[![codecov](https://codecov.io/gl/r3dlight/leguichet/branch/master/graph/badge.svg)](https://codecov.io/gl/r3dlight/leguichet)

<div  align="center">

<img  src ="img/guichet.png"  alt="LeGuichet RER"  width=300px/>

</div>

  

# Le-Guichet

  

**Le-Guichet** is a prototype of a decontamination station aka "white station" written in Rust, fast, secure and multithreaded.

Untrusted files are deposited (via a chrooted sftp) in the entry window (in) and scanned by an antivirus server (clamd API). If a file is considered unhealthy, it is logged and immediately deleted. Files considered as healthy are logged and hashed (sha512) and sent to the transit window through a unidirectional software diode (named pipe) where they are logged and hashed again. Finally, files in transit are transfered to the output window through another software diode.

  
  

## Security

  

- Memory-safe
 
- Thread-safe
  
- No unsafe block

- Tested with cargo audit & Clippy

- Systemd protections:
    - SystemCallFilter=~ptrace ( Disable ptrace )
    - PrivateDevices=yes ( Limited access to /dev )
    - ProtectSystem=full ( /usr, /boot and /etc are mounted read-only )
    - InaccessiblePaths=/proc ( /proc is simply unreachable )
    - RemoveIPC=true (All POSIX IPCs are removed when the unit is stopped)
    - RestrictSUIDSGID=true (SUID/SGID are simply forbidden)
    - ProtectKernelModules=true (Explicit module loading is denied)

## Network flow charts:

  

<div  align="center">

<img  src ="img/schema.png"  alt="LeGuichet schema"  width=900px/>

</div>

  
  
  

```mermaid

graph LR

A(Untrusted files) -- sftp --> B

B[Guichet-In] -- Scan --> C((Clamd))

C -- Ok/Suppress --> B

B -- Write only access --> E{Diode}

F[Guichet-Transit] -- Read only access --> E

F -- Write only access --> G{Diode}

H[Guichet-Out] -- Read only access --> G

H -- sftp --> I(Trusted files + sha512)

```

  
## Demo Video
<a  href="https://www.youtube.com/watch?feature=player_embedded&v=lVAa6TcFrSA"  target="_blank"><img  src="https://img.youtube.com/vi/lVAa6TcFrSA/0.jpg"  alt="Le-Guichet demo video"  width="360"  height="300"  border="20"  /></a>

# Installation

- You must have cargo and rustc already installed.

```bash
git clone https://gitlab.com/r3dlight/leguichet.git
```
- Get some help:

```bash
make help
```

- Test the code: 

```bash
make test
```

- Audit the code (run cargo install cargo-audit before): 

```bash
make audit
```

- Build Le-Guichet binaries:

```bash
make build
```

- Install on Debian/Ubuntu (not tested on other GNU/Linux distributions)

```bash
sudo make install
```

To uninstall Le-Guichet:

```bash
sudo make uninstall
```

## To do:

  

- Create bindings for yara / static analysis

- Switch from fifo to posix mqueues

- Be able to read a config.toml

- Debian packaging via Cargo

- Namespaces / cgroups