jfe

#!/usr/bin/env python

import socket
import threading
import binascii
import ssl
import sys
import os
from free_tls_certificates import client as certbotClient
import re
from requests import get
import time
import optparse
import atexit
import os
import signal
import glob
import atexit
from SimpleHTTPServer import SimpleHTTPRequestHandler
from BaseHTTPServer import HTTPServer
from IPy import IP
import SocketServer
import select
import struct
from daemonize import Daemonize

def flush_mangle_table():
    os.system("""
iptables -F -t mangle
ip rule del fwmark 1 lookup 100
ip route del local 0.0.0.0/0 dev lo table 100
""")

atexit.register(flush_mangle_table)

def logger(*msg):
    if opts.verbose: 
        print(msg)

# XXX unused for now
def getTCPInfo(s):
        fmt = "B"*7+"I"*21
        x = struct.unpack(fmt, s.getsockopt(socket.IPPROTO_TCP, socket.TCP_INFO, 92))
        return x

challenges = {}

class RequestHandler(SimpleHTTPRequestHandler):
    def do_HEAD(self):
        # XXX look for people who screwed this up, nice landmine if spidey sense is right
        self.send_response(404)
        self.send_header('Content-Length',0)
        self.end_headers()
        
    def do_GET(self):
        self.protocol_version = 'HTTP/1.1'
        if(self.path[-1]=="/"): 
            self.path="/noindex"
        challenge = self.path.split("/")[-1]
        if challenge in challenges:
            self.send_response(200)
            data = challenges[challenge]
            self.send_header('Content-Length',len(data))
            self.end_headers()
            self.wfile.write(data)
            print self.path, data
        else:
            self.send_response(404)
            self.send_header('Content-Length',0)
            self.end_headers()

class JFEServer(object):
    def __init__(self, host, port):
        self.host = host
        self.port = port
        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        self.sock.setsockopt(socket.SOL_IP, 19, 1) #ORDINALS!  Actually IP_TRANSPARENT
        self.sock.bind((self.host, self.port))
        
        

    def listen(self):
        # needs to be part of the JFE server, or it doesn't survive daemonization
        server = SocketServer.ThreadingTCPServer(('0.0.0.0', 2), RequestHandler, False) # Do not automatically bind
        server.allow_reuse_address = True # Prevent 'cannot bind to address' errors on restart
        server.allow_reuse_port = True # Prevent 'cannot bind to address' errors on restart
        server.server_bind()     # Manually bind, to support allow_reuse_address
        server.server_activate() # (see above comment)
        thread = threading.Thread(target = server.serve_forever)
        #thread.daemon = True
        thread.start()


        self.sock.listen(100)
        while True:
            try: 
                client, address = self.sock.accept()
            except:
                sys.exit(1)
            try: threading.Thread(target = self.proxyConnection, args = (client,address)).start()
            except (KeyboardInterrupt, SystemExit):
                sys.exit(1)


    def proxyConnection(self, client, address):
        (host, port) = client.getsockname()

        sniff = client.recv(128, socket.MSG_PEEK).split("\n")[0]
        if sniff.find(".well-known/acme-challenge")>-1:
            logger( "found acme challenge")
            port = 2
        if(port == 443): 
            port = 80
        sniff = binascii.hexlify(sniff)

        if(sniff[0:4]=="1603"): #XXX need better SSL sniff
            logger("sniffed SSL client hello")
            ctx=ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
            if not os.path.isfile(opts.accountcache + "/selfstub.cer"):
                logger("no cached selfstub.cer, issuing self signed cert")
                cert=certbotClient.issue_certificate(
                    ["localhost"],
                    opts.accountcache,
                    logger=logger,
                    self_signed=True
                )
                open(opts.accountcache + "/selfstub.cer", "wb").write(cert["cert"] + '\n'.join(cert["chain"]) + cert["private_key"] + "\n")

            ctx.load_cert_chain(certfile=opts.accountcache + "/selfstub.cer")
            def on_sni(sslSocket,serverName,ctx):
                logger("on_sni: ", serverName)
                if not serverName: 
                    return None
                if not re.match("^((?!-)[A-Za-z0-9-]{1,63}(?<!-)\.)+[A-Za-z]{2,6}$", serverName):
                    logger("regex match of servername failed")
                    return None #could error
                try:
                    remote = get('https://api.ipify.org').text  #NOT XXX -- This is apparently a stable IP discovery endpoint
                    addrinfo = socket.getaddrinfo(serverName, port, 0, 0, 6)  #  XXX -- This needs to check all A records, at least
                    matchedAddr = None
                    firstAddr = None
                    for addr in addrinfo:
                      sockaddr = addr[4]
                      address = sockaddr[0]
                      if firstAddr is None:
                        firstAddr = address
                      if remote == address:
                        matchedAddr = address
                    logger(remote, matchedAddr)
                    if matchedAddr is None:
                        print "getaddrinfo for", serverName, "[", firstAddr, "] did not match remote ip", remote
                        ip = IP(firstAddr)
                        if not ip.iptype() == "PUBLIC":
                          print "The IP address returned by getaddrinfo was of type ", ip.iptype()
                          print "Perhaps this is a default hostname in a cloud environment like AWS or you are behind a NAT?"
                          print "To prevent denial of service attacks, certificates will only be requested for names"
                          print "which are locally recognized as bound to a public IP address of this machine."
                        return None
                except Exception as e:
                    print e.message
                    return None
                certFile = opts.accountcache + "/" + serverName + ".cer"
                if not os.path.isfile(certFile): # XXX need to check for expiry
                    cert=self.getCert(serverName, certFile)
                    open(certFile, "wb").write(cert["cert"] + '\n'.join(cert["chain"]) + cert["private_key"] + "\n")
                newctx=ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
                newctx.load_cert_chain(certfile=certFile)
                sslSocket.context = newctx
                return None
            ctx.set_servername_callback(on_sni)
            try: 
                client = ctx.wrap_socket(client, server_side=True,suppress_ragged_eofs=True)
            except Exception as e:
                print e.message
                pass
        
        forward = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        # XXX How to make the connection appear to come from its original source?
        try: forward.connect(("127.0.0.1", port))
        except:
            logger("Connection to port " + str(port) + " rejected")
            return

        # this is clearly suboptimal, but I'm trying to get around the fact that
        # there's other things that can block (free_tls_certificates and my
        # waiting for it) and I don't want one connection to be able to block
        # everything else.  It'd be nice to use *anything* else but there's
        # missing features in every other approach, see readme
        
        client.setblocking(1)
        client.settimeout(999)
        forward.setblocking(1)
        forward.settimeout(999)
        threading.Thread(target = self.toForward, args = (client, address, forward)).start()
        threading.Thread(target = self.toClient,  args = (client, address, forward)).start()

    def getCert(self, serverName, certFile):
        tos_url = None
        if os.path.isfile(opts.accountcache + "/tos_url.txt"):
            tos_url = open(opts.accountcache + "/tos_url.txt", "r").read()
        try:
            acme = "https://acme-v01.api.letsencrypt.org/directory"
            if(opts.staging):
                acme="https://acme-staging.api.letsencrypt.org/directory"
            cert=certbotClient.issue_certificate(
                [serverName],
                opts.accountcache,
                agree_to_tos_url=tos_url,
                certificate_file=certFile,
                acme_server=acme,
                logger=logger
            )
            return cert
        except certbotClient.NeedToAgreeToTOS as e:
            tos_url = e.url
            open(opts.accountcache + "/tos_url.txt", "w").write(tos_url)
        except certbotClient.NeedToTakeAction as e:
            for action in e.actions:
                if isinstance(action, certbotClient.NeedToInstallFile):
                    #f = open(opts.webroot + "/.well-known/acme-challenge/" + action.url.split("/")[-1], "w") # XXX exploitable
                    #f.write(action.contents)
                    challenge = action.url.split("/")[-1]
                    challenges[challenge] = action.contents # XXX obviously need a cache that times out
                    #f.close()
        except certbotClient.WaitABit as e:
            import datetime
            print ("Try again in %s." % (e.until_when - datetime.datetime.now()))   
            # XXX need to actually implement a blocker
        except:
            raise
        return self.getCert(serverName, certFile)


    def _socket_nuke(self, sock):
        try: sock=sock.unwrap()
        except: pass
        #try:
        #    sock.close()
        #except: pass
        try:
            sock.shutdown(socket.SHUT_RDWR)
        except: pass

    def nuke(self, client, forward):
        self._socket_nuke(client)
        self._socket_nuke(forward)

    def toForward(self, client, address, forward):
        while 1:
            try: 
                data = client.recv(1024)
                if len(data)==0: raise Exception
                forward.send(data)
            except Exception as e:
                time.sleep(0.3) # XXX need to detect proxy still draining
                self.nuke(client, forward)
                return

    def toClient(self, client, address, forward):
        while 1:
            try: 
                data = forward.recv(1024)
                if len(data)==0: raise Exception
                client.send(data)
            except Exception as e:
                time.sleep(0.3)  # XXX need to detect proxy still draining
                self.nuke(client, forward)
                return

def apply_firewall():
    s = """
#!/bin/sh
iptables -F
iptables -F -t mangle
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A DIVERT -j MARK --set-mark 1
iptables -t mangle -A DIVERT -j ACCEPT
ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
# Refusing to intercept SSH until this is 100% solid
iptables -t mangle -A PREROUTING  -p tcp --dport 23:65535 ! -d 127.0.0.1 -j TPROXY \
 --tproxy-mark 0x1/0x1 --on-port 1
iptables -L -t mangle
"""
    os.system(s)
   
opts = None
remainder = None
    
        


if __name__ == "__main__":
    usage ="""
JFE (Jump to Full Encryption):  Full System Encryption Agent
Dan Kaminsky, Chief Scientist, whiteops.com

NOTE:  This is just a demonstration of a system-wide "bump in the wire"
TLS implementation providing encryption on demand when requested by a
client, using the new machine acquirable certicates freely available
from Certbot/Let's Encrypt/CertBot."""

    pidfile = "/dev/null"
    parser = optparse.OptionParser(usage=usage)
    parser.add_option("-D", "--daemon", dest="daemonize", default=False, action="store_true", help="Run as Background Daemon")
    parser.add_option("-p", "--pidfile", dest="pidfile", default="/dev/null", help="PID of process (when daemonized)")
#    parser.add_option("", "--clear", dest="clearcache", default=False, action="store_true", help="Clear cached certs/creds")
    parser.add_option("-s", "--staging", dest="staging", default=False, action="store_true", help="Use Staging Server (Not As Rate Limited)")
#    parser.add_option("-w", "--webroot", dest="webroot", default="/var/www/html", help="Location of webroot (/var/www/html)")
    parser.add_option("-c", "--cache", dest="accountcache", default=os.getcwd() + "/cache", help="Location of cached credentials (./cache)")
    parser.add_option("-v", "--verbose", dest="verbose", default=False, action="store_true", help="Verbose (false)")
    

    opts, remainder = parser.parse_args(sys.argv)
    print opts, remainder
    if not os.path.isdir(opts.accountcache): os.mkdir(opts.accountcache)
    if opts.staging:
        opts.accountcache += "/staging/"
    if not os.path.isdir(opts.accountcache): os.mkdir(opts.accountcache)
    
    apply_firewall()


            
    jfe_server = JFEServer('',1)
    if opts.daemonize:
        daemon = Daemonize(app="jfe", pid=opts.pidfile, auto_close_fds = False, action=jfe_server.listen, foreground = False)
        daemon.start()
        time.sleep(1)
    else:
        try: 
            jfe_server.listen()
        except:
            flush_mangle_table()
            os._exit(1)