0xb00b5/firegex-traffic-viewer
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rebase to working version

Browse Source
This commit is contained in:
DomySh
2022-06-18 20:32:27 +02:00
parent 2332a4f5f7
commit 8bff1a888d
5 changed files with 195 additions and 256 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -11,7 +11,7 @@
/backend/db/firegex.db /backend/db/firegex.db
/backend/db/firegex.db-journal /backend/db/firegex.db-journal
/backend/proxy/proxy.so /backend/proxy/proxy
docker-compose.yml docker-compose.yml
# production # production
/frontend/build /frontend/build

67
backend/proxy/__init__.py
View File

@@ -1,8 +1,7 @@
from signal import SIGUSR1, SIGUSR2 from signal import SIGUSR1
from secrets import token_urlsafe from secrets import token_urlsafe
from kthread import KThread import subprocess, re, os
import re, os
from ctypes import CDLL, POINTER, c_char_p, c_int, c_ushort, CFUNCTYPE, c_void_p, byref
#c++ -o proxy proxy.cpp #c++ -o proxy proxy.cpp
@@ -41,44 +40,36 @@ class Proxy:
config_file_path = os.path.join("/tmp/" + token_urlsafe(16)) config_file_path = os.path.join("/tmp/" + token_urlsafe(16))
if not os.path.exists(config_file_path): if not os.path.exists(config_file_path):
self.config_file_path = config_file_path self.config_file_path = config_file_path
self.lib = CDLL(os.path.join(os.path.dirname(os.path.abspath(__file__)),"./proxy.so"))
self.lib.start_proxy.restype = c_int
#char* local_host_p, unsigned short local_port, char* forward_host_p, unsigned short forward_port, char* config_file_p, void (*incrementCallback_p)(const char *)
self.lib.start_proxy.argtypes = [c_char_p, c_ushort, c_char_p, c_ushort, c_char_p, POINTER(c_int), c_void_p]
def start(self, in_pause=False): def start(self, in_pause=False):
if self.process is None: if self.process is None:
self.filter_map = self.compile_filters() filter_map = self.compile_filters()
filters_codes = list(self.filter_map.keys()) if not in_pause else [] filters_codes = list(filter_map.keys()) if not in_pause else []
proxy_binary_path = os.path.join(os.path.dirname(os.path.abspath(__file__)),"./proxy")
self.__write_config(filters_codes) self.__write_config(filters_codes)
@CFUNCTYPE(None, c_char_p) self.process = subprocess.Popen(
def callback_wrap(regex): [proxy_binary_path, str(self.public_host), str(self.public_port), str(self.internal_host), str(self.internal_port), self.config_file_path],
filter = self.filter_map[regex.decode()] stdout=subprocess.PIPE, universal_newlines=True
filter.blocked+=1
print(self.filter_map)
if self.callback_blocked_update:
self.callback_blocked_update(self.filter_map[regex.decode()])
status_code = c_int(1)
self.process = KThread(
target=self.lib.start_proxy,
args=(self.public_host.encode(), self.public_port,
self.internal_host.encode(), self.internal_port,
self.config_file_path.encode(),
byref(status_code), callback_wrap
),
) )
self.process.start() for stdout_line in iter(self.process.stdout.readline, ""):
self.process.join() if stdout_line.startswith("BLOCKED"):
self.__delete_config() regex_id = stdout_line.split()[1]
return status_code.value filter_map[regex_id].blocked+=1
if self.callback_blocked_update: self.callback_blocked_update(filter_map[regex_id])
self.process.stdout.close()
return self.process.wait()
def stop(self): def stop(self):
if self.process: if self.process:
if self.process.is_alive(): self.process.terminate()
os.kill(self.process.native_id,SIGUSR2) try:
self.process.wait(timeout=3)
return True
except Exception:
self.process.kill()
return False
finally:
self.process = None self.process = None
return True return True
@@ -92,9 +83,6 @@ class Proxy:
for line in filters_codes: for line in filters_codes:
config_file.write(line + '\n') config_file.write(line + '\n')
def __delete_config(self):
os.remove(self.config_file_path)
def reload(self): def reload(self):
if self.isactive(): if self.isactive():
filter_map = self.compile_filters() filter_map = self.compile_filters()
@@ -103,12 +91,11 @@ class Proxy:
self.trigger_reload_config() self.trigger_reload_config()
def isactive(self): def isactive(self):
if self.process and not self.process.is_alive(): return True if self.process else False
self.process = None
return not self.process is None
def trigger_reload_config(self): def trigger_reload_config(self):
os.kill(self.process.native_id, SIGUSR1) self.process.send_signal(SIGUSR1)
def pause(self): def pause(self):
if self.isactive(): if self.isactive():

273
backend/proxy/proxy.cpp
View File

@@ -4,7 +4,6 @@
#include <string> #include <string>
#include <csignal> #include <csignal>
#include <fstream> #include <fstream>
#include <unistd.h>
#include <boost/regex.hpp> #include <boost/regex.hpp>
#include <boost/shared_ptr.hpp> #include <boost/shared_ptr.hpp>
@@ -12,13 +11,12 @@
#include <boost/bind.hpp> #include <boost/bind.hpp>
#include <boost/asio.hpp> #include <boost/asio.hpp>
#include <boost/thread/mutex.hpp> #include <boost/thread/mutex.hpp>
#include <map>
#include <cctype> // is* #include <cctype> // is*
using namespace std; //#define DEBUG
#define DEBUG using namespace std;
int to_int(int c) { int to_int(int c) {
if (not isxdigit(c)) return -1; // error: non-hexadecimal digit found if (not isxdigit(c)) return -1; // error: non-hexadecimal digit found
@@ -39,94 +37,8 @@ unhexlify(InputIterator first, InputIterator last, OutputIterator ascii) {
return 0; return 0;
} }
namespace tcp_proxy{ vector<pair<string,boost::regex>> regex_s_c_w, regex_c_s_w, regex_s_c_b, regex_c_s_b;
class acceptor; const char* config_file;
};
struct regex_filter_table{
vector<pair<string,boost::regex>>
regex_s_c_w, regex_c_s_w, regex_s_c_b, regex_c_s_b;
};
struct regex_proxy{
string config_file;
tcp_proxy::acceptor *acceptor;
int* status_code;
regex_filter_table filter_tab;
void (*incrementCallback)(const char *) = nullptr;
};
map<pid_t, regex_proxy*> proxy_map;
auto firewall(){
return proxy_map[gettid()];
}
void push_regex(char* arg, bool case_sensitive, vector<pair<string,boost::regex>> &v){
size_t expr_len = (strlen(arg)-2)/2;
char expr[expr_len];
unhexlify(arg+2, arg+strlen(arg)-1, expr);
if (case_sensitive){
boost::regex regex(reinterpret_cast<char*>(expr),
reinterpret_cast<char*>(expr) + expr_len);
#ifdef DEBUG
cout << "Added case sensitive regex " << expr << endl;
#endif
v.push_back(make_pair(string(arg), regex));
} else {
boost::regex regex(reinterpret_cast<char*>(expr),
reinterpret_cast<char*>(expr) + expr_len, boost::regex::icase);
#ifdef DEBUG
cout << "Added case insensitive regex " << expr << endl;
#endif
v.push_back(make_pair(string(arg), regex));
}
}
void update_regex(){
fstream fd;
fd.open(firewall()->config_file,ios::in);
if (!fd.is_open()){
std::cerr << "Error: config file couln't be opened" << std::endl;
*(firewall()->status_code) = 2;
return;
}
firewall()->filter_tab.regex_s_c_w.clear();
firewall()->filter_tab.regex_c_s_w.clear();
firewall()->filter_tab.regex_s_c_b.clear();
firewall()->filter_tab.regex_c_s_b.clear();
string line;
while(getline(fd, line)){
char tp[line.length() +1];
strcpy(tp, line.c_str());
if (strlen(tp) >= 2){
bool case_sensitive = true;
if(tp[0] == '0'){
case_sensitive = false;
}
switch(tp[1]){
case 'C': { // Client to server Blacklist
push_regex(tp, case_sensitive, firewall()->filter_tab.regex_c_s_b);
break;
}
case 'c': { // Client to server Whitelist
push_regex(tp, case_sensitive, firewall()->filter_tab.regex_c_s_w);
break;
}
case 'S': { // Server to client Blacklist
push_regex(tp, case_sensitive, firewall()->filter_tab.regex_s_c_b);
break;
}
case 's': { // Server to client Whitelist
push_regex(tp, case_sensitive, firewall()->filter_tab.regex_s_c_w);
break;
}
}
}
}
}
bool filter_data(unsigned char* data, const size_t& bytes_transferred, vector<pair<string,boost::regex>> const &blacklist, vector<pair<string,boost::regex>> const &whitelist){ bool filter_data(unsigned char* data, const size_t& bytes_transferred, vector<pair<string,boost::regex>> const &blacklist, vector<pair<string,boost::regex>> const &whitelist){
#ifdef DEBUG #ifdef DEBUG
@@ -140,7 +52,7 @@ bool filter_data(unsigned char* data, const size_t& bytes_transferred, vector<pa
boost::cmatch what; boost::cmatch what;
if (boost::regex_match(reinterpret_cast<const char*>(data), if (boost::regex_match(reinterpret_cast<const char*>(data),
reinterpret_cast<const char*>(data) + bytes_transferred, what, ele.second)){ reinterpret_cast<const char*>(data) + bytes_transferred, what, ele.second)){
if (firewall()->incrementCallback != nullptr) firewall()->incrementCallback(ele.first.c_str()); cout << "BLOCKED " << ele.first << endl;
return false; return false;
} }
} }
@@ -148,7 +60,7 @@ bool filter_data(unsigned char* data, const size_t& bytes_transferred, vector<pa
boost::cmatch what; boost::cmatch what;
if (!boost::regex_match(reinterpret_cast<const char*>(data), if (!boost::regex_match(reinterpret_cast<const char*>(data),
reinterpret_cast<const char*>(data) + bytes_transferred, what, ele.second)){ reinterpret_cast<const char*>(data) + bytes_transferred, what, ele.second)){
if (firewall()->incrementCallback != nullptr) firewall()->incrementCallback(ele.first.c_str()); cout << "BLOCKED " << ele.first << endl;
return false; return false;
} }
} }
@@ -162,10 +74,13 @@ namespace tcp_proxy
{ {
namespace ip = boost::asio::ip; namespace ip = boost::asio::ip;
typedef ip::tcp::socket socket_type;
class bridge : public boost::enable_shared_from_this<bridge> class bridge : public boost::enable_shared_from_this<bridge>
{ {
public: public:
typedef ip::tcp::socket socket_type;
typedef boost::shared_ptr<bridge> ptr_type;
bridge(boost::asio::io_service& ios) bridge(boost::asio::io_service& ios)
: downstream_socket_(ios), : downstream_socket_(ios),
upstream_socket_ (ios) upstream_socket_ (ios)
@@ -173,11 +88,13 @@ namespace tcp_proxy
socket_type& downstream_socket() socket_type& downstream_socket()
{ {
// Client socket
return downstream_socket_; return downstream_socket_;
} }
socket_type& upstream_socket() socket_type& upstream_socket()
{ {
// Remote server socket
return upstream_socket_; return upstream_socket_;
} }
@@ -217,6 +134,8 @@ namespace tcp_proxy
close(); close();
} }
private:
/* /*
Section A: Remote Server --> Proxy --> Client Section A: Remote Server --> Proxy --> Client
Process data recieved from remote sever then send to client. Process data recieved from remote sever then send to client.
@@ -228,7 +147,7 @@ namespace tcp_proxy
{ {
if (!error) if (!error)
{ {
if (filter_data(upstream_data_, bytes_transferred, firewall()->filter_tab.regex_s_c_b, firewall()->filter_tab.regex_s_c_w)){ if (filter_data(upstream_data_, bytes_transferred, regex_s_c_b, regex_s_c_w)){
async_write(downstream_socket_, async_write(downstream_socket_,
boost::asio::buffer(upstream_data_,bytes_transferred), boost::asio::buffer(upstream_data_,bytes_transferred),
boost::bind(&bridge::handle_downstream_write, boost::bind(&bridge::handle_downstream_write,
@@ -271,7 +190,7 @@ namespace tcp_proxy
{ {
if (!error) if (!error)
{ {
if (filter_data(downstream_data_, bytes_transferred, firewall()->filter_tab.regex_c_s_b, firewall()->filter_tab.regex_c_s_w)){ if (filter_data(downstream_data_, bytes_transferred, regex_c_s_b, regex_c_s_w)){
async_write(upstream_socket_, async_write(upstream_socket_,
boost::asio::buffer(downstream_data_,bytes_transferred), boost::asio::buffer(downstream_data_,bytes_transferred),
boost::bind(&bridge::handle_upstream_write, boost::bind(&bridge::handle_upstream_write,
@@ -323,9 +242,10 @@ namespace tcp_proxy
enum { max_data_length = 8192 }; //8KB enum { max_data_length = 8192 }; //8KB
unsigned char downstream_data_[max_data_length]; unsigned char downstream_data_[max_data_length];
unsigned char upstream_data_ [max_data_length]; unsigned char upstream_data_ [max_data_length];
boost::mutex mutex_; boost::mutex mutex_;
}; public:
class acceptor class acceptor
{ {
@@ -339,11 +259,7 @@ namespace tcp_proxy
acceptor_(io_service_,ip::tcp::endpoint(localhost_address,local_port)), acceptor_(io_service_,ip::tcp::endpoint(localhost_address,local_port)),
upstream_port_(upstream_port), upstream_port_(upstream_port),
upstream_host_(upstream_host) upstream_host_(upstream_host)
{ {}
boost::asio::socket_base::reuse_address option(true);
acceptor_.set_option(option);
}
bool accept_connections() bool accept_connections()
{ {
@@ -355,7 +271,6 @@ namespace tcp_proxy
boost::bind(&acceptor::handle_accept, boost::bind(&acceptor::handle_accept,
this, this,
boost::asio::placeholders::error)); boost::asio::placeholders::error));
} }
catch(std::exception& e) catch(std::exception& e)
{ {
@@ -366,16 +281,6 @@ namespace tcp_proxy
return true; return true;
} }
void close(){
cout << "acceptor 1: " << endl;
acceptor_.close();
cout << "acceptor 2: " << endl;
acceptor_.cancel();
cout << "acceptor 3: " << endl;
session_->close();
cout << "acceptor 4: " << endl;
}
private: private:
void handle_accept(const boost::system::error_code& error) void handle_accept(const boost::system::error_code& error)
@@ -398,80 +303,126 @@ namespace tcp_proxy
boost::asio::io_service& io_service_; boost::asio::io_service& io_service_;
ip::address_v4 localhost_address; ip::address_v4 localhost_address;
ip::tcp::acceptor acceptor_; ip::tcp::acceptor acceptor_;
boost::shared_ptr<bridge> session_; ptr_type session_;
unsigned short upstream_port_; unsigned short upstream_port_;
std::string upstream_host_; std::string upstream_host_;
}; };
};
} }
static void signal_handler(int signal_num){ void push_regex(char* arg, bool case_sensitive, vector<pair<string,boost::regex>> &v){
if (signal_num == SIGUSR1){ size_t expr_len = (strlen(arg)-2)/2;
char expr[expr_len];
unhexlify(arg+2, arg+strlen(arg)-1, expr);
if (case_sensitive){
boost::regex regex(reinterpret_cast<char*>(expr),
reinterpret_cast<char*>(expr) + expr_len);
#ifdef DEBUG #ifdef DEBUG
cout << "Updating configurtation: " << gettid() << endl; cout << "Added case sensitive regex " << expr << endl;
#endif #endif
update_regex(); v.push_back(make_pair(string(arg), regex));
}else if(signal_num == SIGUSR2){ } else {
boost::regex regex(reinterpret_cast<char*>(expr),
reinterpret_cast<char*>(expr) + expr_len, boost::regex::icase);
#ifdef DEBUG #ifdef DEBUG
cout << "Killed: " << gettid() << endl; cout << "Added case insensitive regex " << expr << endl;
#endif
*(firewall()->status_code) = 0;
#ifdef DEBUG
cout << "Exiting PT1: " << gettid() << endl;
#endif
proxy_map.erase(gettid());
#ifdef DEBUG
cout << "Exiting PT2: " << gettid() << endl;
#endif
//firewall()->acceptor->close();
#ifdef DEBUG
cout << "Exiting PT3: " << gettid() << endl;
#endif #endif
v.push_back(make_pair(string(arg), regex));
} }
} }
extern "C" void start_proxy(
char* local_host,unsigned short local_port, void update_regex(){
char* forward_host, unsigned short forward_port, fstream fd;
char* config_file, int* status_code, void (*incrementCallback)(const char *) fd.open(config_file,ios::in);
){ if (!fd.is_open()){
#ifdef DEBUG std::cerr << "Error: config file couln't be opened" << std::endl;
cout << "Starting: " << gettid() << endl; exit(1);
#endif }
regex_proxy tmp;
proxy_map[gettid()] = &tmp; regex_s_c_w.clear();
tmp.config_file = config_file; regex_c_s_w.clear();
tmp.status_code = status_code; regex_s_c_b.clear();
tmp.incrementCallback = incrementCallback; regex_c_s_b.clear();
string line;
while(getline(fd, line)){
char tp[line.length() +1];
strcpy(tp, line.c_str());
if (strlen(tp) >= 2){
bool case_sensitive = true;
if(tp[0] == '0'){
case_sensitive = false;
}
switch(tp[1]){
case 'C': { // Client to server Blacklist
push_regex(tp, case_sensitive, regex_c_s_b);
break;
}
case 'c': { // Client to server Whitelist
push_regex(tp, case_sensitive, regex_c_s_w);
break;
}
case 'S': { // Server to client Blacklist
push_regex(tp, case_sensitive, regex_s_c_b);
break;
}
case 's': { // Server to client Whitelist
push_regex(tp, case_sensitive, regex_s_c_w);
break;
}
}
}
}
}
void signal_handler(int signal_num)
{
if (signal_num == SIGUSR1){
cout << "Updating configurtation" << endl;
update_regex(); update_regex();
}
}
int main(int argc, char* argv[])
{
if (argc < 6)
{
std::cerr << "usage: tcpproxy_server <local host ip> <local port> <forward host ip> <forward port> <config_file>" << std::endl;
return 1;
}
const unsigned short local_port = static_cast<unsigned short>(::atoi(argv[2]));
const unsigned short forward_port = static_cast<unsigned short>(::atoi(argv[4]));
const std::string local_host = argv[1];
const std::string forward_host = argv[3];
signal(SIGUSR1, signal_handler);\
config_file = argv[5];
update_regex();
boost::asio::io_service ios; boost::asio::io_service ios;
signal(SIGUSR1, signal_handler);
signal(SIGUSR2, signal_handler);
try try
{ {
tcp_proxy::acceptor acceptor(ios, tcp_proxy::bridge::acceptor acceptor(ios,
local_host, local_port, local_host, local_port,
forward_host, forward_port); forward_host, forward_port);
firewall()->acceptor = &acceptor;
acceptor.accept_connections(); acceptor.accept_connections();
ios.run(); ios.run();
} }
catch(std::exception& e) catch(std::exception& e)
{ {
std::cerr << "Error: " << e.what() << std::endl; std::cerr << "Error: " << e.what() << std::endl;
*(firewall()->status_code) = 1; return 1;
proxy_map.erase(gettid());
return;
} }
#ifdef DEBUG return 0;
cout << "Exiting: " << gettid() << endl;
#endif
*(firewall()->status_code) = 0;
proxy_map.erase(gettid());
} }
/* /*

BIN
backend/proxy/proxy.so
View File

Binary file not shown.

3
backend/utils.py
View File

@@ -155,7 +155,7 @@ class ProxyManager:
self.__update_status_db(id, next_status) self.__update_status_db(id, next_status)
if saved_status[0] == "wait": saved_status[0] = next_status if saved_status[0] == "wait": saved_status[0] = next_status
proxy_status = proxy.start(in_pause=(next_status==STATUS.PAUSE)) proxy_status = proxy.start(in_pause=(next_status==STATUS.PAUSE))
if proxy_status != 0: if proxy_status == 1:
self.__update_status_db(id, STATUS.STOP) self.__update_status_db(id, STATUS.STOP)
return return
else: else:
@@ -210,6 +210,7 @@ class ProxyManager:
def stats_updater(filter:Filter): def stats_updater(filter:Filter):
print("Callback received",filter.blocked, filter.code)
self.db.query("UPDATE regexes SET blocked_packets = ? WHERE regex_id = ?;", (filter.blocked, filter.code)) self.db.query("UPDATE regexes SET blocked_packets = ? WHERE regex_id = ?;", (filter.blocked, filter.code))
if not proxy: if not proxy: