WireguardBackend.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * GPL v3. BastionGuard™ is a trademark of Calogero Scarnà.
 */
 
#include "WireguardBackend.hpp"
 
#include <glibmm/spawn.h>
#include <glibmm/shell.h>
 
#include <cstdlib>
#include <cstring>
#include <fstream>
#include <sstream>
#include <filesystem>
#include <regex>
#include <arpa/inet.h>
#include <unistd.h>
#include <sys/wait.h>
 
namespace fs = std::filesystem;
 
namespace BastionGuard {
 
WireguardBackend::WireguardBackend(std::string iface)
    : iface_(std::move(iface)) {}
 
// ===========================================================================
// Esecuzione processi (stesso meccanismo di prima)
// ===========================================================================
OpResult WireguardBackend::run(const std::vector<std::string>& argv,
                               bool privileged) const {
    OpResult res;
    std::vector<std::string> full;
    if (privileged) full.push_back("pkexec");
    full.insert(full.end(), argv.begin(), argv.end());
 
    std::string out, err;
    int exit_status = 0;
    try {
        Glib::spawn_sync("", full, Glib::SpawnFlags::SEARCH_PATH,
                         {}, &out, &err, &exit_status);
    } catch (const Glib::Error& e) {
        res.ok = false; res.exit_code = -1;
        res.output = std::string("spawn error: ") + e.what();
        return res;
    }
    res.exit_code = exit_status;
    res.ok = (exit_status == 0);
    res.output = out;
    if (!err.empty()) { if (!res.output.empty()) res.output += "\n"; res.output += err; }
    return res;
}
 
OpResult WireguardBackend::run_with_stdin(const std::vector<std::string>& argv,
                                          const std::string& stdin_data,
                                          bool privileged) const {
    OpResult res;
    std::vector<std::string> full;
    if (privileged) full.push_back("pkexec");
    full.insert(full.end(), argv.begin(), argv.end());
 
    std::vector<char*> c_argv;
    c_argv.reserve(full.size() + 1);
    for (auto& s : full) c_argv.push_back(const_cast<char*>(s.c_str()));
    c_argv.push_back(nullptr);
 
    int in_pipe[2], out_pipe[2];
    if (pipe(in_pipe) != 0 || pipe(out_pipe) != 0) {
        res.ok = false; res.output = "pipe() fallita"; return res;
    }
    pid_t pid = fork();
    if (pid < 0) { res.ok = false; res.output = "fork() fallita"; return res; }
    if (pid == 0) {
        dup2(in_pipe[0], STDIN_FILENO);
        dup2(out_pipe[1], STDOUT_FILENO);
        dup2(out_pipe[1], STDERR_FILENO);
        close(in_pipe[0]); close(in_pipe[1]);
        close(out_pipe[0]); close(out_pipe[1]);
        execvp(c_argv[0], c_argv.data());
        _exit(127);
    }
    close(in_pipe[0]); close(out_pipe[1]);
    size_t w = 0;
    while (w < stdin_data.size()) {
        ssize_t n = write(in_pipe[1], stdin_data.data() + w, stdin_data.size() - w);
        if (n <= 0) break;
        w += (size_t)n;
    }
    close(in_pipe[1]);
 
    std::string output; char buf[4096]; ssize_t n;
    while ((n = read(out_pipe[0], buf, sizeof(buf))) > 0)
        output.append(buf, (size_t)n);
    close(out_pipe[0]);
 
    int status = 0; waitpid(pid, &status, 0);
    res.output = output;
    if (WIFEXITED(status)) { res.exit_code = WEXITSTATUS(status); res.ok = (res.exit_code == 0); }
    else { res.exit_code = -1; res.ok = false; }
    return res;
}
 
// ===========================================================================
// Tooling
// ===========================================================================
static bool in_path_(const char* bin) {
    const char* p = std::getenv("PATH");
    if (!p) p = "/usr/sbin:/usr/bin:/sbin:/bin";
    std::string paths(p);
    size_t start = 0;
    while (start <= paths.size()) {
        size_t end = paths.find(':', start);
        std::string dir = paths.substr(start,
            end == std::string::npos ? std::string::npos : end - start);
        if (!dir.empty() && ::access((dir + "/" + bin).c_str(), X_OK) == 0) return true;
        if (end == std::string::npos) break;
        start = end + 1;
    }
    return false;
}
 
bool WireguardBackend::tooling_available(std::string* missing) const {
    if (!in_path_("wg"))  { if (missing) *missing = "wg";  return false; }
    if (!in_path_("ip"))  { if (missing) *missing = "ip";  return false; }
    return true;
}
 
// ===========================================================================
// Parser del file .conf  (robusto: spazi, commenti, multi-peer)
// ===========================================================================
static std::string strip_(std::string s) {
    size_t a = s.find_first_not_of(" \t\r\n");
    size_t b = s.find_last_not_of(" \t\r\n");
    if (a == std::string::npos) return {};
    return s.substr(a, b - a + 1);
}
 
static std::vector<std::string> split_csv_(const std::string& s) {
    std::vector<std::string> out;
    std::string tok; std::istringstream iss(s);
    while (std::getline(iss, tok, ',')) {
        std::string t = strip_(tok);
        if (!t.empty()) out.push_back(t);
    }
    return out;
}
 
static bool parse_uint_range_(const std::string& s, unsigned min, unsigned max) {
    if (s.empty() || s.find_first_not_of("0123456789") != std::string::npos)
        return false;
    try {
        unsigned long v = std::stoul(s);
        return v >= min && v <= max;
    } catch (...) {
        return false;
    }
}
 
static bool valid_wg_key_(const std::string& s) {
    // WireGuard keys are 32 bytes encoded as 44-character base64 strings.
    static const std::regex re(R"(^[A-Za-z0-9+/]{43}=$)");
    return std::regex_match(s, re);
}
 
static bool valid_ip_(const std::string& s) {
    struct in_addr a4 {};
    struct in6_addr a6 {};
    return ::inet_pton(AF_INET, s.c_str(), &a4) == 1 ||
           ::inet_pton(AF_INET6, s.c_str(), &a6) == 1;
}
 
static bool valid_cidr_(const std::string& s) {
    const auto slash = s.rfind('/');
    if (slash == std::string::npos || slash == 0 || slash + 1 >= s.size())
        return false;
    const std::string ip = s.substr(0, slash);
    const std::string prefix = s.substr(slash + 1);
    if (!parse_uint_range_(prefix, 0, 128)) return false;
 
    struct in_addr a4 {};
    if (::inet_pton(AF_INET, ip.c_str(), &a4) == 1)
        return std::stoul(prefix) <= 32;
    struct in6_addr a6 {};
    if (::inet_pton(AF_INET6, ip.c_str(), &a6) == 1)
        return std::stoul(prefix) <= 128;
    return false;
}
 
static bool valid_hostname_(const std::string& host) {
    if (host.empty() || host.size() > 253 || host.front() == '.' || host.back() == '.')
        return false;
    static const std::regex re(R"(^[A-Za-z0-9.-]+$)");
    if (!std::regex_match(host, re) || host.find("..") != std::string::npos)
        return false;
    std::istringstream labels(host);
    std::string label;
    while (std::getline(labels, label, '.')) {
        if (label.empty() || label.size() > 63 || label.front() == '-' || label.back() == '-')
            return false;
    }
    return true;
}
 
static bool valid_endpoint_(const std::string& endpoint) {
    std::string host, port;
    if (!endpoint.empty() && endpoint.front() == '[') {
        const auto close = endpoint.find(']');
        if (close == std::string::npos || close + 1 >= endpoint.size() || endpoint[close + 1] != ':')
            return false;
        host = endpoint.substr(1, close - 1);
        port = endpoint.substr(close + 2);
        struct in6_addr a6 {};
        if (::inet_pton(AF_INET6, host.c_str(), &a6) != 1) return false;
    } else {
        const auto colon = endpoint.rfind(':');
        if (colon == std::string::npos || colon == 0 || colon + 1 >= endpoint.size())
            return false;
        host = endpoint.substr(0, colon);
        port = endpoint.substr(colon + 1);
        struct in_addr a4 {};
        if (::inet_pton(AF_INET, host.c_str(), &a4) != 1 && !valid_hostname_(host))
            return false;
    }
    return parse_uint_range_(port, 1, 65535);
}
 
static bool valid_iface_(const std::string& iface) {
    static const std::regex re(R"(^[A-Za-z0-9_.-]{1,15}$)");
    return std::regex_match(iface, re);
}
 
static bool validate_spec_(const WgTunnelSpec& sp, std::string* err) {
    auto fail = [&](const char* msg) {
        if (err) *err = msg;
        return false;
    };
    if (!sp.valid()) return fail("Configurazione WireGuard incompleta.");
    if (!valid_wg_key_(sp.private_key)) return fail("PrivateKey WireGuard non valida.");
    if (!sp.listen_port.empty() && !parse_uint_range_(sp.listen_port, 1, 65535))
        return fail("ListenPort non valida.");
    if (sp.mtu != 0 && (sp.mtu < 576 || sp.mtu > 9000))
        return fail("MTU fuori intervallo consentito.");
 
    for (const auto& a : sp.addresses)
        if (!valid_cidr_(a)) return fail("Address deve essere un IP/CIDR valido.");
    for (const auto& ns : sp.dns)
        if (!valid_ip_(ns)) return fail("DNS deve essere un indirizzo IP valido.");
 
    for (const auto& peer : sp.peers) {
        if (!valid_wg_key_(peer.public_key)) return fail("PublicKey peer non valida.");
        if (!peer.preshared_key.empty() && !valid_wg_key_(peer.preshared_key))
            return fail("PresharedKey non valida.");
        if (!valid_endpoint_(peer.endpoint)) return fail("Endpoint WireGuard non valido.");
        for (const auto& cidr : split_csv_(peer.allowed_ips))
            if (!valid_cidr_(cidr)) return fail("AllowedIPs contiene un CIDR non valido.");
        if (!peer.persistent_keepalive.empty() &&
            !parse_uint_range_(peer.persistent_keepalive, 0, 65535))
            return fail("PersistentKeepalive non valido.");
    }
    return true;
}
 
bool WireguardBackend::load_from_conf(const std::string& conf_path,
                                      std::string* err) {
    std::ifstream in(conf_path);
    if (!in) { if (err) *err = "Impossibile aprire: " + conf_path; return false; }
 
    WgTunnelSpec sp;
    enum class Section { None, Interface, Peer } sec = Section::None;
    WgPeer cur_peer;
 
    auto flush_peer = [&]() {
        if (!cur_peer.public_key.empty() || !cur_peer.endpoint.empty()) {
            sp.peers.push_back(cur_peer);
            cur_peer = {};
        }
    };
 
    std::string line;
    while (std::getline(in, line)) {
        std::string t = strip_(line);
        if (t.empty() || t[0] == '#' || t[0] == ';') continue;
 
        if (t.front() == '[' && t.back() == ']') {
            std::string name = t.substr(1, t.size() - 2);
            // normalizza
            for (auto& c : name) c = (char)std::tolower((unsigned char)c);
            if (name == "interface") { flush_peer(); sec = Section::Interface; }
            else if (name == "peer") { flush_peer(); sec = Section::Peer; }
            else sec = Section::None;
            continue;
        }
 
        // key = value (con qualunque spaziatura)
        size_t eq = t.find('=');
        if (eq == std::string::npos) continue;
        std::string k = strip_(t.substr(0, eq));
        std::string v = strip_(t.substr(eq + 1));
        std::string kl = k;
        for (auto& c : kl) c = (char)std::tolower((unsigned char)c);
 
        if (sec == Section::Interface) {
            if      (kl == "privatekey") sp.private_key = v;
            else if (kl == "address")    sp.addresses = split_csv_(v);
            else if (kl == "dns")        sp.dns       = split_csv_(v);
            else if (kl == "listenport") sp.listen_port = v;
            else if (kl == "mtu")        sp.mtu = std::atoi(v.c_str());
            // PostUp/PostDown/Table/SaveConfig: IGNORATI (sono cose di wg-quick)
        } else if (sec == Section::Peer) {
            if      (kl == "publickey")           cur_peer.public_key = v;
            else if (kl == "presharedkey")        cur_peer.preshared_key = v;
            else if (kl == "endpoint")            cur_peer.endpoint = v;
            else if (kl == "allowedips")          cur_peer.allowed_ips = v;
            else if (kl == "persistentkeepalive") cur_peer.persistent_keepalive = v;
        }
    }
    flush_peer();
 
    if (!validate_spec_(sp, err)) return false;
    spec_ = std::move(sp);
    return true;
}
 
bool WireguardBackend::load_from_params(const WgConfigParams& p,
                                        std::string* err) {
    if (p.private_key.empty() || p.server_public_key.empty() ||
        p.endpoint.empty() || p.address.empty()) {
        if (err) *err = "Campi obbligatori mancanti.";
        return false;
    }
    WgTunnelSpec sp;
    sp.private_key = p.private_key;
    sp.addresses   = split_csv_(p.address);
    if (!p.dns.empty()) sp.dns = split_csv_(p.dns);
    sp.listen_port = p.listen_port;
 
    WgPeer peer;
    peer.public_key  = p.server_public_key;
    peer.endpoint    = p.endpoint;
    peer.allowed_ips = p.allowed_ips.empty() ? std::string("0.0.0.0/0, ::/0")
                                              : p.allowed_ips;
    peer.persistent_keepalive = p.persistent_keepalive;
    sp.peers.push_back(peer);
 
    if (!validate_spec_(sp, err)) return false;
    spec_ = std::move(sp);
    return true;
}
 
// ===========================================================================
// Chiavi
// ===========================================================================
std::optional<WgKeyPair> WireguardBackend::generate_keys() const {
    OpResult gen = run({"wg", "genkey"}, false);
    if (!gen.ok) return std::nullopt;
    std::string priv = strip_(gen.output);
    if (priv.empty()) return std::nullopt;
    OpResult pub = run_with_stdin({"wg", "pubkey"}, priv + "\n", false);
    if (!pub.ok) return std::nullopt;
    std::string pk = strip_(pub.output);
    if (pk.empty()) return std::nullopt;
    return WgKeyPair{priv, pk};
}
 
// ===========================================================================
// Build del testo per `wg setconf` (solo cose che `wg` capisce)
// ===========================================================================
std::string WireguardBackend::build_wg_setconf_text() const {
    std::ostringstream os;
    os << "[Interface]\n";
    os << "PrivateKey = " << spec_.private_key << "\n";
    if (!spec_.listen_port.empty()) os << "ListenPort = " << spec_.listen_port << "\n";
    for (const auto& p : spec_.peers) {
        os << "\n[Peer]\n";
        os << "PublicKey = " << p.public_key << "\n";
        if (!p.preshared_key.empty())
            os << "PresharedKey = " << p.preshared_key << "\n";
        if (!p.endpoint.empty())
            os << "Endpoint = " << p.endpoint << "\n";
        if (!p.allowed_ips.empty())
            os << "AllowedIPs = " << p.allowed_ips << "\n";
        if (!p.persistent_keepalive.empty())
            os << "PersistentKeepalive = " << p.persistent_keepalive << "\n";
    }
    return os.str();
}
 
// ===========================================================================
// Helper: determina se serve full-tunnel (default route via wg0)
// ===========================================================================
static bool needs_default_route_(const WgTunnelSpec& sp) {
    for (const auto& p : sp.peers)
        for (const auto& a : split_csv_(p.allowed_ips))
            if (a == "0.0.0.0/0" || a == "::/0") return true;
    return false;
}
 
// ===========================================================================
// CONNECT: setup completo con ip + wg, niente wg-quick
// ===========================================================================
OpResult WireguardBackend::connect() {
    OpResult res;
    std::string validation_error;
    if (!validate_spec_(spec_, &validation_error) || !valid_iface_(iface_)) {
        res.ok = false;
        res.exit_code = -1;
        res.output = validation_error.empty() ? "Interfaccia WireGuard non valida." : validation_error;
        return res;
    }
 
    auto fail = [](const std::string& step, const OpResult& r) {
        OpResult out = r;
        out.ok = false;
        out.output = step + (r.output.empty() ? std::string{} : ": " + r.output);
        return out;
    };
 
    // Cleanup residue from an interrupted previous connection. Errors here are harmless.
    run({"ip", "link", "delete", "dev", iface_}, true);
 
    OpResult r = run({"ip", "link", "add", "dev", iface_, "type", "wireguard"}, true);
    if (!r.ok) return fail("ip link add", r);
 
    const std::string wg_text = build_wg_setconf_text();
    r = run_with_stdin({"wg", "setconf", iface_, "/dev/stdin"}, wg_text, true);
    if (!r.ok) {
        run({"ip", "link", "delete", "dev", iface_}, true);
        return fail("wg setconf", r);
    }
 
    if (spec_.mtu > 0) {
        r = run({"ip", "link", "set", "dev", iface_, "mtu", std::to_string(spec_.mtu)}, true);
        if (!r.ok) return fail("ip link mtu", r);
    }
 
    for (const auto& a : spec_.addresses) {
        const std::string fam = (a.find(':') != std::string::npos) ? "-6" : "-4";
        r = run({"ip", fam, "address", "add", a, "dev", iface_}, true);
        if (!r.ok) return fail("ip address add", r);
    }
 
    r = run({"ip", "link", "set", "dev", iface_, "up"}, true);
    if (!r.ok) return fail("ip link up", r);
 
    if (needs_default_route_(spec_)) {
        // These may already exist after a previous interrupted run; preserve the
        // old `|| true` semantics by intentionally ignoring duplicate errors.
        run({"ip", "-4", "route", "add", "default", "dev", iface_, "table", "51820"}, true);
        run({"ip", "-4", "rule", "add", "not", "from", "all", "fwmark", "0x51820",
             "lookup", "51820", "priority", "32764"}, true);
        run({"ip", "-4", "rule", "add", "table", "main", "suppress_prefixlength", "0",
             "priority", "32765"}, true);
        run({"wg", "set", iface_, "fwmark", "0x51820"}, true);
        run({"sysctl", "-q", "net.ipv4.conf.all.src_valid_mark=1"}, true);
    } else {
        for (const auto& peer : spec_.peers) {
            for (const auto& cidr : split_csv_(peer.allowed_ips)) {
                if (cidr == "0.0.0.0/0" || cidr == "::/0") continue;
                const std::string fam = (cidr.find(':') != std::string::npos) ? "-6" : "-4";
                run({"ip", fam, "route", "add", cidr, "dev", iface_}, true);
            }
        }
    }
 
    if (!spec_.dns.empty()) {
        static const std::string bak = "/etc/resolv.conf.bastionguard.bak";
        if (!fs::exists(bak)) {
            run({"cp", "-a", "--no-dereference", "--", "/etc/resolv.conf", bak}, true);
        }
 
        std::ostringstream dns_text;
        for (const auto& ns : spec_.dns)
            dns_text << "nameserver " << ns << "\n";
 
        r = run_with_stdin({"tee", "/etc/resolv.conf"}, dns_text.str(), true);
        if (!r.ok) return fail("aggiornamento DNS", r);
    }
 
    res.ok = true;
    res.exit_code = 0;
    res.output = "Tunnel WireGuard attivato.";
    return res;
}
 
// ===========================================================================
// DISCONNECT: ripristina resolv.conf, rimuove route, butta giù interfaccia
// ===========================================================================
OpResult WireguardBackend::disconnect() {
    static const std::string bak = "/etc/resolv.conf.bastionguard.bak";
 
    if (fs::exists(bak)) {
        run({"rm", "-f", "--", "/etc/resolv.conf"}, true);
        run({"cp", "-a", "--no-dereference", "--", bak, "/etc/resolv.conf"}, true);
        run({"rm", "-f", "--", bak}, true);
    }
 
    run({"ip", "-4", "rule", "del", "table", "main", "suppress_prefixlength", "0",
         "priority", "32765"}, true);
    run({"ip", "-4", "rule", "del", "not", "from", "all", "fwmark", "0x51820",
         "lookup", "51820", "priority", "32764"}, true);
    run({"ip", "-4", "route", "flush", "table", "51820"}, true);
    run({"ip", "link", "delete", "dev", iface_}, true);
 
    OpResult check = run({"ip", "link", "show", iface_}, false);
    OpResult res;
    res.ok = !check.ok;
    res.exit_code = res.ok ? 0 : 1;
    res.output = res.ok ? "Tunnel WireGuard disattivato." : "Interfaccia WireGuard ancora presente.";
    return res;
}
 
// ===========================================================================
// Stato / IP pubblico
// ===========================================================================
WgStatus WireguardBackend::status() const {
    WgStatus st; st.interface = iface_;
 
    // Rilevamento "up/down" primario SENZA privilegi: l'esistenza
    // dell'interfaccia wg0 con stato UP è leggibile da `ip link show`,
    // che non richiede root (a differenza di `wg show` su molti sistemi).
    OpResult link = run({"ip", "link", "show", iface_}, false);
    if (!link.ok) { st.up = false; return st; }   // interfaccia assente
    st.up = true;
 
    // Dettagli (endpoint, handshake) da `wg show`: utile ma non essenziale,
    // e può richiedere privilegi. Proviamo senza, poi con pkexec solo se
    // l'output sembra negato. Se fallisce, lasciamo st.up=true comunque.
    OpResult r = run({"wg", "show", iface_}, false);
    if (!r.ok) return st;   // niente dettagli, ma il tunnel è su
    std::istringstream iss(r.output);
    std::string line;
    while (std::getline(iss, line)) {
        std::string t = strip_(line);
        if (t.rfind("endpoint:", 0) == 0)
            st.endpoint = strip_(t.substr(9));
        else if (t.rfind("latest handshake:", 0) == 0)
            st.last_handshake = strip_(t.substr(17));
    }
    return st;
}
 
std::optional<std::string> WireguardBackend::public_ip() const {
    // Proviamo più servizi: se uno è lento/bloccato, passiamo al successivo.
    static const char* endpoints[] = {
        "https://api.ipify.org",
        "https://ifconfig.me/ip",
        "https://icanhazip.com",
        "https://ipinfo.io/ip",
    };
    for (const char* url : endpoints) {
        OpResult r = run({"curl", "-s", "-4", "--max-time", "10", url}, false);
        if (r.ok) {
            std::string ip = strip_(r.output);
            // sanity: deve assomigliare a un IPv4
            if (!ip.empty() && ip.find_first_not_of("0123456789.") == std::string::npos)
                return ip;
        }
    }
    return std::nullopt;
}
 
// ===========================================================================
// Kill-switch (invariato concettualmente)
// ===========================================================================
static const char* kKsTable = "bastionguard_ks";
 
OpResult WireguardBackend::killswitch_enable() {
    if (!valid_iface_(iface_))
        return OpResult{false, -1, "Interfaccia WireGuard non valida."};
 
    WgStatus st = status();
    std::string endpoint_rule;
    if (!st.endpoint.empty()) {
        std::string host;
        if (st.endpoint.front() == '[') {
            auto close = st.endpoint.find(']');
            if (close != std::string::npos) host = st.endpoint.substr(1, close - 1);
        } else {
            auto pos = st.endpoint.rfind(':');
            if (pos != std::string::npos) host = st.endpoint.substr(0, pos);
        }
 
        struct in_addr a4 {};
        struct in6_addr a6 {};
        if (::inet_pton(AF_INET, host.c_str(), &a4) == 1)
            endpoint_rule = "    ip daddr " + host + " accept\n";
        else if (::inet_pton(AF_INET6, host.c_str(), &a6) == 1)
            endpoint_rule = "    ip6 daddr " + host + " accept\n";
    }
 
    std::ostringstream rules;
    rules << "table inet " << kKsTable << " {\n"
          << "  chain out {\n"
          << "    type filter hook output priority 0; policy drop;\n"
          << "    oifname lo accept\n"
          << "    oifname \"" << iface_ << "\" accept\n"
          << endpoint_rule
          << "    meta l4proto udp accept\n"
          << "  }\n"
          << "}\n";
 
    return run_with_stdin({"nft", "-f", "-"}, rules.str(), true);
}
 
OpResult WireguardBackend::killswitch_disable() {
    OpResult r = run({"nft", "delete", "table", "inet", kKsTable}, true);
    if (!r.ok) {
        // An already absent table is equivalent to a disabled kill-switch.
        r.ok = true;
        r.exit_code = 0;
    }
    return r;
}
 
bool WireguardBackend::killswitch_active() const {
    return run({"nft", "list", "table", "inet", kKsTable}, true).ok;
}
 
} // namespace BastionGuard