Merge pull request #129 from kpcyrd/onions

Allow modules to set a proxy

README.md

@@ -205,6 +205,7 @@ For everything else please have a look at the [detailed list][1].
   - [sock_newline](https://sn0int.readthedocs.io/en/latest/reference.html#sock-newline)
   - [status](https://sn0int.readthedocs.io/en/latest/reference.html#status)
   - [stdin_readline](https://sn0int.readthedocs.io/en/latest/reference.html#stdin-readline)
+  - [stdin_read_to_end](https://sn0int.readthedocs.io/en/latest/reference.html#stdin-read-to-end)
   - [strftime](https://sn0int.readthedocs.io/en/latest/reference.html#strftime)
   - [strptime](https://sn0int.readthedocs.io/en/latest/reference.html#strptime)
   - [time_unix](https://sn0int.readthedocs.io/en/latest/reference.html#time-unix)

docs/reference.rst

@@ -362,6 +362,9 @@ options are set. The following options are available:
 ``into_blob``
   If true, the response body is stored in blob storage and a blob reference is
   returned as ``blob`` instead of the full body.
+``proxy``
+  Use a socks5 proxy in the format ``127.0.0.1:9050``. This option only works
+  if it doesn't conflict with the global proxy settings.
 
 This function may fail.
 
@@ -784,6 +787,9 @@ The following options are available:
   **Danger**: disable tls verification. This disables all security on the
   connection. Note that sn0int is still rather strict, you're going to run into
   issues if you need support for insecure ciphers.
+``proxy``
+  Use a socks5 proxy in the format ``127.0.0.1:9050``. This option only works
+  if it doesn't conflict with the global proxy settings.
 
 .. code-block:: lua
 

modules/harness/onion-http.lua

@@ -0,0 +1,16 @@
+-- Description: Send a request to a hidden service
+-- Version: 0.1.0
+-- License: GPL-3.0
+
+function run()
+    local session = http_mksession()
+    local req = http_request(session, 'GET', 'http://expyuzz4wqqyqhjn.onion/', {
+        proxy='127.0.0.1:9050',
+    })
+    local r = http_fetch(req)
+    if last_err() then return end
+
+    local title = html_select(r['text'], 'title')
+    if last_err() then return end
+    info(title['html'])
+end

src/engine/ctx.rs

@@ -139,7 +139,7 @@ pub trait State {
 
     fn sock_upgrade_tls(&self, id: &str, options: &SocketOptions) -> Result<TlsData>;
 
-    fn http(&self) -> &chrootable_https::Client<Resolver>;
+    fn http(&self, proxy: &Option<SocketAddr>) -> Result<Arc<chrootable_https::Client<Resolver>>>;
 
     fn http_mksession(&self) -> String;
 
@@ -167,7 +167,7 @@ pub struct LuaState {
     socket_sessions: Mutex<HashMap<String, Arc<Mutex<Socket>>>>,
     blobs: Mutex<HashMap<String, Arc<Blob>>>,
     http_sessions: Mutex<HashMap<String, HttpSession>>,
-    http: chrootable_https::Client<Resolver>,
+    http_clients: Mutex<HashMap<String, Arc<chrootable_https::Client<Resolver>>>>,
 
     verbose: u64,
     keyring: Vec<KeyRingEntry>, // TODO: maybe hashmap
@@ -251,9 +251,10 @@ impl State for LuaState {
         let mut mtx = self.socket_sessions.lock().unwrap();
         let id = self.random_id();
 
-        let sock = match &self.proxy {
-            Some(proxy) => Socket::connect_socks5(proxy, host, port, options)?,
-            _ => Socket::connect(&self.dns_config, host, port, options)?,
+        let sock = if let Some(proxy) = self.resolve_proxy_options(&options.proxy)? {
+            Socket::connect_socks5(proxy, host, port, options)?
+        } else {
+            Socket::connect(&self.dns_config, host, port, options)?
         };
 
         mtx.insert(id.clone(), Arc::new(Mutex::new(sock)));
@@ -281,8 +282,30 @@ impl State for LuaState {
         Ok(tls)
     }
 
-    fn http(&self) -> &chrootable_https::Client<Resolver> {
-        &self.http
+    fn http(&self, proxy: &Option<SocketAddr>) -> Result<Arc<chrootable_https::Client<Resolver>>> {
+        let proxy = self.resolve_proxy_options(proxy)?;
+
+        let proxy_str = if let Some(proxy) = &proxy {
+            proxy.to_string()
+        } else {
+            String::new()
+        };
+
+        let mut clients = self.http_clients.lock().unwrap();
+
+        if let Some(client) = clients.get(&proxy_str) {
+            Ok(client.clone())
+        } else {
+            let client = if let Some(proxy) = proxy {
+                chrootable_https::Client::with_socks5(*proxy)
+            } else {
+                let resolver = self.dns_config.clone();
+                chrootable_https::Client::new(resolver)
+            };
+            let client = Arc::new(client);
+            clients.insert(proxy_str, client.clone());
+            Ok(client)
+        }
     }
 
     fn http_mksession(&self) -> String {
@@ -324,6 +347,18 @@ impl State for LuaState {
     }
 }
 
+impl LuaState {
+    fn resolve_proxy_options<'a>(&'a self, options: &'a Option<SocketAddr>) -> Result<Option<&'a SocketAddr>> {
+        match (&self.proxy, options) {
+            (Some(system),  Some(options))  if system == options => Ok(Some(system)),
+            (Some(_),       Some(_))        => bail!("Overriding the system proxy isn't allowed"),
+            (Some(system),  None)           => Ok(Some(system)),
+            (None,          Some(options))  => Ok(Some(options)),
+            (None,          None)           => Ok(None),
+        }
+    }
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Script {
     code: String,
@@ -334,21 +369,13 @@ pub fn ctx<'a>(env: Environment, logger: Arc<Mutex<Box<dyn Reporter>>>) -> (hlua
     let mut lua = hlua::Lua::new();
     lua.open_string();
 
-    let http = match env.proxy {
-        Some(proxy) => chrootable_https::Client::with_socks5(proxy),
-        _ => {
-            let resolver = env.dns_config.clone();
-            chrootable_https::Client::new(resolver)
-        },
-    };
-
     let state = Arc::new(LuaState {
         error: Mutex::new(None),
         logger,
         socket_sessions: Mutex::new(HashMap::new()),
         blobs: Mutex::new(HashMap::new()),
         http_sessions: Mutex::new(HashMap::new()),
-        http,
+        http_clients: Mutex::new(HashMap::new()),
 
         verbose: env.verbose,
         keyring: env.keyring,

src/sockets/mod.rs

@@ -42,6 +42,7 @@ pub struct SocketOptions {
     sni_value: Option<String>,
     #[serde(default)]
     disable_tls_verify: bool,
+    pub proxy: Option<SocketAddr>,
 
     // TODO: enable_sni (default to true)
     // TODO: cacert

src/web.rs

@@ -11,6 +11,7 @@ use serde_json;
 use rand::{Rng, thread_rng};
 use rand::distributions::Alphanumeric;
 use std::fmt;
+use std::net::SocketAddr;
 use serde::Serialize;
 use crate::engine::structs::LuaMap;
 use crate::json::LuaJsonValue;
@@ -64,6 +65,7 @@ pub struct RequestOptions {
     timeout: Option<u64>,
     #[serde(default)]
     into_blob: bool,
+    proxy: Option<SocketAddr>,
 }
 
 impl RequestOptions {
@@ -92,6 +94,7 @@ pub struct HttpRequest {
     body: Option<ReqBody>,
     timeout: Option<Duration>,
     into_blob: bool,
+    proxy: Option<SocketAddr>,
 }
 
 impl HttpRequest {
@@ -113,6 +116,7 @@ impl HttpRequest {
             body: None,
             timeout,
             into_blob: options.into_blob,
+            proxy: options.proxy,
         };
 
         if let Some(json) = options.json {
@@ -208,10 +212,12 @@ impl HttpRequest {
         };
         let req = req.body(body)?;
 
+        debug!("Getting http client");
+        let client = state.http(&self.proxy)?;
+
         // send request
         debug!("Sending http request: {:?}", req);
-
-        let res = state.http().request(req)
+        let res = client.request(req)
             .with_timeout(self.timeout)
             .wait_for_response()?;