App-HTTP_Proxy_IMP
view release on metacpan or search on metacpan
lib/App/HTTP_Proxy_IMP.pm view on Meta::CPAN
use strict;
use warnings;
package App::HTTP_Proxy_IMP;
our $VERSION = '0.958';
use fields (
'addr', # \@addr to listen on
'impns', # \@namespace for IMP plugins
'filter', # \@plugins to load
'logrx', # regexp for filtering log messages
'pcapdir', # dir to store pcap files of requests
'mitm_ca', # file containing cert and key of proxy cert
'capath', # path to CA to verify server cert
'no_check_certificate', # don't check server certificates
'childs', # use this number of childs ( 0 = don't fork)
'max_connect_per_child', # max number of connections before child exits
);
use App::HTTP_Proxy_IMP::IMP;
use App::HTTP_Proxy_IMP::Conn;
use App::HTTP_Proxy_IMP::Request;
use App::HTTP_Proxy_IMP::Relay;
use AnyEvent;
use Getopt::Long qw(:config posix_default bundling);
use App::HTTP_Proxy_IMP::Debug qw(debug $DEBUG $DEBUG_RX);
use Net::Inspect::Debug qw(%TRACE);
use IO::Socket::SSL::Intercept;
use IO::Socket::SSL::Utils;
use Carp 'croak';
use POSIX '_exit';
# try IPv6 using IO::Socket::IP or IO::Socket::INET6
# fallback to IPv4 only
my $sockclass;
BEGIN {
for(qw( IO::Socket::IP IO::Socket::INET6 IO::Socket::INET )) {
if ( eval "require $_" ) {
$sockclass = $_;
last;
}
}
$sockclass or die "cannot find usable socket class";
}
sub new {
my ($class,@args) = @_;
my $self = fields::new($class);
$self->{impns} = [qw(App::HTTP_Proxy_IMP::IMP Net::IMP::HTTP Net::IMP)];
%$self = ( %$self, %{ shift(@args) }) if @args && ref($args[0]);
$self->getoptions(@args) if @args;
return $self;
}
sub start {
my $self = shift;
$self = $self->new(@_) or return if ! ref($self); # package->start
my $pcapdir = $self->{pcapdir};
if ( $pcapdir ) {
croak("pcap directory not writeable") unless -d $pcapdir && -w _;
eval { require Net::PcapWriter } or croak(
"cannot load Net::PcapWriter, which is needed with --pcapdir option");
}
my $mitm;
if ( my $f = $self->{mitm_ca} ) {
my $serial = 1;
my $cache = {};
my $cachedir = "$f.cache";
if ( -d $cachedir || mkdir($cachedir,0700)) {
for my $f (glob("$cachedir/*.pem")) {
lib/App/HTTP_Proxy_IMP.pm view on Meta::CPAN
if ($_[1] eq '-') {
# discard all previously defined
@{$self->{filter}} = ();
} else {
push @{$self->{filter}}, $_[1]
}
},
'imp-ns=s' => sub {
if ($_[1] eq '-') {
# discard all previously defined
@{$self->{impns}} = ();
} else {
push @{$self->{impns}}, $_[1]
}
},
'l|log:s' => sub {
$self->{logrx} = $_[1]
? eval { qr/$_[1]/ } || "bad rx $_[1]"
: qr/./;
},
'd|debug:s' => sub {
$DEBUG = 1;
if ($_[1]) {
my $rx = eval { qr{$_[1]} };
croak("invalid regex '$_[1]' for debugging: $@") if ! $rx;
$DEBUG_RX = $rx;
}
},
'T|trace=s' => sub {
$TRACE{$_} = 1 for split(m/,/,$_[1])
},
);
my @addr = @ARGV;
$self->{logrx} //= qr/./;
$self->{addr} or @addr or usage("no listener given");
$self->{addr} = \@addr;
1;
}
sub usage {
my ($msg,$cmd) = @_;
$cmd ||= $0;
print STDERR "ERROR: $msg\n" if $msg;
print STDERR <<USAGE;
HTTP proxy, which can inspect and modify requests and responses before
forwarding using Net::IMP plugins.
$cmd Options* [ip:port|ip:port=upstream_ip:port]+
ip:port - listen address(es) for the proxy
ip:port=upstream_ip:port - listen adress and upstream proxy
Options:
-h|--help show usage
--mitm-ca ca.pem use given file in PEM format as a Proxy-CA for intercepting
SSL connections (e.g. man in the middle). Should include key
and cert.
--capath P path to file or dir containing CAs, which are used to verify
server certificates when intercepting SSL.
Tries to use builtin default if not given.
--no-check-certificate do not check server certificates when intercepting
SSL connections
-C|--childs N fork N childs an keep them running, e.g. if one child dies
immediatly fork another one. This way one can spread the load
over multiple processors (N>1) or just make sure, that child
gets restarted on errors (N=1)
-M|--maxconn N child will exit (and gets restarted) after N connections
-F|--filter F add named IMP plugin as filter, can be used multiple times
with --filter mod=args arguments can be given to the filter
--imp-ns N perl module namespace, were it will look for IMP plugins.
Can be given multiple times.
Plugins outside these namespace need to be given with
full name.
Defaults to App::HTTP_Proxy_IMP, Net::IMP
-l|--log [rx] print log messages where category matches rx (default all)
# options intended for development and debugging:
-P|--pcapdir D save connections as pcap files into D, needs Net::PcapWriter
-d|--debug [RX] debug mode, if RX is given restricts debugging to packages
matching RX
-T|--trace T enable Net::Inspect traces
Examples:
start proxy at 127.0.0.1:8888 and log all requests to /tmp as pcap files
$cmd --filter Net::IMP::SessionLog=dir=/tmp/&format=pcap 127.0.0.1:8888
start proxy at 127.0.0.1:8888 and log all form fields
$cmd --filter LogFormData 127.0.0.1:8888
start proxy at 127.0.0.1:8888 with CSRF protection plugin
$cmd --filter CSRFprotect 127.0.0.1:8888
start proxy at 127.0.0.1:8888 with CSRF protection plugin, using upstream
proxy proxy:8888
$cmd --filter CSRFprotect 127.0.0.1:8888=proxy:8888
USAGE
exit(2);
}
############################################################################
# AnyEvent wrapper to privide Net::IMP::Remote etc with acccess to
# IO events
############################################################################
package App::HTTP_Proxy_IMP::EventLoop;
sub new { bless {},shift }
{
my %watchr;
sub onread {
my ($self,$fh,$cb) = @_;
defined( my $fn = fileno($fh)) or die "invalid filehandle";
if ( $cb ) {
$watchr{$fn} = AnyEvent->io(
fh => $fh,
cb => $cb,
poll => 'r'
);
} else {
lib/App/HTTP_Proxy_IMP.pm view on Meta::CPAN
If '-' is given as name on the cmdline all previously defined filters are
discarded.
=item impns ARRAY | --imp-ns prefix
Namespace prefixes to make adding filters from cmdline shorter.
Defaults to L<App::HTTP_Proxy_IMP::IMP>, L<Net::IMP>.
The cmdline option can be given multiple times.
If '-' is given at cmdline all previously defined prefixes (including defaults) are
discarded.
=item addr [spec+]
Array of listener/upstream specifications for proxy.
Each specification can be
=over 12
=item ip:port - address where the proxy should listen
=item ip:port=target_ip:port - listener address and upstream proxy address
=item socket - precreated listener socket
=item [ socket, target_ip:port ] - precreated listener socket and address of
upstream proxy
=back
On the cmdline these are given as the remaining arguments, e.g. after all
other options.
=item mitm_ca proxy_ca.pem
When this parameter is given it will intercept SSL connections by ending the
connection from the server at the proxy and creating a new connection with a
new certificate signed by the given ca.pem (e.g. man in the middle).
Thus it will be able to analyse and manipulate encrypted connections.
ca.pem needs to include the CA cert and key in PEM format.
Also you better import the CA certificate into your browser, or you will get
warnings on access to SSL sites, because of the correctly detected man in the
middle attack.
To generate the proxy certificate you might use openssl:
openssl genrsa -out key.pem 1024
openssl req -new -x509 -extensions v3_ca -key key.pem -out proxy_ca.pem
cat key.pem >> proxy_ca.pem
# export to PKCS12 for import into browser
openssl pkcs12 -export -in proxy_ca.pem -inkey proxy_ca.pem -out proxy_ca.p12
It will try to create the directory proxy_ca.pem.cache and use it as a cache
for generated cloned certificates. If this is not possible the cloned certificates
will persist over restarts of the proxy.
=item capath certs.pem | cert-dir
The path (file with certificates or directory) with the CAs, which are used to
verify SSL certificates when doing SSL interception.
If not given it will check initially for various path, starting with using
Mozilla::CA, trying /etc/ssl/certs and /etc/ssl/certs.pem before giving up and
exiting.
=item no_check_certificate
If true disables checking of SSL certificates when doing SSL interception.
=item childs N
If N>0 it will fork N children to handle the requests.
Whenever a child exits it will be restarted immediatly.
This can be used to spread the load over multiple processors or to keep the
proxy running, even if a child crashed.
=item max_connect_per_child N | --maxconn N option
If N>0 the child will fork itself after N connections to handle the unfinished
connections. The parent will immediatly restart the child.
If options childs is not greater than 0 this option will be ignored.
This option is useful if the childs are leaking memory due to bad IMP plugins.
=back
The following options are only for the cmdline
=over 8
=item -d|--debug [RX]
Enable debugging.
If RX is given it will be used as a regular expression to restrict debugging to
given packages.
Outside the cmdline these settings can be done by setting C<$DEBUG> and
C<$DEBUG_RX> exported by L<App::HTTP_Proxy_IMP::Debug>.
=item -T|--trace T
Enable tracing for L<Net::Inspect> modules.
Outside the cmdline these settings can be done by setting C<%TRACE> from the
L<Net::Inspect::Debug> package.
=back
=item * start
Start the proxy, e.g. start listeners and process incoming connections.
No arguments are expected if called on an object, but one can use the form
C<< App::HTTP_Proxy_IMP->start(@args) >> as a shorter alternative to
C<< App::HTTP_Proxy_IMP->new(@args)->start >>.
If no return value is expected from this method it will enter into an endless
loop by calling C<loop>.
If a value is expected it will return 1, and the caller hast to call C<loop>
itself.
=item * loop
Class method, which calls AnyEvent mainloop using C<< AnyEvent->condvar->recv >>
( run in 0.621 second using v1.01-cache-2.11-cpan-39bf76dae61 )