >= 0) ::close(old);
            handshake_done_ = false;
        }
    }
 
    // ── I/O di basso livello ───────────────────────────────────────────
 
    // Scrive un frame completo. Usa write_mutex_ per serializzare.
    bool write_frame(const std::string& payload) {
        int fd = fd_.load();
        if (fd < 0) return false;
        std::vector<std::uint8_t> frame;
        bsc::proto::frame_encode(payload, frame);
        std::lock_guard<std::mutex> lk(write_mutex_);
        std::size_t total = 0;
        while (total < frame.size()) {
            ssize_t n = ::send(fd, frame.data() + total, frame.size() - total, MSG_NOSIGNAL);
            if (n < 0) {
                if (errno == EINTR) continue;
                return false;
            }
            total += static_cast<std::size_t>(n);
        }
        return true;
    }
 
    // Legge esattamente N byte o ritorna false se il socket si chiude.
    bool read_exact(int fd, std::uint8_t* buf, std::size_t n) {
        std::size_t got = 0;
        while (got < n) {
            ssize_t r = ::recv(fd, buf + got, n - got, 0);
            if (r == 0) return false;        // EOF
            if (r < 0) {
                if (errno == EINTR) continue;
                return false;
            }
            got += static_cast<std::size_t>(r);
        }
        return true;
    }
 
    // Loop di lettura: smonta frame → smista per tipo.
    void read_until_eof() {
        auto& log = bsc::logging::Logger::instance();
        int fd = fd_.load();
        while (fd >= 0 && running_) {
            std::uint8_t len_buf[4];
            if (!read_exact(fd, len_buf, 4)) break;
            const std::int64_t len = bsc::proto::frame_peek_length(len_buf, 4);
            if (len < 0 || static_cast<std::size_t>(len) > bsc::proto::kMaxFrameSize) {
                log.warning("UIClient: frame invalido, chiudo connessione");
                break;
            }
            std::vector<std::uint8_t> payload(static_cast<std::size_t>(len));
            if (!read_exact(fd, payload.data(), payload.size())) break;
 
            try {
                json j = json::parse(payload.begin(), payload.end());
                dispatch_incoming(j);
            } catch (const std::exception& e) {
                log.warning(std::string("UIClient: JSON invalido: ") + e.what());
            }
            fd = fd_.load();
        }
    }
 
    // Smista un messaggio ricevuto per tipo.
    void dispatch_incoming(const json& j) {
        const std::string type = j.value("type", std::string{});
        if (type == bsc::proto::msg::kPong) {
            // Nothing to do: e' una conferma di heartbeat.
            return;
        }
        if (type == bsc::proto::msg::kAskRuleReply) {
            const auto id = j.value("id", std::uint64_t{0});
            std::shared_ptr<PendingAsk> p;
            {
                std::lock_guard<std::mutex> lk(pending_mutex_);
                auto it = pending_asks_.find(id);
                if (it == pending_asks_.end()) return;
                p = it->second;
            }
            {
                std::lock_guard<std::mutex> l2(p->mu);
                p->reply = j;
                p->ready = true;
            }
            p->cv.notify_all();
            return;
        }
        if (type == bsc::proto::msg::kNotification) {
            NotificationEvent ev;
            ev.id   = j.value("id", std::uint64_t{0});
            ev.type = j.value("kind", std::string{});
            ev.data = j.value("data", std::string{});
            if (j.contains("rules") && j["rules"].is_array()) {
                for (const auto& r : j["rules"]) ev.rules.push_back(rule_from_json(r));
            }
            std::function<void(const NotificationEvent&)> cb;
            {
                std::lock_guard<std::mutex> lk(handler_mutex_);
                cb = notif_handler_;
            }
            if (cb) cb(ev);
            return;
        }
        bsc::logging::Logger::instance().warning(
            "UIClient: messaggio di tipo sconosciuto: " + type);
    }
 
    // ── Invio messaggi ────────────────────────────────────────────────
 
    bool send_hello() {
        json j = {
            {"type", bsc::proto::msg::kHello},
            {"id",   next_id_++},
            {"daemon_version", "bsc-daemon-cpp"}
        };
        return write_frame(j.dump());
    }
 
    void flush_queued_alerts() {
        std::deque<std::string> q;
        {
            std::lock_guard<std::mutex> lk(alerts_mutex_);
            q.swap(queued_alerts_);
        }
        for (const auto& payload : q) {
            if (!write_frame(payload)) {
                // Rimetti in coda quello che non siamo riusciti a spedire
                std::lock_guard<std::mutex> lk(alerts_mutex_);
                queued_alerts_.push_front(payload);
                break;
            }
        }
    }
 
    // Invia l'alert se connesso, altrimenti lo accoda (fino a 128 alert).
    bool send_or_queue_alert(const json& j) {
        const std::string payload = j.dump();
        if (is_connected() && write_frame(payload)) return true;
        std::lock_guard<std::mutex> lk(alerts_mutex_);
        if (queued_alerts_.size() >= 128) queued_alerts_.pop_front();
        queued_alerts_.push_back(payload);
        return true;
    }
};
 
// ────────────────────────────────────────────────────────────────────────────
// Facade UIClient
// ────────────────────────────────────────────────────────────────────────────
 
UIClient::UIClient(std::string socket_uri)
    : impl_(std::make_unique<Impl>(std::move(socket_uri))) {}
 
UIClient::~UIClient() = default;
 
void UIClient::start() { impl_->start(); }
void UIClient::stop()  { impl_->stop(); }
 
bool UIClient::is_connected() const noexcept {
    return impl_->is_connected();
}
 
void UIClient::set_notification_handler(std::function<void(const NotificationEvent&)> cb) {
    std::lock_guard<std::mutex> lk(impl_->handler_mutex_);
    impl_->notif_handler_ = std::move(cb);
}
 
std::optional<bsc::rule::Rule> UIClient::ask_rule(const bsc::model::Connection& conn) {
    if (!impl_->is_connected()) return std::nullopt;
 
    const auto id = impl_->next_id_++;
    auto pending = std::make_shared<Impl::PendingAsk>();
    {
        std::lock_guard<std::mutex> lk(impl_->pending_mutex_);
        impl_->pending_asks_[id] = pending;
    }
 
    // Costruisci la richiesta
    json j = {
        {"type", bsc::proto::msg::kAskRule},
        {"id",   id}
    };
    json cj;
    connection_to_json(conn, cj);
    j["connection"] = cj;
 
    if (!impl_->write_frame(j.dump())) {
        std::lock_guard<std::mutex> lk(impl_->pending_mutex_);
        impl_->pending_asks_.erase(id);
        return std::nullopt;
    }
 
    // Aspetta la risposta con timeout 30s (il popup ha countdown 15s,
    // 30 da margine per il jitter).
    std::unique_lock<std::mutex> lk(pending->mu);
    const bool ok = pending->cv.wait_for(lk, std::chrono::seconds(30),
                                         [&]() { return pending->ready; });
 
    {
        std::lock_guard<std::mutex> lk2(impl_->pending_mutex_);
        impl_->pending_asks_.erase(id);
    }
 
    if (!ok) return std::nullopt;  // timeout
 
    // Estrai la rule dalla risposta
    bsc::rule::Rule r;
    r.action   = pending->reply.value("action",   std::string{"deny"});
    r.duration = pending->reply.value("duration", std::string{"once"});
    r.name     = pending->reply.value("rule_name", std::string{});
    r.enabled  = true;
    return r;
}
 
bool UIClient::ping(const bsc::stats::Statistics& stats) {
    if (!impl_->is_connected()) return false;
    json j = {
        {"type", bsc::proto::msg::kPing},
        {"id",   impl_->next_id_++},
        {"stats", {
            {"daemon_version", "bsc-daemon-cpp"},
            {"rules",         stats.rules()},
            {"connections",   stats.connections()},
            {"dns_responses", stats.dns_responses()},
            {"ignored",       stats.ignored()},
            {"accepted",      stats.accepted()},
            {"dropped",       stats.dropped()},
            {"rule_hits",     stats.rule_hits()},
            {"rule_misses",   stats.rule_misses()},
        }}
    };
    return impl_->write_frame(j.dump());
}
 
bool UIClient::post_alert(const std::string& text) {
    json j = {
        {"type", bsc::proto::msg::kAlert},
        {"id",   impl_->next_id_++},
        {"level", "info"},
        {"what",  "generic"},
        {"text",  text}
    };
    return impl_->send_or_queue_alert(j);
}
 
bool UIClient::post_connection_alert(const bsc::model::Connection& conn,
                                     const std::string& action,
                                     const std::string& rule_name) {
    json j = {
        {"type", bsc::proto::msg::kAlert},
        {"id",   impl_->next_id_++},
        {"level", action == "deny" ? "warning" : "info"},
        {"what",  "connection"},
    };
    json cj;
    connection_to_json(conn, cj);
    j["connection"] = cj;
    if (!rule_name.empty()) {
        j["rule"] = {{"name", rule_name}, {"action", action}};
    }
    return impl_->send_or_queue_alert(j);
}
 
} // namespace bsc::ui