CaInstaller Namespace Reference

Functions
static fs::path	ca_src_path ()
static fs::path	stamp_path ()
static std::string	ca_fingerprint (const fs::path &ca_path)
static bool	stamp_is_valid ()
static void	write_stamp ()
static bool	run (const std::vector< std::string > &args)
static std::string	current_home ()
static std::vector< std::string >	glob_expand (const std::string &pat)
static bool	is_system_trusted ()
static void	nss_add (const std::string &nssdb)
static void	install_nss_user (const std::string &home)
static bool	install_system_via_pkexec ()
static bool	ensure_trusted ()

Variables
static constexpr const char *	CA_NAME = "BastionGuard-CA"
static constexpr const char *	HELPER

Function Documentation

ca_fingerprint()

std::string CaInstaller::ca_fingerprint ( const fs::path & ca_path )

inlinestatic

Definition at line 59 of file ca_installer.hpp.

                                                              {
    const auto result = bg_process::run({"openssl", "x509", "-in", ca_path.string(),
                                         "-noout", "-fingerprint", "-sha1"});
    if (!result.ok()) return {};
    const auto eq = result.output.find('=');
    if (eq == std::string::npos) return {};
    std::string fingerprint = result.output.substr(eq + 1);
    while (!fingerprint.empty() && (fingerprint.back() == '\n' || fingerprint.back() == '\r'))
        fingerprint.pop_back();
    return fingerprint;
}

References ca_fingerprint(), bg_process::Result::output, and bg_process::run().

Referenced by ca_fingerprint(), stamp_is_valid(), and write_stamp().

ca_src_path()

fs::path CaInstaller::ca_src_path ( )

inlinestatic

Definition at line 47 of file ca_installer.hpp.

                                   {
    const char* h = std::getenv("HOME");
    return fs::path(h ? h : "/tmp")
           / ".local/share/BastionGuard/certs/intercept-ca.crt.pem";
}

References ca_src_path().

Referenced by ca_src_path(), ensure_trusted(), install_nss_user(), install_system_via_pkexec(), is_system_trusted(), nss_add(), stamp_is_valid(), and write_stamp().

current_home()

std::string CaInstaller::current_home ( )

inlinestatic

Definition at line 92 of file ca_installer.hpp.

                                       {
    const char* h = std::getenv("HOME");
    if (h && *h) return h;
    const passwd* pw = getpwuid(getuid());
    return pw ? pw->pw_dir : "";
}

References current_home().

Referenced by current_home(), and ensure_trusted().

ensure_trusted()

bool CaInstaller::ensure_trusted ( )

inlinestatic

Definition at line 179 of file ca_installer.hpp.

                                    {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[ca-installer] CEF/CA disabilitati su Fedora/RHEL/Alma/Rocky\n");
        return false;
    }
    const fs::path ca_path = ca_src_path();
 
    if (!fs::exists(ca_path)) {
        std::cerr << _("[ca-installer] ❌ CA intercept non trovata: ") << ca_path << "\n";
        std::cerr << _("[ca-installer] ℹ️  Verrà generata al primo avvio del proxy TLS\n");
        return false;
    }
 
    const std::string home = current_home();
    if (stamp_is_valid() && is_system_trusted()) {
        std::cerr << _("[ca-installer] ✅ CA già trusted (sentinel valido)\n");
        install_nss_user(home);
        return true;
    }
 
    std::cerr << _("[ca-installer] 🔄 CA nuova o non ancora trusted — installazione...\n");
    if (!install_system_via_pkexec()) {
        std::cerr << _("[ca-installer] ⚠️  Fallback sudo...\n");
        const bool sudo_ok =
            run({"sudo", HELPER, ca_path.string()});
        if (!sudo_ok) {
            std::cerr << _("[ca-installer] ❌ Impossibile installare CA nel sistema\n");
            install_nss_user(home);
            return false;
        }
        write_stamp();
    }
 
    install_nss_user(home);
    return true;
}

References _, ca_src_path(), current_home(), ensure_trusted(), HELPER, install_nss_user(), install_system_via_pkexec(), BastionGuard::Platform::is_fedora_rhel_family(), is_system_trusted(), run(), stamp_is_valid(), and write_stamp().

Referenced by ensure_trusted().

glob_expand()

std::vector< std::string > CaInstaller::glob_expand ( const std::string & pat )

inlinestatic

Definition at line 99 of file ca_installer.hpp.

                                                                     {
    std::vector<std::string> out;
    glob_t g{};
    if (glob(pat.c_str(), GLOB_NOSORT | GLOB_TILDE, nullptr, &g) == 0)
        for (size_t i = 0; i < g.gl_pathc; ++i)
            out.emplace_back(g.gl_pathv[i]);
    globfree(&g);
    return out;
}

References glob_expand().

Referenced by glob_expand(), and install_nss_user().

install_nss_user()

void CaInstaller::install_nss_user ( const std::string & home )

inlinestatic

Definition at line 137 of file ca_installer.hpp.

                                                           {
    if (home.empty() || !fs::exists(ca_src_path())) return;
 
    for (const auto& pat : std::vector<std::string>{
            home + "/.mozilla/firefox/*.default",
            home + "/.mozilla/firefox/*.default-release",
            home + "/.mozilla/firefox/*.default-esr",
            home + "/.var/app/org.mozilla.firefox/.mozilla/firefox/*.default",
            home + "/.var/app/org.mozilla.firefox/.mozilla/firefox/*.default-release",
            home + "/.pki/nssdb",
            home + "/snap/chromium/current/.pki/nssdb",
        })
    {
        for (const auto& match : glob_expand(pat))
            nss_add(match);
    }
 
    std::cerr << _("[ca-installer] NSS utente aggiornato\n");
}

References _, ca_src_path(), glob_expand(), install_nss_user(), and nss_add().

Referenced by ensure_trusted(), and install_nss_user().

install_system_via_pkexec()

bool CaInstaller::install_system_via_pkexec ( )

inlinestatic

Definition at line 157 of file ca_installer.hpp.

                                               {
    if (BastionGuard::Platform::is_fedora_rhel_family()) {
        std::cerr << _("[ca-installer] CA di sistema disabilitata su Fedora/RHEL/Alma/Rocky\n");
        return false;
    }
    if (!fs::exists(HELPER)) {
        std::cerr << _("[ca-installer] ❌ helper non trovato: ") << HELPER << "\n";
        return false;
    }
 
    std::cerr << _("[ca-installer] 🔐 Richiesta autorizzazione installazione CA...\n");
    if (!run({"pkexec", HELPER, ca_src_path().string()})) {
        std::cerr << _("[ca-installer] ❌ pkexec fallito o rifiutato dall'utente\n");
        return false;
    }
 
    write_stamp();
 
    std::cerr << _("[ca-installer] ✅ CA installata nel sistema via pkexec\n");
    return true;
}

References _, ca_src_path(), HELPER, install_system_via_pkexec(), BastionGuard::Platform::is_fedora_rhel_family(), run(), and write_stamp().

Referenced by ensure_trusted(), and install_system_via_pkexec().

is_system_trusted()

bool CaInstaller::is_system_trusted ( )

inlinestatic

Definition at line 109 of file ca_installer.hpp.

                                       {
    const std::string ca = ca_src_path().string();
    if (!fs::exists(ca)) return false;
    for (const auto& bundle : {
            std::string("/etc/ssl/certs/ca-certificates.crt"),
            std::string("/etc/pki/tls/certs/ca-bundle.crt"),
            std::string("/etc/ssl/ca-bundle.pem"),
            std::string("/etc/pki/tls/cacert.pem"),
            std::string("/usr/share/ca-certificates/ca-bundle.crt"),
            std::string("/etc/ssl/certs/ca-bundle.crt"),
        })
    {
        if (fs::exists(bundle) &&
            run({"openssl", "verify", "-CAfile", bundle, ca}))
            return true;
    }
    return false;
}

References ca_src_path(), is_system_trusted(), and run().

Referenced by ensure_trusted(), and is_system_trusted().

nss_add()

void CaInstaller::nss_add ( const std::string & nssdb )

inlinestatic

Definition at line 128 of file ca_installer.hpp.

                                                   {
    if (!fs::exists(nssdb)) return;
    const std::string ca = ca_src_path().string();
    if (!fs::exists(ca)) return;
    const std::string prefix = fs::exists(nssdb + "/cert9.db") ? "sql:" : "dbm:";
    run({"certutil", "-A", "-d", prefix + nssdb,
         "-n", CA_NAME, "-t", "CT,,", "-i", ca});
}

References CA_NAME, ca_src_path(), nss_add(), and run().

Referenced by install_nss_user(), and nss_add().

run()

bool CaInstaller::run ( const std::vector< std::string > & args )

inlinestatic

Definition at line 88 of file ca_installer.hpp.

                                                         {
    return bg_process::run(args).ok();
}

References bg_process::Result::ok(), bg_process::run(), and run().

Referenced by ensure_trusted(), install_system_via_pkexec(), is_system_trusted(), nss_add(), and run().

stamp_is_valid()

bool CaInstaller::stamp_is_valid ( )

inlinestatic

Definition at line 71 of file ca_installer.hpp.

                                    {
    if (!fs::exists(stamp_path())) return false;
    std::ifstream f(stamp_path());
    std::string stamped_fp;
    std::getline(f, stamped_fp);
    const std::string current_fp = ca_fingerprint(ca_src_path());
    return !current_fp.empty() && (stamped_fp == current_fp);
}

References ca_fingerprint(), ca_src_path(), stamp_is_valid(), and stamp_path().

Referenced by ensure_trusted(), and stamp_is_valid().

stamp_path()

fs::path CaInstaller::stamp_path ( )

inlinestatic

Definition at line 53 of file ca_installer.hpp.

                                  {
    const char* h = std::getenv("HOME");
    return fs::path(h ? h : "/tmp")
           / ".local/share/BastionGuard/ca-installed.stamp";
}

References stamp_path().

Referenced by stamp_is_valid(), stamp_path(), and write_stamp().

write_stamp()

void CaInstaller::write_stamp ( )

inlinestatic

Definition at line 80 of file ca_installer.hpp.

                                 {
    try {
        fs::create_directories(stamp_path().parent_path());
        std::ofstream f(stamp_path());
        f << ca_fingerprint(ca_src_path()) << "\n";
    } catch (...) {}
}

References ca_fingerprint(), ca_src_path(), stamp_path(), and write_stamp().

Referenced by ensure_trusted(), install_system_via_pkexec(), and write_stamp().

Variable Documentation

CA_NAME

const char* CaInstaller::CA_NAME = "BastionGuard-CA"

staticconstexpr

Definition at line 42 of file ca_installer.hpp.

Referenced by nss_add().

HELPER

const char* CaInstaller::HELPER

staticconstexpr

Initial value:

                                =
"/usr/share/BastionGuard/data/scripts/install-ca-system.sh"

Definition at line 44 of file ca_installer.hpp.

Referenced by ensure_trusted(), and install_system_via_pkexec().