diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..e595d1b --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,71 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +env: + CARGO_TERM_COLOR: always + RUSTFLAGS: -D warnings + +jobs: + lint: + name: Formatação e clippy + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v7 + - uses: dtolnay/rust-toolchain@stable + with: + components: rustfmt, clippy + - uses: Swatinem/rust-cache@v2 + - run: cargo fmt --all -- --check + - run: cargo clippy --workspace --all-targets + + test: + name: Testes (${{ matrix.os }}) + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + os: [ubuntu-24.04, windows-latest, macos-latest] + steps: + - uses: actions/checkout@v7 + - uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + - run: cargo test --workspace + + audit: + name: Auditoria de dependências + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v7 + - uses: rustsec/audit-check@v2 + with: + token: ${{ secrets.GITHUB_TOKEN }} + + gui: + name: Compila o app desktop (Linux) + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v7 + - uses: dtolnay/rust-toolchain@stable + - uses: Swatinem/rust-cache@v2 + with: + workspaces: apps/gui/src-tauri + - uses: actions/setup-node@v7 + with: + node-version: 22 + - name: Dependências do Tauri + run: | + sudo apt-get update + sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf + - name: Gera os ícones + run: npx --yes @tauri-apps/cli@2 icon apps/gui/src-tauri/icons/source.png -o apps/gui/src-tauri/icons + - run: cargo check --manifest-path apps/gui/src-tauri/Cargo.toml + env: + RUSTFLAGS: "" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..d7d2266 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,146 @@ +name: Release + +# Publica uma release pública ao empurrar uma tag vX.Y.Z (ex.: git tag v0.1.0 && git push --tags) +on: + push: + tags: ["v*.*.*"] + +permissions: + contents: write + +env: + CARGO_TERM_COLOR: always + +jobs: + create-release: + name: Cria a release + runs-on: ubuntu-24.04 + outputs: + release_id: ${{ steps.rel.outputs.result }} + steps: + - uses: actions/checkout@v7 + - name: Notas da versão (do CHANGELOG) + id: notes + run: | + v="${GITHUB_REF_NAME#v}" + v="${v%%-*}" + awk -v v="$v" '$0 ~ "^## \\[" v "\\]" {f=1; next} /^## \[/ {f=0} f' CHANGELOG.md > notes.md + [ -s notes.md ] || echo "Veja o CHANGELOG." > notes.md + - uses: actions/github-script@v9 + id: rel + with: + script: | + const fs = require('fs'); + const tag = context.ref.replace('refs/tags/', ''); + const r = await github.rest.repos.createRelease({ + owner: context.repo.owner, repo: context.repo.repo, tag_name: tag, + name: `Sabiá ${tag}`, body: fs.readFileSync('notes.md', 'utf8'), + draft: true, prerelease: tag.includes('-'), + }); + return r.data.id; + + cli: + name: CLI (${{ matrix.name }}) + needs: create-release + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + include: + - { name: linux-x86_64, os: ubuntu-24.04, target: x86_64-unknown-linux-gnu } + - { name: linux-aarch64, os: ubuntu-24.04-arm, target: aarch64-unknown-linux-gnu } + - { name: macos-aarch64, os: macos-latest, target: aarch64-apple-darwin } + - { name: macos-x86_64, os: macos-latest, target: x86_64-apple-darwin } + - { name: windows-x86_64, os: windows-latest, target: x86_64-pc-windows-msvc } + steps: + - uses: actions/checkout@v7 + - uses: dtolnay/rust-toolchain@stable + with: + targets: ${{ matrix.target }} + - uses: Swatinem/rust-cache@v2 + - run: cargo build --release --locked -p sabia-cli --target ${{ matrix.target }} + - name: Empacota + shell: bash + run: | + name="sabia-${GITHUB_REF_NAME}-${{ matrix.name }}" + mkdir "$name" + if [ "$RUNNER_OS" = "Windows" ]; then + cp target/${{ matrix.target }}/release/sabia.exe "$name/" + else + cp target/${{ matrix.target }}/release/sabia "$name/" + fi + cp README.md LICENSE-MIT LICENSE-APACHE "$name/" + if [ "$RUNNER_OS" = "Windows" ]; then + 7z a "$name.zip" "$name" >/dev/null; asset="$name.zip" + else + tar czf "$name.tar.gz" "$name"; asset="$name.tar.gz" + fi + if command -v sha256sum >/dev/null; then sha256sum "$asset" > "$asset.sha256"; else shasum -a 256 "$asset" > "$asset.sha256"; fi + echo "ASSET=$asset" >> "$GITHUB_ENV" + - name: Envia para a release + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: gh release upload "$GITHUB_REF_NAME" "$ASSET" "$ASSET.sha256" --clobber + + gui: + name: App desktop (${{ matrix.name }}) + needs: create-release + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + include: + - { name: linux-x86_64, os: ubuntu-24.04, args: "" } + - { name: macos-aarch64, os: macos-latest, args: "--target aarch64-apple-darwin" } + - { name: macos-x86_64, os: macos-latest, args: "--target x86_64-apple-darwin" } + - { name: windows-x86_64, os: windows-latest, args: "" } + steps: + - uses: actions/checkout@v7 + - uses: dtolnay/rust-toolchain@stable + with: + targets: ${{ contains(matrix.args, 'apple') && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }} + - uses: Swatinem/rust-cache@v2 + with: + workspaces: apps/gui/src-tauri + - uses: actions/setup-node@v7 + with: + node-version: 22 + - name: Dependências do Tauri (Linux) + if: runner.os == 'Linux' + run: | + sudo apt-get update + sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf + - name: Gera os ícones + run: npx --yes @tauri-apps/cli@2 icon apps/gui/src-tauri/icons/source.png -o apps/gui/src-tauri/icons + - uses: tauri-apps/tauri-action@v1 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + with: + projectPath: apps/gui/src-tauri + releaseId: ${{ needs.create-release.outputs.release_id }} + args: ${{ matrix.args }} + + publish: + name: Publica a release + needs: [create-release, cli, gui] + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v7 + - name: Notas da versão (do CHANGELOG) + run: | + v="${GITHUB_REF_NAME#v}" + v="${v%%-*}" + awk -v v="$v" '$0 ~ "^## \\[" v "\\]" {f=1; next} /^## \[/ {f=0} f' CHANGELOG.md > notes.md + [ -s notes.md ] || echo "Veja o CHANGELOG." > notes.md + - uses: actions/github-script@v9 + with: + script: | + const fs = require('fs'); + await github.rest.repos.updateRelease({ + owner: context.repo.owner, repo: context.repo.repo, + release_id: ${{ needs.create-release.outputs.release_id }}, + name: `Sabiá ${context.ref.replace('refs/tags/', '')}`, + body: fs.readFileSync('notes.md', 'utf8'), + draft: false, + }); diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..a9b9632 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,23 @@ +# Changelog + +Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer. + +## [0.1.0] - 2026-10-23 + +Primeira versão: CLI, app desktop e núcleo compartilhado. + +### Added +- `sabia-core`: descoberta de interfaces Wi-Fi, controle de modo monitor e + canal (via `iw`/`ip`), captura crua de quadros 802.11 por AF_PACKET (sem + libpcap), parsing de radiotap e de quadros de gerenciamento (beacon, + probe, EAPOL), agregação de APs e clientes vistos, escrita de `.pcap`, + trilha de auditoria local encadeada por hash, auto-atualização por + releases do GitHub. +- `sabia`: CLI com `iface`, `scan`, `update`, `audit-verify` e `ui` + (servidor local da interface gráfica). +- App desktop (Tauri) com a mesma interface servida pelo `sabia ui`, + pedindo elevação de administrador automaticamente ao abrir — modo + monitor e captura crua exigem root/admin. +- Interface gráfica: sidebar de interfaces, painel de captura com linha + de sinal animada, tabela de redes com barras de sinal e badges de + segurança por cor. diff --git a/LICENSE-APACHE b/LICENSE-APACHE new file mode 100644 index 0000000..d645695 --- /dev/null +++ b/LICENSE-APACHE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/LICENSE-MIT b/LICENSE-MIT new file mode 100644 index 0000000..9f3a103 --- /dev/null +++ b/LICENSE-MIT @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Sabiá contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index 39b0b0e..ab327db 100644 --- a/README.md +++ b/README.md @@ -17,8 +17,8 @@ crates/sabia-core biblioteca: netlink (iw), radiotap, parsing 802.11, captura crua (AF_PACKET), auditoria, auto-atualização crates/sabia-cli binário `sabia`: comandos de terminal + servidor local da interface (`sabia ui`) -apps/gui/ui mesma página HTML/JS servida pelo `sabia ui` -apps/gui/src-tauri shell desktop (Tauri) — esqueleto +apps/gui/ui mesma página HTML/JS servida pelo `sabia ui` e pelo app desktop +apps/gui/src-tauri app desktop (Tauri) — pede administrador/root ao abrir ``` ## Uso @@ -32,8 +32,12 @@ sabia update # verifica atualização sabia update --apply # baixa e aplica a atualização ``` -Capturar quadros 802.11 exige `CAP_NET_RAW`/`CAP_NET_ADMIN` — normalmente -root (`sudo sabia ...`). +Ou baixe o app desktop em [Releases](https://github.com/lucasrguerra/sabia/releases) +— ele pede elevação de administrador/root automaticamente ao abrir, já que +modo monitor e captura crua exigem esse privilégio em qualquer sistema. + +Pela CLI, capturar quadros 802.11 exige `CAP_NET_RAW`/`CAP_NET_ADMIN` — +normalmente root (`sudo sabia ...`). ## Dependências externas diff --git a/apps/gui/src-tauri/Cargo.toml b/apps/gui/src-tauri/Cargo.toml new file mode 100644 index 0000000..34ada48 --- /dev/null +++ b/apps/gui/src-tauri/Cargo.toml @@ -0,0 +1,28 @@ +# App desktop (Tauri 2). Fica fora do workspace principal porque exige +# as bibliotecas de WebView do sistema (WebKitGTK no Linux). +[package] +name = "sabia-gui" +description = "Sabiá: interface gráfica de auditoria de Wi-Fi" +version = "0.1.0" +edition = "2021" +license = "MIT OR Apache-2.0" +repository = "https://github.com/lucasrguerra/sabia" +rust-version = "1.80" + +[workspace] + +[build-dependencies] +tauri-build = { version = "2", features = [] } + +[dependencies] +tauri = { version = "2", features = [] } +serde_json = "1" +sabia-core = { path = "../../../crates/sabia-core" } + +[target.'cfg(unix)'.dependencies] +libc = "0.2" + +[profile.release] +lto = "thin" +codegen-units = 1 +strip = true diff --git a/apps/gui/src-tauri/build.rs b/apps/gui/src-tauri/build.rs new file mode 100644 index 0000000..e9b1480 --- /dev/null +++ b/apps/gui/src-tauri/build.rs @@ -0,0 +1,13 @@ +fn main() { + #[cfg(windows)] + { + // Modo monitor e captura crua exigem administrador no Windows: o + // manifesto pede elevação (UAC) assim que o app abre. + let manifest = include_str!("windows-app-manifest.xml"); + let attrs = tauri_build::Attributes::new() + .windows_attributes(tauri_build::WindowsAttributes::new().app_manifest(manifest)); + tauri_build::try_build(attrs).expect("falha no tauri-build"); + } + #[cfg(not(windows))] + tauri_build::build(); +} diff --git a/apps/gui/src-tauri/icons/source.png b/apps/gui/src-tauri/icons/source.png new file mode 100644 index 0000000..0b20ffb Binary files /dev/null and b/apps/gui/src-tauri/icons/source.png differ diff --git a/apps/gui/src-tauri/src/main.rs b/apps/gui/src-tauri/src/main.rs new file mode 100644 index 0000000..ba37232 --- /dev/null +++ b/apps/gui/src-tauri/src/main.rs @@ -0,0 +1,190 @@ +// Evita a janela de console extra no Windows em release. +#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")] + +use sabia_core::engine::Engine; +use std::sync::Arc; + +struct State(Arc); + +#[tauri::command] +fn version(state: tauri::State<'_, State>) -> String { + state.0.version().to_string() +} + +#[tauri::command] +fn list_ifaces(state: tauri::State<'_, State>) -> Result { + let list = state.0.list_ifaces().map_err(|e| e.to_string())?; + serde_json::to_value(list).map_err(|e| e.to_string()) +} + +#[tauri::command] +fn set_monitor(state: tauri::State<'_, State>, iface: String, enable: bool) -> Result<(), String> { + state.0.set_monitor(&iface, enable).map_err(|e| e.to_string()) +} + +#[tauri::command] +fn start_scan(state: tauri::State<'_, State>, iface: String) -> Result<(), String> { + state.0.start_scan(&iface).map_err(|e| e.to_string()) +} + +#[tauri::command] +fn stop_scan(state: tauri::State<'_, State>, iface: String) { + state.0.stop_scan(&iface); +} + +#[tauri::command] +fn scan_results(state: tauri::State<'_, State>, iface: String) -> Result { + serde_json::to_value(state.0.scan_results(&iface)).map_err(|e| e.to_string()) +} + +#[tauri::command] +fn update_check(state: tauri::State<'_, State>) -> Result { + let status = state.0.update_check().map_err(|e| e.to_string())?; + serde_json::to_value(status).map_err(|e| e.to_string()) +} + +#[tauri::command] +fn update_apply(state: tauri::State<'_, State>) -> Result { + state.0.update_apply().map_err(|e| e.to_string()) +} + +/// `true` quando o processo já tem privilégio suficiente pra tudo que o +/// Sabiá faz (modo monitor, captura crua). No Windows o manifesto já +/// exige administrador antes mesmo do app abrir, então aqui é sempre `true`. +#[tauri::command] +fn is_elevated() -> bool { + #[cfg(unix)] + { + unsafe { libc::geteuid() == 0 } + } + #[cfg(windows)] + { + true + } +} + +/// Reabre o app com privilégios de administrador (Linux/macOS). O app novo +/// encerra este quando abre; se a autorização falhar ou for cancelada, a +/// janela continua aqui e a interface mostra o motivo. +#[tauri::command] +fn relaunch_elevated(app: tauri::AppHandle) -> Result<(), String> { + #[cfg(any(target_os = "linux", target_os = "macos"))] + { + do_relaunch_elevated(app) + } + #[cfg(windows)] + { + let _ = app; + Err("o Sabiá já roda como administrador no Windows".into()) + } +} + +#[cfg(any(target_os = "linux", target_os = "macos"))] +fn do_relaunch_elevated(app: tauri::AppHandle) -> Result<(), String> { + use tauri::Emitter; + let exe = elevated_exe()?; + let log = std::env::temp_dir().join(format!("sabia-elevate-{}.log", std::process::id())); + let _ = std::fs::write(&log, b""); + let out = std::fs::OpenOptions::new().append(true).open(&log).map_err(|e| e.to_string())?; + let err = out.try_clone().map_err(|e| e.to_string())?; + let pid = std::process::id().to_string(); + + #[cfg(target_os = "linux")] + let mut cmd = { + let mut c = std::process::Command::new("pkexec"); + c.arg("/usr/bin/env"); + for k in ["DISPLAY", "WAYLAND_DISPLAY", "XAUTHORITY", "XDG_RUNTIME_DIR", "DBUS_SESSION_BUS_ADDRESS", "GDK_BACKEND"] { + if let Ok(v) = std::env::var(k) { + c.arg(format!("{k}={v}")); + } + } + c.arg(format!("SABIA_REPLACE_PID={pid}")); + c.arg(&exe); + c + }; + #[cfg(target_os = "macos")] + let mut cmd = { + let shell = format!("SABIA_REPLACE_PID={} '{}' >/dev/null 2>&1 &", pid, exe.display()); + let script = format!("do shell script \"{}\" with administrator privileges", shell.replace('\\', "\\\\").replace('"', "\\\"")); + let mut c = std::process::Command::new("osascript"); + c.args(["-e", &script]); + c + }; + cmd.stdout(out).stderr(err); + let mut child = cmd.spawn().map_err(|e| format!("não foi possível pedir privilégios: {e}"))?; + std::thread::spawn(move || { + let status = child.wait(); + if matches!(&status, Ok(s) if s.success()) { + let _ = std::fs::remove_file(&log); + return; + } + let detail = std::fs::read_to_string(&log).unwrap_or_default(); + let msg = match status.ok().and_then(|s| s.code()) { + Some(126) => "Autorização cancelada.".to_string(), + Some(127) => "Não foi possível autenticar como administrador.".to_string(), + _ => format!("Não foi possível reiniciar como administrador. {}", detail.lines().last().unwrap_or("").trim()), + }; + let _ = app.emit("elevate-failed", msg); + let _ = std::fs::remove_file(&log); + }); + Ok(()) +} + +/// Caminho que o root consegue executar. No AppImage, `current_exe` aponta +/// pra dentro de um ponto de montagem FUSE do usuário, inacessível ao root: +/// usa o próprio arquivo `.AppImage` (variável `APPIMAGE`). +#[cfg(any(target_os = "linux", target_os = "macos"))] +fn elevated_exe() -> Result { + if let Some(p) = std::env::var_os("APPIMAGE").map(std::path::PathBuf::from).filter(|p| p.is_file()) { + return Ok(p); + } + std::env::current_exe().map_err(|e| e.to_string()) +} + +fn main() { + let engine = Arc::new(Engine::new()); + tauri::Builder::default() + .manage(State(engine)) + .setup(|app| { + // Quando abrimos elevados a pedido do app normal, ele fecha o app antigo. + #[cfg(unix)] + if let Some(pid) = std::env::var("SABIA_REPLACE_PID").ok().and_then(|p| p.parse::().ok()) { + std::thread::spawn(move || { + std::thread::sleep(std::time::Duration::from_millis(1200)); + // SAFETY: só envia SIGTERM ao processo anterior do próprio usuário. + unsafe { + if libc::geteuid() == 0 { + libc::kill(pid, libc::SIGTERM); + } + } + }); + } + + // Captura crua e modo monitor exigem root: pede elevação assim + // que o app abre, sem esperar o usuário procurar um botão. Se + // a autorização falhar, a janela continua aberta e a interface + // mostra o aviso (com um botão pra tentar de novo). + #[cfg(any(target_os = "linux", target_os = "macos"))] + if unsafe { libc::geteuid() != 0 } && std::env::var("SABIA_REPLACE_PID").is_err() { + let handle = app.handle().clone(); + std::thread::spawn(move || { + let _ = do_relaunch_elevated(handle); + }); + } + Ok(()) + }) + .invoke_handler(tauri::generate_handler![ + version, + list_ifaces, + set_monitor, + start_scan, + stop_scan, + scan_results, + update_check, + update_apply, + is_elevated, + relaunch_elevated, + ]) + .run(tauri::generate_context!()) + .expect("erro ao iniciar o Sabiá"); +} diff --git a/apps/gui/src-tauri/tauri.conf.json b/apps/gui/src-tauri/tauri.conf.json new file mode 100644 index 0000000..01f6af2 --- /dev/null +++ b/apps/gui/src-tauri/tauri.conf.json @@ -0,0 +1,39 @@ +{ + "$schema": "https://schema.tauri.app/config/2", + "productName": "Sabiá", + "version": "0.1.0", + "identifier": "dev.sabia.app", + "build": { + "frontendDist": "../ui" + }, + "app": { + "withGlobalTauri": true, + "windows": [ + { + "title": "Sabiá", + "width": 1180, + "height": 780, + "minWidth": 420, + "minHeight": 560, + "resizable": true + } + ], + "security": { + "csp": "default-src 'self'; img-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost; style-src 'self' 'unsafe-inline'; script-src 'self'; worker-src 'self'; frame-src 'none'; object-src 'none'" + } + }, + "bundle": { + "active": true, + "targets": "all", + "category": "Utility", + "shortDescription": "Auditoria de Wi-Fi", + "longDescription": "Sabiá audita, monitora e testa a segurança de redes Wi-Fi — modo monitor, captura de quadros e handshakes, sempre com trilha de auditoria.", + "icon": [ + "icons/32x32.png", + "icons/128x128.png", + "icons/128x128@2x.png", + "icons/icon.icns", + "icons/icon.ico" + ] + } +} diff --git a/apps/gui/src-tauri/windows-app-manifest.xml b/apps/gui/src-tauri/windows-app-manifest.xml new file mode 100644 index 0000000..9597f92 --- /dev/null +++ b/apps/gui/src-tauri/windows-app-manifest.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + diff --git a/crates/sabia-cli/src/web/app.css b/apps/gui/ui/app.css similarity index 100% rename from crates/sabia-cli/src/web/app.css rename to apps/gui/ui/app.css diff --git a/crates/sabia-cli/src/web/app.js b/apps/gui/ui/app.js similarity index 75% rename from crates/sabia-cli/src/web/app.js rename to apps/gui/ui/app.js index e20fdba..5020f77 100644 --- a/crates/sabia-cli/src/web/app.js +++ b/apps/gui/ui/app.js @@ -1,5 +1,6 @@ const params = new URLSearchParams(location.search); const token = params.get('token'); +const tauri = window.__TAURI__; const els = { list: document.getElementById('ifaceList'), @@ -24,12 +25,46 @@ const ICON_WIFI = ``; async function api(path, opts) { + if (tauri) return tauriApi(path); const url = new URL(path, location.origin); url.searchParams.set('token', token); const r = await fetch(url, opts); return r.json(); } +// No app desktop não existe servidor HTTP: as mesmas rotas viram chamadas +// IPC diretas pro núcleo, pelos comandos registrados em src-tauri/src/main.rs. +async function tauriApi(path) { + const [p, qs] = path.split('?'); + const q = new URLSearchParams(qs || ''); + const invoke = tauri.core.invoke; + try { + switch (p) { + case '/api/version': + return { version: await invoke('version') }; + case '/api/ifaces': + return await invoke('list_ifaces'); + case '/api/monitor': + await invoke('set_monitor', { iface: q.get('iface'), enable: q.get('enable') === 'true' }); + return { ok: true }; + case '/api/scan/start': + await invoke('start_scan', { iface: q.get('iface') }); + return { ok: true }; + case '/api/scan/stop': + await invoke('stop_scan', { iface: q.get('iface') }); + return { ok: true }; + case '/api/scan': + return await invoke('scan_results', { iface: q.get('iface') }); + case '/api/update/check': + return await invoke('update_check'); + default: + return { error: 'rota desconhecida' }; + } + } catch (e) { + return { ok: false, error: String(e) }; + } +} + function renderEmptyResult(message, hint) { els.resultArea.innerHTML = `
${ICON_EMPTY}

${message}

${hint}

`; } @@ -185,7 +220,35 @@ async function poll() { setTimeout(poll, 1000); } +async function checkElevation() { + if (!tauri) return; // via `sabia ui` a elevação é responsabilidade do terminal (sudo) + const notice = document.getElementById('elevateNotice'); + const msg = document.getElementById('elevateMsg'); + const retry = document.getElementById('btnElevateRetry'); + const elevated = await tauri.core.invoke('is_elevated').catch(() => true); + if (elevated) return; + + notice.hidden = false; + msg.textContent = 'Pedindo privilégio de administrador — necessário pra modo monitor e captura…'; + retry.hidden = true; + + retry.addEventListener('click', async () => { + msg.textContent = 'Pedindo privilégio de administrador — necessário pra modo monitor e captura…'; + retry.hidden = true; + await tauri.core.invoke('relaunch_elevated').catch((e) => { + msg.textContent = String(e); + retry.hidden = false; + }); + }); + + tauri.event?.listen?.('elevate-failed', (e) => { + msg.textContent = String(e.payload || 'Não foi possível obter privilégio de administrador.'); + retry.hidden = false; + }); +} + (async function init() { + checkElevation(); const status = await api('/api/version'); els.verInfo.textContent = `v${status.version}`; await loadIfaces(); diff --git a/crates/sabia-cli/src/web/index.html b/apps/gui/ui/index.html similarity index 79% rename from crates/sabia-cli/src/web/index.html rename to apps/gui/ui/index.html index a6674ba..e1efa5b 100644 --- a/crates/sabia-cli/src/web/index.html +++ b/apps/gui/ui/index.html @@ -42,6 +42,12 @@ + +
Use somente em redes próprias ou com autorização explícita do responsável. Toda ativação de modo monitor e sessão de captura fica registrada na trilha de auditoria local. diff --git a/crates/sabia-cli/src/web/sabia-logo.svg b/apps/gui/ui/sabia-logo.svg similarity index 100% rename from crates/sabia-cli/src/web/sabia-logo.svg rename to apps/gui/ui/sabia-logo.svg diff --git a/crates/sabia-cli/src/main.rs b/crates/sabia-cli/src/main.rs index 68b450c..600b17d 100644 --- a/crates/sabia-cli/src/main.rs +++ b/crates/sabia-cli/src/main.rs @@ -1,14 +1,20 @@ mod web; use clap::{Parser, Subcommand}; -use sabia_core::{audit::AuditLog, capture::RawCapture, iface, netlink, pcapwriter::PcapWriter, scan::ScanTable}; +use sabia_core::{ + audit::AuditLog, capture::RawCapture, iface, netlink, pcapwriter::PcapWriter, scan::ScanTable, +}; use std::path::PathBuf; use std::sync::atomic::{AtomicBool, Ordering}; use std::sync::Arc; use std::time::Duration; #[derive(Parser)] -#[command(name = "sabia", about = "Sabiá — auditoria e monitoramento de redes Wi-Fi", version)] +#[command( + name = "sabia", + about = "Sabiá — auditoria e monitoramento de redes Wi-Fi", + version +)] struct Cli { #[command(subcommand)] cmd: Cmd, @@ -52,7 +58,11 @@ enum Cmd { enum IfaceAction { List, /// Liga/desliga modo monitor numa interface Wi-Fi. - Monitor { iface: String, #[arg(value_enum)] state: OnOff }, + Monitor { + iface: String, + #[arg(value_enum)] + state: OnOff, + }, } #[derive(Clone, Copy, clap::ValueEnum)] @@ -94,23 +104,31 @@ fn run(cli: Cli) -> sabia_core::Result<()> { iface::get(&name)?; // valida que é Wi-Fi antes de tocar nela netlink::set_monitor_mode(&name, enable)?; let mut log = AuditLog::open(audit_path())?; - log.record( - "monitor_mode", - &name, - &format!("{{\"enable\": {enable}}}"), - )?; - println!("{name}: modo monitor {}", if enable { "ativado" } else { "desativado" }); + log.record("monitor_mode", &name, &format!("{{\"enable\": {enable}}}"))?; + println!( + "{name}: modo monitor {}", + if enable { "ativado" } else { "desativado" } + ); } }, - Cmd::Scan { iface: name, channel, seconds, out } => { + Cmd::Scan { + iface: name, + channel, + seconds, + out, + } => { let info = iface::get(&name)?; if info.mode != iface::Mode::Monitor { eprintln!("aviso: {name} não está em modo monitor (sabia iface monitor {name} on)"); } let mut log = AuditLog::open(audit_path())?; - log.record("scan_start", &name, &format!("{{\"channel\": {channel:?}}}"))?; + log.record( + "scan_start", + &name, + &format!("{{\"channel\": {channel:?}}}"), + )?; let cap = RawCapture::open(&name)?; cap.set_read_timeout(Duration::from_millis(500))?; @@ -143,7 +161,10 @@ fn run(cli: Cli) -> sabia_core::Result<()> { break; } } - if channel.is_none() && !channels.is_empty() && last_hop.elapsed() > Duration::from_millis(300) { + if channel.is_none() + && !channels.is_empty() + && last_hop.elapsed() > Duration::from_millis(300) + { chan_idx = (chan_idx + 1) % channels.len(); let _ = netlink::set_channel(&name, channels[chan_idx]); last_hop = std::time::Instant::now(); @@ -167,16 +188,25 @@ fn run(cli: Cli) -> sabia_core::Result<()> { w.flush()?; } - log.record("scan_stop", &name, &format!("{{\"aps_found\": {}}}", table.access_points().len()))?; + log.record( + "scan_stop", + &name, + &format!("{{\"aps_found\": {}}}", table.access_points().len()), + )?; - println!("\n{:<18} {:<24} {:<8} {:<8} {:<6} {}", "BSSID", "SSID", "CANAL", "SINAL", "SEG", "CLIENTES"); + println!( + "\n{:<18} {:<24} {:<8} {:<8} {:<6} CLIENTES", + "BSSID", "SSID", "CANAL", "SINAL", "SEG" + ); for ap in table.access_points() { println!( "{:<18} {:<24} {:<8} {:<8} {:<6} {}", ap.bssid, ap.ssid.unwrap_or_default(), ap.channel.map(|c| c.to_string()).unwrap_or_default(), - ap.last_signal_dbm.map(|s| format!("{s}dBm")).unwrap_or_default(), + ap.last_signal_dbm + .map(|s| format!("{s}dBm")) + .unwrap_or_default(), ap.security.unwrap_or_default(), ap.clients.len() ); diff --git a/crates/sabia-cli/src/web/mod.rs b/crates/sabia-cli/src/web/mod.rs index bf26188..e042302 100644 --- a/crates/sabia-cli/src/web/mod.rs +++ b/crates/sabia-cli/src/web/mod.rs @@ -1,36 +1,24 @@ -//! Servidor local da interface: a mesma filosofia do Guará (`guara ui`) — -//! uma única página HTML/JS servida em `127.0.0.1`, protegida por um token -//! gerado na hora, falando com o núcleo por uma API JSON simples. A mesma -//! página é o que o shell desktop (Tauri, em `apps/gui`) vai carregar depois. +//! Servidor local da interface: uma única página HTML/JS servida em +//! `127.0.0.1`, protegida por um token gerado na hora, falando com o +//! núcleo por uma API JSON simples. A mesma página em `apps/gui/ui` é o +//! que o app desktop (Tauri) carrega — só muda o transporte. -use sabia_core::{audit::AuditLog, capture::RawCapture, iface, netlink, scan::ScanTable}; +use sabia_core::engine::Engine; use std::collections::HashMap; use std::io::{BufRead, BufReader, Write}; use std::net::{TcpListener, TcpStream}; -use std::sync::atomic::{AtomicBool, Ordering}; -use std::sync::{Arc, Mutex}; +use std::sync::Arc; use std::thread; -use std::time::Duration; -const INDEX_HTML: &str = include_str!("index.html"); -const APP_CSS: &str = include_str!("app.css"); -const APP_JS: &str = include_str!("app.js"); -const LOGO_SVG: &str = include_str!("sabia-logo.svg"); - -struct Session { - table: Arc>, - running: Arc, -} - -#[derive(Default)] -struct AppState { - sessions: Mutex>, -} +const INDEX_HTML: &str = include_str!("../../../../apps/gui/ui/index.html"); +const APP_CSS: &str = include_str!("../../../../apps/gui/ui/app.css"); +const APP_JS: &str = include_str!("../../../../apps/gui/ui/app.js"); +const LOGO_SVG: &str = include_str!("../../../../apps/gui/ui/sabia-logo.svg"); pub fn serve(port: u16) -> sabia_core::Result<()> { let token = gen_token(); let listener = TcpListener::bind(("127.0.0.1", port))?; - let state = Arc::new(AppState::default()); + let engine = Arc::new(Engine::new()); println!("Sabiá UI em http://127.0.0.1:{port}/?token={token}"); let _ = open_browser(&format!("http://127.0.0.1:{port}/?token={token}")); @@ -40,10 +28,10 @@ pub fn serve(port: u16) -> sabia_core::Result<()> { Ok(s) => s, Err(_) => continue, }; - let state = state.clone(); + let engine = engine.clone(); let token = token.clone(); thread::spawn(move || { - let _ = handle(stream, &state, &token); + let _ = handle(stream, &engine, &token); }); } Ok(()) @@ -51,12 +39,35 @@ pub fn serve(port: u16) -> sabia_core::Result<()> { fn gen_token() -> String { use std::time::{SystemTime, UNIX_EPOCH}; - let nanos = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_nanos(); + let nanos = SystemTime::now() + .duration_since(UNIX_EPOCH) + .unwrap() + .as_nanos(); format!("{nanos:x}") } fn open_browser(url: &str) -> std::io::Result<()> { - std::process::Command::new("xdg-open").arg(url).spawn().map(|_| ()) + #[cfg(target_os = "linux")] + { + std::process::Command::new("xdg-open") + .arg(url) + .spawn() + .map(|_| ()) + } + #[cfg(target_os = "macos")] + { + std::process::Command::new("open") + .arg(url) + .spawn() + .map(|_| ()) + } + #[cfg(windows)] + { + std::process::Command::new("cmd") + .args(["/C", "start", "", url]) + .spawn() + .map(|_| ()) + } } struct Request { @@ -74,7 +85,6 @@ fn parse_request(stream: &mut TcpStream) -> std::io::Result { let method = parts.next().unwrap_or("GET").to_string(); let full_path = parts.next().unwrap_or("/").to_string(); - // consome o resto dos headers loop { let mut l = String::new(); if reader.read_line(&mut l)? == 0 || l == "\r\n" { @@ -93,28 +103,54 @@ fn parse_request(stream: &mut TcpStream) -> std::io::Result { } } let token = query.get("token").cloned(); - Ok(Request { method, path, query, token }) + Ok(Request { + method, + path, + query, + token, + }) } fn urldecode(s: &str) -> String { - s.replace('+', " ").replace("%3A", ":").replace("%2F", "/").replace("%20", " ") + s.replace('+', " ") + .replace("%3A", ":") + .replace("%2F", "/") + .replace("%20", " ") } -fn handle(mut stream: TcpStream, state: &Arc, expected_token: &str) -> std::io::Result<()> { +fn handle( + mut stream: TcpStream, + engine: &Arc, + expected_token: &str, +) -> std::io::Result<()> { let req = parse_request(&mut stream)?; if req.path == "/" { if req.token.as_deref() != Some(expected_token) { return respond(&mut stream, 401, "text/plain", b"token invalido"); } - return respond(&mut stream, 200, "text/html; charset=utf-8", INDEX_HTML.as_bytes()); + return respond( + &mut stream, + 200, + "text/html; charset=utf-8", + INDEX_HTML.as_bytes(), + ); } // Assets estáticos: não carregam dado nenhum, então não exigem token. match req.path.as_str() { "/app.css" => return respond(&mut stream, 200, "text/css", APP_CSS.as_bytes()), - "/app.js" => return respond(&mut stream, 200, "application/javascript", APP_JS.as_bytes()), - "/sabia-logo.svg" => return respond(&mut stream, 200, "image/svg+xml", LOGO_SVG.as_bytes()), + "/app.js" => { + return respond( + &mut stream, + 200, + "application/javascript", + APP_JS.as_bytes(), + ) + } + "/sabia-logo.svg" => { + return respond(&mut stream, 200, "image/svg+xml", LOGO_SVG.as_bytes()) + } _ => {} } @@ -122,10 +158,15 @@ fn handle(mut stream: TcpStream, state: &Arc, expected_token: &str) -> return respond(&mut stream, 404, "text/plain", b"not found"); } if req.token.as_deref() != Some(expected_token) { - return respond(&mut stream, 401, "application/json", b"{\"error\":\"token invalido\"}"); + return respond( + &mut stream, + 401, + "application/json", + b"{\"error\":\"token invalido\"}", + ); } - let body = api(state, &req); + let body = api(engine, &req); respond(&mut stream, 200, "application/json", body.as_bytes()) } @@ -141,102 +182,45 @@ fn respond(stream: &mut TcpStream, code: u16, ctype: &str, body: &[u8]) -> std:: Ok(()) } -fn api(state: &Arc, req: &Request) -> String { +fn api(engine: &Arc, req: &Request) -> String { match (req.method.as_str(), req.path.as_str()) { - ("GET", "/api/version") => { - format!("{{\"version\":{:?}}}", env!("CARGO_PKG_VERSION")) - } - ("GET", "/api/update/check") => { - match sabia_core::update::check(env!("CARGO_PKG_VERSION")) { - Ok(status) => serde_json::to_string(&status).unwrap_or_else(|_| "{}".into()), - Err(e) => format!("{{\"error\":{:?}}}", e.to_string()), - } - } + ("GET", "/api/version") => format!("{{\"version\":{:?}}}", engine.version()), + ("GET", "/api/update/check") => match engine.update_check() { + Ok(status) => serde_json::to_string(&status).unwrap_or_else(|_| "{}".into()), + Err(e) => format!("{{\"error\":{:?}}}", e.to_string()), + }, ("GET", "/api/ifaces") => { - let list = iface::list_wireless().unwrap_or_default(); + let list = engine.list_ifaces().unwrap_or_default(); serde_json::to_string(&list).unwrap_or_else(|_| "[]".into()) } ("POST", "/api/monitor") => { let name = req.query.get("iface").cloned().unwrap_or_default(); - let enable = req.query.get("enable").map(|v| v == "true").unwrap_or(false); - match netlink::set_monitor_mode(&name, enable) { - Ok(()) => { - if let Ok(mut log) = AuditLog::open(".sabia-audit.log") { - let _ = log.record("monitor_mode", &name, &format!("{{\"enable\":{enable}}}")); - } - "{\"ok\":true}".into() - } + let enable = req + .query + .get("enable") + .map(|v| v == "true") + .unwrap_or(false); + match engine.set_monitor(&name, enable) { + Ok(()) => "{\"ok\":true}".into(), Err(e) => format!("{{\"ok\":false,\"error\":{:?}}}", e.to_string()), } } ("POST", "/api/scan/start") => { let name = req.query.get("iface").cloned().unwrap_or_default(); - start_scan(state, name) + match engine.start_scan(&name) { + Ok(()) => "{\"ok\":true}".into(), + Err(e) => format!("{{\"ok\":false,\"error\":{:?}}}", e.to_string()), + } } ("POST", "/api/scan/stop") => { let name = req.query.get("iface").cloned().unwrap_or_default(); - stop_scan(state, &name); + engine.stop_scan(&name); "{\"ok\":true}".into() } ("GET", "/api/scan") => { let name = req.query.get("iface").cloned().unwrap_or_default(); - let sessions = state.sessions.lock().unwrap(); - match sessions.get(&name) { - Some(s) => { - let table = s.table.lock().unwrap(); - serde_json::to_string(&table.access_points()).unwrap_or_else(|_| "[]".into()) - } - None => "[]".into(), - } + serde_json::to_string(&engine.scan_results(&name)).unwrap_or_else(|_| "[]".into()) } _ => "{\"error\":\"rota desconhecida\"}".into(), } } - -fn start_scan(state: &Arc, name: String) -> String { - let mut sessions = state.sessions.lock().unwrap(); - if sessions.contains_key(&name) { - return "{\"ok\":true,\"already_running\":true}".into(); - } - let table = Arc::new(Mutex::new(ScanTable::new())); - let running = Arc::new(AtomicBool::new(true)); - - let t = table.clone(); - let r = running.clone(); - let iface_name = name.clone(); - thread::spawn(move || { - let cap = match RawCapture::open(&iface_name) { - Ok(c) => c, - Err(e) => { - eprintln!("falha ao abrir captura em {iface_name}: {e}"); - return; - } - }; - let _ = cap.set_read_timeout(Duration::from_millis(500)); - let channels = netlink::supported_channels(&iface_name).unwrap_or_default(); - let mut idx = 0usize; - let mut last_hop = std::time::Instant::now(); - let mut buf = [0u8; 65535]; - while r.load(Ordering::SeqCst) { - if !channels.is_empty() && last_hop.elapsed() > Duration::from_millis(300) { - idx = (idx + 1) % channels.len(); - let _ = netlink::set_channel(&iface_name, channels[idx]); - last_hop = std::time::Instant::now(); - } - if let Ok(Some(n)) = cap.recv(&mut buf) { - let mut table = t.lock().unwrap(); - table.ingest(&buf[..n]); - } - } - }); - - sessions.insert(name, Session { table, running }); - "{\"ok\":true}".into() -} - -fn stop_scan(state: &Arc, name: &str) { - let mut sessions = state.sessions.lock().unwrap(); - if let Some(s) = sessions.remove(name) { - s.running.store(false, Ordering::SeqCst); - } -} diff --git a/crates/sabia-core/src/audit.rs b/crates/sabia-core/src/audit.rs index ecbff7f..b980a5c 100644 --- a/crates/sabia-core/src/audit.rs +++ b/crates/sabia-core/src/audit.rs @@ -75,7 +75,10 @@ impl AuditLog { hash: hash.clone(), }; - let mut file = OpenOptions::new().create(true).append(true).open(&self.path)?; + let mut file = OpenOptions::new() + .create(true) + .append(true) + .open(&self.path)?; writeln!(file, "{}", serde_json::to_string(&entry)?)?; self.last_hash = hash; diff --git a/crates/sabia-core/src/capture.rs b/crates/sabia-core/src/capture.rs index 6df6684..41a0fda 100644 --- a/crates/sabia-core/src/capture.rs +++ b/crates/sabia-core/src/capture.rs @@ -38,7 +38,7 @@ impl RawCapture { let mut sll: libc::sockaddr_ll = unsafe { mem::zeroed() }; sll.sll_family = libc::AF_PACKET as u16; - sll.sll_protocol = (ETH_P_ALL as u16).to_be(); + sll.sll_protocol = ETH_P_ALL.to_be(); sll.sll_ifindex = ifindex; let ret = unsafe { diff --git a/crates/sabia-core/src/dot11.rs b/crates/sabia-core/src/dot11.rs index d8b31f5..8ced17b 100644 --- a/crates/sabia-core/src/dot11.rs +++ b/crates/sabia-core/src/dot11.rs @@ -30,7 +30,10 @@ pub struct ManagementInfo { } pub fn mac_to_string(mac: &[u8]) -> String { - format!("{:02x}:{:02x}:{:02x}:{:02x}:{:02x}:{:02x}", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]) + format!( + "{:02x}:{:02x}:{:02x}:{:02x}:{:02x}:{:02x}", + mac[0], mac[1], mac[2], mac[3], mac[4], mac[5] + ) } /// Quadro 802.11 já sem o cabeçalho radiotap. @@ -66,7 +69,14 @@ pub fn parse(buf: &[u8]) -> Option> { if buf.len() < 24 { // sem addr1/2/3 completos (comum em alguns quadros de controle) - return Some(Frame { kind, bssid: None, src: None, dst: None, body: buf, ie_offset: 0 }); + return Some(Frame { + kind, + bssid: None, + src: None, + dst: None, + body: buf, + ie_offset: 0, + }); } let addr1: [u8; 6] = buf[4..10].try_into().ok()?; @@ -77,9 +87,20 @@ pub fn parse(buf: &[u8]) -> Option> { // Para beacon/probe response, corpo fixo de 12 bytes (timestamp + // interval + capability) antecede os information elements. - let ie_offset = if matches!(kind, FrameKind::Beacon | FrameKind::ProbeResponse) { 24 + 12 } else { 24 }; + let ie_offset = if matches!(kind, FrameKind::Beacon | FrameKind::ProbeResponse) { + 24 + 12 + } else { + 24 + }; - Some(Frame { kind, bssid: Some(bssid), src: Some(src), dst: Some(dst), body: buf, ie_offset }) + Some(Frame { + kind, + bssid: Some(bssid), + src: Some(src), + dst: Some(dst), + body: buf, + ie_offset, + }) } impl<'a> Frame<'a> { @@ -137,11 +158,9 @@ impl<'a> Frame<'a> { } } 48 => rsn_present = true, // RSN IE = WPA2/WPA3 - 221 => { - // vendor-specific; OUI 00:50:F2 tipo 1 = WPA1 - if len >= 4 && val[0..3] == [0x00, 0x50, 0xF2] && val[3] == 1 { - wpa1_present = true; - } + // vendor-specific; OUI 00:50:F2 tipo 1 = WPA1 + 221 if len >= 4 && val[0..3] == [0x00, 0x50, 0xF2] && val[3] == 1 => { + wpa1_present = true; } _ => {} } diff --git a/crates/sabia-core/src/engine.rs b/crates/sabia-core/src/engine.rs new file mode 100644 index 0000000..b6cc7ec --- /dev/null +++ b/crates/sabia-core/src/engine.rs @@ -0,0 +1,139 @@ +//! Ponte única entre o núcleo e as duas interfaces (servidor local da CLI e +//! o app desktop Tauri): ambos chamam exatamente os mesmos métodos, então +//! qualquer coisa que funcione em um funciona idêntico no outro. + +use crate::audit::AuditLog; +use crate::error::Result; +use crate::iface::{self, Interface}; +use crate::netlink; +use crate::scan::{AccessPoint, ScanTable}; +use crate::update::{self, UpdateStatus}; +use std::collections::HashMap; +use std::path::PathBuf; +use std::sync::atomic::{AtomicBool, Ordering}; +use std::sync::{Arc, Mutex}; + +struct Session { + table: Arc>, + running: Arc, +} + +pub struct Engine { + sessions: Mutex>, + audit_path: PathBuf, +} + +impl Default for Engine { + fn default() -> Self { + Self::new() + } +} + +impl Engine { + pub fn new() -> Self { + Self { + sessions: Mutex::new(HashMap::new()), + audit_path: PathBuf::from(".sabia-audit.log"), + } + } + + pub fn version(&self) -> &'static str { + env!("CARGO_PKG_VERSION") + } + + pub fn list_ifaces(&self) -> Result> { + iface::list_wireless() + } + + pub fn set_monitor(&self, name: &str, enable: bool) -> Result<()> { + netlink::set_monitor_mode(name, enable)?; + if let Ok(mut log) = AuditLog::open(&self.audit_path) { + let _ = log.record("monitor_mode", name, &format!("{{\"enable\":{enable}}}")); + } + Ok(()) + } + + #[cfg(target_os = "linux")] + pub fn start_scan(&self, name: &str) -> Result<()> { + use crate::capture::RawCapture; + use std::thread; + use std::time::Duration; + + let mut sessions = self.sessions.lock().unwrap(); + if sessions.contains_key(name) { + return Ok(()); + } + let table = Arc::new(Mutex::new(ScanTable::new())); + let running = Arc::new(AtomicBool::new(true)); + + let t = table.clone(); + let r = running.clone(); + let iface_name = name.to_string(); + thread::spawn(move || { + let cap = match RawCapture::open(&iface_name) { + Ok(c) => c, + Err(e) => { + eprintln!("falha ao abrir captura em {iface_name}: {e}"); + return; + } + }; + let _ = cap.set_read_timeout(Duration::from_millis(500)); + let channels = netlink::supported_channels(&iface_name).unwrap_or_default(); + let mut idx = 0usize; + let mut last_hop = std::time::Instant::now(); + let mut buf = [0u8; 65535]; + while r.load(Ordering::SeqCst) { + if !channels.is_empty() && last_hop.elapsed() > Duration::from_millis(300) { + idx = (idx + 1) % channels.len(); + let _ = netlink::set_channel(&iface_name, channels[idx]); + last_hop = std::time::Instant::now(); + } + if let Ok(Some(n)) = cap.recv(&mut buf) { + let mut table = t.lock().unwrap(); + table.ingest(&buf[..n]); + } + } + }); + + if let Ok(mut log) = AuditLog::open(&self.audit_path) { + let _ = log.record("scan_start", name, "{}"); + } + sessions.insert(name.to_string(), Session { table, running }); + Ok(()) + } + + /// Captura crua (AF_PACKET) só existe no Linux (ver `crate::capture`). + /// Em macOS/Windows o app compila e roda, mas a captura ainda não tem + /// backend nativo — próximo passo natural do projeto. + #[cfg(not(target_os = "linux"))] + pub fn start_scan(&self, _name: &str) -> Result<()> { + Err(crate::error::SabiaError::UnsupportedPlatform) + } + + pub fn stop_scan(&self, name: &str) { + let mut sessions = self.sessions.lock().unwrap(); + if let Some(s) = sessions.remove(name) { + s.running.store(false, Ordering::SeqCst); + if let Ok(mut log) = AuditLog::open(&self.audit_path) { + let _ = log.record("scan_stop", name, "{}"); + } + } + } + + pub fn scan_results(&self, name: &str) -> Vec { + let sessions = self.sessions.lock().unwrap(); + match sessions.get(name) { + Some(s) => s.table.lock().unwrap().access_points(), + None => Vec::new(), + } + } + + pub fn update_check(&self) -> Result { + update::check(self.version()) + } + + pub fn update_apply(&self) -> Result { + let exe = std::env::current_exe()?; + update::apply(&exe) + } +} diff --git a/crates/sabia-core/src/iface.rs b/crates/sabia-core/src/iface.rs index 62a1276..e6ccc74 100644 --- a/crates/sabia-core/src/iface.rs +++ b/crates/sabia-core/src/iface.rs @@ -45,7 +45,10 @@ pub fn list_all() -> Result> { /// Lista apenas interfaces com um `phy80211` (ou seja, rádios Wi-Fi). pub fn list_wireless() -> Result> { - Ok(list_all()?.into_iter().filter(|i| i.phy.is_some()).collect()) + Ok(list_all()? + .into_iter() + .filter(|i| i.phy.is_some()) + .collect()) } pub fn get(name: &str) -> Result { @@ -94,7 +97,13 @@ fn read_interface(name: &str) -> Result { Mode::Unknown }; - Ok(Interface { name: name.to_string(), mac, phy, mode, up }) + Ok(Interface { + name: name.to_string(), + mac, + phy, + mode, + up, + }) } /// Lê o modo (`managed`/`monitor`) via `/sys/class/net//type` + `uevent` diff --git a/crates/sabia-core/src/lib.rs b/crates/sabia-core/src/lib.rs index 8f64811..179c31f 100644 --- a/crates/sabia-core/src/lib.rs +++ b/crates/sabia-core/src/lib.rs @@ -5,6 +5,7 @@ pub mod audit; pub mod dot11; +pub mod engine; pub mod error; pub mod iface; pub mod netlink; diff --git a/crates/sabia-core/src/netlink.rs b/crates/sabia-core/src/netlink.rs index cbf9235..2561ee4 100644 --- a/crates/sabia-core/src/netlink.rs +++ b/crates/sabia-core/src/netlink.rs @@ -11,10 +11,13 @@ use crate::iface::Mode; use std::process::Command; fn run(cmd: &str, args: &[&str]) -> Result { - let out = Command::new(cmd).args(args).output().map_err(|e| SabiaError::CommandFailed { - cmd: format!("{cmd} {}", args.join(" ")), - detail: e.to_string(), - })?; + let out = Command::new(cmd) + .args(args) + .output() + .map_err(|e| SabiaError::CommandFailed { + cmd: format!("{cmd} {}", args.join(" ")), + detail: e.to_string(), + })?; if !out.status.success() { let detail = String::from_utf8_lossy(&out.stderr).trim().to_string(); let detail = if detail.is_empty() { @@ -90,6 +93,9 @@ pub fn set_monitor_mode(iface: &str, enable: bool) -> Result<()> { /// Troca o canal atual da interface (precisa já estar em modo monitor). pub fn set_channel(iface: &str, channel: u32) -> Result<()> { - run("iw", &["dev", iface, "set", "channel", &channel.to_string()])?; + run( + "iw", + &["dev", iface, "set", "channel", &channel.to_string()], + )?; Ok(()) } diff --git a/crates/sabia-core/src/pcapwriter.rs b/crates/sabia-core/src/pcapwriter.rs index a40fab5..2d8c54d 100644 --- a/crates/sabia-core/src/pcapwriter.rs +++ b/crates/sabia-core/src/pcapwriter.rs @@ -31,7 +31,9 @@ impl PcapWriter { /// Grava um quadro crú (radiotap + 802.11), com timestamp de agora. pub fn write_frame(&mut self, raw: &[u8]) -> Result<()> { - let now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap_or_default(); + let now = SystemTime::now() + .duration_since(UNIX_EPOCH) + .unwrap_or_default(); self.out.write_all(&(now.as_secs() as u32).to_le_bytes())?; self.out.write_all(&(now.subsec_micros()).to_le_bytes())?; self.out.write_all(&(raw.len() as u32).to_le_bytes())?; // caplen diff --git a/crates/sabia-core/src/radiotap.rs b/crates/sabia-core/src/radiotap.rs index c23e310..da37b67 100644 --- a/crates/sabia-core/src/radiotap.rs +++ b/crates/sabia-core/src/radiotap.rs @@ -33,7 +33,12 @@ pub fn parse(buf: &[u8]) -> Option { if offset + 4 > buf.len() { return None; } - let word = u32::from_le_bytes([buf[offset], buf[offset + 1], buf[offset + 2], buf[offset + 3]]); + let word = u32::from_le_bytes([ + buf[offset], + buf[offset + 1], + buf[offset + 2], + buf[offset + 3], + ]); present_words.push(word); offset += 4; if word & (1 << 31) == 0 { @@ -42,7 +47,10 @@ pub fn parse(buf: &[u8]) -> Option { } let present = present_words[0]; // só o primeiro conjunto de campos padrão nos interessa - let mut info = RadiotapInfo { header_len, ..Default::default() }; + let mut info = RadiotapInfo { + header_len, + ..Default::default() + }; let mut cursor = offset; // TSFT (u64, align 8) viria antes de Flags; para o nosso subconjunto de @@ -63,11 +71,9 @@ pub fn parse(buf: &[u8]) -> Option { cursor += 8; // TSFT } if present & BIT_FLAGS != 0 { - align!(1); cursor += 1; } if present & BIT_RATE != 0 { - align!(1); cursor += 1; } if present & BIT_CHANNEL != 0 { @@ -83,11 +89,8 @@ pub fn parse(buf: &[u8]) -> Option { align!(2); cursor += 2; } - if present & BIT_ANTSIGNAL != 0 { - align!(1); - if cursor < buf.len() { - info.signal_dbm = Some(buf[cursor] as i8); - } + if present & BIT_ANTSIGNAL != 0 && cursor < buf.len() { + info.signal_dbm = Some(buf[cursor] as i8); } Some(info) diff --git a/crates/sabia-core/src/scan.rs b/crates/sabia-core/src/scan.rs index 7e71960..b15c1f6 100644 --- a/crates/sabia-core/src/scan.rs +++ b/crates/sabia-core/src/scan.rs @@ -47,24 +47,31 @@ impl ScanTable { None => return false, }; - let now = SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0); + let now = SystemTime::now() + .duration_since(UNIX_EPOCH) + .map(|d| d.as_secs()) + .unwrap_or(0); match frame.kind { FrameKind::Beacon | FrameKind::ProbeResponse => { if let Some(bssid) = frame.bssid_str() { let info = frame.management_info(); - let channel = - info.channel_ie.or_else(|| rt.freq_mhz.and_then(radiotap::freq_to_channel)); - let entry = self.aps.entry(bssid.clone()).or_insert_with(|| AccessPoint { - bssid, - ssid: None, - channel: None, - security: None, - last_signal_dbm: None, - beacons_seen: 0, - clients: Vec::new(), - last_seen_unix: now, - }); + let channel = info + .channel_ie + .or_else(|| rt.freq_mhz.and_then(radiotap::freq_to_channel)); + let entry = self + .aps + .entry(bssid.clone()) + .or_insert_with(|| AccessPoint { + bssid, + ssid: None, + channel: None, + security: None, + last_signal_dbm: None, + beacons_seen: 0, + clients: Vec::new(), + last_seen_unix: now, + }); if let Some(ssid) = info.ssid { entry.ssid = Some(ssid); } @@ -96,7 +103,7 @@ impl ScanTable { pub fn access_points(&self) -> Vec { let mut v: Vec<_> = self.aps.values().cloned().collect(); - v.sort_by(|a, b| b.beacons_seen.cmp(&a.beacons_seen)); + v.sort_by_key(|a| std::cmp::Reverse(a.beacons_seen)); v } } diff --git a/crates/sabia-core/src/update.rs b/crates/sabia-core/src/update.rs index 916d14c..06b540d 100644 --- a/crates/sabia-core/src/update.rs +++ b/crates/sabia-core/src/update.rs @@ -37,7 +37,10 @@ fn curl_text(url: &str) -> Result { let out = Command::new("curl") .args(["-fsSL", "-H", "User-Agent: sabia-updater", url]) .output() - .map_err(|e| SabiaError::CommandFailed { cmd: format!("curl {url}"), detail: e.to_string() })?; + .map_err(|e| SabiaError::CommandFailed { + cmd: format!("curl {url}"), + detail: e.to_string(), + })?; if !out.status.success() { return Err(SabiaError::CommandFailed { cmd: format!("curl {url}"), @@ -53,14 +56,23 @@ fn curl_download(url: &str, dest: &PathBuf) -> Result<()> { .arg(dest) .arg(url) .status() - .map_err(|e| SabiaError::CommandFailed { cmd: format!("curl {url}"), detail: e.to_string() })?; + .map_err(|e| SabiaError::CommandFailed { + cmd: format!("curl {url}"), + detail: e.to_string(), + })?; if !status.success() { - return Err(SabiaError::CommandFailed { cmd: format!("curl {url}"), detail: "download falhou".into() }); + return Err(SabiaError::CommandFailed { + cmd: format!("curl {url}"), + detail: "download falhou".into(), + }); } Ok(()) } -fn asset_name_for_platform() -> String { +/// Sufixo que identifica o pacote certo entre os assets da release — o +/// nome completo inclui a tag (ex.: `sabia-v0.1.0-linux-x86_64.tar.gz`), +/// então casamos pelo fim em vez do nome inteiro. +fn asset_suffix_for_platform() -> String { let os = if cfg!(target_os = "linux") { "linux" } else if cfg!(target_os = "macos") { @@ -68,8 +80,13 @@ fn asset_name_for_platform() -> String { } else { "windows" }; - let arch = if cfg!(target_arch = "x86_64") { "x86_64" } else { "aarch64" }; - format!("sabia-{os}-{arch}.tar.gz") + let arch = if cfg!(target_arch = "x86_64") { + "x86_64" + } else { + "aarch64" + }; + let ext = if cfg!(windows) { "zip" } else { "tar.gz" }; + format!("-{os}-{arch}.{ext}") } /// Consulta a última release publicada e compara com a versão atual @@ -105,16 +122,22 @@ pub fn apply(current_exe: &PathBuf) -> Result { let body = curl_text(&url)?; let release: Release = serde_json::from_str(&body)?; - let wanted = asset_name_for_platform(); + let suffix = asset_suffix_for_platform(); let asset = release .assets .iter() - .find(|a| a.name == wanted) + .find(|a| a.name.ends_with(&suffix)) .ok_or_else(|| SabiaError::CommandFailed { cmd: "update".into(), - detail: format!("nenhum asset `{wanted}` na release {}", release.tag_name), + detail: format!( + "nenhum asset terminado em `{suffix}` na release {}", + release.tag_name + ), })?; - let checksum_asset = release.assets.iter().find(|a| a.name == format!("{}.sha256", asset.name)); + let checksum_asset = release + .assets + .iter() + .find(|a| a.name == format!("{}.sha256", asset.name)); let tmp_dir = std::env::temp_dir().join("sabia-update"); fs::create_dir_all(&tmp_dir)?; @@ -123,7 +146,11 @@ pub fn apply(current_exe: &PathBuf) -> Result { if let Some(checksum_asset) = checksum_asset { let expected = curl_text(&checksum_asset.browser_download_url)?; - let expected_hash = expected.split_whitespace().next().unwrap_or("").to_lowercase(); + let expected_hash = expected + .split_whitespace() + .next() + .unwrap_or("") + .to_lowercase(); let data = fs::read(&archive_path)?; let mut hasher = Sha256::new(); hasher.update(&data); @@ -136,13 +163,24 @@ pub fn apply(current_exe: &PathBuf) -> Result { } } - // Extrai o tar.gz e substitui o binário atual atomicamente. + // Extrai o pacote (tar.gz no Linux/macOS, zip no Windows — `tar xf` sem + // flag de compressão detecta os dois formatos nos `tar` modernos, + // incluindo o bsdtar que o Windows já traz por padrão) e substitui o + // binário atual atomicamente. let extract_dir = tmp_dir.join("extracted"); let _ = fs::remove_dir_all(&extract_dir); fs::create_dir_all(&extract_dir)?; - let status = Command::new("tar").args(["xzf"]).arg(&archive_path).arg("-C").arg(&extract_dir).status()?; + let status = Command::new("tar") + .arg("xf") + .arg(&archive_path) + .arg("-C") + .arg(&extract_dir) + .status()?; if !status.success() { - return Err(SabiaError::CommandFailed { cmd: "tar xzf".into(), detail: "extração falhou".into() }); + return Err(SabiaError::CommandFailed { + cmd: "tar xf".into(), + detail: "extração falhou".into(), + }); } let new_binary = find_binary(&extract_dir)?; @@ -161,13 +199,29 @@ pub fn apply(current_exe: &PathBuf) -> Result { Ok(release.tag_name) } +/// O binário vem dentro de uma subpasta (o CI empacota +/// `sabia-vX.Y.Z-/sabia`), então procura até um nível de +/// profundidade abaixo do diretório extraído. fn find_binary(dir: &PathBuf) -> Result { + fn is_binary(name: &std::ffi::OsStr) -> bool { + name == "sabia" || name == "sabia.exe" + } for entry in fs::read_dir(dir)? { let entry = entry?; - let name = entry.file_name(); - if name == "sabia" || name == "sabia.exe" { + if is_binary(&entry.file_name()) { return Ok(entry.path()); } + if entry.file_type().map(|t| t.is_dir()).unwrap_or(false) { + for inner in fs::read_dir(entry.path())? { + let inner = inner?; + if is_binary(&inner.file_name()) { + return Ok(inner.path()); + } + } + } } - Err(SabiaError::CommandFailed { cmd: "update".into(), detail: "binário não encontrado no pacote baixado".into() }) + Err(SabiaError::CommandFailed { + cmd: "update".into(), + detail: "binário não encontrado no pacote baixado".into(), + }) }