UIServer.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ Secure Connection
 * Copyright (C) 2025–2026 Calogero Scarnà
 * GPL-3.0
 */
 
#include "UIServer.hpp"
#include "../util/AppResolver.hpp"
#include "bsc/proto/Wire.hpp"
 
#include <glibmm/main.h>
#include <nlohmann/json.hpp>
 
#include <atomic>
#include <chrono>
#include <condition_variable>
#include <cstring>
#include <deque>
#include <errno.h>
#include <filesystem>
#include <iostream>
#include <mutex>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/un.h>
#include <thread>
#include <unistd.h>
 
namespace fs = std::filesystem;
using json = nlohmann::json;
 
// ---------------------------------------------------------------------------
// Helper: conversione JSON -> ConnectionInfo
// ---------------------------------------------------------------------------
static ConnectionInfo connection_info_from_json(const json& j) {
    ConnectionInfo info;
    info.app_path  = j.value("process_path", std::string{});
    info.app_comm  = j.value("process_comm", std::string{});
    info.app_cwd   = j.value("process_cwd",  std::string{});
    info.pid       = j.value("process_id",   std::uint32_t{0});
    info.uid       = j.value("user_id",      std::uint32_t{0});
    if (j.contains("process_args") && j["process_args"].is_array()) {
        for (const auto& a : j["process_args"]) info.app_args.push_back(a.get<std::string>());
    }
    info.protocol  = j.value("protocol", std::string{});
    info.src_ip    = j.value("src_ip",   std::string{});
    info.src_port  = j.value("src_port", std::uint32_t{0});
    info.dest_host = j.value("dst_host", std::string{});
    info.dest_ip   = j.value("dst_ip",   std::string{});
    info.dest_port = j.value("dst_port", std::uint32_t{0});
    return info;
}
 
 
static std::string display_app_name(const ConnectionInfo& info) {
    return bsc::ui_util::best_connection_display_name(
        info.app_comm, info.app_path, info.app_args, info.dest_ip, info.src_ip);
}
 
// ---------------------------------------------------------------------------
// Impl
// ---------------------------------------------------------------------------
class UIServer::Impl {
public:
    Impl(UIServer* owner) : owner_(owner) {}
    ~Impl() { stop(); }
 
    UIServer* owner_;
 
    // Socket in ascolto
    int listen_fd_{-1};
    std::string socket_file_;
 
    // Client connesso (al massimo uno alla volta: un solo daemon)
    std::atomic_int client_fd_{-1};
 
    // Thread di accept
    std::thread accept_thread_;
    std::atomic_bool running_{false};
 
    // Thread di lettura (per-client)
    std::thread reader_thread_;
 
    // Scrittore serializzato
    std::mutex write_mutex_;
 
    // ID per le notifiche in uscita
    std::atomic_uint64_t next_id_{1};
 
    // Coda notifiche da spedire
    std::mutex notif_mutex_;
    std::deque<json> pending_notifs_;
 
    // Risposta al corrente ask_rule pending
    std::mutex              reply_mutex_;
    std::condition_variable reply_cv_;
    bool                    reply_ready_{false};
    ReplyAction             reply_action_{ReplyAction::DENY_ONCE};
    std::uint64_t           current_ask_id_{0};
 
    // ── Lifecycle ─────────────────────────────────────────────────────
 
    bool start(const std::string& socketPath) {
        if (running_.exchange(true)) return false;
 
        socket_file_ = bsc::proto::resolve_socket_path(socketPath);
        try {
            fs::path p(socket_file_);
            if (p.has_parent_path()) fs::create_directories(p.parent_path());
            if (fs::exists(p)) fs::remove(p);
        } catch (const std::exception& e) {
            std::cerr << "[UIServer] prep socket: " << e.what() << "\n";
        }
 
        listen_fd_ = ::socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
        if (listen_fd_ < 0) { running_ = false; return false; }
 
        sockaddr_un addr{};
        addr.sun_family = AF_UNIX;
        if (socket_file_.size() >= sizeof(addr.sun_path)) {
            ::close(listen_fd_); listen_fd_ = -1; running_ = false; return false;
        }
        std::memcpy(addr.sun_path, socket_file_.c_str(), socket_file_.size());
 
        if (::bind(listen_fd_, reinterpret_cast<sockaddr*>(&addr), sizeof(addr)) < 0) {
            std::cerr << "[UIServer] bind fallita: " << std::strerror(errno) << "\n";
            ::close(listen_fd_); listen_fd_ = -1; running_ = false; return false;
        }
 
        // Permessi: il daemon gira come root, la UI come utente. Il socket
        // deve essere accessibile da entrambi → 0666.
        ::chmod(socket_file_.c_str(), 0666);
 
        if (::listen(listen_fd_, 4) < 0) {
            ::close(listen_fd_); listen_fd_ = -1; running_ = false; return false;
        }
 
        std::cout << "[UIServer] in ascolto su " << socket_file_ << "\n";
 
        accept_thread_ = std::thread([this]() { accept_loop(); });
        return true;
    }
 
    void stop() {
        if (!running_.exchange(false)) return;
 
        // Chiudi listen e client
        int lfd = listen_fd_; listen_fd_ = -1;
        if (lfd >= 0) { ::shutdown(lfd, SHUT_RDWR); ::close(lfd); }
        int cfd = client_fd_.exchange(-1);
        if (cfd >= 0) { ::shutdown(cfd, SHUT_RDWR); ::close(cfd); }
 
        // Sblocca eventuali sendReply in attesa
        {
            std::lock_guard<std::mutex> lk(reply_mutex_);
            reply_ready_ = true;
        }
        reply_cv_.notify_all();
 
        if (accept_thread_.joinable()) accept_thread_.join();
        if (reader_thread_.joinable()) reader_thread_.join();
 
        try { if (!socket_file_.empty()) fs::remove(socket_file_); } catch (...) {}
    }
 
    // ── Accept loop ───────────────────────────────────────────────────
 
    void accept_loop() {
        while (running_) {
            int fd = ::accept4(listen_fd_, nullptr, nullptr, SOCK_CLOEXEC);
            if (fd < 0) {
                if (errno == EINTR) continue;
                if (!running_) break;
                std::cerr << "[UIServer] accept fallita: " << std::strerror(errno) << "\n";
                std::this_thread::sleep_for(std::chrono::milliseconds(200));
                continue;
            }
 
            // Chiudi client precedente se c'e' (un solo daemon alla volta)
            int old = client_fd_.exchange(fd);
            if (old >= 0) { ::shutdown(old, SHUT_RDWR); ::close(old); }
            if (reader_thread_.joinable()) reader_thread_.join();
 
            reader_thread_ = std::thread([this, fd]() { client_session(fd); });
        }
    }
 
    // ── Lettura frame → dispatch ──────────────────────────────────────
 
    bool read_exact(int fd, std::uint8_t* buf, std::size_t n) {
        std::size_t got = 0;
        while (got < n) {
            ssize_t r = ::recv(fd, buf + got, n - got, 0);
            if (r == 0) return false;
            if (r < 0) { if (errno == EINTR) continue; return false; }
            got += static_cast<std::size_t>(r);
        }
        return true;
    }
 
    void client_session(int fd) {
        // Emetti "connected" al primo frame ricevuto (hello) — non subito,
        // cosi' non segnaliamo client che si connettono e rompono il socket
        // senza inviare niente. La pratica: appena ci arriva un hello
        // dispatchiamo connected.
        bool announced = false;
 
        while (running_ && fd == client_fd_.load()) {
            std::uint8_t lenbuf[4];
            if (!read_exact(fd, lenbuf, 4)) break;
            const std::int64_t len = bsc::proto::frame_peek_length(lenbuf, 4);
            if (len < 0 || static_cast<std::size_t>(len) > bsc::proto::kMaxFrameSize) break;
            std::vector<std::uint8_t> payload(static_cast<std::size_t>(len));
            if (!read_exact(fd, payload.data(), payload.size())) break;
 
            try {
                json j = json::parse(payload.begin(), payload.end());
                const std::string type = j.value("type", std::string{});
 
                if (type == bsc::proto::msg::kHello) {
                    if (!announced) {
                        announced = true;
                        dispatch_connected();
                        // Spedisci eventuali notifiche accodate prima della
                        // connessione.
                        flush_pending_notifs();
                    }
                    continue;
                }
 
                if (!announced) {
                    // Pazienza: il daemon non ci ha mandato hello, ma
                    // accettiamo messaggi comunque.
                    announced = true;
                    dispatch_connected();
                }
 
                if (type == bsc::proto::msg::kPing) {
                    // Rispondi con pong; il payload stats lo ignoriamo per ora
                    json pong = { {"type", bsc::proto::msg::kPong}, {"id", j.value("id", std::uint64_t{0})} };
                    send_frame(pong.dump());
                    continue;
                }
 
                if (type == bsc::proto::msg::kAskRule) {
                    const auto id = j.value("id", std::uint64_t{0});
                    ConnectionInfo info;
                    if (j.contains("connection")) info = connection_info_from_json(j["connection"]);
 
                    // Registra l'id come "corrente"; sendReply verra' chiamato
                    // dalla UI (thread GTK) e spedira' il reply.
                    {
                        std::lock_guard<std::mutex> lk(reply_mutex_);
                        reply_ready_  = false;
                        current_ask_id_ = id;
                    }
 
                    dispatch_new_connection(info);
 
                    // Aspetta sendReply (timeout 20s)
                    std::unique_lock<std::mutex> lk(reply_mutex_);
                    const bool got = reply_cv_.wait_for(lk, std::chrono::seconds(20),
                                                        [this]() { return reply_ready_; });
                    const ReplyAction action = got ? reply_action_ : ReplyAction::DENY_ONCE;
                    reply_ready_ = false;
                    lk.unlock();
 
                    json reply = {
                        {"type", bsc::proto::msg::kAskRuleReply},
                        {"id",   id},
                    };
                    switch (action) {
                        case ReplyAction::ALLOW_ONCE:   reply["action"] = "allow"; reply["duration"] = "once";   break;
                        case ReplyAction::ALLOW_ALWAYS: reply["action"] = "allow"; reply["duration"] = "always"; break;
                        case ReplyAction::DENY_ONCE:    reply["action"] = "deny";  reply["duration"] = "once";   break;
                        case ReplyAction::DENY_ALWAYS:  reply["action"] = "deny";  reply["duration"] = "always"; break;
                    }
                    send_frame(reply.dump());
                    continue;
                }
 
                if (type == bsc::proto::msg::kAlert) {
                    AlertInfo ai;
                    ai.id       = j.value("id", std::uint64_t{0});
                    const std::string level = j.value("level", std::string{"info"});
                    ai.type     = level == "error"   ? 0
                                : level == "warning" ? 1
                                : 2;
                    const std::string what = j.value("what", std::string{"generic"});
                    ai.what     = what == "firewall"   ? 2
                                : what == "connection" ? 3
                                : 0;
                    ai.action   = 1;  // show_alert
                    ai.priority = 1;
                    ai.text     = j.value("text", std::string{});
                    if (j.contains("connection")) {
                        ai.connection = connection_info_from_json(j["connection"]);
                        ai.has_connection = true;
                    }
                    if (j.contains("rule")) {
                        ai.rule_name = j["rule"].value("name", std::string{});
                    }
                    if (ai.text.empty() && ai.has_connection) {
                        const auto host = !ai.connection.dest_host.empty()
                                              ? ai.connection.dest_host
                                              : ai.connection.dest_ip;
                        ai.text = ai.connection.protocol + " " + display_app_name(ai.connection)
                                  + " -> " + host + ":" + std::to_string(ai.connection.dest_port);
                    }
                    dispatch_alert(ai);
                    continue;
                }
 
                // tipo sconosciuto: ignora
            } catch (const std::exception& e) {
                std::cerr << "[UIServer] JSON parse error: " << e.what() << "\n";
            }
        }
 
        // Disconnessione
        if (announced) dispatch_disconnected();
        int expected = fd;
        client_fd_.compare_exchange_strong(expected, -1);
        ::close(fd);
 
        // Sblocca eventuale sendReply pendente
        {
            std::lock_guard<std::mutex> lk(reply_mutex_);
            reply_ready_ = true;
            reply_action_ = ReplyAction::DENY_ONCE;
        }
        reply_cv_.notify_all();
    }
 
    // ── Scrittura ─────────────────────────────────────────────────────
 
    bool send_frame(const std::string& payload) {
        int fd = client_fd_.load();
        if (fd < 0) return false;
        std::vector<std::uint8_t> frame;
        bsc::proto::frame_encode(payload, frame);
        std::lock_guard<std::mutex> lk(write_mutex_);
        std::size_t total = 0;
        while (total < frame.size()) {
            ssize_t n = ::send(fd, frame.data() + total, frame.size() - total, MSG_NOSIGNAL);
            if (n < 0) { if (errno == EINTR) continue; return false; }
            total += static_cast<std::size_t>(n);
        }
        return true;
    }
 
    void flush_pending_notifs() {
        std::deque<json> q;
        {
            std::lock_guard<std::mutex> lk(notif_mutex_);
            q.swap(pending_notifs_);
        }
        for (const auto& j : q) {
            if (!send_frame(j.dump())) {
                std::lock_guard<std::mutex> lk(notif_mutex_);
                pending_notifs_.push_front(j);
                break;
            }
        }
    }
 
    // ── sendReply pubblico ────────────────────────────────────────────
 
    void send_reply(ReplyAction action) {
        {
            std::lock_guard<std::mutex> lk(reply_mutex_);
            reply_action_ = action;
            reply_ready_  = true;
        }
        reply_cv_.notify_one();
    }
 
    // ── queueNotification pubblico ────────────────────────────────────
 
    void queue_notification(int type, const std::string& data) {
        static const char* kinds[] = {
            "none", "enable_interception", "disable_interception",
            "enable_firewall", "disable_firewall", "reload_fw_rules",
            "change_config", "enable_rule", "disable_rule", "delete_rule",
            "change_rule", "log_level", "stop", "task_start", "task_stop",
            "desktop_active", "desktop_idle"
        };
        const std::string kind = (type >= 0 && type < 17) ? kinds[type] : "none";
        json j = {
            {"type", bsc::proto::msg::kNotification},
            {"id",   next_id_++},
            {"kind", kind},
            {"data", data}
        };
        if (client_fd_.load() >= 0 && send_frame(j.dump())) return;
        std::lock_guard<std::mutex> lk(notif_mutex_);
        if (pending_notifs_.size() > 128) pending_notifs_.pop_front();
        pending_notifs_.push_back(std::move(j));
    }
 
    // ── Dispatch verso thread GTK ─────────────────────────────────────
 
    void dispatch_connected()    { Glib::signal_idle().connect_once([this]() { owner_->signal_daemon_connected.emit(); }); }
    void dispatch_disconnected() { Glib::signal_idle().connect_once([this]() { owner_->signal_daemon_disconnected.emit(); }); }
    void dispatch_new_connection(const ConnectionInfo& info) {
        Glib::signal_idle().connect_once([this, info]() { owner_->signal_new_connection.emit(info); });
    }
    void dispatch_alert(const AlertInfo& a) {
        Glib::signal_idle().connect_once([this, a]() { owner_->signal_alert.emit(a); });
    }
};
 
// ---------------------------------------------------------------------------
// Facade
// ---------------------------------------------------------------------------
 
UIServer::UIServer() : impl_(std::make_unique<Impl>(this)) {}
UIServer::~UIServer() { stop(); }
 
void UIServer::start(const std::string& socketPath) { impl_->start(socketPath); }
void UIServer::stop()                               { impl_->stop(); }
void UIServer::sendReply(ReplyAction action)        { impl_->send_reply(action); }
void UIServer::queueNotification(int type, const std::string& data) {
    impl_->queue_notification(type, data);
}