VpnPage.cpp

Go to the documentation of this file.

/*
 * BastionGuard™
 * Copyright (C) 2025–2026 Calogero Scarnà
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, version 3.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * BastionGuard™ is a trademark of Calogero Scarnà.
 * The BastionGuard™ name and branding are not licensed under the GPL.
 */
 
#include "vpn/VpnPage.hpp"
 
#include <glibmm/i18n.h>
#include <glibmm/main.h>
#include <thread>
#include <utility>
 
using namespace BastionGuard;
 
VpnPage::VpnPage()
    : Gtk::Box(Gtk::Orientation::VERTICAL, 14) {
    backend_ = std::make_unique<WireguardBackend>("wg0");
    build_ui();
 
    append_log(_("Pagina VPN inizializzata."));
 
    std::string missing;
    if (!backend_->tooling_available(&missing)) {
        append_log(_("⚠ Strumenti WireGuard mancanti: ") + missing +
                   _(". Installa il pacchetto 'wireguard-tools'."));
        btn_connect_.set_sensitive(false);
        btn_gen_keys_.set_sensitive(false);
        btn_generate_.set_sensitive(false);
    }
 
    on_refresh_ip_clicked();
 
 
    poll_conn_ = Glib::signal_timeout().connect(
        sigc::mem_fun(*this, &VpnPage::on_poll_status), 4000);
}
 
VpnPage::~VpnPage() {
    if (alive_) alive_->store(false);
    if (poll_conn_.connected()) poll_conn_.disconnect();
}
 
// ---------------------------------------------------------------------------
// Helper layout: riga "etichetta + campo"
// ---------------------------------------------------------------------------
Gtk::Box* VpnPage::labeled_row(const std::string& label, Gtk::Widget& field) {
    auto row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lbl = Gtk::make_managed<Gtk::Label>(label);
    lbl->set_halign(Gtk::Align::START);
    lbl->set_size_request(180, -1);
    lbl->set_xalign(0.0f);
    field.set_hexpand(true);
    row->append(*lbl);
    row->append(field);
    return row;
}
 
// ---------------------------------------------------------------------------
// Costruzione UI
// ---------------------------------------------------------------------------
void VpnPage::build_ui() {
    set_margin(20);
    get_style_context()->add_class("content");
 
    lbl_title_.set_text(_("VPN WireGuard"));
    lbl_title_.set_halign(Gtk::Align::START);
    lbl_title_.get_style_context()->add_class("page-title");
    append(lbl_title_);
 
    lbl_subtitle_.set_text(
        _("Connettiti al tuo server WireGuard e maschera il tuo IP pubblico."));
    lbl_subtitle_.set_halign(Gtk::Align::START);
    lbl_subtitle_.get_style_context()->add_class("page-subtitle");
    append(lbl_subtitle_);
 
    // ===================================================================
    // Corpo a due colonne: a sinistra le tab, a destra il log.
    // ===================================================================
    auto columns = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 16);
    columns->set_vexpand(true);
    columns->set_margin_top(10);
 
    // --- Colonna sinistra: notebook con le schede ---
    notebook_.set_vexpand(true);
    notebook_.set_hexpand(true);
    notebook_.append_page(*build_tab_connection(), _("Connessione"));
    notebook_.append_page(*build_tab_config(),     _("Configurazione"));
    notebook_.append_page(*build_tab_killswitch(), _("Kill-switch"));
    columns->append(notebook_);
 
    // --- Colonna destra: pannello informativo ---
    auto right_col = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 12);
    right_col->set_size_request(320, -1);   // larghezza fissa del pannello
    right_col->set_vexpand(true);
 
    // Log (riempie il resto della colonna destra)
    auto log_lbl = Gtk::make_managed<Gtk::Label>(_("Log"));
    log_lbl->set_halign(Gtk::Align::START);
    log_lbl->get_style_context()->add_class("section-label");
    right_col->append(*log_lbl);
 
    txt_log_.set_editable(false);
    txt_log_.set_monospace(true);
    txt_log_.set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
    log_scroller_.set_child(txt_log_);
    log_scroller_.set_vexpand(true);
    log_scroller_.set_policy(Gtk::PolicyType::AUTOMATIC, Gtk::PolicyType::AUTOMATIC);
    right_col->append(log_scroller_);
 
    columns->append(*right_col);
    append(*columns);
}
 
Gtk::Widget* VpnPage::build_tab_connection() {
    tab_conn_.set_margin(14);
 
    auto btn_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    btn_connect_.set_label(_("Connetti"));
    btn_connect_.get_style_context()->add_class("suggested-action");
    btn_disconnect_.set_label(_("Disconnetti"));
    btn_disconnect_.set_sensitive(false);
    spinner_.set_visible(false);
    btn_row->append(btn_connect_);
    btn_row->append(btn_disconnect_);
    btn_row->append(spinner_);
    tab_conn_.append(*btn_row);
 
    lbl_state_.set_text(_("Stato: disconnesso"));
    lbl_state_.set_halign(Gtk::Align::START);
    lbl_endpoint_.set_text(_("Endpoint: —"));
    lbl_endpoint_.set_halign(Gtk::Align::START);
    tab_conn_.append(lbl_state_);
    tab_conn_.append(lbl_endpoint_);
 
    auto sep = Gtk::make_managed<Gtk::Separator>(Gtk::Orientation::HORIZONTAL);
    tab_conn_.append(*sep);
 
    auto ip_lbl = Gtk::make_managed<Gtk::Label>(_("IP pubblico"));
    ip_lbl->set_halign(Gtk::Align::START);
    ip_lbl->get_style_context()->add_class("section-label");
    tab_conn_.append(*ip_lbl);
 
    lbl_ip_before_.set_text(_("Prima del tunnel: —"));
    lbl_ip_before_.set_halign(Gtk::Align::START);
    lbl_ip_after_.set_text(_("Con tunnel attivo: —"));
    lbl_ip_after_.set_halign(Gtk::Align::START);
    btn_refresh_ip_.set_label(_("Aggiorna IP"));
    btn_refresh_ip_.set_halign(Gtk::Align::START);
    tab_conn_.append(lbl_ip_before_);
    tab_conn_.append(lbl_ip_after_);
    tab_conn_.append(btn_refresh_ip_);
 
    btn_connect_.signal_clicked().connect(
        sigc::mem_fun(*this, &VpnPage::on_connect_clicked));
    btn_disconnect_.signal_clicked().connect(
        sigc::mem_fun(*this, &VpnPage::on_disconnect_clicked));
    btn_refresh_ip_.signal_clicked().connect(
        sigc::mem_fun(*this, &VpnPage::on_refresh_ip_clicked));
 
    return &tab_conn_;
}
 
Gtk::Widget* VpnPage::build_tab_config() {
    tab_config_.set_margin(14);
 
    // --- Sezione chiavi client ---
    auto keys_lbl = Gtk::make_managed<Gtk::Label>(_("Chiavi del client"));
    keys_lbl->set_halign(Gtk::Align::START);
    keys_lbl->get_style_context()->add_class("section-label");
    tab_config_.append(*keys_lbl);
 
    entry_client_priv_.set_editable(false);
    entry_client_priv_.set_placeholder_text(_("(generata localmente)"));
    entry_client_priv_.set_visibility(false); // nascondi la chiave privata
    entry_client_pub_.set_editable(false);
    entry_client_pub_.set_placeholder_text(_("(da comunicare al tuo server)"));
    btn_gen_keys_.set_label(_("Genera chiavi"));
    btn_gen_keys_.set_halign(Gtk::Align::START);
 
    tab_config_.append(*labeled_row(_("Chiave privata:"), entry_client_priv_));
    tab_config_.append(*labeled_row(_("Chiave pubblica:"), entry_client_pub_));
    tab_config_.append(btn_gen_keys_);
 
    auto sep1 = Gtk::make_managed<Gtk::Separator>(Gtk::Orientation::HORIZONTAL);
    tab_config_.append(*sep1);
 
    // --- Sezione dati server ---
    auto srv_lbl = Gtk::make_managed<Gtk::Label>(_("Dati del tuo server"));
    srv_lbl->set_halign(Gtk::Align::START);
    srv_lbl->get_style_context()->add_class("section-label");
    tab_config_.append(*srv_lbl);
 
    entry_server_pub_.set_placeholder_text(_("Chiave pubblica del server"));
    entry_endpoint_.set_placeholder_text(_("es. vpn.miosito.it:51820"));
    entry_address_.set_placeholder_text(_("es. 10.0.0.2/32"));
    entry_dns_.set_placeholder_text(_("es. 10.0.0.1 (opzionale)"));
    entry_allowed_.set_placeholder_text(_("0.0.0.0/0, ::/0"));
    entry_allowed_.set_text("0.0.0.0/0, ::/0");
 
    tab_config_.append(*labeled_row(_("Chiave pubblica server:"), entry_server_pub_));
    tab_config_.append(*labeled_row(_("Endpoint (host:porta):"), entry_endpoint_));
    tab_config_.append(*labeled_row(_("Indirizzo client:"), entry_address_));
    tab_config_.append(*labeled_row(_("DNS:"), entry_dns_));
    tab_config_.append(*labeled_row(_("AllowedIPs:"), entry_allowed_));
 
    btn_generate_.set_label(_("Genera e carica"));
    btn_generate_.get_style_context()->add_class("suggested-action");
    btn_generate_.set_halign(Gtk::Align::START);
    tab_config_.append(btn_generate_);
 
    auto sep2 = Gtk::make_managed<Gtk::Separator>(Gtk::Orientation::HORIZONTAL);
    tab_config_.append(*sep2);
 
    // --- Sezione import alternativo ---
    auto imp_lbl = Gtk::make_managed<Gtk::Label>(
        _("In alternativa, importa un file .conf esistente"));
    imp_lbl->set_halign(Gtk::Align::START);
    imp_lbl->get_style_context()->add_class("section-label");
    tab_config_.append(*imp_lbl);
 
    auto imp_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    entry_conf_path_.set_hexpand(true);
    entry_conf_path_.set_placeholder_text(_("/percorso/al/tuo/wg0.conf"));
    btn_browse_.set_label(_("Sfoglia…"));
    btn_import_.set_label(_("Importa"));
    imp_row->append(entry_conf_path_);
    imp_row->append(btn_browse_);
    imp_row->append(btn_import_);
    tab_config_.append(*imp_row);
 
    btn_gen_keys_.signal_clicked().connect(
        sigc::mem_fun(*this, &VpnPage::on_generate_keys_clicked));
    btn_generate_.signal_clicked().connect(
        sigc::mem_fun(*this, &VpnPage::on_generate_config_clicked));
    btn_browse_.signal_clicked().connect(
        sigc::mem_fun(*this, &VpnPage::on_browse_clicked));
    btn_import_.signal_clicked().connect(
        sigc::mem_fun(*this, &VpnPage::on_import_clicked));
 
    // La scheda config può crescere: avvolgila in uno scroller.
    auto scroller = Gtk::make_managed<Gtk::ScrolledWindow>();
    scroller->set_child(tab_config_);
    scroller->set_policy(Gtk::PolicyType::NEVER, Gtk::PolicyType::AUTOMATIC);
    return scroller;
}
 
Gtk::Widget* VpnPage::build_tab_killswitch() {
    tab_ks_.set_margin(14);
 
    auto row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto lbl = Gtk::make_managed<Gtk::Label>(
        _("Blocca tutto il traffico se il tunnel cade"));
    lbl->set_hexpand(true);
    lbl->set_halign(Gtk::Align::START);
    switch_ks_.set_valign(Gtk::Align::CENTER);
    row->append(*lbl);
    row->append(switch_ks_);
    tab_ks_.append(*row);
 
    auto note = Gtk::make_managed<Gtk::Label>(
        _("Quando attivo, il traffico in uscita è consentito solo attraverso "
          "il tunnel WireGuard. Se la VPN cade, la connessione viene bloccata."));
    note->set_halign(Gtk::Align::START);
    note->set_wrap(true);
    note->get_style_context()->add_class("dim-label");
    tab_ks_.append(*note);
 
    switch_ks_.property_active().signal_changed().connect(
        sigc::mem_fun(*this, &VpnPage::on_killswitch_toggled));
 
    return &tab_ks_;
}
 
// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------
void VpnPage::append_log(const std::string& line) {
    auto buf = txt_log_.get_buffer();
    buf->insert(buf->end(), line + "\n");
    auto mark = buf->create_mark(buf->end());
    txt_log_.scroll_to(mark);
    buf->delete_mark(mark);
}
 
void VpnPage::set_busy(bool b) {
    busy_ = b;
    spinner_.set_visible(b);
    if (b) spinner_.start();
    else   spinner_.stop();
 
    const bool enable = !b;
    btn_connect_.set_sensitive(enable);
    btn_disconnect_.set_sensitive(enable);
    btn_import_.set_sensitive(enable);
    btn_generate_.set_sensitive(enable);
    btn_gen_keys_.set_sensitive(enable);
    btn_refresh_ip_.set_sensitive(enable);
    btn_browse_.set_sensitive(enable);
}
 
void VpnPage::refresh_state_ui(const WgStatus& st) {
    const bool enable = !busy_;
    if (st.up) {
        lbl_state_.set_text(_("Stato: connesso"));
        lbl_state_.get_style_context()->remove_class("state-down");
        lbl_state_.get_style_context()->add_class("state-up");
        // Endpoint: preferisci quello riportato da `wg show`; se assente
        // (perché richiede privilegi) usa quello della config caricata.
        std::string ep = st.endpoint;
        if (ep.empty()) ep = backend_->configured_endpoint();
        lbl_endpoint_.set_text(
            _("Endpoint: ") + (ep.empty() ? std::string("—") : ep));
        btn_connect_.set_sensitive(false);
        btn_disconnect_.set_sensitive(enable);
    } else {
        lbl_state_.set_text(_("Stato: disconnesso"));
        lbl_state_.get_style_context()->remove_class("state-up");
        lbl_state_.get_style_context()->add_class("state-down");
        lbl_endpoint_.set_text(_("Endpoint: —"));
        btn_connect_.set_sensitive(enable);
        // "Disconnetti" resta attivo anche da disconnesso: serve per ripulire
        // un'interfaccia wg0 rimasta appesa dopo un tentativo fallito.
        btn_disconnect_.set_sensitive(enable);
    }
}
 
// ---------------------------------------------------------------------------
 
 
 
void VpnPage::run_async(std::function<OpResult()> work,
                        std::function<void(OpResult)> done) {
    set_busy(true);
    auto alive = alive_;
    std::thread([this, alive, work = std::move(work), done = std::move(done)]() {
        OpResult r = work();
        Glib::signal_idle().connect_once([this, alive, r, done]() {
            if (!*alive) return;
            set_busy(false);
            done(r);
        });
    }).detach();
}
 
// ---------------------------------------------------------------------------
// Azioni: Configurazione
// ---------------------------------------------------------------------------
void VpnPage::on_generate_keys_clicked() {
 
    append_log(_("Generazione coppia di chiavi…"));
    run_async(
        [this]() {
            OpResult r;
            auto kp = backend_->generate_keys();
            if (kp) {
                r.ok = true;
                // impacchettiamo priv|pub nel campo output (separati da \n)
                r.output = kp->private_key + "\n" + kp->public_key;
            } else {
                r.ok = false;
                r.output = "generazione chiavi fallita";
            }
            return r;
        },
        [this](OpResult r) {
            if (!r.ok) { append_log(_("✗ Generazione chiavi fallita.")); return; }
            auto nl = r.output.find('\n');
            std::string priv = r.output.substr(0, nl);
            std::string pub  = (nl == std::string::npos) ? "" : r.output.substr(nl + 1);
            entry_client_priv_.set_text(priv);
            entry_client_pub_.set_text(pub);
            append_log(_("✔ Chiavi generate. Comunica la chiave pubblica al server."));
        });
}
 
void VpnPage::on_generate_config_clicked() {
 
    if (entry_client_priv_.get_text().empty()) {
        append_log(_("Genera prima le chiavi del client."));
        return;
    }
 
    WgConfigParams p;
    p.private_key       = entry_client_priv_.get_text();
    p.server_public_key = entry_server_pub_.get_text();
    p.endpoint          = entry_endpoint_.get_text();
    p.address           = entry_address_.get_text();
    p.dns               = entry_dns_.get_text();
    p.allowed_ips       = entry_allowed_.get_text();
 
    std::string err;
    if (backend_->load_from_params(p, &err)) {
        append_log(_("✔ Configurazione caricata. Premi Connetti per attivare il tunnel."));
    } else {
        append_log(_("✗ Configurazione non valida: ") + err);
    }
}
 
void VpnPage::on_browse_clicked() {
    auto parent = dynamic_cast<Gtk::Window*>(get_root());
    auto dialog = Gtk::make_managed<Gtk::FileChooserDialog>(
        *parent, _("Seleziona configurazione WireGuard"),
        Gtk::FileChooser::Action::OPEN);
 
    dialog->add_button(_("Annulla"), Gtk::ResponseType::CANCEL);
    dialog->add_button(_("Apri"), Gtk::ResponseType::OK);
 
    auto filter = Gtk::FileFilter::create();
    filter->set_name(_("File WireGuard (*.conf)"));
    filter->add_pattern("*.conf");
    dialog->add_filter(filter);
 
    auto alive = alive_;
    dialog->signal_response().connect(
        [this, alive, dialog](int response) {
            if (*alive && response == Gtk::ResponseType::OK) {
                auto file = dialog->get_file();
                if (file) entry_conf_path_.set_text(file->get_path());
            }
            dialog->hide();
        });
    dialog->present();
}
 
void VpnPage::on_import_clicked() {
 
    std::string path = entry_conf_path_.get_text();
    if (path.empty()) { append_log(_("Nessun file selezionato.")); return; }
 
    std::string err;
    if (backend_->load_from_conf(path, &err)) {
        append_log(_("✔ Configurazione importata. Premi Connetti per attivare il tunnel."));
    } else {
        append_log(_("✗ Import fallito: ") + err);
    }
}
 
// ---------------------------------------------------------------------------
// Azioni: Connessione
// ---------------------------------------------------------------------------
void VpnPage::on_connect_clicked() {
 
    if (!backend_->has_spec()) {
        append_log(_("Nessuna configurazione caricata. Importa un file .conf "
                     "dalla scheda Configurazione, oppure compila i campi e premi "
                     "\"Genera e carica\"."));
        notebook_.set_current_page(1);
        return;
    }
 
    append_log(_("Connessione al server WireGuard…"));
    run_async(
        [this]() { return backend_->connect(); },
        [this](OpResult r) {
            if (r.ok) {
                append_log(_("✔ Tunnel attivo."));
                refresh_state_ui(backend_->status());
                // Attendi ~1.5s che l'handshake e la route si stabilizzino,
                // poi interroga esplicitamente l'IP "con tunnel attivo".
                auto alive = alive_;
                Glib::signal_timeout().connect_once(
                    [this, alive]() {
                        if (!*alive) return;
                        append_log(_("Verifica IP pubblico con tunnel…"));
                        refresh_public_ip(IpSlot::After);
                    },
                    1500);
            } else {
                append_log(_("✗ Connessione fallita: ") + r.output);
            }
        });
}
 
void VpnPage::on_disconnect_clicked() {
 
    append_log(_("Disconnessione…"));
    run_async(
        [this]() { return backend_->disconnect(); },
        [this](OpResult r) {
            if (r.ok) {
                append_log(_("✔ Tunnel chiuso."));
                lbl_ip_after_.set_text(_("Con tunnel attivo: —"));
            } else {
                append_log(_("✗ Disconnessione fallita: ") + r.output);
            }
            refresh_state_ui(backend_->status());
        });
}
 
void VpnPage::on_refresh_ip_clicked() {
    refresh_public_ip(IpSlot::Auto);
}
 
void VpnPage::refresh_public_ip(IpSlot slot) {
    // Risolvi "Auto" una sola volta, qui, in base allo stato corrente.
    if (slot == IpSlot::Auto)
        slot = backend_->status().up ? IpSlot::After : IpSlot::Before;
 
    run_async(
        [this]() {
            OpResult r;
            auto ip = backend_->public_ip();
            r.ok = ip.has_value();
            r.output = ip.value_or("");
            return r;
        },
        [this, slot](OpResult r) {
            if (!r.ok) {
                append_log(_("Impossibile determinare l'IP pubblico."));
                return;
            }
            if (slot == IpSlot::After) {
                lbl_ip_after_.set_text(_("Con tunnel attivo: ") + r.output);
                if (!ip_before_.empty()) {
                    if (ip_before_ != r.output)
                        append_log(_("✔ IP pubblico mascherato correttamente."));
                    else
                        append_log(_("⚠ L'IP pubblico non è cambiato: verifica "
                                     "AllowedIPs = 0.0.0.0/0, ::/0 e il NAT sul server."));
                }
            } else {
                ip_before_ = r.output;
                lbl_ip_before_.set_text(_("Prima del tunnel: ") + r.output);
            }
        });
}
 
// ---------------------------------------------------------------------------
// Azioni: Kill-switch
// ---------------------------------------------------------------------------
void VpnPage::on_killswitch_toggled() {
 
    bool enable = switch_ks_.get_active();
    append_log(enable ? _("Attivazione kill-switch…")
                      : _("Disattivazione kill-switch…"));
    run_async(
        [this, enable]() {
            return enable ? backend_->killswitch_enable()
                          : backend_->killswitch_disable();
        },
        [this, enable](OpResult r) {
            if (r.ok) {
                append_log(enable ? _("✔ Kill-switch attivo.")
                                  : _("✔ Kill-switch disattivato."));
            } else {
                append_log(_("✗ Operazione kill-switch fallita: ") + r.output);
                switch_ks_.set_active(backend_->killswitch_active());
            }
        });
}
 
// ---------------------------------------------------------------------------
// Polling
// ---------------------------------------------------------------------------
bool VpnPage::on_poll_status() {
    if (!*alive_) return false;
    if (busy_) return true;
    refresh_state_ui(backend_->status());
    return true;
}