data handler improves, written test for nfproxy, new option on parsing fail

2025-03-09 22:14:34 +01:00
parent 9dfe229a26
commit 73c40d2f5d
21 changed files with 1077 additions and 306 deletions
--- a/tests/README.md
+++ b/tests/README.md
@@ -15,8 +15,8 @@ You can also run tests manually:
 $ ./api_test.py -h
 usage: api_test.py [-h] [--address ADDRESS] --password PASSWORD

-$ ./nf_test.py -h
-usage: nf_test.py [-h] [--address ADDRESS] --password PASSWORD [--service_name SERVICE_NAME] [--port PORT]
+$ ./nfregex_test.py -h
+usage: nfregex_test.py [-h] [--address ADDRESS] --password PASSWORD [--service_name SERVICE_NAME] [--port PORT]
                [--ipv6] [--proto {tcp,udp}]

 optional arguments:
--- a/tests/benchmark.py
+++ b/tests/benchmark.py
@@ -36,7 +36,7 @@ else:
 def exit_test(code):
    if service_id:
        server.kill()
-        if(firegex.nf_delete_service(service_id)):
+        if(firegex.nfregex_delete_service(service_id)):
            puts("Sucessfully deleted service ✔", color=colors.green)
        else:
            puts("Test Failed: Coulnd't delete serivce ✗", color=colors.red)
@@ -45,12 +45,12 @@ def exit_test(code):

 #Create new Service

-srvs = firegex.nf_get_services()
+srvs = firegex.nfregex_get_services()
 for ele in srvs:
    if ele['name'] == args.service_name:
-        firegex.nf_delete_service(ele['service_id'])
+        firegex.nfregex_delete_service(ele['service_id'])

-service_id = firegex.nf_add_service(args.service_name, args.port, "tcp", "127.0.0.1/24")
+service_id = firegex.nfregex_add_service(args.service_name, args.port, "tcp", "127.0.0.1/24")
 if service_id:
    puts(f"Sucessfully created service {service_id} ✔", color=colors.green)
 else:
@@ -105,7 +105,7 @@ print(f"{getReading(args.port)} MB/s")

 #Start firewall

-if firegex.nf_start_service(service_id):
+if firegex.nfregex_start_service(service_id):
    puts(f"Sucessfully started service with id {service_id} ✔", color=colors.green)
 else:
    puts("Benchmark Failed: Coulnd't start the service ✗", color=colors.red)
@@ -120,7 +120,7 @@ print(f"{results[0]} MB/s")
 #Add all the regexs
 for i in range(1,args.num_of_regexes+1):
    regex = gen_regex()
-    if not firegex.nf_add_regex(service_id,regex,"B",active=True,is_case_sensitive=False): 
+    if not firegex.nfregex_add_regex(service_id,regex,"B",active=True,is_case_sensitive=False): 
        puts("Benchmark Failed: Couldn't add the regex ✗", color=colors.red)
        exit_test(1)
    puts(f"Performance with {i} regex(s): ", color=colors.red, end='')
@@ -135,7 +135,7 @@ with open(args.output_file,'w') as f:
 puts(f"Sucessfully written results to {args.output_file} ✔", color=colors.magenta)

 #Delete the Service 
-if firegex.nf_delete_service(service_id):
+if firegex.nfregex_delete_service(service_id):
    puts(f"Sucessfully delete service with id {service_id} ✔", color=colors.green)
 else:
    puts("Test Failed: Couldn't delete service ✗", color=colors.red)
--- a/tests/nfproxy_test.py
+++ b/tests/nfproxy_test.py
@@ -0,0 +1,534 @@
+#!/usr/bin/env python3
+from utils.colors import colors, puts, sep
+from utils.firegexapi import FiregexAPI
+from utils.tcpserver import TcpServer
+import argparse
+import secrets
+import time
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--address", "-a", type=str , required=False, help='Address of firegex backend', default="http://127.0.0.1:4444/")
+parser.add_argument("--password", "-p", type=str, required=True, help='Firegex password')
+parser.add_argument("--service_name", "-n", type=str , required=False, help='Name of the test service', default="Test Service")
+parser.add_argument("--port", "-P", type=int , required=False, help='Port of the test service', default=1337)
+parser.add_argument("--ipv6", "-6" , action="store_true", help='Test Ipv6', default=False)
+
+args = parser.parse_args()
+sep()
+puts("Testing will start on ", color=colors.cyan, end="")
+puts(f"{args.address}", color=colors.yellow)
+
+firegex = FiregexAPI(args.address)
+
+#Login
+if (firegex.login(args.password)):
+    puts("Sucessfully logged in ✔", color=colors.green)
+else:
+    puts("Test Failed: Unknown response or wrong passowrd ✗", color=colors.red)
+    exit(1)
+
+#Create server
+server = TcpServer(args.port,ipv6=args.ipv6)
+
+srvs = firegex.nfproxy_get_services()
+for ele in srvs:
+    if ele['name'] == args.service_name:
+        firegex.nfproxy_delete_service(ele['service_id'])
+
+service_id = firegex.nfproxy_add_service(args.service_name, args.port, "http" , "::1" if args.ipv6 else "127.0.0.1" )
+if service_id:
+    puts(f"Sucessfully created service {service_id} ✔", color=colors.green)
+else:
+    puts("Test Failed: Failed to create service ✗", color=colors.red)
+    exit(1)
+
+def exit_test(code):
+    if service_id:
+        server.stop()
+        #if firegex.nfproxy_delete_service(service_id):
+        #    puts("Sucessfully deleted service ✔", color=colors.green)
+        #else:
+        #    puts("Test Failed: Coulnd't delete serivce ✗", color=colors.red)      
+    exit(code)
+
+if(firegex.nfproxy_start_service(service_id)):
+    puts("Sucessfully started service ✔", color=colors.green)
+else:
+    puts("Test Failed: Failed to start service ✗", color=colors.red)
+    exit_test(1)
+
+server.start()
+time.sleep(0.5)
+try:
+    if server.sendCheckData(secrets.token_bytes(432)):
+        puts("Successfully tested first proxy with no filters ✔", color=colors.green)
+    else:
+        puts("Test Failed: Data was corrupted ", color=colors.red)
+        exit_test(1)
+except Exception:
+    puts("Test Failed: Couldn't send data to the server ", color=colors.red)
+    exit_test(1)
+
+BASE_FILTER_VERDICT_TEST = """
+from firegex.nfproxy.models import RawPacket
+from firegex.nfproxy import pyfilter, ACCEPT, UNSTABLE_MANGLE, DROP, REJECT
+
+@pyfilter
+def verdict_test(packet:RawPacket):
+    if b"%%TEST%%" in packet.data:
+        packet.l4_data = packet.l4_data.replace(b"%%TEST%%", b"%%MANGLE%%")
+        return %%ACTION%%
+"""
+
+BASE_FILTER_VERDICT_NAME = "verdict_test"
+
+def get_vedict_test(to_match:str, action:str, mangle_to:str="REDACTED"):
+    return BASE_FILTER_VERDICT_TEST.replace("%%TEST%%", to_match).replace("%%ACTION%%", action).replace("%%MANGLE%%", mangle_to)
+
+
+#Check if filter is present in the service
+n_blocked = 0
+n_mangled = 0
+
+def checkFilter(match_bytes, filter_name, should_work=True, mangle_with=None):
+    if mangle_with:
+        if should_work:
+            global n_mangled
+            for r in firegex.nfproxy_get_service_pyfilters(service_id):
+                if r["name"] == filter_name:
+                    #Test the filter
+                    pre_packet = secrets.token_bytes(40)
+                    post_packet = secrets.token_bytes(40)
+                    server.connect_client()
+                    server.send_packet(pre_packet + match_bytes + post_packet)
+                    real_response = server.recv_packet()
+                    expected_response = pre_packet + mangle_with + post_packet
+                    if real_response == expected_response:
+                        puts("The malicious request was successfully mangled ✔", color=colors.green)
+                        n_mangled += 1
+                        time.sleep(1)
+                        if firegex.nfproxy_get_pyfilter(service_id, filter_name)["edited_packets"] == n_mangled:
+                            puts("The packet was reported as mangled in the API ✔", color=colors.green)
+                        else:
+                            puts("Test Failed: The packet wasn't reported as mangled in the API ✗", color=colors.red)
+                            exit_test(1)
+                        server.send_packet(pre_packet)
+                        if server.recv_packet() == pre_packet:
+                            puts("Is able to communicate after mangle ✔", color=colors.green)
+                        else:
+                            puts("Test Failed: Couldn't communicate after mangle ✗", color=colors.red)
+                            exit_test(1)
+                    else:
+                        puts("Test Failed: The request wasn't mangled ✗", color=colors.red)
+                        exit_test(1)
+                    server.close_client()
+                    return
+            puts("Test Failed: The filter wasn't found ✗", color=colors.red)
+        else:
+            if server.sendCheckData(secrets.token_bytes(40) + match_bytes + secrets.token_bytes(40)):
+                puts("The request wasn't mangled ✔", color=colors.green)
+            else:
+                puts("Test Failed: The request was mangled when it shouldn't have", color=colors.red)
+                exit_test(1)
+    else:
+        if should_work:
+            global n_blocked
+            for r in firegex.nfproxy_get_service_pyfilters(service_id):
+                if r["name"] == filter_name:
+                    #Test the filter
+                    if not server.sendCheckData(secrets.token_bytes(40) + match_bytes + secrets.token_bytes(40)):
+                        puts("The malicious request was successfully blocked ✔", color=colors.green)
+                        n_blocked += 1
+                        time.sleep(1)
+                        if firegex.nfproxy_get_pyfilter(service_id, filter_name)["blocked_packets"] == n_blocked:
+                            puts("The packet was reported as blocked in the API ✔", color=colors.green)
+                        else:
+                            puts("Test Failed: The packet wasn't reported as blocked in the API ✗", color=colors.red)
+                            exit_test(1)
+                    else:
+                        puts("Test Failed: The request wasn't blocked ✗", color=colors.red)
+                        exit_test(1)
+                    return
+            puts("Test Failed: The filter wasn't found ✗", color=colors.red)
+            exit_test(1)
+        else:
+            if server.sendCheckData(secrets.token_bytes(40) + match_bytes + secrets.token_bytes(40)):
+                puts("The request wasn't blocked ✔", color=colors.green)
+            else:
+                puts("Test Failed: The request was blocked when it shouldn't have", color=colors.red)
+                exit_test(1)
+
+#Add new filter
+secret = bytes(secrets.token_hex(16).encode())
+
+if firegex.nfproxy_set_code(service_id,get_vedict_test(secret.decode(), "REJECT")): 
+    puts(f"Sucessfully added filter for {str(secret)} in REJECT mode ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+checkFilter(secret, BASE_FILTER_VERDICT_NAME)
+
+#Pause the proxy
+if firegex.nfproxy_stop_service(service_id):
+    puts(f"Sucessfully paused service with id {service_id} ✔", color=colors.green)
+else:
+    puts("Test Failed: Coulnd't pause the service ✗", color=colors.red)
+    exit_test(1)
+
+#Check if it's actually paused
+checkFilter(secret, BASE_FILTER_VERDICT_NAME, should_work=False)
+
+#Start firewall
+if firegex.nfproxy_start_service(service_id):
+    puts(f"Sucessfully started service with id {service_id} ✔", color=colors.green)
+else:
+    puts("Test Failed: Coulnd't start the service ✗", color=colors.red)
+    exit_test(1)
+
+checkFilter(secret, BASE_FILTER_VERDICT_NAME)
+
+#Disable filter 
+if firegex.nfproxy_disable_pyfilter(service_id, BASE_FILTER_VERDICT_NAME):
+    puts(f"Sucessfully disabled filter {BASE_FILTER_VERDICT_NAME} ✔", color=colors.green)
+else: 
+    puts("Test Failed: Coulnd't disable the filter ✗", color=colors.red)
+    exit_test(1)
+
+#Check if it's actually disabled
+checkFilter(secret, BASE_FILTER_VERDICT_NAME, should_work=False)
+
+#Enable filter
+if firegex.nfproxy_enable_pyfilter(service_id, BASE_FILTER_VERDICT_NAME):
+    puts(f"Sucessfully enabled filter {BASE_FILTER_VERDICT_NAME} ✔", color=colors.green)
+else: 
+    puts("Test Failed: Coulnd't enable the regex ✗", color=colors.red)
+    exit_test(1)
+
+checkFilter(secret, BASE_FILTER_VERDICT_NAME)
+
+def remove_filters():
+    global n_blocked, n_mangled
+    server.stop()
+    server.start()
+    if not firegex.nfproxy_set_code(service_id, ""):
+        puts("Test Failed: Couldn't remove the filter ✗", color=colors.red)
+        exit_test(1)
+    n_blocked = 0
+    n_mangled = 0
+
+remove_filters()
+
+#Check if it's actually deleted
+checkFilter(secret, BASE_FILTER_VERDICT_NAME, should_work=False)
+
+#Check if DROP works
+if firegex.nfproxy_set_code(service_id,get_vedict_test(secret.decode(), "DROP")): 
+    puts(f"Sucessfully added filter for {str(secret)} in DROP mode ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+checkFilter(secret, BASE_FILTER_VERDICT_NAME)
+
+remove_filters()
+
+#Check if UNSTABLE_MANGLE works
+mangle_result = secrets.token_hex(4).encode() # Mangle to a smaller packet
+if firegex.nfproxy_set_code(service_id, get_vedict_test(secret.decode(), "UNSTABLE_MANGLE", mangle_result.decode())):
+    puts(f"Sucessfully added filter for {str(secret)} in UNSTABLE_MANGLE mode to a smaller packet size ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+checkFilter(secret, BASE_FILTER_VERDICT_NAME, mangle_with=mangle_result)
+
+remove_filters()
+
+#Check if UNSTABLE_MANGLE works
+mangle_result = secrets.token_hex(60).encode() # Mangle to a bigger packet
+if firegex.nfproxy_set_code(service_id, get_vedict_test(secret.decode(), "UNSTABLE_MANGLE", mangle_result.decode())):
+    puts(f"Sucessfully added filter for {str(secret)} in UNSTABLE_MANGLE mode to a bigger packet size ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+checkFilter(secret, BASE_FILTER_VERDICT_NAME, mangle_with=mangle_result)
+
+remove_filters()
+
+secret = b"8331ee1bf75893dd7fa3d34f29bac7fc8935aa3ef6c565fe8b395ef7f485"
+TCP_INPUT_STREAM_TEST = f"""
+from firegex.nfproxy.models import TCPInputStream
+from firegex.nfproxy import pyfilter, ACCEPT, UNSTABLE_MANGLE, DROP, REJECT
+
+@pyfilter
+def data_type_test(packet:TCPInputStream):
+    if {repr(secret)} in packet.data:
+        return REJECT
+
+"""
+
+if firegex.nfproxy_set_code(service_id, TCP_INPUT_STREAM_TEST):
+    puts(f"Sucessfully added filter for {str(secret)} for TCPInputStream ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+data_split = len(secret)//2
+server.connect_client()
+server.send_packet(secret[:data_split])
+if server.recv_packet() == secret[:data_split]:
+    puts("The half-packet was successfully sent and received ✔", color=colors.green)
+else:
+    puts("Test Failed: The half-packet wasn't received ✗", color=colors.red)
+    exit_test(1)
+server.send_packet(secret[data_split:])
+if not server.recv_packet():
+    puts("The malicious request was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The request wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+remove_filters()
+
+secret = b"8331ee1bf75893dd7fa3d34f29bac7fc8935aa3ef6c565fe8b395ef7f485"
+TCP_OUTPUT_STREAM_TEST = f"""
+from firegex.nfproxy.models import TCPOutputStream
+from firegex.nfproxy import pyfilter, ACCEPT, UNSTABLE_MANGLE, DROP, REJECT
+
+@pyfilter
+def data_type_test(packet:TCPOutputStream):
+    if {repr(secret)} in packet.data:
+        return REJECT
+
+"""
+
+if firegex.nfproxy_set_code(service_id, TCP_OUTPUT_STREAM_TEST):
+    puts(f"Sucessfully added filter for {str(secret)} for TCPOutputStream ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+data_split = len(secret)//2
+server.connect_client()
+server.send_packet(secret[:data_split])
+if server.recv_packet() == secret[:data_split]:
+    puts("The half-packet was successfully sent and received ✔", color=colors.green)
+else:
+    puts("Test Failed: The half-packet wasn't received ✗", color=colors.red)
+    exit_test(1)
+server.send_packet(secret[data_split:])
+if not server.recv_packet():
+    puts("The malicious request was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The request wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+remove_filters()
+
+secret = b"8331ee1bf75893dd7fa3d34f29bac7fc8935aa3ef6c565fe8b395ef7f485"
+
+REQUEST_HEADER_TEST = f"""POST / HTTP/1.1
+Host: localhost
+X-TeSt: {secret.decode()}
+Content-Length: 15
+
+A Friendly Body""".replace("\n", "\r\n")
+
+REQUEST_BODY_TEST = f"""POST / HTTP/1.1
+Host: localhost
+X-TeSt: NotTheSecret
+Content-Length: {len(secret.decode())}
+
+{secret.decode()}""".replace("\n", "\r\n")
+
+HTTP_REQUEST_STREAM_TEST = f"""
+from firegex.nfproxy.models import HttpRequest
+from firegex.nfproxy import pyfilter, ACCEPT, UNSTABLE_MANGLE, DROP, REJECT
+
+@pyfilter
+def data_type_test(req:HttpRequest):
+    if {repr(secret.decode())} in req.get_header("x-test"):
+        return REJECT
+    if req.body:
+        if {repr(secret)} in req.body:
+            return REJECT
+
+"""
+
+if firegex.nfproxy_set_code(service_id, HTTP_REQUEST_STREAM_TEST):
+    puts(f"Sucessfully added filter for {str(secret)} for HttpRequest ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+server.connect_client()
+server.send_packet(REQUEST_HEADER_TEST.encode())
+if not server.recv_packet():
+    puts("The malicious HTTP request with the malicious header was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The HTTP request with the malicious header wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+server.connect_client()
+server.send_packet(REQUEST_BODY_TEST.encode())
+if not server.recv_packet():
+    puts("The malicious HTTP request with the malicious body was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The HTTP request with the malicious body wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+remove_filters()
+
+HTTP_REQUEST_HEADER_STREAM_TEST = f"""
+from firegex.nfproxy.models import HttpRequestHeader
+from firegex.nfproxy import pyfilter, ACCEPT, UNSTABLE_MANGLE, DROP, REJECT
+
+@pyfilter
+def data_type_test(req:HttpRequestHeader):
+    if {repr(secret.decode())} in req.get_header("x-test"):
+        return REJECT
+
+"""
+
+if firegex.nfproxy_set_code(service_id, HTTP_REQUEST_HEADER_STREAM_TEST):
+    puts(f"Sucessfully added filter for {str(secret)} for HttpRequestHeader ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+server.connect_client()
+server.send_packet(REQUEST_HEADER_TEST.encode())
+if not server.recv_packet():
+    puts("The malicious HTTP request with the malicious header was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The HTTP request with the malicious header wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+remove_filters()
+
+secret = b"8331ee1bf75893dd7fa3d34f29bac7fc8935aa3ef6c565fe8b395ef7f485"
+
+RESPONSE_HEADER_TEST = f"""HTTP/1.1 200 OK
+Host: localhost
+X-TeSt: {secret.decode()}
+Content-Length: 15
+
+A Friendly Body""".replace("\n", "\r\n")
+
+RESPONSE_BODY_TEST = f"""HTTP/1.1 200 OK
+Host: localhost
+X-TeSt: NotTheSecret
+Content-Length: {len(secret.decode())}
+
+{secret.decode()}""".replace("\n", "\r\n")
+
+HTTP_RESPONSE_STREAM_TEST = f"""
+from firegex.nfproxy.models import HttpResponse
+from firegex.nfproxy import pyfilter, ACCEPT, UNSTABLE_MANGLE, DROP, REJECT
+
+@pyfilter
+def data_type_test(req:HttpResponse):
+    if {repr(secret.decode())} in req.get_header("x-test"):
+        return REJECT
+    if req.body:
+        if {repr(secret)} in req.body:
+            return REJECT
+
+"""
+
+if firegex.nfproxy_set_code(service_id, HTTP_RESPONSE_STREAM_TEST):
+    puts(f"Sucessfully added filter for {str(secret)} for HttpResponse ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+server.connect_client()
+server.send_packet(RESPONSE_HEADER_TEST.encode())
+if not server.recv_packet():
+    puts("The malicious HTTP request with the malicious header was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The HTTP request with the malicious header wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+server.connect_client()
+server.send_packet(RESPONSE_BODY_TEST.encode())
+if not server.recv_packet():
+    puts("The malicious HTTP request with the malicious body was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The HTTP request with the malicious body wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+remove_filters()
+
+HTTP_RESPONSE_HEADER_STREAM_TEST = f"""
+from firegex.nfproxy.models import HttpResponseHeader
+from firegex.nfproxy import pyfilter, ACCEPT, UNSTABLE_MANGLE, DROP, REJECT
+
+@pyfilter
+def data_type_test(req:HttpResponseHeader):
+    if {repr(secret.decode())} in req.get_header("x-test"):
+        return REJECT
+
+"""
+
+if firegex.nfproxy_set_code(service_id, HTTP_RESPONSE_HEADER_STREAM_TEST):
+    puts(f"Sucessfully added filter for {str(secret)} for HttpResponseHeader ✔", color=colors.green)
+else:
+    puts(f"Test Failed: Couldn't add the filter {str(secret)} ✗", color=colors.red)
+    exit_test(1)
+
+server.connect_client()
+server.send_packet(RESPONSE_HEADER_TEST.encode())
+if not server.recv_packet():
+    puts("The malicious HTTP request with the malicious header was successfully blocked ✔", color=colors.green)
+else:
+    puts("Test Failed: The HTTP request with the malicious header wasn't blocked ✗", color=colors.red)
+    exit_test(1)
+server.close_client()
+
+remove_filters()
+
+#Rename service
+if firegex.nfproxy_rename_service(service_id,f"{args.service_name}2"):
+    puts(f"Sucessfully renamed service to {args.service_name}2 ✔", color=colors.green)
+else:
+    puts("Test Failed: Coulnd't rename service ✗", color=colors.red)
+    exit_test(1)
+
+#Check if service was renamed correctly
+service = firegex.nfproxy_get_service(service_id)
+if service["name"] == f"{args.service_name}2":
+    puts("Checked that service was renamed correctly  ✔", color=colors.green)
+else:
+    puts("Test Failed: Service wasn't renamed correctly ✗", color=colors.red)
+    exit_test(1)
+    
+#Rename back service
+if(firegex.nfproxy_rename_service(service_id,f"{args.service_name}")):
+    puts(f"Sucessfully renamed service to {args.service_name} ✔", color=colors.green)
+else:
+    puts("Test Failed: Coulnd't rename service ✗", color=colors.red)
+    exit_test(1)
+
+#Change settings
+if(firegex.nfproxy_settings_service(service_id, 1338, "::dead:beef" if args.ipv6 else "123.123.123.123", True)):
+    srv_updated = firegex.nfproxy_get_service(service_id)
+    if srv_updated["port"] == 1338 and ("::dead:beef" if args.ipv6 else "123.123.123.123") in srv_updated["ip_int"] and srv_updated["fail_open"]:
+        puts("Sucessfully changed service settings ✔", color=colors.green)
+    else:
+        puts("Test Failed: Service settings weren't updated correctly ✗", color=colors.red)
+        exit_test(1)
+else:
+    puts("Test Failed: Coulnd't change service settings ✗", color=colors.red)
+    exit_test(1)
+
+exit_test(0)
--- a/tests/nfregex_test.py
+++ b/tests/nfregex_test.py
@@ -36,26 +36,26 @@ server = (TcpServer if args.proto == "tcp" else UdpServer)(args.port,ipv6=args.i
 def exit_test(code):
    if service_id:
        server.stop()
-        if(firegex.nf_delete_service(service_id)):
+        if(firegex.nfregex_delete_service(service_id)):
            puts("Sucessfully deleted service ✔", color=colors.green)
        else:
            puts("Test Failed: Coulnd't delete serivce ✗", color=colors.red)
            exit_test(1)        
    exit(code)

-srvs = firegex.nf_get_services()
+srvs = firegex.nfregex_get_services()
 for ele in srvs:
    if ele['name'] == args.service_name:
-        firegex.nf_delete_service(ele['service_id'])
+        firegex.nfregex_delete_service(ele['service_id'])

-service_id = firegex.nf_add_service(args.service_name, args.port, args.proto , "::1" if args.ipv6 else "127.0.0.1" )
+service_id = firegex.nfregex_add_service(args.service_name, args.port, args.proto , "::1" if args.ipv6 else "127.0.0.1" )
 if service_id:
    puts(f"Sucessfully created service {service_id} ✔", color=colors.green)
 else:
    puts("Test Failed: Failed to create service ✗", color=colors.red)
    exit(1)

-if(firegex.nf_start_service(service_id)):
+if(firegex.nfregex_start_service(service_id)):
    puts("Sucessfully started service ✔", color=colors.green)
 else:
    puts("Test Failed: Failed to start service ✗", color=colors.red)
@@ -76,7 +76,7 @@ except Exception:
 secret = bytes(secrets.token_hex(16).encode())
 regex = base64.b64encode(secret).decode()

-if firegex.nf_add_regex(service_id,regex,"B",active=True,is_case_sensitive=True): 
+if firegex.nfregex_add_regex(service_id,regex,"B",active=True,is_case_sensitive=True): 
    puts(f"Sucessfully added regex {str(secret)} ✔", color=colors.green)
 else:
    puts(f"Test Failed: Couldn't add the regex {str(secret)} ✗", color=colors.red)
@@ -87,14 +87,14 @@ else:
 n_blocked = 0

 def getMetric(metric_name, regex):
-    for metric in firegex.nf_get_metrics().split("\n"):
+    for metric in firegex.nfregex_get_metrics().split("\n"):
        if metric.startswith(metric_name + "{") and f'regex="{regex}"' in metric:
            return int(metric.split(" ")[-1])

 def checkRegex(regex, should_work=True, upper=False, deleted=False):
    if should_work:
        global n_blocked
-        for r in firegex.nf_get_service_regexes(service_id):
+        for r in firegex.nfregex_get_service_regexes(service_id):
            if r["regex"] == regex:
                #Test the regex
                s = base64.b64decode(regex).upper() if upper else base64.b64decode(regex)
@@ -102,7 +102,7 @@ def checkRegex(regex, should_work=True, upper=False, deleted=False):
                    puts("The malicious request was successfully blocked ✔", color=colors.green)
                    n_blocked += 1
                    time.sleep(1)
-                    if firegex.nf_get_regex(r["id"])["n_packets"] == n_blocked:
+                    if firegex.nfregex_get_regex(r["id"])["n_packets"] == n_blocked:
                        puts("The packet was reported as blocked in the API ✔", color=colors.green)
                    else:
                        puts("Test Failed: The packet wasn't reported as blocked in the API ✗", color=colors.red)
@@ -139,16 +139,16 @@ def checkRegex(regex, should_work=True, upper=False, deleted=False):
 def clear_regexes():
    global n_blocked
    n_blocked = 0
-    for r in firegex.nf_get_service_regexes(service_id):
+    for r in firegex.nfregex_get_service_regexes(service_id):
        if r["regex"] == regex:
-            if(firegex.nf_delete_regex(r["id"])): 
+            if(firegex.nfregex_delete_regex(r["id"])): 
                puts(f"Sucessfully deleted regex with id {r['id']} ✔", color=colors.green)
            else: 
                puts("Test Failed: Coulnd't delete the regex ✗", color=colors.red)
                exit_test(1)
            break
-    if f'regex="{secret.decode()}"' not in firegex.nf_get_metrics():
-        puts(f"No regex metrics after deletion ✔", color=colors.green)
+    if f'regex="{secret.decode()}"' not in firegex.nfregex_get_metrics():
+        puts("No regex metrics after deletion ✔", color=colors.green)
    else:
        puts("Test Failed: Metrics found after deleting the regex ✗", color=colors.red)
        exit_test(1)
@@ -156,7 +156,7 @@ def clear_regexes():
 checkRegex(regex)

 #Pause the proxy
-if(firegex.nf_stop_service(service_id)):
+if(firegex.nfregex_stop_service(service_id)):
    puts(f"Sucessfully paused service with id {service_id} ✔", color=colors.green)
 else:
    puts("Test Failed: Coulnd't pause the service ✗", color=colors.red)
@@ -166,7 +166,7 @@ else:
 checkRegex(regex,should_work=False)

 #Start firewall
-if(firegex.nf_start_service(service_id)):
+if(firegex.nfregex_start_service(service_id)):
    puts(f"Sucessfully started service with id {service_id} ✔", color=colors.green)
 else:
    puts("Test Failed: Coulnd't start the service ✗", color=colors.red)
@@ -175,9 +175,9 @@ else:
 checkRegex(regex)

 #Disable regex 
-for r in firegex.nf_get_service_regexes(service_id):
+for r in firegex.nfregex_get_service_regexes(service_id):
    if r["regex"] == regex:
-        if(firegex.nf_disable_regex(r["id"])): 
+        if(firegex.nfregex_disable_regex(r["id"])): 
            puts(f"Sucessfully disabled regex with id {r['id']} ✔", color=colors.green)
        else: 
            puts("Test Failed: Coulnd't disable the regex ✗", color=colors.red)
@@ -188,9 +188,9 @@ for r in firegex.nf_get_service_regexes(service_id):
 checkRegex(regex,should_work=False)

 #Enable regex
-for r in firegex.nf_get_service_regexes(service_id):
+for r in firegex.nfregex_get_service_regexes(service_id):
    if r["regex"] == regex:
-        if(firegex.nf_enable_regex(r["id"])): 
+        if(firegex.nfregex_enable_regex(r["id"])): 
            puts(f"Sucessfully enabled regex with id {r['id']} ✔", color=colors.green)
        else: 
            puts("Test Failed: Coulnd't enable the regex ✗", color=colors.red)
@@ -206,7 +206,7 @@ clear_regexes()
 checkRegex(regex,should_work=False,deleted=True)

 #Add case insensitive regex
-if(firegex.nf_add_regex(service_id,regex,"B",active=True, is_case_sensitive=False)): 
+if(firegex.nfregex_add_regex(service_id,regex,"B",active=True, is_case_sensitive=False)): 
    puts(f"Sucessfully added case insensitive regex {str(secret)} ✔", color=colors.green)
 else:
    puts(f"Test Failed: Coulnd't add the case insensitive regex {str(secret)} ✗", color=colors.red)
@@ -218,24 +218,31 @@ checkRegex(regex)
 clear_regexes()

 #Rename service
-if(firegex.nf_rename_service(service_id,f"{args.service_name}2")):
+if(firegex.nfregex_rename_service(service_id,f"{args.service_name}2")):
    puts(f"Sucessfully renamed service to {args.service_name}2 ✔", color=colors.green)
 else:
    puts("Test Failed: Coulnd't rename service ✗", color=colors.red)
    exit_test(1)

 #Check if service was renamed correctly
-service = firegex.nf_get_service(service_id)
+service = firegex.nfregex_get_service(service_id)
 if service["name"] == f"{args.service_name}2":
    puts("Checked that service was renamed correctly  ✔", color=colors.green)
 else:
    puts("Test Failed: Service wasn't renamed correctly ✗", color=colors.red)
    exit_test(1)

+#Rename back service
+if(firegex.nfregex_rename_service(service_id,f"{args.service_name}")):
+    puts(f"Sucessfully renamed service to {args.service_name} ✔", color=colors.green)
+else:
+    puts("Test Failed: Coulnd't rename service ✗", color=colors.red)
+    exit_test(1)
+
 #Change settings
 opposite_proto = "udp" if args.proto == "tcp" else "tcp"
-if(firegex.nf_settings_service(service_id, 1338, opposite_proto, "::dead:beef" if args.ipv6 else "123.123.123.123", True)):
-    srv_updated = firegex.nf_get_service(service_id)
+if(firegex.nfregex_settings_service(service_id, 1338, opposite_proto, "::dead:beef" if args.ipv6 else "123.123.123.123", True)):
+    srv_updated = firegex.nfregex_get_service(service_id)
    if srv_updated["port"] == 1338 and srv_updated["proto"] == opposite_proto and ("::dead:beef" if args.ipv6 else "123.123.123.123") in srv_updated["ip_int"] and srv_updated["fail_open"]:
        puts("Sucessfully changed service settings ✔", color=colors.green)
    else:
--- a/tests/run_tests.sh
+++ b/tests/run_tests.sh
@@ -16,13 +16,13 @@ done
 echo "Running standard API test"
 python3 api_test.py -p $PASSWORD || ERROR=1
 echo "Running Netfilter Regex TCP ipv4"
-python3 nf_test.py -p $PASSWORD -m tcp || ERROR=1
+python3 nfregex_test.py -p $PASSWORD -m tcp || ERROR=1
 echo "Running Netfilter Regex TCP ipv6"
-python3 nf_test.py -p $PASSWORD -m tcp -6 || ERROR=1
+python3 nfregex_test.py -p $PASSWORD -m tcp -6 || ERROR=1
 echo "Running Netfilter Regex UDP ipv4"
-python3 nf_test.py -p $PASSWORD -m udp || ERROR=1
+python3 nfregex_test.py -p $PASSWORD -m udp || ERROR=1
 echo "Running Netfilter Regex UDP ipv6"
-python3 nf_test.py -p $PASSWORD -m udp -6 || ERROR=1
+python3 nfregex_test.py -p $PASSWORD -m udp -6 || ERROR=1
 echo "Running Port Hijack TCP ipv4"
 python3 ph_test.py -p $PASSWORD -m tcp || ERROR=1
 echo "Running Port Hijack TCP ipv6"
@@ -31,6 +31,10 @@ echo "Running Port Hijack UDP ipv4"
 python3 ph_test.py -p $PASSWORD -m udp || ERROR=1
 echo "Running Port Hijack UDP ipv6"
 python3 ph_test.py -p $PASSWORD -m udp -6 || ERROR=1
+echo "Running Netfilter Proxy ipv4"
+python3 nfproxy_test.py -p $PASSWORD || ERROR=1
+echo "Running Netfilter Proxy ipv6"
+python3 nfproxy_test.py -p $PASSWORD -6 || ERROR=1

 if [[ "$ERROR" == "0" ]] then
 	python3 benchmark.py -p $PASSWORD -r 5 -d 1 -s 10 || ERROR=1
--- a/tests/utils/firegexapi.py
+++ b/tests/utils/firegexapi.py
@@ -78,65 +78,65 @@ class FiregexAPI:
    def reset(self, delete: bool):
        self.s.post(f"{self.address}api/reset", json={"delete":delete})

-    def nf_get_services(self):
+    def nfregex_get_services(self):
        req = self.s.get(f"{self.address}api/nfregex/services")
        return req.json() 

-    def nf_get_service(self,service_id: str):
+    def nfregex_get_service(self,service_id: str):
        req = self.s.get(f"{self.address}api/nfregex/services/{service_id}")
        return req.json()

-    def nf_stop_service(self,service_id: str):
+    def nfregex_stop_service(self,service_id: str):
        req = self.s.post(f"{self.address}api/nfregex/services/{service_id}/stop")
        return verify(req)
    
-    def nf_start_service(self,service_id: str):
+    def nfregex_start_service(self,service_id: str):
        req = self.s.post(f"{self.address}api/nfregex/services/{service_id}/start")
        return verify(req)

-    def nf_delete_service(self,service_id: str):
+    def nfregex_delete_service(self,service_id: str):
        req = self.s.delete(f"{self.address}api/nfregex/services/{service_id}")
        return verify(req)

-    def nf_rename_service(self,service_id: str, newname: str):
+    def nfregex_rename_service(self,service_id: str, newname: str):
        req = self.s.put(f"{self.address}api/nfregex/services/{service_id}/rename" , json={"name":newname})
        return verify(req)
    
-    def nf_settings_service(self,service_id: str, port: int, proto: str, ip_int: str, fail_open: bool):
+    def nfregex_settings_service(self,service_id: str, port: int, proto: str, ip_int: str, fail_open: bool):
        req = self.s.put(f"{self.address}api/nfregex/services/{service_id}/settings" , json={"port":port, "proto":proto, "ip_int":ip_int, "fail_open":fail_open})
        return verify(req)

-    def nf_get_service_regexes(self,service_id: str):
+    def nfregex_get_service_regexes(self,service_id: str):
        req = self.s.get(f"{self.address}api/nfregex/services/{service_id}/regexes")
        return req.json()

-    def nf_get_regex(self,regex_id: str):
+    def nfregex_get_regex(self,regex_id: str):
        req = self.s.get(f"{self.address}api/nfregex/regexes/{regex_id}")
        return req.json()
    
-    def nf_delete_regex(self,regex_id: str):
+    def nfregex_delete_regex(self,regex_id: str):
        req = self.s.delete(f"{self.address}api/nfregex/regexes/{regex_id}")
        return verify(req)
    
-    def nf_enable_regex(self,regex_id: str):
+    def nfregex_enable_regex(self,regex_id: str):
        req = self.s.post(f"{self.address}api/nfregex/regexes/{regex_id}/enable")
        return verify(req)

-    def nf_disable_regex(self,regex_id: str):
+    def nfregex_disable_regex(self,regex_id: str):
        req = self.s.post(f"{self.address}api/nfregex/regexes/{regex_id}/disable")
        return verify(req)

-    def nf_add_regex(self, service_id: str, regex: str, mode: str, active: bool, is_case_sensitive: bool):
+    def nfregex_add_regex(self, service_id: str, regex: str, mode: str, active: bool, is_case_sensitive: bool):
        req = self.s.post(f"{self.address}api/nfregex/regexes", 
            json={"service_id": service_id, "regex": regex, "mode": mode, "active": active, "is_case_sensitive": is_case_sensitive})
        return verify(req)

-    def nf_add_service(self, name: str, port: int, proto: str, ip_int: str, fail_open: bool = False):
+    def nfregex_add_service(self, name: str, port: int, proto: str, ip_int: str, fail_open: bool = False):
        req = self.s.post(f"{self.address}api/nfregex/services" , 
            json={"name":name,"port":port, "proto": proto, "ip_int": ip_int, "fail_open": fail_open})
        return req.json()["service_id"] if verify(req) else False 

-    def nf_get_metrics(self):
+    def nfregex_get_metrics(self):
        req = self.s.get(f"{self.address}api/nfregex/metrics")
        return req.text

@@ -173,3 +173,60 @@ class FiregexAPI:
        req = self.s.post(f"{self.address}api/porthijack/services" , 
            json={"name":name, "public_port": public_port, "proxy_port":proxy_port, "proto": proto, "ip_src": ip_src, "ip_dst": ip_dst})
        return req.json()["service_id"] if verify(req) else False 
+
+    def nfproxy_get_services(self):
+        req = self.s.get(f"{self.address}api/nfproxy/services")
+        return req.json() 
+
+    def nfproxy_get_service(self,service_id: str):
+        req = self.s.get(f"{self.address}api/nfproxy/services/{service_id}")
+        return req.json()
+
+    def nfproxy_stop_service(self,service_id: str):
+        req = self.s.post(f"{self.address}api/nfproxy/services/{service_id}/stop")
+        return verify(req)
+    
+    def nfproxy_start_service(self,service_id: str):
+        req = self.s.post(f"{self.address}api/nfproxy/services/{service_id}/start")
+        return verify(req)
+
+    def nfproxy_delete_service(self,service_id: str):
+        req = self.s.delete(f"{self.address}api/nfproxy/services/{service_id}")
+        return verify(req)
+
+    def nfproxy_rename_service(self,service_id: str, newname: str):
+        req = self.s.put(f"{self.address}api/nfproxy/services/{service_id}/rename" , json={"name":newname})
+        return verify(req)
+    
+    def nfproxy_settings_service(self,service_id: str, port: int, ip_int: str, fail_open: bool):
+        req = self.s.put(f"{self.address}api/nfproxy/services/{service_id}/settings" , json={"port":port, "ip_int":ip_int, "fail_open":fail_open})
+        return verify(req)
+
+    def nfproxy_get_service_pyfilters(self,service_id: str):
+        req = self.s.get(f"{self.address}api/nfproxy/services/{service_id}/pyfilters")
+        return req.json()
+
+    def nfproxy_get_pyfilter(self, service_id:str, filter_name: str):
+        req = self.s.get(f"{self.address}api/nfproxy/services/{service_id}/pyfilters/{filter_name}")
+        return req.json()
+    
+    def nfproxy_enable_pyfilter(self, service_id:str, filter_name: str):
+        req = self.s.post(f"{self.address}api/nfproxy/services/{service_id}/pyfilters/{filter_name}/enable")
+        return verify(req)
+
+    def nfproxy_disable_pyfilter(self, service_id:str, filter_name: str):
+        req = self.s.post(f"{self.address}api/nfproxy/services/{service_id}/pyfilters/{filter_name}/disable")
+        return verify(req)
+
+    def nfproxy_add_service(self, name: str, port: int, proto: str, ip_int: str, fail_open: bool = False):
+        req = self.s.post(f"{self.address}api/nfproxy/services" , 
+            json={"name":name,"port":port, "proto": proto, "ip_int": ip_int, "fail_open": fail_open})
+        return req.json()["service_id"] if verify(req) else False 
+
+    def nfproxy_get_code(self, service_id: str):
+        req = self.s.get(f"{self.address}api/nfproxy/services/{service_id}/code")
+        return req.text
+    
+    def nfproxy_set_code(self, service_id: str, code: str):
+        req = self.s.put(f"{self.address}api/nfproxy/services/{service_id}/code", json={"code":code})
+        return verify(req)
--- a/tests/utils/tcpserver.py
+++ b/tests/utils/tcpserver.py
@@ -1,34 +1,72 @@
 from multiprocessing import Process
 import socket
+import traceback

 class TcpServer:
-    def __init__(self,port,ipv6,proxy_port=None):
-        def _startServer(port):
-            sock = socket.socket(socket.AF_INET6 if ipv6 else socket.AF_INET, socket.SOCK_STREAM)
-            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-            sock.bind(('::1' if ipv6 else '127.0.0.1', port))
-            sock.listen(8)
-            while True:  
-                connection,address = sock.accept()  
-                buf = connection.recv(4096)  
-                connection.send(buf)    		
-                connection.close()
+    def __init__(self,port,ipv6,proxy_port=None, verbose=False):
        self.proxy_port = proxy_port
        self.ipv6 = ipv6
        self.port = port
-        self.server = Process(target=_startServer,args=[port])
+        self.verbose = verbose
+        self._regen_process()
+
+    def _regen_process(self):
+        def _startServer(port):
+            sock = socket.socket(socket.AF_INET6 if self.ipv6 else socket.AF_INET, socket.SOCK_STREAM)
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            sock.bind(('::1' if self.ipv6 else '127.0.0.1', port))
+            sock.listen(8)
+            while True:
+                connection,address = sock.accept()
+                while True:
+                    try:
+                        buf = connection.recv(4096)
+                        if buf == b'':
+                            break
+                        if self.verbose:
+                            print("SERVER: ", buf)
+                        connection.sendall(buf)
+                    except Exception:
+                        if self.verbose:
+                            traceback.print_exc()
+                connection.close()
+        self.server = Process(target=_startServer,args=[self.port])

    def start(self):
        self.server.start()
    
    def stop(self):
        self.server.terminate()
+        self.server.join()
+        self._regen_process()

-    def sendCheckData(self,data):
-        s = socket.socket(socket.AF_INET6 if self.ipv6 else socket.AF_INET, socket.SOCK_STREAM)
-        s.settimeout(1)
-        s.connect(('::1' if self.ipv6 else '127.0.0.1', self.proxy_port if self.proxy_port else self.port), )
-        s.sendall(data)
-        received_data = s.recv(4096)
-        s.close()
+    def connect_client(self):
+        self.client_sock = socket.socket(socket.AF_INET6 if self.ipv6 else socket.AF_INET, socket.SOCK_STREAM)
+        self.client_sock.settimeout(1)
+        self.client_sock.connect(('::1' if self.ipv6 else '127.0.0.1', self.proxy_port if self.proxy_port else self.port))      
+
+    def close_client(self):
+        if self.client_sock:
+            self.client_sock.close()
+
+    def send_packet(self, packet):
+        if self.verbose:
+            print("CLIENT: ", packet)
+        self.client_sock.sendall(packet)
+    
+    def recv_packet(self):
+        try:
+            return self.client_sock.recv(4096)
+        except TimeoutError:
+            if self.verbose:
+                traceback.print_exc()
+            return False
+    
+    def sendCheckData(self, data, get_data=False):
+        self.connect_client()
+        self.send_packet(data)
+        received_data = self.recv_packet()
+        self.close_client()
+        if get_data:
+            return received_data
        return received_data == data