BastionGuard Namespace Reference

Namespaces
namespace	Activation
namespace	nativehost
namespace	Platform
namespace	RootGuard
namespace	wizard

Classes
class	DnsmasqBackend
struct	OpResult
struct	WgConfigParams
struct	WgKeyPair
struct	WgPeer
struct	WgStatus
struct	WgTunnelSpec
class	WireguardBackend

Typedefs
using	AliveFlag = std::shared_ptr<std::atomic<bool>>

Functions
AliveFlag	make_alive_flag ()
template<typename Fn>
void	if_alive (const AliveFlag &alive, Fn &&fn)
static void	load_list_file (const std::string &path, std::vector< std::string > &out, bool is_blacklist)
static void	ensure_loaded (const std::string &bl, const std::string &wl)
static bool	in_path_ (const char *bin)
static std::string	strip_ (std::string s)
static std::vector< std::string >	split_csv_ (const std::string &s)
static bool	parse_uint_range_ (const std::string &s, unsigned min, unsigned max)
static bool	valid_wg_key_ (const std::string &s)
static bool	valid_ip_ (const std::string &s)
static bool	valid_cidr_ (const std::string &s)
static bool	valid_hostname_ (const std::string &host)
static bool	valid_endpoint_ (const std::string &endpoint)
static bool	valid_iface_ (const std::string &iface)
static bool	validate_spec_ (const WgTunnelSpec &sp, std::string *err)
static bool	needs_default_route_ (const WgTunnelSpec &sp)

Variables
static std::mutex	g_mutex
static std::atomic< bool >	g_loaded {false}
static std::vector< std::string >	g_blacklist
static std::vector< std::string >	g_whitelist
static const char *	kKsTable = "bastionguard_ks"

Typedef Documentation

AliveFlag

using BastionGuard::AliveFlag = std::shared_ptr<std::atomic<bool>>

Definition at line 65 of file LifetimeGuard.hpp.

Function Documentation

ensure_loaded()

void BastionGuard::ensure_loaded ( const std::string & bl, const std::string & wl )

static

Definition at line 79 of file dnsmasq_backend.cpp.

{
    if (g_loaded.load()) return;
 
    std::lock_guard<std::mutex> lock(g_mutex);
    if (g_loaded) return;
 
    load_list_file(bl, g_blacklist, true);
    load_list_file(wl, g_whitelist, false);
 
    g_loaded = true;
}

References ensure_loaded(), g_blacklist, g_loaded, g_mutex, g_whitelist, and load_list_file().

Referenced by BastionGuard::DnsmasqBackend::add_to_blacklist(), BastionGuard::DnsmasqBackend::add_to_whitelist(), ensure_loaded(), BastionGuard::DnsmasqBackend::remove_from_blacklist(), and BastionGuard::DnsmasqBackend::remove_from_whitelist().

if_alive()

template<typename Fn>

void BastionGuard::if_alive ( const AliveFlag & alive, Fn && fn )

inline

Definition at line 74 of file LifetimeGuard.hpp.

                                                      {
    if (alive && alive->load(std::memory_order_acquire)) {
        std::forward<Fn>(fn)();
    }
}

References if_alive().

Referenced by LiveScanDialog::append_output(), IdentityLeakPage::appendLog(), BankPage::auto_update_bank_list(), SettingsPage::build_antiphish_tab(), SettingsPage::build_antiransom_tab(), DashboardPage::check_updates_async(), ScanPage::cloudCheckMalwareBazaar(), ScanPage::cloudCheckMalwareBazaarWorker(), if_alive(), BackupPage::logSafe(), PasswordManagerPage::logSafe(), UpdatePage::logSafe(), PrivacyPage::manual_unlock_devices(), LiveScanDialog::mark_finished(), PrivacyPage::monitor_loop(), PhishingPage::on_analyze_requested(), BankPage::on_refresh_clicked(), UpdatePage::onUpdateClicked(), PrivacyPage::PrivacyPage(), ScanPage::readOutput(), USBScanPage::run_clamdscan_async(), PrivacyPage::run_privacy_script_async(), BackupPage::runAsyncStreaming(), ScanPage::scanAurAuto(), ScanPage::scanFileAutomatically(), PrivacyPage::show_next_alert(), PrivacyPage::show_permission_popup(), AntiRansomwarePage::startRealtimeLogReader(), UpdatePage::updateFromExtraSources(), and UpdatePage::updateSaneSecurity().

in_path_()

bool BastionGuard::in_path_ ( const char * bin )

static

Definition at line 109 of file WireguardBackend.cpp.

                                      {
    const char* p = std::getenv("PATH");
    if (!p) p = "/usr/sbin:/usr/bin:/sbin:/bin";
    std::string paths(p);
    size_t start = 0;
    while (start <= paths.size()) {
        size_t end = paths.find(':', start);
        std::string dir = paths.substr(start,
            end == std::string::npos ? std::string::npos : end - start);
        if (!dir.empty() && ::access((dir + "/" + bin).c_str(), X_OK) == 0) return true;
        if (end == std::string::npos) break;
        start = end + 1;
    }
    return false;
}

References in_path_().

Referenced by in_path_(), and BastionGuard::WireguardBackend::tooling_available().

load_list_file()

void BastionGuard::load_list_file ( const std::string & path, std::vector< std::string > & out, bool is_blacklist )

static

Definition at line 52 of file dnsmasq_backend.cpp.

{
    out.clear();
 
    if (!fs::exists(path)) return;
 
    std::ifstream ifs(path);
    std::string line;
 
    while (std::getline(ifs, line)) {
        if (line.empty()) continue;
 
        if (is_blacklist) {
            auto a = line.find("address=/");
            if (a != std::string::npos) {
                auto b = line.find('/', a + 9);
                if (b != std::string::npos)
                    out.push_back(line.substr(a + 9, b - (a + 9)));
            }
        } else {
            out.push_back(line);
        }
    }
}

References load_list_file().

Referenced by ensure_loaded(), and load_list_file().

make_alive_flag()

AliveFlag BastionGuard::make_alive_flag ( )

inline

Definition at line 67 of file LifetimeGuard.hpp.

                                   {
    return std::make_shared<std::atomic<bool>>(true);
}

References make_alive_flag().

Referenced by make_alive_flag().

needs_default_route_()

bool BastionGuard::needs_default_route_ ( const WgTunnelSpec & sp )

static

Definition at line 394 of file WireguardBackend.cpp.

                                                         {
    for (const auto& p : sp.peers)
        for (const auto& a : split_csv_(p.allowed_ips))
            if (a == "0.0.0.0/0" || a == "::/0") return true;
    return false;
}

References needs_default_route_(), BastionGuard::WgTunnelSpec::peers, and split_csv_().

Referenced by BastionGuard::WireguardBackend::connect(), and needs_default_route_().

parse_uint_range_()

bool BastionGuard::parse_uint_range_ ( const std::string & s, unsigned min, unsigned max )

static

Definition at line 151 of file WireguardBackend.cpp.

                                                                              {
    if (s.empty() || s.find_first_not_of("0123456789") != std::string::npos)
        return false;
    try {
        unsigned long v = std::stoul(s);
        return v >= min && v <= max;
    } catch (...) {
        return false;
    }
}

References parse_uint_range_().

Referenced by parse_uint_range_(), valid_cidr_(), valid_endpoint_(), and validate_spec_().

split_csv_()

std::vector< std::string > BastionGuard::split_csv_ ( const std::string & s )

static

Definition at line 141 of file WireguardBackend.cpp.

                                                           {
    std::vector<std::string> out;
    std::string tok; std::istringstream iss(s);
    while (std::getline(iss, tok, ',')) {
        std::string t = strip_(tok);
        if (!t.empty()) out.push_back(t);
    }
    return out;
}

References split_csv_(), and strip_().

Referenced by BastionGuard::WireguardBackend::connect(), BastionGuard::WireguardBackend::load_from_conf(), BastionGuard::WireguardBackend::load_from_params(), needs_default_route_(), split_csv_(), and validate_spec_().

strip_()

std::string BastionGuard::strip_ ( std::string s )

static

Definition at line 134 of file WireguardBackend.cpp.

                                     {
    size_t a = s.find_first_not_of(" \t\r\n");
    size_t b = s.find_last_not_of(" \t\r\n");
    if (a == std::string::npos) return {};
    return s.substr(a, b - a + 1);
}

References strip_().

Referenced by BastionGuard::WireguardBackend::generate_keys(), BastionGuard::WireguardBackend::load_from_conf(), BastionGuard::WireguardBackend::public_ip(), split_csv_(), BastionGuard::WireguardBackend::status(), and strip_().

valid_cidr_()

bool BastionGuard::valid_cidr_ ( const std::string & s )

static

Definition at line 175 of file WireguardBackend.cpp.

                                            {
    const auto slash = s.rfind('/');
    if (slash == std::string::npos || slash == 0 || slash + 1 >= s.size())
        return false;
    const std::string ip = s.substr(0, slash);
    const std::string prefix = s.substr(slash + 1);
    if (!parse_uint_range_(prefix, 0, 128)) return false;
 
    struct in_addr a4 {};
    if (::inet_pton(AF_INET, ip.c_str(), &a4) == 1)
        return std::stoul(prefix) <= 32;
    struct in6_addr a6 {};
    if (::inet_pton(AF_INET6, ip.c_str(), &a6) == 1)
        return std::stoul(prefix) <= 128;
    return false;
}

References AF_INET, AF_INET6, parse_uint_range_(), and valid_cidr_().

Referenced by valid_cidr_(), and validate_spec_().

valid_endpoint_()

bool BastionGuard::valid_endpoint_ ( const std::string & endpoint )

static

Definition at line 207 of file WireguardBackend.cpp.

                                                       {
    std::string host, port;
    if (!endpoint.empty() && endpoint.front() == '[') {
        const auto close = endpoint.find(']');
        if (close == std::string::npos || close + 1 >= endpoint.size() || endpoint[close + 1] != ':')
            return false;
        host = endpoint.substr(1, close - 1);
        port = endpoint.substr(close + 2);
        struct in6_addr a6 {};
        if (::inet_pton(AF_INET6, host.c_str(), &a6) != 1) return false;
    } else {
        const auto colon = endpoint.rfind(':');
        if (colon == std::string::npos || colon == 0 || colon + 1 >= endpoint.size())
            return false;
        host = endpoint.substr(0, colon);
        port = endpoint.substr(colon + 1);
        struct in_addr a4 {};
        if (::inet_pton(AF_INET, host.c_str(), &a4) != 1 && !valid_hostname_(host))
            return false;
    }
    return parse_uint_range_(port, 1, 65535);
}

References AF_INET, AF_INET6, parse_uint_range_(), valid_endpoint_(), and valid_hostname_().

Referenced by valid_endpoint_(), and validate_spec_().

valid_hostname_()

bool BastionGuard::valid_hostname_ ( const std::string & host )

static

Definition at line 192 of file WireguardBackend.cpp.

                                                   {
    if (host.empty() || host.size() > 253 || host.front() == '.' || host.back() == '.')
        return false;
    static const std::regex re(R"(^[A-Za-z0-9.-]+$)");
    if (!std::regex_match(host, re) || host.find("..") != std::string::npos)
        return false;
    std::istringstream labels(host);
    std::string label;
    while (std::getline(labels, label, '.')) {
        if (label.empty() || label.size() > 63 || label.front() == '-' || label.back() == '-')
            return false;
    }
    return true;
}

References valid_hostname_().

Referenced by valid_endpoint_(), and valid_hostname_().

valid_iface_()

bool BastionGuard::valid_iface_ ( const std::string & iface )

static

Definition at line 230 of file WireguardBackend.cpp.

                                                 {
    static const std::regex re(R"(^[A-Za-z0-9_.-]{1,15}$)");
    return std::regex_match(iface, re);
}

References valid_iface_().

Referenced by BastionGuard::WireguardBackend::connect(), BastionGuard::WireguardBackend::killswitch_enable(), and valid_iface_().

valid_ip_()

bool BastionGuard::valid_ip_ ( const std::string & s )

static

Definition at line 168 of file WireguardBackend.cpp.

                                          {
    struct in_addr a4 {};
    struct in6_addr a6 {};
    return ::inet_pton(AF_INET, s.c_str(), &a4) == 1 ||
           ::inet_pton(AF_INET6, s.c_str(), &a6) == 1;
}

References AF_INET, AF_INET6, and valid_ip_().

Referenced by valid_ip_(), and validate_spec_().

valid_wg_key_()

bool BastionGuard::valid_wg_key_ ( const std::string & s )

static

Definition at line 162 of file WireguardBackend.cpp.

                                              {
    // WireGuard keys are 32 bytes encoded as 44-character base64 strings.
    static const std::regex re(R"(^[A-Za-z0-9+/]{43}=$)");
    return std::regex_match(s, re);
}

References valid_wg_key_().

Referenced by valid_wg_key_(), and validate_spec_().

validate_spec_()

bool BastionGuard::validate_spec_ ( const WgTunnelSpec & sp, std::string * err )

static

Definition at line 235 of file WireguardBackend.cpp.

                                                                   {
    auto fail = [&](const char* msg) {
        if (err) *err = msg;
        return false;
    };
    if (!sp.valid()) return fail("Configurazione WireGuard incompleta.");
    if (!valid_wg_key_(sp.private_key)) return fail("PrivateKey WireGuard non valida.");
    if (!sp.listen_port.empty() && !parse_uint_range_(sp.listen_port, 1, 65535))
        return fail("ListenPort non valida.");
    if (sp.mtu != 0 && (sp.mtu < 576 || sp.mtu > 9000))
        return fail("MTU fuori intervallo consentito.");
 
    for (const auto& a : sp.addresses)
        if (!valid_cidr_(a)) return fail("Address deve essere un IP/CIDR valido.");
    for (const auto& ns : sp.dns)
        if (!valid_ip_(ns)) return fail("DNS deve essere un indirizzo IP valido.");
 
    for (const auto& peer : sp.peers) {
        if (!valid_wg_key_(peer.public_key)) return fail("PublicKey peer non valida.");
        if (!peer.preshared_key.empty() && !valid_wg_key_(peer.preshared_key))
            return fail("PresharedKey non valida.");
        if (!valid_endpoint_(peer.endpoint)) return fail("Endpoint WireGuard non valido.");
        for (const auto& cidr : split_csv_(peer.allowed_ips))
            if (!valid_cidr_(cidr)) return fail("AllowedIPs contiene un CIDR non valido.");
        if (!peer.persistent_keepalive.empty() &&
            !parse_uint_range_(peer.persistent_keepalive, 0, 65535))
            return fail("PersistentKeepalive non valido.");
    }
    return true;
}

References BastionGuard::WgTunnelSpec::addresses, BastionGuard::WgTunnelSpec::dns, BastionGuard::WgTunnelSpec::listen_port, BastionGuard::WgTunnelSpec::mtu, parse_uint_range_(), BastionGuard::WgTunnelSpec::peers, BastionGuard::WgTunnelSpec::private_key, split_csv_(), BastionGuard::WgTunnelSpec::valid(), valid_cidr_(), valid_endpoint_(), valid_ip_(), valid_wg_key_(), and validate_spec_().

Referenced by BastionGuard::WireguardBackend::connect(), BastionGuard::WireguardBackend::load_from_conf(), BastionGuard::WireguardBackend::load_from_params(), and validate_spec_().

Variable Documentation

g_blacklist

std::vector<std::string> BastionGuard::g_blacklist

static

Definition at line 38 of file dnsmasq_backend.cpp.

Referenced by BastionGuard::DnsmasqBackend::add_to_blacklist(), ensure_loaded(), and BastionGuard::DnsmasqBackend::remove_from_blacklist().

g_loaded

std::atomic<bool> BastionGuard::g_loaded {false}

static

Definition at line 37 of file dnsmasq_backend.cpp.

Referenced by ensure_loaded().

g_mutex

std::mutex BastionGuard::g_mutex

static

Definition at line 36 of file dnsmasq_backend.cpp.

Referenced by BastionGuard::DnsmasqBackend::add_to_blacklist(), BastionGuard::DnsmasqBackend::add_to_whitelist(), ensure_loaded(), BastionGuard::DnsmasqBackend::remove_from_blacklist(), and BastionGuard::DnsmasqBackend::remove_from_whitelist().

g_whitelist

std::vector<std::string> BastionGuard::g_whitelist

static

Definition at line 39 of file dnsmasq_backend.cpp.

Referenced by BastionGuard::DnsmasqBackend::add_to_whitelist(), ensure_loaded(), and BastionGuard::DnsmasqBackend::remove_from_whitelist().

kKsTable

const char* BastionGuard::kKsTable = "bastionguard_ks"

static

Definition at line 568 of file WireguardBackend.cpp.

Referenced by BastionGuard::WireguardBackend::killswitch_active(), BastionGuard::WireguardBackend::killswitch_disable(), and BastionGuard::WireguardBackend::killswitch_enable().