AppResolver.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ Secure Connection
 * GPL-3.0
 */
 
#include "AppResolver.hpp"
 
#include <arpa/inet.h>
 
#include <giomm/appinfo.h>
#include <giomm/desktopappinfo.h>
#include <giomm/themedicon.h>
 
#include <algorithm>
#include <cctype>
#include <filesystem>
#include <mutex>
#include <optional>
#include <unordered_map>
#include <unordered_set>
#include <libintl.h>
 
#define _(text) gettext(text)
#define N_(text) text
 
 
namespace bsc::ui_util {
namespace fs = std::filesystem;
namespace {
 
constexpr const char* kGenericIcon = "application-x-executable";
constexpr const char* kUnknownProcessLabel =
N_("(processo sconosciuto)");
 
constexpr const char* kSafeLocalProcessLabel =
N_("Processo locale sicuro");
constexpr const char* kSafeLocalProcessIcon = "network-workgroup";
 
struct DesktopIndex {
    std::unordered_map<std::string, AppMetadata> by_key;
    bool built{false};
};
 
DesktopIndex g_index;
std::mutex g_index_mutex;
 
std::string lower(std::string s) {
    std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c) {
        return static_cast<char>(std::tolower(c));
    });
    return s;
}
 
std::string trim_copy(std::string s) {
    auto is_ws = [](unsigned char c) { return std::isspace(c) != 0; };
    while (!s.empty() && is_ws(static_cast<unsigned char>(s.front()))) s.erase(s.begin());
    while (!s.empty() && is_ws(static_cast<unsigned char>(s.back()))) s.pop_back();
    return s;
}
 
std::string normalized_address(std::string s) {
    s = lower(trim_copy(std::move(s)));
 
    // Rimuove eventuali parentesi di IPv6: [::1]
    if (s.size() >= 2 && s.front() == '[' && s.back() == ']') {
        s = s.substr(1, s.size() - 2);
    }
 
    // Rimuove eventuale zone-id IPv6: fe80::1%lo
    if (const auto percent = s.find('%'); percent != std::string::npos) {
        s = s.substr(0, percent);
    }
 
    // Alcuni log salvano un endpoint come host:porta. Per IPv4/localhost lo
    // normalizziamo, per IPv6 puro lasciamo i ':' intatti.
    const auto colon = s.rfind(':');
    if (colon != std::string::npos && s.find(':') == colon) {
        const auto after = s.substr(colon + 1);
        if (!after.empty() && std::all_of(after.begin(), after.end(), [](unsigned char c) {
                return std::isdigit(c) != 0;
            })) {
            s = s.substr(0, colon);
        }
    }
 
    return s;
}
 
bool is_unknown_identity_value(const std::string& value) {
    const auto d = lower(trim_copy(value));
    return d.empty()
        || d == lower(kUnknownProcessLabel)
        || d == "processo sconosciuto"
        || d == "unknown"
        || d == "unknown process";
}
 
bool has_reliable_process_identity(const std::string& app_comm,
                                   const std::string& app_path,
                                   const std::vector<std::string>& app_args) {
    if (!is_unknown_identity_value(app_comm)) return true;
    if (!is_unknown_identity_value(app_path)) return true;
    if (!app_args.empty() && !is_unknown_identity_value(app_args.front())) return true;
    return false;
}
 
bool is_unknown_display_name(const std::string& display_name) {
    return is_unknown_identity_value(display_name);
}
 
std::string basename_of(std::string s) {
    if (s.empty()) return {};
    try {
        return fs::path(s).filename().string();
    } catch (...) {
        const auto pos = s.find_last_of('/');
        return pos == std::string::npos ? s : s.substr(pos + 1);
    }
}
 
std::string strip_wrappers(std::string s) {
    if (s.empty()) return s;
    if ((s.front() == '"' && s.back() == '"') ||
        (s.front() == '\'' && s.back() == '\'')) {
        s = s.substr(1, s.size() - 2);
    }
    if (s.rfind("--", 0) == 0) return {};
    if (!s.empty() && s[0] == '%') return {};
    return s;
}
 
std::vector<std::string> split_exec_tokens(const std::string& exec) {
    std::vector<std::string> out;
    std::string cur;
    char quote = 0;
    bool esc = false;
    for (char ch : exec) {
        if (esc) { cur.push_back(ch); esc = false; continue; }
        if (ch == '\\') { esc = true; continue; }
        if (quote) {
            if (ch == quote) quote = 0;
            else cur.push_back(ch);
            continue;
        }
        if (ch == '\'' || ch == '"') { quote = ch; continue; }
        if (std::isspace(static_cast<unsigned char>(ch))) {
            if (!cur.empty()) { out.push_back(cur); cur.clear(); }
            continue;
        }
        cur.push_back(ch);
    }
    if (!cur.empty()) out.push_back(cur);
    return out;
}
 
std::string key_for(std::string s) {
    s = strip_wrappers(std::move(s));
    if (s.empty()) return {};
    return lower(std::move(s));
}
 
 
 
void add_key(std::unordered_map<std::string, AppMetadata>& map,
             const std::string& raw,
             const AppMetadata& meta) {
    const auto k = key_for(raw);
    if (k.empty()) return;
    map.emplace(k, meta);
    const auto base = key_for(basename_of(raw));
    if (!base.empty()) map.emplace(base, meta);
}
 
bool token_is_env_assignment(const std::string& t) {
    const auto eq = t.find('=');
    return eq != std::string::npos && eq > 0 && t.find('/') == std::string::npos;
}
 
void add_exec_aliases(std::unordered_map<std::string, AppMetadata>& map,
                      const std::string& commandline,
                      const AppMetadata& meta) {
    const auto tokens = split_exec_tokens(commandline);
    if (tokens.empty()) return;
 
    for (std::size_t i = 0; i < tokens.size(); ++i) {
        std::string t = strip_wrappers(tokens[i]);
        if (t.empty()) continue;
        if (t == "env") continue;
        if (token_is_env_assignment(t)) continue;
        if (t == "sh" || t == "/bin/sh" || t == "bash" || t == "/bin/bash") continue;
        if (t == "-c") continue;
        if (t == "flatpak") {
            for (std::size_t j = i + 1; j < tokens.size(); ++j) {
                if (tokens[j] == "run" || tokens[j].rfind("--", 0) == 0) continue;
                add_key(map, tokens[j], meta);
                const auto dot = tokens[j].find_last_of('.');
                if (dot != std::string::npos) add_key(map, tokens[j].substr(dot + 1), meta);
                return;
            }
        }
        add_key(map, t, meta);
        return;
    }
}
 
bool looks_like_thread_name(const std::string& comm) {
    const auto s = lower(comm);
    return s.find("thread") != std::string::npos ||
           s.find("web content") != std::string::npos ||
           s.find("socket") != std::string::npos ||
           s.find("renderer") != std::string::npos ||
           s.find("utility") != std::string::npos ||
           s.find("chrome_") != std::string::npos ||
           s.find("isolated web") != std::string::npos ||
           s == "gpu process" ||
           s == "rdd process" ||
           s == "privileged cont";
}
 
std::string icon_name_from_appinfo(const Glib::RefPtr<Gio::AppInfo>& ai) {
    if (!ai) return {};
    auto icon = ai->get_icon();
    if (!icon) return {};
    auto themed = std::dynamic_pointer_cast<Gio::ThemedIcon>(icon);
    if (!themed) return {};
    const auto names = themed->get_names();
    for (const auto& n : names) {
        if (!n.empty()) return n.raw();
    }
    return {};
}
 
void build_index_locked() {
    if (g_index.built) return;
    g_index.built = true;
 
    auto apps = Gio::AppInfo::get_all();
    for (const auto& ai : apps) {
        if (!ai) continue;
 
        AppMetadata meta;
        meta.display_name = ai->get_name();
        meta.icon_name = icon_name_from_appinfo(ai);
        if (meta.icon_name.empty()) meta.icon_name = kGenericIcon;
 
        add_key(g_index.by_key, meta.display_name, meta);
 
        auto dai = std::dynamic_pointer_cast<Gio::DesktopAppInfo>(ai);
        if (!dai) continue;
 
        const std::string cmd = dai->get_commandline();
        add_exec_aliases(g_index.by_key, cmd, meta);
 
        const std::string wm = dai->get_startup_wm_class();
        if (!wm.empty()) add_key(g_index.by_key, wm, meta);
    }
}
 
void add_candidate(std::vector<std::string>& out, const std::string& s) {
    const auto cleaned = strip_wrappers(s);
    if (cleaned.empty()) return;
    out.push_back(cleaned);
    const auto base = basename_of(cleaned);
    if (!base.empty() && base != cleaned) out.push_back(base);
}
 
std::vector<std::string> browser_aliases_for(const std::string& raw) {
    const auto s = lower(raw);
    if (s.find("firefox") != std::string::npos || s.find("mozilla") != std::string::npos) {
        return {"firefox", "firefox-esr", "org.mozilla.firefox"};
    }
    if (s.find("chromium") != std::string::npos) {
        return {"chromium", "chromium-browser", "org.chromium.chromium"};
    }
    if (s.find("google-chrome") != std::string::npos || s == "chrome" || s.find("chrome_") != std::string::npos) {
        return {"google-chrome", "google-chrome-stable", "chrome", "chromium", "chromium-browser"};
    }
    if (s.find("brave") != std::string::npos) {
        return {"brave-browser", "brave", "com.brave.browser"};
    }
    if (s.find("vivaldi") != std::string::npos) {
        return {"vivaldi", "vivaldi-stable", "com.vivaldi.vivaldi"};
    }
    if (s.find("librewolf") != std::string::npos) {
        return {"librewolf", "io.gitlab.librewolf-community"};
    }
    if (s.find("waterfox") != std::string::npos) {
        return {"waterfox"};
    }
    if (s.find("opera") != std::string::npos) {
        return {"opera", "opera-browser", "com.opera.Opera"};
    }
    if (s.find("msedge") != std::string::npos || s.find("edge") != std::string::npos) {
        return {"microsoft-edge", "microsoft-edge-stable", "msedge"};
    }
    return {};
}
 
std::optional<AppMetadata> lookup_exact_or_alias(const std::vector<std::string>& candidates) {
    for (const auto& c : candidates) {
        const auto k = key_for(c);
        if (k.empty()) continue;
        if (auto it = g_index.by_key.find(k); it != g_index.by_key.end()) return it->second;
        for (const auto& alias : browser_aliases_for(k)) {
            if (auto ai = g_index.by_key.find(key_for(alias)); ai != g_index.by_key.end()) return ai->second;
        }
    }
    return std::nullopt;
}
 
std::optional<AppMetadata> lookup_prefix(const std::vector<std::string>& candidates) {
    for (const auto& c : candidates) {
        const auto needle = key_for(c);
        if (needle.size() < 4) continue;
        for (const auto& [key, meta] : g_index.by_key) {
            if (key.size() < 4) continue;
            if ((key.size() > needle.size() && key.compare(0, needle.size(), needle) == 0) ||
                (needle.size() > key.size() && needle.compare(0, key.size(), key) == 0)) {
                return meta;
            }
        }
    }
    return std::nullopt;
}
 
AppMetadata fallback_metadata(const std::string& app_comm,
                              const std::string& app_path,
                              const std::vector<std::string>& app_args) {
    AppMetadata meta;
    if (!app_comm.empty() && !looks_like_thread_name(app_comm)) {
        meta.display_name = app_comm;
    } else if (!app_path.empty()) {
        meta.display_name = basename_of(app_path);
    } else if (!app_args.empty() && !app_args.front().empty()) {
        meta.display_name = basename_of(app_args.front());
    } else if (!app_comm.empty()) {
        meta.display_name = app_comm;
    } else {
        meta.display_name = kUnknownProcessLabel;
    }
 
    std::string icon_guess = basename_of(app_path.empty() ? app_comm : app_path);
    icon_guess = key_for(icon_guess);
    if (!icon_guess.empty() && !looks_like_thread_name(icon_guess)) meta.icon_name = icon_guess;
    else meta.icon_name = kGenericIcon;
    return meta;
}
 
} // namespace
 
AppMetadata resolve_app_metadata(const std::string& app_comm,
                                 const std::string& app_path,
                                 const std::vector<std::string>& app_args) {
    std::lock_guard lock(g_index_mutex);
    build_index_locked();
 
    std::vector<std::string> candidates;
    add_candidate(candidates, app_path);
    if (!app_args.empty()) add_candidate(candidates, app_args.front());
    add_candidate(candidates, app_comm);
 
    if (auto found = lookup_exact_or_alias(candidates)) return *found;
    if (auto found = lookup_prefix(candidates)) return *found;
    return fallback_metadata(app_comm, app_path, app_args);
}
 
std::string best_app_display_name(const std::string& app_comm,
                                  const std::string& app_path,
                                  const std::vector<std::string>& app_args) {
    return resolve_app_metadata(app_comm, app_path, app_args).display_name;
}
 
std::string best_app_icon_name(const std::string& app_comm,
                               const std::string& app_path,
                               const std::vector<std::string>& app_args) {
    auto icon = resolve_app_metadata(app_comm, app_path, app_args).icon_name;
    return icon.empty() ? kGenericIcon : icon;
}
 
bool is_safe_local_address(const std::string& address) {
    const auto s = normalized_address(address);
    if (s.empty()) return false;
 
    if (s == "localhost" || s == "localhost.localdomain" || s == "ip6-localhost") return true;
    if (s == "::1" || s == "0:0:0:0:0:0:0:1") return true;
 
    // Endpoint unspecified che indicano binding/traffico locale, non Internet.
    if (s == "0.0.0.0" || s == "::" || s == "0:0:0:0:0:0:0:0") return true;
 
    // IPv4 loopback 127.0.0.0/8 e IPv4-mapped IPv6 loopback.
    if (s.rfind("127.", 0) == 0) return true;
    if (s.rfind("::ffff:127.", 0) == 0) return true;
    if (s.rfind("0:0:0:0:0:ffff:127.", 0) == 0) return true;
 
    return false;
}
 
bool is_safe_local_connection(const std::string& dst_ip, const std::string& src_ip) {
    return is_safe_local_address(dst_ip) || is_safe_local_address(src_ip);
}
 
std::string safe_local_process_label() {
    return kSafeLocalProcessLabel;
}
 
std::string safe_local_process_icon_name() {
    return kSafeLocalProcessIcon;
}
 
std::string best_connection_display_name(const std::string& app_comm,
                                         const std::string& app_path,
                                         const std::vector<std::string>& app_args,
                                         const std::string& dst_ip,
                                         const std::string& src_ip) {
    const auto display = best_app_display_name(app_comm, app_path, app_args);
    if (is_unknown_display_name(display)
        && !has_reliable_process_identity(app_comm, app_path, app_args)
        && is_safe_local_connection(dst_ip, src_ip)) {
        return kSafeLocalProcessLabel;
    }
    return display;
}
 
std::string best_connection_icon_name(const std::string& app_comm,
                                      const std::string& app_path,
                                      const std::vector<std::string>& app_args,
                                      const std::string& dst_ip,
                                      const std::string& src_ip) {
    if (!has_reliable_process_identity(app_comm, app_path, app_args)
        && is_safe_local_connection(dst_ip, src_ip)) {
        return kSafeLocalProcessIcon;
    }
    return best_app_icon_name(app_comm, app_path, app_args);
}
 
 
} // namespace bsc::ui_util