Firewall.cpp

Go to the documentation of this file.

#include "bsc/fw/Firewall.hpp"
#include "bsc/logging/Logger.hpp"
 
#include <algorithm>
#include <array>
#include <cctype>
#include <cstdlib>
#include <filesystem>
#include <fstream>
#include <map>
#include <nlohmann/json.hpp>
#include <optional>
#include <set>
#include <sstream>
#include <string>
#include <vector>
 
namespace bsc::fw {
namespace fs = std::filesystem;
using json = nlohmann::json;
 
namespace {
 
std::string trim(std::string s) {
    auto not_space = [](unsigned char ch) { return !std::isspace(ch); };
    s.erase(s.begin(), std::find_if(s.begin(), s.end(), not_space));
    s.erase(std::find_if(s.rbegin(), s.rend(), not_space).base(), s.end());
    return s;
}
 
std::string lower(std::string s) {
    std::transform(s.begin(), s.end(), s.begin(),
                   [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
    return s;
}
 
std::vector<std::string> split_csv_values(const std::string& raw) {
    std::vector<std::string> out;
    std::stringstream ss(raw);
    std::string item;
    while (std::getline(ss, item, ',')) {
        item = trim(item);
        if (!item.empty()) out.push_back(item);
    }
    if (out.empty()) {
        const auto v = trim(raw);
        if (!v.empty()) out.push_back(v);
    }
    return out;
}
 
std::optional<std::string> resolve_nft_binary() {
    if (const char* env = std::getenv("NFT_BIN")) {
        fs::path p(env);
        if (env[0] && fs::exists(p)) return p.string();
    }
 
    if (const char* path_env = std::getenv("PATH")) {
        std::stringstream ss(path_env);
        std::string entry;
        while (std::getline(ss, entry, ':')) {
            if (entry.empty()) continue;
            fs::path p = fs::path(entry) / "nft";
            if (fs::exists(p)) return p.string();
        }
    }
 
    static constexpr std::array<const char*, 4> candidates{
        "/usr/sbin/nft", "/sbin/nft", "/usr/bin/nft", "/bin/nft"
    };
    for (const auto* c : candidates) {
        if (fs::exists(c)) return std::string(c);
    }
    return std::nullopt;
}
 
std::string shell_quote(const std::string& in) {
    std::string out = "'";
    for (char ch : in) {
        if (ch == '\'') {
            out += "'\\''";
        } else {
            out.push_back(ch);
        }
    }
    out += "'";
    return out;
}
 
std::string normalize_chain_type(const std::string& type, const std::string& hook) {
    const auto t = lower(type);
    const auto h = lower(hook);
    if (t == "natdest" || t == "natsource" || t == "nat") return "nat";
    if (t == "route") return "route";
    if (t == "mangle") return h == "output" ? "route" : "filter";
    return "filter";
}
 
std::string default_priority_for(const std::string& type) {
    const auto t = lower(type);
    if (t == "natdest") return "dstnat";
    if (t == "natsource") return "srcnat";
    if (t == "mangle") return "mangle";
    return "filter";
}
 
std::string normalize_chain_name(std::string name) {
    name = lower(trim(std::move(name)));
    if (name == "input" || name == "output" || name == "forward" || name == "prerouting" || name == "postrouting") {
        return name;
    }
    return name;
}
 
std::string normalize_table_name(std::string name) {
    name = lower(trim(std::move(name)));
    return name.empty() ? std::string{"filter"} : name;
}
 
std::string render_value_set(const std::vector<std::string>& values) {
    if (values.empty()) return {};
    if (values.size() == 1) return values.front();
 
    std::ostringstream oss;
    oss << "{ ";
    for (std::size_t i = 0; i < values.size(); ++i) {
        if (i) oss << ", ";
        oss << values[i];
    }
    oss << " }";
    return oss.str();
}
 
std::string render_statement(const json& stmt) {
    if (!stmt.is_object()) return {};
 
    const std::string name = trim(stmt.value("Name", std::string{}));
    if (name.empty()) return {};
 
    std::map<std::string, std::vector<std::string>> grouped;
    if (stmt.contains("Values") && stmt["Values"].is_array()) {
        for (const auto& value : stmt["Values"]) {
            if (!value.is_object()) continue;
            const auto key = trim(value.value("Key", std::string{}));
            const auto raw = trim(value.value("Value", std::string{}));
            if (raw.empty()) continue;
            for (const auto& item : split_csv_values(raw)) grouped[key].push_back(item);
        }
    }
 
    std::ostringstream oss;
    bool first = true;
    const auto op = trim(stmt.value("Op", std::string{}));
 
    for (const auto& kv : grouped) {
        if (!first) oss << ' ';
        first = false;
        oss << name;
        if (!kv.first.empty()) oss << ' ' << kv.first;
        if (!op.empty()) oss << ' ' << op;
        oss << ' ' << render_value_set(kv.second);
    }
    if (!grouped.empty()) return oss.str();
 
    if (!op.empty()) return name + " " + op;
    return name;
}
 
std::string render_rule(const json& rule) {
    if (!rule.is_object()) return {};
    if (rule.contains("Enabled") && rule["Enabled"].is_boolean() && !rule["Enabled"].get<bool>()) return {};
 
    std::vector<std::string> parts;
 
    if (rule.contains("Parameters") && rule["Parameters"].is_string()) {
        const auto params = trim(rule["Parameters"].get<std::string>());
        if (!params.empty()) parts.push_back(params);
    }
 
    if (rule.contains("Expressions") && rule["Expressions"].is_array()) {
        for (const auto& expr : rule["Expressions"]) {
            if (!expr.is_object()) continue;
            if (expr.contains("Statement")) {
                const auto stmt = render_statement(expr["Statement"]);
                if (!stmt.empty()) parts.push_back(stmt);
            }
        }
    }
 
    const auto target = trim(lower(rule.value("Target", std::string{})));
    if (!target.empty()) parts.push_back(target);
 
    if (rule.contains("TargetParameters") && rule["TargetParameters"].is_string()) {
        const auto params = trim(rule["TargetParameters"].get<std::string>());
        if (!params.empty()) parts.push_back(params);
    }
 
    std::ostringstream oss;
    for (std::size_t i = 0; i < parts.size(); ++i) {
        if (i) oss << ' ';
        oss << parts[i];
    }
    return trim(oss.str());
}
 
std::string convert_legacy_parameters(const std::string& params) {
    std::istringstream iss(params);
    std::vector<std::string> out;
    std::string tok;
    while (iss >> tok) {
        if ((tok == "-p" || tok == "--protocol") && iss >> tok) out.push_back(lower(tok));
        else if ((tok == "--dport" || tok == "--destination-port") && iss >> tok) out.push_back("tcp dport " + tok);
        else if ((tok == "--sport" || tok == "--source-port") && iss >> tok) out.push_back("tcp sport " + tok);
        else if ((tok == "-d" || tok == "--destination") && iss >> tok) out.push_back("ip daddr " + tok);
        else if ((tok == "-s" || tok == "--source") && iss >> tok) out.push_back("ip saddr " + tok);
    }
    std::ostringstream oss;
    for (std::size_t i = 0; i < out.size(); ++i) {
        if (i) oss << ' ';
        oss << out[i];
    }
    return trim(oss.str());
}
 
struct RenderedRuleLine {
    std::string family{"inet"};
    std::string table;
    std::string chain;
    std::string rule;
};
 
std::optional<RenderedRuleLine> render_legacy_rule(const json& legacy_rule) {
    if (!legacy_rule.is_object()) return std::nullopt;
    if (legacy_rule.contains("Enabled") && legacy_rule["Enabled"].is_boolean() && !legacy_rule["Enabled"].get<bool>()) return std::nullopt;
 
    RenderedRuleLine line;
    line.table = normalize_table_name(legacy_rule.value("Table", std::string{}));
    line.chain = normalize_chain_name(legacy_rule.value("Chain", std::string{}));
    std::vector<std::string> parts;
 
    if (legacy_rule.contains("Parameters") && legacy_rule["Parameters"].is_string()) {
        const auto converted = convert_legacy_parameters(legacy_rule["Parameters"].get<std::string>());
        if (!converted.empty()) parts.push_back(converted);
    }
 
    if (legacy_rule.contains("Expressions") && legacy_rule["Expressions"].is_array()) {
        for (const auto& expr : legacy_rule["Expressions"]) {
            if (!expr.is_object() || !expr.contains("Statement")) continue;
            const auto stmt = render_statement(expr["Statement"]);
            if (!stmt.empty()) parts.push_back(stmt);
        }
    }
 
    const auto target = trim(lower(legacy_rule.value("Target", std::string{})));
    if (!target.empty()) parts.push_back(target);
    if (legacy_rule.contains("TargetParameters") && legacy_rule["TargetParameters"].is_string()) {
        const auto params = trim(legacy_rule["TargetParameters"].get<std::string>());
        if (!params.empty()) parts.push_back(params);
    }
 
    std::ostringstream oss;
    for (std::size_t i = 0; i < parts.size(); ++i) {
        if (i) oss << ' ';
        oss << parts[i];
    }
    line.rule = trim(oss.str());
    if (line.table.empty() || line.chain.empty() || line.rule.empty()) return std::nullopt;
    return line;
}
 
void ensure_table_and_chain(std::ostringstream& script,
                            std::set<std::string>& recreated_tables,
                            std::set<std::string>& created_chains,
                            const std::string& family,
                            const std::string& table,
                            const std::string& chain,
                            const std::string& type,
                            const std::string& hook,
                            const std::string& priority,
                            const std::string& policy) {
    const auto table_key = family + ":" + table;
    if (recreated_tables.find(table_key) == recreated_tables.end()) {
        script << "delete table " << family << ' ' << table << "\n";
        script << "add table " << family << ' ' << table << "\n";
        recreated_tables.insert(table_key);
    }
 
    const auto chain_key = table_key + ":" + chain;
    if (created_chains.find(chain_key) != created_chains.end()) return;
 
    script << "add chain " << family << ' ' << table << ' ' << chain;
    if (!hook.empty()) {
        script << " { type " << type
               << " hook " << hook
               << " priority " << priority
               << "; policy " << policy << "; }";
    }
    script << "\n";
    created_chains.insert(chain_key);
}
 
bool render_json_config_to_nft(const json& j, const fs::path& script_path) {
    if (j.contains("Enabled") && j["Enabled"].is_boolean() && !j["Enabled"].get<bool>()) {
        bsc::logging::Logger::instance().info("firewall config caricata ma disabilitata: skip reload");
        return true;
    }
 
    if (!j.contains("SystemRules") || !j["SystemRules"].is_array()) return false;
 
    std::ostringstream script;
    script << "#!/usr/sbin/nft -f\n";
 
    std::set<std::string> recreated_tables;
    std::set<std::string> created_chains;
    std::size_t added_rules = 0;  // contatore regole effettivamente emesse
 
    for (const auto& group : j["SystemRules"]) {
        if (!group.is_object()) continue;
 
        if (group.contains("Rule") && group["Rule"].is_object()) {
            if (auto legacy = render_legacy_rule(group["Rule"])) {
                ensure_table_and_chain(script, recreated_tables, created_chains,
                                       legacy->family, legacy->table, legacy->chain,
                                       normalize_chain_type(legacy->table, legacy->chain),
                                       legacy->chain,
                                       default_priority_for(legacy->table),
                                       "accept");
                script << "add rule " << legacy->family << ' ' << legacy->table << ' ' << legacy->chain
                       << ' ' << legacy->rule << "\n";
                ++added_rules;
            }
        }
 
        if (!group.contains("Chains") || !group["Chains"].is_array()) continue;
 
        for (const auto& chain : group["Chains"]) {
            if (!chain.is_object()) continue;
 
            const auto family = lower(trim(chain.value("Family", std::string{"inet"})));
            const auto table = trim(chain.value("Table", std::string{}));
            const auto name = trim(chain.value("Name", std::string{}));
            const auto hook = lower(trim(chain.value("Hook", std::string{})));
            if (table.empty() || name.empty()) continue;
 
            // Conta quante Rules dentro questa chain sono enabled. Se zero,
            // non creiamo neanche la chain: con `system-fw.json` legacy di
            // OpenSnitch tutte le chain sono placeholder vuote che nft non
            // sa gestire senza priority valida.
            std::size_t chain_enabled_rules = 0;
            if (chain.contains("Rules") && chain["Rules"].is_array()) {
                for (const auto& rule : chain["Rules"]) {
                    if (rule.is_object() && rule.contains("Enabled") &&
                        rule["Enabled"].is_boolean() && !rule["Enabled"].get<bool>()) continue;
                    if (!render_rule(rule).empty()) ++chain_enabled_rules;
                }
            }
            if (chain_enabled_rules == 0) continue;
 
            const auto policy = lower(trim(chain.value("Policy", std::string{"accept"})));
            const auto priority = trim(chain.value("Priority", std::string{}));
            const auto type = normalize_chain_type(chain.value("Type", std::string{"filter"}), hook);
            ensure_table_and_chain(script, recreated_tables, created_chains,
                                   family, table, name, type, hook,
                                   priority.empty() ? default_priority_for(chain.value("Type", std::string{"filter"})) : priority,
                                   policy);
 
            for (const auto& rule : chain["Rules"]) {
                const auto rendered = render_rule(rule);
                if (!rendered.empty()) {
                    script << "add rule " << family << ' ' << table << ' ' << name
                           << ' ' << rendered << "\n";
                    ++added_rules;
                }
            }
        }
    }
 
    // Se non abbiamo emesso nessuna regola effettiva, non scriviamo neanche
    // lo script: il chiamante interpretera' questo come "niente da fare"
    // (ritorno true) e non generera' un warning inutile.
    if (added_rules == 0) {
        bsc::logging::Logger::instance().info(
            "system-fw.json presente ma nessuna regola abilitata: skip reload");
        return true;
    }
 
    std::ofstream out(script_path);
    out << script.str();
    return static_cast<bool>(out);
}
 
} // namespace
 
bool Firewall::reload(const std::string& config_path) const {
    if (backend_ != "nftables") return false;
    if (config_path.empty() || !fs::exists(config_path)) return false;
 
    const auto nft_bin = resolve_nft_binary();
    if (!nft_bin) {
        bsc::logging::Logger::instance().warning(
            "nft non trovato nel sistema: reload firewall non effettuato");
        return false;
    }
 
    if (fs::path(config_path).extension() == ".nft") {
        const auto cmd = *nft_bin + " -f " + shell_quote(config_path) + " >/dev/null 2>&1";
        return std::system(cmd.c_str()) == 0;
    }
 
    try {
        std::ifstream in(config_path);
        json j;
        in >> j;
 
        static const std::vector<std::string> candidate_keys{
            "NftFile", "NftablesFile", "RulesFile", "ScriptPath"
        };
 
        for (const auto& key : candidate_keys) {
            if (j.contains(key) && j[key].is_string()) {
                const auto nft_file = j[key].get<std::string>();
                if (!nft_file.empty() && fs::exists(nft_file)) {
                    const auto cmd = *nft_bin + " -f " + shell_quote(nft_file) + " >/dev/null 2>&1";
                    return std::system(cmd.c_str()) == 0;
                }
            }
        }
 
        const auto rendered = fs::path(config_path).parent_path() / ".bsc-rendered-system-fw.nft";
        // Rimuovi eventuale script residuo di un run precedente, cosi' dopo
        // possiamo verificare univocamente "il render ha prodotto regole?"
        std::error_code rm_ec;
        fs::remove(rendered, rm_ec);
 
        if (!render_json_config_to_nft(j, rendered)) {
            bsc::logging::Logger::instance().warning(
                "firewall JSON non supportato o incompleto: reload non effettuato");
            return false;
        }
 
        // Se render_json_config_to_nft ha ritornato true ma non ha scritto
        // lo script (config valida ma nessuna regola enabled), consideriamo
        // l'operazione riuscita silenziosamente: niente da caricare in nft.
        if (!fs::exists(rendered)) {
            return true;
        }
 
        bsc::logging::Logger::instance().info("script nft renderizzato: " + rendered.string());
 
        const auto cmd = *nft_bin + " -f " + shell_quote(rendered.string()) + " >/dev/null 2>&1";
        const auto rc = std::system(cmd.c_str());
        if (rc != 0) {
            bsc::logging::Logger::instance().warning(
                "reload firewall fallito eseguendo script nft renderizzato da " + config_path);
            return false;
        }
 
        bsc::logging::Logger::instance().info(
            "firewall nftables ricaricato da " + config_path + " usando " + *nft_bin);
        return true;
    } catch (const std::exception& e) {
        bsc::logging::Logger::instance().warning(
            std::string("reload firewall fallito: ") + e.what());
    } catch (...) {
        bsc::logging::Logger::instance().warning(
            "reload firewall fallito: errore sconosciuto");
    }
 
    return false;
}
 
bool Firewall::install_nfqueue_rule(std::uint16_t queue_num, bool queue_bypass) const {
    if (backend_ != "nftables") return false;
 
    const auto nft_bin = resolve_nft_binary();
    if (!nft_bin) {
        bsc::logging::Logger::instance().warning(
            "nft non trovato: impossibile installare la regola NFQUEUE, "
            "fallback su polling /proc");
        return false;
    }
 
    // Catena dedicata: inet bsc_intercept output, priority mangle - 10
    // (prima delle regole utente comuni). Usa un nome prefissato bsc_* per
    // non collidere con regole esistenti dell'utente.
    std::ostringstream script;
    script << "add table inet bsc_intercept\n";
    // Elimina eventuale chain precedente (idempotente).
    script << "delete chain inet bsc_intercept output\n";
    script << "add chain inet bsc_intercept output "
              "{ type filter hook output priority mangle - 10; policy accept; }\n";
 
    // ── Whitelist: traffico infrastrutturale che NON va mai chiesto ─────
    // Chiedere conferma per ogni query DNS o broadcast DHCP rende il sistema
    // inusabile (decine di popup al minuto). Questi protocolli passano sempre.
    script << "add rule inet bsc_intercept output oif lo accept\n";
    script << "add rule inet bsc_intercept output meta mark 0x42 accept\n";
    // DNS (UDP e TCP porta 53)
    script << "add rule inet bsc_intercept output udp dport 53 accept\n";
    script << "add rule inet bsc_intercept output tcp dport 53 accept\n";
    // DHCP client (UDP 67/68)
    script << "add rule inet bsc_intercept output udp sport { 67, 68 } accept\n";
    script << "add rule inet bsc_intercept output udp dport { 67, 68 } accept\n";
    // mDNS (UDP 5353) — usato da avahi/Bonjour per service discovery locale
    script << "add rule inet bsc_intercept output udp dport 5353 accept\n";
    // NTP (UDP 123) — sincronizzazione orario
    script << "add rule inet bsc_intercept output udp dport 123 accept\n";
    // ICMP (ping, destination unreachable, ecc.) — diagnostica
    script << "add rule inet bsc_intercept output meta l4proto icmp accept\n";
    script << "add rule inet bsc_intercept output meta l4proto icmpv6 accept\n";
    // IGMP (multicast management)
    script << "add rule inet bsc_intercept output meta l4proto igmp accept\n";
 
    // Regola principale: tutto il nuovo traffico (stato ct new) va in coda.
    // 'bypass' permette al traffico di passare se il daemon non e' in ascolto.
    script << "add rule inet bsc_intercept output ct state new queue num "
           << queue_num;
    if (queue_bypass) script << " bypass";
    script << "\n";
 
    // Scriviamo lo script in un file temporaneo invece di pipe, cosi' nft
    // riporta errori leggibili nel log (se abilitato).
    fs::path tmp_script = fs::temp_directory_path() / "bsc-nfqueue-install.nft";
    {
        std::ofstream out(tmp_script);
        if (!out) {
            bsc::logging::Logger::instance().warning(
                "Impossibile creare lo script temporaneo nft in " + tmp_script.string());
            return false;
        }
        out << script.str();
    }
 
    const auto cmd = *nft_bin + " -f " + shell_quote(tmp_script.string()) +
                     " 2>/dev/null";
    // Il primo delete chain puo' fallire se la tabella non esiste ancora;
    // nft in modalita' atomica fallisce tutto. Rifaccio un retry senza il
    // delete se il primo tentativo fallisce (prima esecuzione).
    int rc = std::system(cmd.c_str());
    if (rc != 0) {
        std::ostringstream s2;
        s2 << "add table inet bsc_intercept\n";
        s2 << "add chain inet bsc_intercept output "
              "{ type filter hook output priority mangle - 10; policy accept; }\n";
        s2 << "flush chain inet bsc_intercept output\n";
        s2 << "add rule inet bsc_intercept output oif lo accept\n";
        s2 << "add rule inet bsc_intercept output meta mark 0x42 accept\n";
        s2 << "add rule inet bsc_intercept output udp dport 53 accept\n";
        s2 << "add rule inet bsc_intercept output tcp dport 53 accept\n";
        s2 << "add rule inet bsc_intercept output udp sport { 67, 68 } accept\n";
        s2 << "add rule inet bsc_intercept output udp dport { 67, 68 } accept\n";
        s2 << "add rule inet bsc_intercept output udp dport 5353 accept\n";
        s2 << "add rule inet bsc_intercept output udp dport 123 accept\n";
        s2 << "add rule inet bsc_intercept output meta l4proto icmp accept\n";
        s2 << "add rule inet bsc_intercept output meta l4proto icmpv6 accept\n";
        s2 << "add rule inet bsc_intercept output meta l4proto igmp accept\n";
        s2 << "add rule inet bsc_intercept output ct state new queue num "
           << queue_num;
        if (queue_bypass) s2 << " bypass";
        s2 << "\n";
        std::ofstream out(tmp_script);
        out << s2.str();
        out.close();
        rc = std::system(cmd.c_str());
    }
 
    std::error_code ec;
    fs::remove(tmp_script, ec);
 
    if (rc != 0) {
        bsc::logging::Logger::instance().warning(
            "installazione regola NFQUEUE fallita "
            "(permessi insufficienti? manca CAP_NET_ADMIN?): fallback su /proc");
        return false;
    }
 
    bsc::logging::Logger::instance().info(
        "regola NFQUEUE installata sulla coda " + std::to_string(queue_num) +
        (queue_bypass ? " (bypass abilitato)" : ""));
    return true;
}
 
void Firewall::remove_nfqueue_rule() const {
    if (backend_ != "nftables") return;
    const auto nft_bin = resolve_nft_binary();
    if (!nft_bin) return;
 
    // Rimuoviamo solo la nostra tabella, non tocchiamo altro.
    const auto cmd = *nft_bin +
                     " delete table inet bsc_intercept >/dev/null 2>&1";
    (void)std::system(cmd.c_str());
}
 
} // namespace bsc::fw