mirror of
https://github.com/Av0idD4rk/firegex.git
synced 2026-10-23 16:31:00 +00:00
478 lines
18 KiB
Python
478 lines
18 KiB
Python
#!/usr/bin/env python3
|
|
from utils.colors import colors, puts, sep
|
|
from utils.firegexapi import FiregexAPI
|
|
from utils.tcpserver import TcpServer
|
|
from utils.udpserver import UdpServer
|
|
from utils.tls_helpers import generate_self_signed_cert_key, tls_connect_send_recv
|
|
import argparse
|
|
import secrets
|
|
import base64
|
|
import time
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument(
|
|
"--address",
|
|
"-a",
|
|
type=str,
|
|
required=False,
|
|
help="Address of firegex backend",
|
|
default="http://127.0.0.1:4444/",
|
|
)
|
|
parser.add_argument(
|
|
"--password", "-p", type=str, required=True, help="Firegex password"
|
|
)
|
|
parser.add_argument(
|
|
"--service_name",
|
|
"-n",
|
|
type=str,
|
|
required=False,
|
|
help="Name of the test service",
|
|
default="Test Service",
|
|
)
|
|
parser.add_argument(
|
|
"--port",
|
|
"-P",
|
|
type=int,
|
|
required=False,
|
|
help="Port of the test service",
|
|
default=1337,
|
|
)
|
|
parser.add_argument(
|
|
"--ipv6", "-6", action="store_true", help="Test Ipv6", default=False
|
|
)
|
|
parser.add_argument(
|
|
"--proto",
|
|
"-m",
|
|
type=str,
|
|
required=False,
|
|
choices=["tcp", "udp"],
|
|
help="Select the protocol",
|
|
default="tcp",
|
|
)
|
|
parser.add_argument(
|
|
"--tls", "-t", action="store_true", help="Test TLS Decrypt", default=False
|
|
)
|
|
|
|
args = parser.parse_args()
|
|
if args.tls and args.proto != "tcp":
|
|
puts("TLS is only supported with TCP protocol.", color=colors.red)
|
|
exit(1)
|
|
|
|
sep()
|
|
puts("Testing will start on ", color=colors.cyan, end="")
|
|
puts(f"{args.address}", color=colors.yellow)
|
|
|
|
firegex = FiregexAPI(args.address)
|
|
|
|
status = firegex.status()
|
|
if status.get("status") == "init":
|
|
firegex.set_password(args.password)
|
|
|
|
# Login
|
|
if firegex.login(args.password):
|
|
puts("Sucessfully logged in ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Unknown response or wrong passowrd ✗", color=colors.red)
|
|
exit(1)
|
|
|
|
# Create server. When testing TLS, the backend itself must also speak TLS: nginx's
|
|
# loopback clear_port leg always re-encrypts before forwarding to the real destination
|
|
# (this mirrors a CTF challenge service that natively speaks TLS).
|
|
backend_cert, backend_key = generate_self_signed_cert_key("127.0.0.1") if args.tls else (None, None)
|
|
server = (TcpServer if args.proto == "tcp" else UdpServer)(
|
|
args.port, ipv6=args.ipv6, **({"tls_cert": backend_cert, "tls_key": backend_key} if args.tls else {})
|
|
)
|
|
|
|
tls_stream_id = None
|
|
tls_ssl_port = None
|
|
service_id = None
|
|
def exit_test(code):
|
|
if service_id:
|
|
server.stop()
|
|
if firegex.nfregex_delete_service(service_id):
|
|
puts("Sucessfully deleted service ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Coulnd't delete serivce ✗", color=colors.red)
|
|
exit(1)
|
|
if tls_stream_id:
|
|
firegex.tls_stop_stream(tls_stream_id)
|
|
if firegex.tls_delete_stream(tls_stream_id):
|
|
puts("Sucessfully deleted TLS stream ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Couldn't delete TLS stream ✗", color=colors.red)
|
|
exit(1)
|
|
exit(code)
|
|
|
|
srvs = firegex.nfregex_get_services()
|
|
for ele in srvs:
|
|
if ele["name"] == args.service_name:
|
|
firegex.nfregex_delete_service(ele["service_id"])
|
|
|
|
if args.tls:
|
|
streams = firegex.tls_get_streams()
|
|
for s in streams:
|
|
if s["port"] == args.port:
|
|
firegex.tls_stop_stream(s["id"])
|
|
firegex.tls_delete_stream(s["id"])
|
|
|
|
cert, key = generate_self_signed_cert_key("localhost")
|
|
tls_stream_id = firegex.tls_add_stream("TLS Stream", "::1" if args.ipv6 else "127.0.0.1", args.port, cert, key)
|
|
if tls_stream_id:
|
|
puts(f"Sucessfully created TLS stream {tls_stream_id} ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Failed to create TLS stream ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
if firegex.tls_start_stream(tls_stream_id):
|
|
puts("Sucessfully started TLS stream ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Failed to start TLS stream ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
tls_ssl_port = firegex.tls_get_stream(tls_stream_id)["ssl_port"]
|
|
|
|
service_id = firegex.nfregex_add_service(
|
|
args.service_name, args.port, args.proto, "::1" if args.ipv6 else "127.0.0.1",
|
|
target_type="tls" if args.tls else "flow",
|
|
tls_stream_id=tls_stream_id if args.tls else None
|
|
)
|
|
if service_id:
|
|
puts(f"Sucessfully created service {service_id} ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Failed to create service ✗", color=colors.red)
|
|
exit(1)
|
|
|
|
if firegex.nfregex_start_service(service_id):
|
|
puts("Sucessfully started service ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Failed to start service ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
server.start()
|
|
time.sleep(0.5)
|
|
|
|
def send_check(data):
|
|
"""Sends data and checks it was echoed back unmodified. When testing TLS,
|
|
routes through a real TLS handshake against the stream's public ssl_port
|
|
(so the check actually exercises decrypt -> filter -> re-encrypt), instead
|
|
of talking to the backend directly."""
|
|
if args.tls:
|
|
return tls_connect_send_recv(tls_ssl_port, args.ipv6, data) == data
|
|
return server.sendCheckData(data)
|
|
|
|
try:
|
|
if send_check(secrets.token_bytes(432)):
|
|
puts("Successfully tested first proxy with no regex ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Data was corrupted ", color=colors.red)
|
|
exit_test(1)
|
|
except Exception:
|
|
puts("Test Failed: Couldn't send data to the server ", color=colors.red)
|
|
exit_test(1)
|
|
# Add new regex
|
|
secret = bytes(secrets.token_hex(16).encode())
|
|
|
|
if firegex.nfregex_add_regex(
|
|
service_id, secret, "B", active=True, is_case_sensitive=True
|
|
):
|
|
puts(f"Sucessfully added regex {str(secret)} ✔", color=colors.green)
|
|
else:
|
|
puts(f"Test Failed: Couldn't add the regex {str(secret)} ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
|
|
|
|
# Check if regex is present in the service
|
|
n_blocked = 0
|
|
|
|
def getMetric(metric_name, regex):
|
|
for metric in firegex.nfregex_get_metrics().split("\n"):
|
|
if metric.startswith(metric_name + "{") and f'regex="{regex}"' in metric:
|
|
return int(metric.split(" ")[-1])
|
|
|
|
def checkRegex(regex, should_work=True, upper=False, deleted=False):
|
|
if should_work:
|
|
global n_blocked
|
|
for r in firegex.nfregex_get_service_regexes(service_id):
|
|
if r["regex"] == secret:
|
|
# Test the regex
|
|
s = regex.upper() if upper else regex
|
|
if not send_check(
|
|
secrets.token_bytes(40) + s + secrets.token_bytes(40)
|
|
):
|
|
puts(
|
|
"The malicious request was successfully blocked ✔",
|
|
color=colors.green,
|
|
)
|
|
n_blocked += 1
|
|
time.sleep(1)
|
|
if firegex.nfregex_get_regex(r["id"])["n_packets"] == n_blocked:
|
|
puts(
|
|
"The packet was reported as blocked in the API ✔",
|
|
color=colors.green,
|
|
)
|
|
else:
|
|
puts(
|
|
"Test Failed: The packet wasn't reported as blocked in the API ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
if (
|
|
getMetric("firegex_blocked_packets", secret.decode())
|
|
== n_blocked
|
|
):
|
|
puts(
|
|
"The packet was reported as blocked in the metrics ✔",
|
|
color=colors.green,
|
|
)
|
|
else:
|
|
puts(
|
|
"Test Failed: The packet wasn't reported as blocked in the metrics ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
if getMetric("firegex_active", secret.decode()) == 1:
|
|
puts(
|
|
"The regex was reported as active in the metrics ✔",
|
|
color=colors.green,
|
|
)
|
|
else:
|
|
puts(
|
|
"Test Failed: The regex wasn't reported as active in the metrics ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
else:
|
|
puts(
|
|
"Test Failed: The request wasn't blocked ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
return
|
|
puts("Test Failed: The regex wasn't found ✗", color=colors.red)
|
|
exit_test(1)
|
|
else:
|
|
if send_check(
|
|
secrets.token_bytes(40)
|
|
+ base64.b64decode(regex)
|
|
+ secrets.token_bytes(40)
|
|
):
|
|
puts("The request wasn't blocked ✔", color=colors.green)
|
|
else:
|
|
puts(
|
|
"Test Failed: The request was blocked when it shouldn't have",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
if not deleted:
|
|
if getMetric("firegex_active", secret.decode()) == 0:
|
|
puts(
|
|
"The regex was reported as inactive in the metrics ✔",
|
|
color=colors.green,
|
|
)
|
|
else:
|
|
puts(
|
|
"Test Failed: The regex wasn't reported as inactive in the metrics ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
|
|
def clear_regexes():
|
|
global n_blocked
|
|
n_blocked = 0
|
|
for r in firegex.nfregex_get_service_regexes(service_id):
|
|
if r["regex"] == secret:
|
|
if firegex.nfregex_delete_regex(r["id"]):
|
|
puts(
|
|
f"Sucessfully deleted regex with id {r['id']} ✔",
|
|
color=colors.green,
|
|
)
|
|
else:
|
|
puts("Test Failed: Coulnd't delete the regex ✗", color=colors.red)
|
|
exit_test(1)
|
|
break
|
|
if f'regex="{secret.decode()}"' not in firegex.nfregex_get_metrics():
|
|
puts("No regex metrics after deletion ✔", color=colors.green)
|
|
else:
|
|
puts(
|
|
"Test Failed: Metrics found after deleting the regex ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
|
|
checkRegex(secret)
|
|
|
|
# Pause the proxy
|
|
if firegex.nfregex_stop_service(service_id):
|
|
puts(f"Sucessfully paused service with id {service_id} ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Coulnd't pause the service ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
# Check if it's actually paused
|
|
checkRegex(secret, should_work=False)
|
|
|
|
# Start firewall
|
|
if firegex.nfregex_start_service(service_id):
|
|
puts(f"Sucessfully started service with id {service_id} ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Coulnd't start the service ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
checkRegex(secret)
|
|
|
|
# Disable regex
|
|
for r in firegex.nfregex_get_service_regexes(service_id):
|
|
if r["regex"] == secret:
|
|
if firegex.nfregex_disable_regex(r["id"]):
|
|
puts(
|
|
f"Sucessfully disabled regex with id {r['id']} ✔",
|
|
color=colors.green,
|
|
)
|
|
else:
|
|
puts("Test Failed: Coulnd't disable the regex ✗", color=colors.red)
|
|
exit_test(1)
|
|
break
|
|
|
|
# Check if it's actually disabled
|
|
checkRegex(secret, should_work=False)
|
|
|
|
# Enable regex
|
|
for r in firegex.nfregex_get_service_regexes(service_id):
|
|
if r["regex"] == secret:
|
|
if firegex.nfregex_enable_regex(r["id"]):
|
|
puts(
|
|
f"Sucessfully enabled regex with id {r['id']} ✔", color=colors.green
|
|
)
|
|
else:
|
|
puts("Test Failed: Coulnd't enable the regex ✗", color=colors.red)
|
|
exit_test(1)
|
|
break
|
|
|
|
checkRegex(secret)
|
|
|
|
# Delete regex
|
|
clear_regexes()
|
|
|
|
# Check if it's actually deleted
|
|
checkRegex(secret, should_work=False, deleted=True)
|
|
|
|
# Add case insensitive regex
|
|
if firegex.nfregex_add_regex(
|
|
service_id, secret, "B", active=True, is_case_sensitive=False
|
|
):
|
|
puts(
|
|
f"Sucessfully added case insensitive regex {str(secret)} ✔",
|
|
color=colors.green,
|
|
)
|
|
else:
|
|
puts(
|
|
f"Test Failed: Coulnd't add the case insensitive regex {str(secret)} ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
|
|
checkRegex(secret, upper=True)
|
|
checkRegex(secret)
|
|
|
|
clear_regexes()
|
|
|
|
# Rename service
|
|
if firegex.nfregex_rename_service(service_id, f"{args.service_name}2"):
|
|
puts(
|
|
f"Sucessfully renamed service to {args.service_name}2 ✔", color=colors.green
|
|
)
|
|
else:
|
|
puts("Test Failed: Coulnd't rename service ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
# Check if service was renamed correctly
|
|
service = firegex.nfregex_get_service(service_id)
|
|
if service["name"] == f"{args.service_name}2":
|
|
puts("Checked that service was renamed correctly ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Service wasn't renamed correctly ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
# Rename back service
|
|
if firegex.nfregex_rename_service(service_id, f"{args.service_name}"):
|
|
puts(
|
|
f"Sucessfully renamed service to {args.service_name} ✔", color=colors.green
|
|
)
|
|
else:
|
|
puts("Test Failed: Coulnd't rename service ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
# Change settings (skipped in --tls mode: the service's own port/ip/proto no longer
|
|
# drive traffic interception once linked to a TLS stream, see resolve_target())
|
|
if not args.tls:
|
|
opposite_proto = "udp" if args.proto == "tcp" else "tcp"
|
|
if firegex.nfregex_settings_service(
|
|
service_id,
|
|
1338,
|
|
"::dead:beef" if args.ipv6 else "123.123.123.123",
|
|
True,
|
|
proto=opposite_proto,
|
|
):
|
|
srv_updated = firegex.nfregex_get_service(service_id)
|
|
if (
|
|
srv_updated["port"] == 1338
|
|
and srv_updated["proto"] == opposite_proto
|
|
and ("::dead:beef" if args.ipv6 else "123.123.123.123")
|
|
in srv_updated["ip_int"]
|
|
and srv_updated["fail_open"]
|
|
):
|
|
puts("Sucessfully changed service settings ✔", color=colors.green)
|
|
else:
|
|
puts(
|
|
"Test Failed: Service settings weren't updated correctly ✗",
|
|
color=colors.red,
|
|
)
|
|
exit_test(1)
|
|
else:
|
|
puts("Test Failed: Coulnd't change service settings ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
if args.tls:
|
|
# Stopping the TLS stream should cascade-stop the dependent service
|
|
if firegex.tls_stop_stream(tls_stream_id):
|
|
time.sleep(1)
|
|
srv_after_stop = firegex.nfregex_get_service(service_id)
|
|
if srv_after_stop["status"] == "stop":
|
|
puts("TLS stream stop correctly cascaded to stop the dependent service ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Dependent service wasn't cascade-stopped ✗", color=colors.red)
|
|
exit_test(1)
|
|
else:
|
|
puts("Test Failed: Coulnd't stop the TLS stream ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
# Starting the dependent service should cascade-reactivate the TLS stream
|
|
if firegex.nfregex_start_service(service_id):
|
|
time.sleep(1)
|
|
stream_after_start = firegex.tls_get_stream(tls_stream_id)
|
|
if stream_after_start["status"] == "active":
|
|
puts("Starting the service correctly cascaded to reactivate the TLS stream ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: TLS stream wasn't cascade-reactivated ✗", color=colors.red)
|
|
exit_test(1)
|
|
else:
|
|
puts("Test Failed: Coulnd't start the service ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
if send_check(secrets.token_bytes(64)):
|
|
puts("Traffic flows correctly after the cascade reactivation ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Traffic didn't flow correctly after the cascade reactivation ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
# Deleting a still-referenced TLS stream must be rejected
|
|
if not firegex.tls_delete_stream(tls_stream_id):
|
|
puts("Correctly rejected deletion of a TLS stream still in use ✔", color=colors.green)
|
|
else:
|
|
puts("Test Failed: Deleting an in-use TLS stream should have failed ✗", color=colors.red)
|
|
exit_test(1)
|
|
|
|
exit_test(0)
|