commit 2e00650afe99f91a58792a6ced3ee361aac6a49f Author: atsika Date: Tue Apr 29 14:05:18 2025 +0200 Initial commit diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..f706eaa --- /dev/null +++ b/.gitignore @@ -0,0 +1,13 @@ +agent +agent.exe +!agent/ +proxy +proxy.exe +!proxy/ +config.json +*-config.json +.DS_Store +.cursor/ +*.txt +__blobstorage__/ +__azurite*.json \ No newline at end of file diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..e72bfdd --- /dev/null +++ b/LICENSE @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. \ No newline at end of file diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..2438c17 --- /dev/null +++ b/Makefile @@ -0,0 +1,18 @@ +.PHONY: all clean proxy agent + +ifndef TOKEN +CONN_STRING ?= +else +CONN_STRING = -X 'main.ConnString=$(TOKEN)' +endif + +all: clean proxy agent + +proxy: + go build -ldflags="-s -w" -trimpath -o proxy cmd/proxy/main.go + +agent: + go build -ldflags="-s -w $(CONN_STRING)" -trimpath -o agent cmd/agent/main.go + +clean: + rm -f proxy agent \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..f3c7e7d --- /dev/null +++ b/README.md @@ -0,0 +1,383 @@ +# ProxyBlob + +

+ ProxyBlob logo +

+

SOCKS proxy over Azure Storage Blob service

+ +## Overview + +ProxyBlob is a tool designed to create SOCKS proxy tunnels through Azure Blob Storage service. This is particularly useful in environments where direct network connectivity is restricted but `*.blob.core.windows.net` is accessible. + +The system consists of two components: + +1. **Proxy Server**: Runs on your local machine and provides a SOCKS interface for your applications +2. **Agent**: Runs inside the target network and communicates with the proxy through Azure Blob Storage + +## Features + +- SOCKS5 protocol (CONNECT and UDP ASSOCIATE) +- Communication through Azure Blob Storage +- Interactive CLI with auto-completion +- Multiple agent management +- Local proxy server + +## Prerequisites + +- Go 1.23 or higher +- An Azure Storage Account + +### Storage Account + +#### Azure + +In order to use ProxyBlob, you will need an Azure Subscription to create an Azure Storage Account. Once you have a subscription, you can create a storage account in the Azure Portal or using the Azure CLI. + +Here are the steps to create a storage account using the Azure Portal: + +1. Go to [https://portal.azure.com](https://portal.azure.com) +2. Login with your Azure account +3. In the top Search bar, type "Storage accounts" +4. Click on "+ Create" +5. Fill in the required fields +6. Click on "Review + create" +7. Click on "Create" + +Storage account settings: + +- **Subscription**: Select your Azure subscription +- **Resource Group**: Create new Resource Group or select existing +- **Storage account name**: Choose a name for your storage account +- **Location**: Select a location near you +- **Performance**: Premium ⚠️ we will require low latency and high throughput +- **Premium account type**: Block blobs (high transaction rates) +- **Redundancy**: Locally-redundant Storage (LRS) + +

+ Create Storage Account +

+ + +Once the deployment is complete, you will see the newly created storage account in the list. + +

+ List of Storage accounts +

+ +Finally, click on "Security + networking" and then "Access keys" to get the storage account key. + +

+ Access Keys +

+ +Here are the steps to create a storage account using the Azure CLI: + +```bash +# Login to Azure +az login + +# Create a resource group +az group create --name "proxyblob-resource-group" --location "Central US" + +# Create a storage account +az storage account create --name "myproxyblob" --resource-group "proxyblob-resource-group" --location "Central US" --sku "Premium_LRS" --kind BlockBlobStorage + +# Get the storage account key +az storage account keys list --account-name "myproxyblob" --output table +``` + +You should see displayed the storage account keys. + +#### Azurite + +If you want to test the tool, you can also use [Azurite] (https://github.com/Azure/Azurite), a lightweight server clone of Azure Storage that can be run locally. To install Azurite, I recommend using either [Visual Studio Code extension](https://marketplace.visualstudio.com/items?itemName=Azurite.azurite) or [Docker](https://hub.docker.com/r/microsoft/azure-storage-azurite). + +For the extension, installation is straightforward: + +1. Go to the Extensions tab +2. Search for `Azurite.azurite` +3. Click "Install" + +You should see down right of your editor 3 buttons like this: + +``` +[Azurite Table Service] [Azurie Queue Service] [Azurite Blob Service] +``` + +Press on the `[Azurite Blob Service]` and the service should be running. + +For Docker, you will have to pull the image and run it: + +``` +docker pull mcr.microsoft.com/azure-storage/azurite +docker run -p 10000:10000 mcr.microsoft.com/azure-storage/azurite +``` + +The default storage account name is `devstoreaccount1` and the account key is `Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==`. + +## Installation + +```bash +# Clone the repository +git clone https://github.com/quarkslab/proxyblob +cd proxyblob + +# Build both components +make +``` + +This will produce the following binaries: + +- `proxy` - the proxy server running on your machine +- `agent` - the agent running on the target + +## Configuration + +Create a `config.json` file based on the [example](example_config.json) with your Azure Storage credentials: + +```json +{ + "storage_url": "http://localhost:10000/", // omit if using Azure + "storage_account_name": "your-storage-account-name", + "storage_account_key": "your-storage-account-key" +} +``` + +## Usage + +### Starting the Proxy Server + +```bash +./proxy -c my-config.json # if omitted, config.json is used by default +``` + +This will start an interactive CLI with the following commands: + +``` +Commands: + clear clear the screen + create, new create a new agent container and generate its connection string + delete, rm delete an existing agent container + exit exit the shell + help use 'help [command]' for command help + list, ls list all existing agent containers + select, use select an agent for subsequent commands + start, proxy start SOCKS proxy server + stop stop running proxy for the selected agent +``` + +Once the proxy server is running, you can create a new agent container by using the `create` command. + +``` +proxyblob » create +16:28:37 INF Agent container created successfully container_id=5f5250e9-5518-4682-90ea-f61abf797654 +16:28:37 INF Connection string generated connection_string=aHR0cDovL2xvY2FsaG9zdDoxMDAwMC9kZXZzdG9yZWFjY291bnQxLzVmNTI1MGU5LTU1MTgtNDY4Mi05MGVhLWY2MWFiZjc5NzY1ND9zZT0yMDI1LTA0LTI0VDE0JTNBMjglM0EzN1omc2lnPXpjNUNVYVZKJTJGS1duY3RtbnlNZ0clMkZZNkNrRzZHYXJzMXRFTXkxR0ZiTVVZJTNEJnNwPXJ3JnNwcj1odHRwcyUyQ2h0dHAmc3I9YyZzdD0yMDI1LTA0LTE3VDE0JTNBMjMlM0EzN1omc3Y9MjAyMC0xMC0wMg +``` + +Use the connection string generated with the agent (see below [Starting the Agent](#starting-the-agent)). If the agent connects successfully, you should see the “Agent Info” column filled in when you list the agents with the `list` command. + +``` +proxyblob » list +╭──────────────────────────────────────┬────────────┬────────────┬─────────────────────┬─────────────────────╮ +│ CONTAINER ID │ AGENT INFO │ PROXY PORT │ FIRST SEEN │ LAST SEEN │ +├──────────────────────────────────────┼────────────┼────────────┼─────────────────────┼─────────────────────┤ +│ 5f5250e9-5518-4682-90ea-f61abf797654 │ atsika@qb │ │ 2025-04-17 14:28:37 │ 2025-04-17 14:28:37 │ +╰──────────────────────────────────────┴────────────┴────────────┴─────────────────────┴─────────────────────╯ +``` + +Select the agent using `select ` and start the proxy listener (by default it listens on localhost:1080) by using the `start` command. + +``` +atsika@qb » select 5f5250e9-5518-4682-90ea-f61abf797654 +17:17:51 INF Agent selected agent=atsika@qb +atsika@qb » start +17:17:58 INF Proxy started successfully agent=atsika@qb port=1080 +``` + +You can now use for example [proxychains](https://github.com/rofl0r/proxychains-ng) to tunnel the traffic through the SOCKS proxy. + +```bash +proxychains xfreerdp /v:dc01.domain.local /u:Administrator +``` + +### Starting the Agent + +In order to run, the agent requires a connection string that can be generated using the proxy. You can pass it as an argument or directly embed it at compile-time. + +```bash +# Via argument +./agent -c + +# Build the agent with embedded connection string +make agent TOKEN= +./agent +``` + +## Architecture + +The communication flow works like this: + +1. The agent periodically polls an Azure Blob container for encoded packets in a request blob +2. The proxy writes encoded packets to the Azure Blob container in a request blob +3. When the agent finds a packet, it processes it and writes the response back to a response blob +4. The proxy reads the response and maintains the SOCKS connection with client applications + +The global flow is the following: + +```mermaid +graph TB + %% Client applications + Client1[Client Application] -->|SOCKS5 Request| SocksServer + Client2[Web Browser] -->|SOCKS5 Request| SocksServer + + %% Proxy Server Components + subgraph "Proxy Server (Local Machine)" + SocksServer[SOCKS5 Server] + CLI[Interactive CLI] + ProxyHandler[Proxy Handler] + TransportP[Blob Transport] + end + + %% Connection between components + CLI -->|Commands| SocksServer + SocksServer -->|Process Request| ProxyHandler + ProxyHandler -->|Encode Packets| TransportP + TransportP -->|Receive Responses| ProxyHandler + ProxyHandler -->|Return Data| SocksServer + + %% Azure Blob Storage + subgraph "Azure Blob Storage" + RequestBlob[Request Blob] + ResponseBlob[Response Blob] + end + + %% Connection to Azure + TransportP -->|Write| RequestBlob + ResponseBlob -->|Read| TransportP + + %% Agent Components + subgraph "Agent (Target Network)" + AgentPoller[Polling Component] + TransportA[Blob Transport] + SocksHandler[SOCKS Handler] + CommandProcessor[Command Processor] + end + + %% Agent connections + RequestBlob -->|Poll| AgentPoller + AgentPoller -->|Process| TransportA + TransportA -->|Decode Packets| SocksHandler + SocksHandler -->|Process Commands| CommandProcessor + + %% Command Processing - Fixed syntax + subgraph "Command Processing" + Connect["CONNECT"] + Bind["TODO: BIND"] + UDP["UDP ASSOCIATE"] + end + + CommandProcessor -->|Route| Connect + CommandProcessor -->|Route| Bind + CommandProcessor -->|Route| UDP + + %% Target Connections + Connect -->|TCP Connection| TargetServer1[Target Server] + UDP -->|UDP Connection| TargetServer2[Target Server] + + %% Return path + TargetServer1 -->|Response Data| SocksHandler + TargetServer2 -->|UDP Data| SocksHandler + SocksHandler -->|Encode Response| TransportA + TransportA -->|Write| ResponseBlob +``` + +An example of a CONNECT operation is the following: + +```mermaid +sequenceDiagram + participant Client as Client Application + participant Proxy as Proxy Server + participant AzureStor as Azure Blob Storage + participant Agent as Agent + participant Target as Target Server + + Note over Client,Target: SOCKS5 Protocol Flow + + %% Proxy Server and Agent Initialization + Proxy->>AzureStor: Initialize connection + Agent->>AzureStor: Start polling for requests + + %% Client Connection and Authentication + Client->>Proxy: TCP Connection + Proxy->>Client: Auth methods (NoAuth supported) + Client->>Proxy: Select Auth method + + %% Command Processing + Client->>Proxy: CONNECT command + target address + Proxy->>AzureStor: Write CONNECT request packet to Request Blob + Agent->>AzureStor: Poll and retrieve CONNECT request + + %% Target Connection + Agent->>Target: Establish TCP connection + Target->>Agent: Connection established + Agent->>AzureStor: Write connection success to Response Blob + Proxy->>AzureStor: Poll and retrieve response + Proxy->>Client: CONNECT success response + + %% Data Transfer (Bidirectional) + Client->>Proxy: Send data + Proxy->>AzureStor: Write data packet to Request Blob + Agent->>AzureStor: Poll and retrieve data packet + Agent->>Target: Forward data + + Target->>Agent: Response data + Agent->>AzureStor: Write response data to Response Blob + Proxy->>AzureStor: Poll and retrieve response data + Proxy->>Client: Forward response data +``` + +## Troubleshooting + +**Why does my agent immediately stop running ?** + +There might be several reasons why your agent stops immediately after you run it. Check its exit code: +```sh +# Bash +echo $? +``` +```cmd +REM CMD +echo %ERRORLEVEL% +``` +```pwsh +# PowerShell +echo $LastExitCode +``` + +Each exit code describes why the agent stopped running: + +| Exit code | Reason | +| --------- | ------------------------------------------- | +| 0 | No error | +| 1 | The context has been canceled | +| 2 | The connection string is missing | +| 3 | The connection string is invalid or expired | +| 4 | The agent failed to write its metadata | +| 5 | The agent container is not found | + +If you encounter issues: + +1. Check Azure credentials and permissions +2. Verify connectivity to Azure Blob Storage +3. Check for any firewall rules blocking outbound connections +4. Ensure the agent is running and properly connected + +## TODO + +- BIND command implementation (currently not working) +- Enhanced error handling and recovery +- Improve proxy speed + +## License + +[GNU GPLv3 License](LICENSE) \ No newline at end of file diff --git a/cmd/agent/main.go b/cmd/agent/main.go new file mode 100644 index 0000000..3e61df2 --- /dev/null +++ b/cmd/agent/main.go @@ -0,0 +1,283 @@ +// Package main implements the SOCKS proxy agent. +package main + +import ( + "bytes" + "context" + "encoding/base64" + "errors" + "flag" + "fmt" + "net/url" + "os" + "os/signal" + "os/user" + "strings" + "syscall" + "time" + + "github.com/Azure/azure-storage-blob-go/azblob" + "github.com/rs/zerolog" + "github.com/rs/zerolog/log" + + "proxyblob/pkg/protocol" + proxy "proxyblob/pkg/proxy/socks" + "proxyblob/pkg/transport" +) + +// Exit codes. +const ( + Success = 0 // success + ErrContextCanceled = 1 // context canceled + ErrNoConnectionString = 2 // missing connection string + ErrConnectionStringError = 3 // invalid connection string + ErrInfoBlobError = 4 // info blob write failed + ErrContainerNotFound = 5 // container not found +) + +// ConnString holds the Azure connection string. +// Can be set at compile time or via command line flag. +var ConnString string + +// Blob names for proxy-agent communication. +const ( + InfoBlobName = "info" // agent metadata + RequestBlobName = "request" // proxy-to-agent traffic + ResponseBlobName = "response" // agent-to-proxy traffic +) + +// InfoKey defines the XOR encryption key for agent information +// Security Note: Changing this key requires synchronized updates on both proxy and agent +var ( + InfoKey = []byte{0xDE, 0xAD, 0xB1, 0x0B} +) + +// Agent manages proxy operations and blob storage communication. +type Agent struct { + ContainerURL azblob.ContainerURL // Azure container access + Handler *proxy.SocksHandler // SOCKS handler +} + +// NewAgent creates an agent from a connection string. +func NewAgent(ctx context.Context, connString string) (*Agent, int) { + storageURL, containerID, sasToken, errCode := ParseConnectionString(connString) + if errCode != Success { + return nil, errCode + } + + pipeline := azblob.NewPipeline( + azblob.NewAnonymousCredential(), + azblob.PipelineOptions{}, + ) + + fullURL := fmt.Sprintf("%s/%s?%s", storageURL, containerID, sasToken) + containerURL, err := url.Parse(fullURL) + if err != nil { + return nil, ErrConnectionStringError + } + + container := azblob.NewContainerURL(*containerURL, pipeline) + blobTransport := transport.NewBlobTransport( + container.NewBlockBlobURL(RequestBlobName), // read + container.NewBlockBlobURL(ResponseBlobName), // write + ) + handler := proxy.NewSocksHandler(ctx, blobTransport) + + agent := &Agent{ + ContainerURL: container, + Handler: handler, + } + + return agent, Success +} + +// Start begins processing proxy requests. +func (a *Agent) Start(ctx context.Context) int { + // Push agent information to blob storage + if err := a.WriteInfoBlob(ctx); err != Success { + a.Stop() + return ErrContainerNotFound + } + + // Start the container monitoring goroutine + go a.healthCheck(ctx) + + // Start the handler + a.Handler.Start("") + + // Wait for handler context to be done + <-a.Handler.Ctx.Done() + + // Check if context was canceled externally + if errors.Is(ctx.Err(), context.Canceled) { + return ErrContextCanceled + } + + return Success +} + +// Stop terminates agent operations. +func (a *Agent) Stop() { + a.Handler.Stop() +} + +// healthCheck verifies container existence every 30s and stops the agent if it's unavailable. +func (a *Agent) healthCheck(ctx context.Context) { + ticker := time.NewTicker(30 * time.Second) + defer ticker.Stop() + + for { + select { + case <-ctx.Done(): + return + case <-ticker.C: + blobURL := a.ContainerURL.NewBlockBlobURL(InfoBlobName) + _, err := blobURL.GetProperties(ctx, azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{}) + if err != nil { + if storageErr, ok := err.(azblob.StorageError); ok { + if storageErr.ServiceCode() == azblob.ServiceCodeContainerNotFound || + storageErr.ServiceCode() == azblob.ServiceCodeContainerBeingDeleted { + a.Stop() + return + } + } + } + } + } +} + +// WriteInfoBlob updates agent metadata. +func (a *Agent) WriteInfoBlob(ctx context.Context) int { + info := GetCurrentInfo() + encryptedInfo := protocol.Xor([]byte(info), InfoKey) + + blobURL := a.ContainerURL.NewBlockBlobURL(InfoBlobName) + _, err := blobURL.Upload( + ctx, + bytes.NewReader(encryptedInfo), + azblob.BlobHTTPHeaders{ContentType: "text/plain"}, + azblob.Metadata{}, + azblob.BlobAccessConditions{}, + azblob.DefaultAccessTier, + nil, + azblob.ClientProvidedKeyOptions{}, + azblob.ImmutabilityPolicyOptions{}, + ) + + if err != nil { + // Check for context cancellation first + if errors.Is(ctx.Err(), context.Canceled) { + return ErrContextCanceled + } + + // Check for container deletion + if storageErr, ok := err.(azblob.StorageError); ok { + if storageErr.ServiceCode() == azblob.ServiceCodeContainerNotFound || + storageErr.ServiceCode() == azblob.ServiceCodeContainerBeingDeleted { + return ErrContainerNotFound + } + // Other storage errors + return ErrInfoBlobError + } + + return ErrInfoBlobError + } + + return Success +} + +// ParseConnectionString extracts storage URL, container ID and SAS token from a connection string. +func ParseConnectionString(connString string) (string, string, string, int) { + // Check for empty string first + if connString == "" { + return "", "", "", ErrNoConnectionString + } + + // Try to decode the base64 encoded string + decoded, err := base64.RawStdEncoding.DecodeString(connString) + if err != nil { + return "", "", "", ErrConnectionStringError + } + + // Parse the URL and extract components + u, err := url.Parse(string(decoded)) + if err != nil { + return "", "", "", ErrConnectionStringError + } + + // Extract path components and query string + path := strings.TrimPrefix(u.Path, "/") + if path == "" { + return "", "", "", ErrConnectionStringError + } + + if u.RawQuery == "" { + return "", "", "", ErrConnectionStringError + } + + // Return the storage URL, container ID and SAS token + storageURL := fmt.Sprintf("%s://%s", u.Scheme, u.Host) + return storageURL, path, u.RawQuery, Success +} + +// GetCurrentInfo returns username@hostname. +func GetCurrentInfo() string { + hostname, err := os.Hostname() + if err != nil { + hostname = "unknown" + } + + currentUser, err := user.Current() + if err != nil { + currentUser = &user.User{ + Username: "unknown", + } + } + + return fmt.Sprintf("%s@%s", currentUser.Username, hostname) +} + +// init configures logging with zerolog +// Sets up console output and INFO level logging +func init() { + // Configure logging + zerolog.TimeFieldFormat = zerolog.TimeFormatUnix + zerolog.SetGlobalLevel(zerolog.InfoLevel) + + // Use a more human-friendly output for console + log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr}) +} + +// main is the entry point for the agent process +// Handles command-line flags, signal management, and agent lifecycle +func main() { + // Parse command line flags + flag.StringVar(&ConnString, "c", ConnString, "Connection string") + flag.Parse() + + if ConnString == "" { + os.Exit(ErrNoConnectionString) + } + + // Create context that can be cancelled with CTRL+C + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + // Handle SIGINT (CTRL+C) and SIGTERM + sig := make(chan os.Signal, 1) + signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM) + go func() { + <-sig + cancel() + }() + + // Create the agent + agent, err := NewAgent(ctx, ConnString) + if err != Success { + os.Exit(err) + } + + // Start the agent + ErrCode := agent.Start(ctx) + os.Exit(ErrCode) +} diff --git a/cmd/proxy/main.go b/cmd/proxy/main.go new file mode 100644 index 0000000..cdb3cda --- /dev/null +++ b/cmd/proxy/main.go @@ -0,0 +1,782 @@ +// Package main implements the SOCKS proxy server. +package main + +import ( + "context" + "encoding/base64" + "encoding/json" + "fmt" + "io" + "net" + "net/url" + "os" + "path/filepath" + "strings" + "sync" + "time" + + "github.com/Azure/azure-storage-blob-go/azblob" + "github.com/desertbit/grumble" + "github.com/google/uuid" + "github.com/jedib0t/go-pretty/table" + "github.com/rs/zerolog" + "github.com/rs/zerolog/log" + + "proxyblob/pkg/protocol" + proxy "proxyblob/pkg/proxy/server" + "proxyblob/pkg/transport" +) + +// CLI banner with version. +const banner = ` + ____ ____ _ _ + | _ \ _ __ _____ ___ _| __ )| | ___ | |__ + | |_) | '__/ _ \ \/ / | | | _ \| |/ _ \| '_ \ + | __/| | | (_) > <| |_| | |_) | | (_) | |_) | + |_| |_| \___/_/\_\\__, |____/|_|\___/|_.__/ + |___/ + + SOCKS Proxy over Azure Blob Storage (v1.0) + ------------------------------------------ + +` + +// Blob names for proxy-agent communication. +const ( + InfoBlobName = "info" // agent metadata + RequestBlobName = "request" // proxy-to-agent traffic + ResponseBlobName = "response" // agent-to-proxy traffic +) + +// InfoKey defines the XOR encryption key for agent information +// Security Note: Changing this key requires synchronized updates on both proxy and agent +var ( + InfoKey = []byte{0xDE, 0xAD, 0xB1, 0x0B} +) + +// Config holds Azure Storage credentials. +type Config struct { + StorageAccountName string `json:"storage_account_name"` // account ID + StorageAccountKey string `json:"storage_account_key"` // access key + StorageURL string `json:"storage_url,omitempty"` // custom endpoint (for development purposes) +} + +// StorageManager handles Azure Storage operations. +type StorageManager struct { + ServiceURL *azblob.ServiceURL // storage endpoint + SharedKeyCredential *azblob.SharedKeyCredential // auth credentials +} + +// ContainerInfo tracks proxy agent metadata. +type ContainerInfo struct { + ID string // container ID + AgentInfo string // username@hostname + ProxyPort string // SOCKS port + CreatedAt time.Time // creation time + LastActivity time.Time // last operation +} + +// Global state. +var ( + config *Config // app config + storageManager *StorageManager // storage access + selectedAgent string // current agent + runningProxies sync.Map // active proxies +) + +// LoadConfig reads and parses config file. +func LoadConfig(configPath string) (*Config, error) { + // Use default config path (./config.json) if none provided + if configPath == "" { + configPath = "./config.json" + } + + // Get absolute path for clearer error messages + absPath, err := filepath.Abs(configPath) + if err != nil { + return nil, fmt.Errorf("failed to resolve config path: %v", err) + } + + // Check if config file exists + if _, err := os.Stat(absPath); os.IsNotExist(err) { + return nil, fmt.Errorf("configuration file not found at %s", absPath) + } + + // Read and parse the configuration file + data, err := os.ReadFile(absPath) + if err != nil { + return nil, fmt.Errorf("failed to read config file %s: %v", absPath, err) + } + + config := new(Config) + if err := json.Unmarshal(data, config); err != nil { + return nil, fmt.Errorf("failed to parse config file %s: %v", absPath, err) + } + + // Validate configuration + if err := config.Validate(); err != nil { + return nil, err + } + + return config, nil +} + +// Validate checks required config fields. +func (config *Config) Validate() error { + if config.StorageAccountName == "" { + return fmt.Errorf("storage_account_name is required") + } + if config.StorageAccountKey == "" { + return fmt.Errorf("storage_account_key is required") + } + return nil +} + +// NewStorageManager creates Azure Storage client. +func NewStorageManager(config *Config) (*StorageManager, error) { + // Create credentials using the storage account name and key + credential, err := azblob.NewSharedKeyCredential( + config.StorageAccountName, + config.StorageAccountKey, + ) + if err != nil { + return nil, fmt.Errorf("failed to create storage credentials: %v", err) + } + + // Create a pipeline for storage operations + pipeline := azblob.NewPipeline( + credential, + azblob.PipelineOptions{}, + ) + + // Build the service URL for the storage account + var serviceURL *url.URL + if config.StorageURL != "" { + // Use the custom storage URL provided in the config (for Azurite support) + serviceURL, err = url.Parse(config.StorageURL) + if err != nil { + return nil, fmt.Errorf("failed to parse storage URL: %v", err) + } + serviceURL = serviceURL.JoinPath(config.StorageAccountName) + } else { + // Use the default Azure Storage URL format + serviceURL, err = url.Parse(fmt.Sprintf("https://%s.blob.core.windows.net/", config.StorageAccountName)) + if err != nil { + return nil, fmt.Errorf("failed to parse service URL: %v", err) + } + } + + service := azblob.NewServiceURL(*serviceURL, pipeline) + + return &StorageManager{ + ServiceURL: &service, + SharedKeyCredential: credential, + }, nil +} + +// CreateAgentContainer creates a new container for agent communication. +// Returns the container ID and connection string that should be provided to the agent. +func (sm *StorageManager) CreateAgentContainer(expiry time.Duration) (string, string, error) { + // Generate a unique ID for the container + containerID := uuid.New().String() + containerURL := sm.ServiceURL.NewContainerURL(containerID) + + ctx := context.Background() + + // Create the container with private access level + _, err := containerURL.Create(ctx, azblob.Metadata{}, azblob.PublicAccessNone) + if err != nil { + return "", "", fmt.Errorf("failed to create container: %v", err) + } + + // Initialize the required blobs + blobNames := []string{InfoBlobName, RequestBlobName, ResponseBlobName} + for _, blobName := range blobNames { + blobURL := containerURL.NewBlockBlobURL(blobName) + + // Create an empty blob - it will be populated later by the agent or proxy + _, err := blobURL.Upload( + ctx, + strings.NewReader(""), // Empty content initially + azblob.BlobHTTPHeaders{ + ContentType: "application/octet-stream", + }, + azblob.Metadata{ + "created": time.Now().UTC().Format(time.RFC3339), + }, + azblob.BlobAccessConditions{}, + azblob.DefaultAccessTier, + azblob.BlobTagsMap{}, // No initial tags + azblob.ClientProvidedKeyOptions{}, // No client-provided encryption + azblob.ImmutabilityPolicyOptions{}, // No immutability policy + ) + + if err != nil { + // If blob creation fails, attempt to clean up the container + if _, delErr := containerURL.Delete(ctx, azblob.ContainerAccessConditions{}); delErr != nil { + return "", "", fmt.Errorf("failed to delete container after blob creation failed: %v", delErr) + } + return "", "", fmt.Errorf("failed to create %s blob: %v", blobName, err) + } + } + + // Generate a SAS token for the container + sasToken, err := sm.GenerateSASToken(containerID, expiry) + if err != nil { + // If SAS token generation fails, clean up the container + if _, delErr := containerURL.Delete(ctx, azblob.ContainerAccessConditions{}); delErr != nil { + return "", "", fmt.Errorf("failed to delete container after SAS token generation failed") + } + return "", "", fmt.Errorf("failed to generate SAS token") + } + + connectionString, _ := url.Parse(storageManager.ServiceURL.String()) + connectionString = connectionString.JoinPath(containerID) + connString := connectionString.String() + "?" + sasToken + + return containerID, connString, nil +} + +// GenerateSASToken creates a Shared Access Signature token for container access. +// The token provides limited-time read/write access to specific container resources. +func (sm *StorageManager) GenerateSASToken(containerName string, expiry time.Duration) (string, error) { + // Start time is 5 minutes before now to avoid clock skew issues + startTime := time.Now().UTC().Add(-5 * time.Minute) + + // Set expiry time (default 7 days) + expiryTime := time.Now().UTC().Add(expiry) + + // Define the permissions for the SAS token + permissions := azblob.ContainerSASPermissions{ + Read: true, + Write: true, + } + + // Generate the SAS signature + sasQueryParams, err := azblob.BlobSASSignatureValues{ + Protocol: azblob.SASProtocolHTTPSandHTTP, + StartTime: startTime, + ExpiryTime: expiryTime, + ContainerName: containerName, + Permissions: permissions.String(), + }.NewSASQueryParameters(sm.SharedKeyCredential) + + if err != nil { + return "", fmt.Errorf("failed to create SAS query parameters: %v", err) + } + + // Convert the SAS query parameters to a string + sasToken := sasQueryParams.Encode() + return sasToken, nil +} + +// ListAgentContainers retrieves information about all agent containers. +// It fetches container metadata and agent information, sorted by creation time. +func (sm *StorageManager) ListAgentContainers(ctx context.Context) ([]ContainerInfo, error) { + var containers []ContainerInfo + + // List all containers in the storage account + for marker := (azblob.Marker{}); marker.NotDone(); { + // Get a segment of containers (up to 100 at a time) + listResponse, err := sm.ServiceURL.ListContainersSegment(ctx, marker, azblob.ListContainersSegmentOptions{ + Prefix: "", + MaxResults: 0, + }) + + if err != nil { + return nil, fmt.Errorf("failed to list containers: %v", err) + } + + // Update marker for next iteration + marker = listResponse.NextMarker + + // Process each container + for _, containerItem := range listResponse.ContainerItems { + // Create container URL for accessing blobs + containerURL := sm.ServiceURL.NewContainerURL(containerItem.Name) + + // Try to get the info blob + blobURL := containerURL.NewBlockBlobURL(InfoBlobName) + downloadResponse, err := blobURL.Download(ctx, 0, azblob.CountToEnd, azblob.BlobAccessConditions{}, false, azblob.ClientProvidedKeyOptions{}) + + // Skip containers that don't have our expected structure + if err != nil { + continue + } + + // Read the info blob content + bodyReader := downloadResponse.Body(azblob.RetryReaderOptions{MaxRetryRequests: 3}) + agentInfo, err := io.ReadAll(bodyReader) + bodyReader.Close() + if err != nil { + log.Warn().Err(err).Str("container", containerItem.Name).Msg("Failed to read info blob") + continue + } + agentInfo = protocol.Xor(agentInfo, InfoKey) + + // Get last activity from response blob + responseBlob := containerURL.NewBlockBlobURL(ResponseBlobName) + responseProps, err := responseBlob.GetProperties(ctx, azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{}) + + // Get the last modified time, defaulting to container creation time if not available + var lastActivity time.Time + if err != nil { + lastActivity = containerItem.Properties.LastModified + } else { + lastActivity = responseProps.LastModified() + } + + // Check if the container has an active proxy + var proxyPort string + if value, running := runningProxies.Load(containerItem.Name); running { + // Try to get the port from the server object + if server, ok := value.(*proxy.ProxyServer); ok && server.Listener != nil { + _, portStr, err := net.SplitHostPort(server.Listener.Addr().String()) + if err == nil { + proxyPort = portStr + } + } + } + + // Add the container to our list + containers = append(containers, ContainerInfo{ + ID: containerItem.Name, + AgentInfo: string(agentInfo), + ProxyPort: proxyPort, + CreatedAt: containerItem.Properties.LastModified, + LastActivity: lastActivity, + }) + } + } + + return containers, nil +} + +// RenderAgentTable formats container information into a human-readable table. +// The table includes container ID, agent info, proxy port, and timing information. +func RenderAgentTable(containers []ContainerInfo) string { + t := table.NewWriter() + t.SetStyle(table.StyleRounded) + + // Set up headers + t.AppendHeader(table.Row{ + "Container ID", + "Agent info", + "Proxy port", + "First seen", + "Last seen", + }) + + // Add rows for each container + for _, c := range containers { + // Add the container information as a row + t.AppendRow(table.Row{ + c.ID, + c.AgentInfo, + c.ProxyPort, + c.CreatedAt.Format("2006-01-02 15:04:05"), + c.LastActivity.Format("2006-01-02 15:04:05"), + }) + } + + // Configure column options for better readability + t.SetColumnConfigs([]table.ColumnConfig{ + {Number: 1}, // Container ID + {Number: 2}, // Agent Info + {Number: 3}, // Proxy port + {Number: 4}, // Created At + {Number: 5}, // Last Activity + }) + + return t.Render() +} + +// DeleteAgentContainer removes a container and its associated blobs. +// This terminates the connection with the remote agent. +func (sm *StorageManager) DeleteAgentContainer(ctx context.Context, containerID string) error { + + // Stop any running proxy for this container + if server, running := runningProxies.Load(containerID); running { + if proxyServer, ok := server.(*proxy.ProxyServer); ok { + proxyServer.Stop() + } + runningProxies.Delete(containerID) + } + + // Create URL for the container we want to delete + containerURL := sm.ServiceURL.NewContainerURL(containerID) + + // Delete the container and all its contents + _, err := containerURL.Delete(ctx, azblob.ContainerAccessConditions{}) + if err != nil { + return fmt.Errorf("failed to delete container") + } + + return nil +} + +// ValidateAgent checks if an agent container exists and is properly configured. +// Returns error if the container is missing. +func (sm *StorageManager) ValidateAgent(ctx context.Context, containerID string) error { + containerURL := sm.ServiceURL.NewContainerURL(containerID) + blobURL := containerURL.NewBlockBlobURL(InfoBlobName) + + // Try to get the info blob to verify this is a valid agent container + _, err := blobURL.GetProperties(ctx, azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{}) + if err != nil { + if serr, ok := err.(azblob.StorageError); ok { + if serr.ServiceCode() == azblob.ServiceCodeContainerNotFound { + return fmt.Errorf("agent container %s does not exist", containerID) + } + } + return fmt.Errorf("invalid agent container %s: %v", containerID, err) + } + + return nil +} + +// GetSelectedAgentInfo retrieves the metadata for the currently selected agent. +// Returns error if no agent is selected or the agent information is unavailable. +func (sm *StorageManager) GetSelectedAgentInfo(ctx context.Context) (string, error) { + if selectedAgent == "" { + return "", fmt.Errorf("no agent selected. Use 'agent use ' first") + } + + containerURL := sm.ServiceURL.NewContainerURL(selectedAgent) + blobURL := containerURL.NewBlockBlobURL(InfoBlobName) + + // Download the info blob + response, err := blobURL.Download(ctx, 0, azblob.CountToEnd, azblob.BlobAccessConditions{}, false, azblob.ClientProvidedKeyOptions{}) + if err != nil { + return "", fmt.Errorf("failed to get agent info: %v", err) + } + + // Read the agent info + agentInfo, err := io.ReadAll(response.Body(azblob.RetryReaderOptions{MaxRetryRequests: 3})) + if err != nil { + return "", fmt.Errorf("failed to read agent info: %v", err) + } + agentInfo = protocol.Xor(agentInfo, InfoKey) + + return string(agentInfo), nil +} + +// AddCommands registers all CLI commands with the application. +// This includes commands for agent management, proxy control, and configuration. +func AddCommands(app *grumble.App) { + // Command to create a new agent + app.AddCommand(&grumble.Command{ + Name: "create", + Aliases: []string{"new"}, + Help: "create a new agent container and generate its connection string", + Flags: func(f *grumble.Flags) { + f.Duration("d", "duration", 7*24*time.Hour, "duration for the SAS token. by default the token will be valid for 7 days") + }, + Run: func(c *grumble.Context) error { + expiry := c.Flags.Duration("duration") + containerID, connString, err := storageManager.CreateAgentContainer(expiry) + if err != nil { + log.Error().Err(err).Msg("Failed to create agent container") + return nil + } + log.Info().Str("container_id", containerID).Msg("Agent container created successfully") + log.Info().Str("connection_string", base64.RawStdEncoding.EncodeToString([]byte(connString))).Msg("Connection string generated") + return nil + }, + }) + // Command to list existing agents + app.AddCommand(&grumble.Command{ + Name: "list", + Aliases: []string{"ls"}, + Help: "list all existing agent containers", + Run: func(c *grumble.Context) error { + ctx := context.Background() + + // Retrieve all containers + containers, err := storageManager.ListAgentContainers(ctx) + if err != nil { + log.Error().Err(err).Msg("Failed to list containers") + return nil + } + + // Display message if no containers found + if len(containers) == 0 { + log.Info().Msg("No agent containers found") + return nil + } + + // Display the container table + c.App.Println(RenderAgentTable(containers)) + return nil + }, + }) + // Command to delete an agent + app.AddCommand(&grumble.Command{ + Name: "delete", + Aliases: []string{"rm"}, + Help: "delete an existing agent container", + Args: func(a *grumble.Args) { + a.StringList("containers-id", "ID of the containers to delete") + }, + Completer: CompleteAgents, + Run: func(c *grumble.Context) error { + containerIDs := c.Args.StringList("containers-id") + if len(containerIDs) == 0 { + containerIDs = append(containerIDs, selectedAgent) + } + + for _, containerID := range containerIDs { + // Ask for confirmation before deletion + log.Info().Str("container_id", containerID).Msg("Are you sure you want to delete container? [y/N]") + var response string + fmt.Scanln(&response) + + if strings.ToLower(response) != "y" { + log.Info().Msg("Deletion cancelled") + return nil + } + + // Proceed with deletion + ctx := context.Background() + if err := storageManager.DeleteAgentContainer(ctx, containerID); err != nil { + log.Error().Err(err).Str("container_id", containerID).Msg("Failed to delete container") + return nil + } + + if selectedAgent == containerID { + selectedAgent = "" + c.App.SetPrompt("proxyblob » ") + } + + log.Info().Str("container_id", containerID).Msg("Container deleted successfully") + } + return nil + }, + }) + // Command to select an agent + app.AddCommand(&grumble.Command{ + Name: "select", + Aliases: []string{"use"}, + Help: "select an agent for subsequent commands", + Args: func(a *grumble.Args) { + a.String("container-id", "ID of the container to select") + }, + Completer: CompleteAgents, + Run: func(c *grumble.Context) error { + ctx := context.Background() + containerID := c.Args.String("container-id") + + // Validate the agent exists + if err := storageManager.ValidateAgent(ctx, containerID); err != nil { + log.Error().Err(err).Msg("Failed to validate agent") + return nil + } + + // Store the selected agent + selectedAgent = containerID + + // Get and display agent info + agentInfo, err := storageManager.GetSelectedAgentInfo(ctx) + if err != nil { + log.Error().Err(err).Msg("Failed to get agent info") + return nil + } + if agentInfo == "" { + agentInfo = "unknown@host" + } + + log.Info().Str("agent", agentInfo).Msg("Agent selected") + c.App.SetPrompt(agentInfo + " » ") + + return nil + }, + }) + // Command to start the proxy server over the current selected agent + app.AddCommand(&grumble.Command{ + Name: "start", + Aliases: []string{"proxy"}, + Help: "start SOCKS proxy server", + Flags: func(f *grumble.Flags) { + f.String("l", "listen", "127.0.0.1:1080", "listen address for SOCKS server") + }, + Run: func(c *grumble.Context) error { + if selectedAgent == "" { + log.Warn().Msg("No agent selected. Use 'select ' first") + return nil + } + + if _, exists := runningProxies.Load(selectedAgent); exists { + log.Warn().Msg("Proxy already running for this agent") + return nil + } + + // Verify the container still exists before starting a proxy + ctx := context.Background() + + // Check if the container exists + if err := storageManager.ValidateAgent(ctx, selectedAgent); err != nil { + log.Error().Err(err).Msg("Cannot start proxy") + return nil + } + + containerURL := storageManager.ServiceURL.NewContainerURL(selectedAgent) + transport := transport.NewBlobTransport( + containerURL.NewBlockBlobURL(ResponseBlobName), + containerURL.NewBlockBlobURL(RequestBlobName), + ) + + server := proxy.NewProxyServer(ctx, transport) + listenAddr := c.Flags.String("listen") + + runningProxies.Store(selectedAgent, server) + server.Start(listenAddr) + + // Log the port info for user feedback + if server.Listener != nil { + _, portStr, _ := net.SplitHostPort(server.Listener.Addr().String()) + // Get agent info for notification + agentInfo, err := storageManager.GetSelectedAgentInfo(context.Background()) + if err != nil || agentInfo == "" { + agentInfo = selectedAgent // Fallback to container ID if we can't get agent info + } + + log.Info().Str("agent", agentInfo).Str("port", portStr).Msg("Proxy started successfully") + } + + return nil + }, + }) + // Command to stop the proxy server running the current selected agent + app.AddCommand(&grumble.Command{ + Name: "stop", + Help: "stop running proxy for the selected agent", + Run: func(c *grumble.Context) error { + if selectedAgent == "" { + log.Warn().Msg("No agent selected. Use 'select ' first") + return nil + } + + // Retrieve and remove the value from the map in one atomic operation + value, exists := runningProxies.LoadAndDelete(selectedAgent) + if !exists { + log.Warn().Msg("No proxy running for this agent") + return nil + } + + // Try to stop the proxy gracefully + server, _ := value.(*proxy.ProxyServer) + server.Stop() + + // Get agent info for notification + agentInfo, err := storageManager.GetSelectedAgentInfo(context.Background()) + if err != nil || agentInfo == "" { + agentInfo = selectedAgent // Fallback to container ID if we can't get agent info + } + + log.Info().Str("agent", agentInfo).Msg("Proxy stopped") + + return nil + }, + }) +} + +// CompleteAgents provides tab completion for agent IDs. +// Returns a list of available agent container IDs. +func CompleteAgents(_ string, _ []string) []string { + containers, err := storageManager.ListAgentContainers(context.Background()) + if err != nil { + return []string{} // Return empty slice on error + } + + var completions []string + for _, container := range containers { + completions = append(completions, container.ID) + } + return completions +} + +// ----------------------------------------------------------------------------- +// Main Application Entry +// ----------------------------------------------------------------------------- + +// main is the entry point for the application. +// It sets up the CLI, configuration, and command handlers. +func main() { + // Set up logging + configureLogging() + + // Configure and create the CLI app + app := setupCLI() + + // Add all command handlers + AddCommands(app) + + // Run the application and handle any errors + if err := app.Run(); err != nil { + log.Fatal().Msg(err.Error()) + } +} + +// configureLogging sets up zerolog with appropriate formatting and level. +func configureLogging() { + // Configure zerolog with a pretty console writer for interactive use + log.Logger = log.Output(zerolog.ConsoleWriter{ + Out: os.Stdout, + TimeFormat: "15:04:05", + }) + + // Set reasonable default log level + zerolog.SetGlobalLevel(zerolog.InfoLevel) +} + +// setupCLI initializes the command-line interface with basic configuration. +// Returns a configured grumble App instance. +func setupCLI() *grumble.App { + // Determine history file location + var histFile string + home, err := os.UserHomeDir() + if err != nil { + histFile = ".proxyblob" // current working directory + } else { + histFile = filepath.Join(home, ".proxyblob") // home directory + } + + // Create and configure the CLI app + app := grumble.New(&grumble.Config{ + Name: "proxyblob", + HistoryFile: histFile, + Flags: func(f *grumble.Flags) { + f.String("c", "config", "config.json", "path to configuration file") + }, + }) + + // Set up our ASCII art banner + app.SetPrintASCIILogo(func(a *grumble.App) { + fmt.Print(banner) + }) + + // Initialize configuration when the app starts + app.OnInit(func(a *grumble.App, flags grumble.FlagMap) error { + // Load configuration from file + var err error + config, err = LoadConfig(flags.String("config")) + if err != nil { + return fmt.Errorf("failed to load configuration: %v", err) + } + + // Validate the configuration + if err := config.Validate(); err != nil { + return fmt.Errorf("invalid configuration: %v", err) + } + + // Initialize the storage manager + storageManager, err = NewStorageManager(config) + if err != nil { + return fmt.Errorf("failed to initialize storage manager: %v", err) + } + + return nil + }) + + return app +} diff --git a/docs/access-keys.png b/docs/access-keys.png new file mode 100644 index 0000000..30a50a3 Binary files /dev/null and b/docs/access-keys.png differ diff --git a/docs/create-storage-account.png b/docs/create-storage-account.png new file mode 100644 index 0000000..faeb2c8 Binary files /dev/null and b/docs/create-storage-account.png differ diff --git a/docs/list-storage-accounts.png b/docs/list-storage-accounts.png new file mode 100644 index 0000000..8189e87 Binary files /dev/null and b/docs/list-storage-accounts.png differ diff --git a/docs/logo.png b/docs/logo.png new file mode 100644 index 0000000..9410ac2 Binary files /dev/null and b/docs/logo.png differ diff --git a/example_config.json b/example_config.json new file mode 100644 index 0000000..0a3c6e3 --- /dev/null +++ b/example_config.json @@ -0,0 +1,4 @@ +{ + "storage_account_name": "storage-name", + "storage_account_key": "storage-access-key" +} \ No newline at end of file diff --git a/go.mod b/go.mod new file mode 100644 index 0000000..c958acc --- /dev/null +++ b/go.mod @@ -0,0 +1,40 @@ +module proxyblob + +go 1.23.4 + +require ( + github.com/desertbit/grumble v1.1.3 + github.com/google/uuid v1.6.0 + golang.org/x/crypto v0.33.0 +) + +require ( + github.com/Azure/azure-pipeline-go v0.2.3 // indirect + github.com/Azure/go-autorest/autorest/adal v0.9.24 // indirect + github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect + github.com/go-openapi/errors v0.22.0 // indirect + github.com/go-openapi/strfmt v0.23.0 // indirect + github.com/golang-jwt/jwt/v4 v4.5.1 // indirect + github.com/mattn/go-ieproxy v0.0.12 // indirect + github.com/mattn/go-runewidth v0.0.16 // indirect + github.com/mitchellh/mapstructure v1.5.0 // indirect + github.com/oklog/ulid v1.3.1 // indirect + github.com/rivo/uniseg v0.4.7 // indirect + go.mongodb.org/mongo-driver v1.17.3 // indirect + golang.org/x/net v0.35.0 // indirect + golang.org/x/text v0.22.0 // indirect +) + +require ( + github.com/Azure/azure-storage-blob-go v0.15.0 + github.com/desertbit/closer/v3 v3.7.5 // indirect + github.com/desertbit/columnize v2.1.0+incompatible // indirect + github.com/desertbit/go-shlex v0.1.1 // indirect + github.com/desertbit/readline v1.5.1 // indirect + github.com/fatih/color v1.18.0 // indirect + github.com/jedib0t/go-pretty v4.3.0+incompatible + github.com/mattn/go-colorable v0.1.14 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect + github.com/rs/zerolog v1.33.0 + golang.org/x/sys v0.30.0 // indirect +) diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..c2c81bc --- /dev/null +++ b/go.sum @@ -0,0 +1,193 @@ +github.com/Azure/azure-pipeline-go v0.2.3 h1:7U9HBg1JFK3jHl5qmo4CTZKFTVgMwdFHMVtCdfBE21U= +github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k= +github.com/Azure/azure-storage-blob-go v0.15.0 h1:rXtgp8tN1p29GvpGgfJetavIG0V7OgcSXPpwp3tx6qk= +github.com/Azure/azure-storage-blob-go v0.15.0/go.mod h1:vbjsVbX0dlxnRc4FFMPsS9BsJWPcne7GB7onqlPvz58= +github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs= +github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24= +github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M= +github.com/Azure/go-autorest/autorest/adal v0.9.24 h1:BHZfgGsGwdkHDyZdtQRQk1WeUdW0m2WPAwuHZwUi5i4= +github.com/Azure/go-autorest/autorest/adal v0.9.24/go.mod h1:7T1+g0PYFmACYW5LlG2fcoPiPlFHjClyRGL7dRlP5c8= +github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw= +github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74= +github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k= +github.com/Azure/go-autorest/logger v0.2.1 h1:IG7i4p/mDa2Ce4TRyAO8IHnVhAVF3RFU+ZtXWSmf4Tg= +github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8= +github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUMfuitfgcfuo= +github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU= +github.com/Netflix/go-expect v0.0.0-20180615182759-c93bf25de8e8/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc= +github.com/Netflix/go-expect v0.0.0-20190729225929-0e00d9168667/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= +github.com/chzyer/logex v1.1.10 h1:Swpa1K6QvQznwJRcfTfQJmTE72DqScAa40E+fbHEXEE= +github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= +github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1 h1:q763qf9huN11kDQavWsoZXJNW3xEE4JJyHa5Q25/sd8= +github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= +github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= +github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/desertbit/closer/v3 v3.1.2/go.mod h1:AAC4KRd8DC40nwvV967J/kDFhujMEiuwIKQfN0IDxXw= +github.com/desertbit/closer/v3 v3.7.5 h1:tJ3BXDeflcWjGSacIQFiFOZf3ep7kit9HMxM87qXVLc= +github.com/desertbit/closer/v3 v3.7.5/go.mod h1:wxbB5mDxqhQC8CjI8ApBhj9aHHSLjdok5WFkJj4Bq7M= +github.com/desertbit/columnize v2.1.0+incompatible h1:h55rYmdrWoTj7w9aAnCkxzM3C2Eb8zuFa2W41t0o5j0= +github.com/desertbit/columnize v2.1.0+incompatible/go.mod h1:5kPrzQwKbQ8E5D28nvTVPqIBJyj+8jvJzwt6HXZvXgI= +github.com/desertbit/go-shlex v0.1.1 h1:c65HnbgX1QyC6kPL1dMzUpZ4puNUE6ai/eVucWNLNsk= +github.com/desertbit/go-shlex v0.1.1/go.mod h1:Qbb+mJNud5AypgHZ81EL8syOGaWlwvAOTqS7XmWI4pQ= +github.com/desertbit/grumble v1.1.3 h1:gbdgVGWsHmNraJ7Gn6Q4TiUEIHU/UHfbc1KUSbBlgYU= +github.com/desertbit/grumble v1.1.3/go.mod h1:r7j3ShNy5EmOsegRD2DzTutIaGiLiA3M5yBTXXeLwcs= +github.com/desertbit/readline v1.5.1 h1:/wOIZkWYl1s+IvJm/5bOknfUgs6MhS9svRNZpFM53Os= +github.com/desertbit/readline v1.5.1/go.mod h1:pHQgTsCFs9Cpfh5mlSUFi9Xa5kkL4d8L1Jo4UVWzPw0= +github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM= +github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= +github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= +github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568 h1:BHsljHzVlRcyQhjrss6TZTdY2VfCqZPbv5k3iBFa2ZQ= +github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc= +github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k= +github.com/go-openapi/errors v0.22.0 h1:c4xY/OLxUBSTiepAg3j/MHuAv5mJhnf53LLMWFB+u/w= +github.com/go-openapi/errors v0.22.0/go.mod h1:J3DmZScxCDufmIMsdOuDHxJbdOGC0xtUynjIx092vXE= +github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c= +github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4= +github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= +github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= +github.com/golang-jwt/jwt/v4 v4.5.1 h1:JdqV9zKUdtaa9gdPlywC3aeoEsR681PlKC+4F5gQgeo= +github.com/golang-jwt/jwt/v4 v4.5.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= +github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= +github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk= +github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA= +github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174/go.mod h1:DqJ97dSdRW1W22yXSB90986pcOyQ7r45iio1KN2ez1A= +github.com/hinshun/vt10x v0.0.0-20180809195222-d55458df857c/go.mod h1:DqJ97dSdRW1W22yXSB90986pcOyQ7r45iio1KN2ez1A= +github.com/jedib0t/go-pretty v4.3.0+incompatible h1:CGs8AVhEKg/n9YbUenWmNStRW2PHJzaeDodcfvRAbIo= +github.com/jedib0t/go-pretty v4.3.0+incompatible/go.mod h1:XemHduiw8R651AF9Pt4FwCTKeG3oo7hrHJAoznj9nag= +github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8= +github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI= +github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= +github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= +github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= +github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= +github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= +github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E= +github.com/mattn/go-ieproxy v0.0.12 h1:OZkUFJC3ESNZPQ+6LzC3VJIFSnreeFLQyqvBWtvfL2M= +github.com/mattn/go-ieproxy v0.0.12/go.mod h1:Vn+N61199DAnVeTgaF8eoB9PvLO8P3OBnG95ENh7B7c= +github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4= +github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= +github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= +github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= +github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= +github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= +github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= +github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d/go.mod h1:o96djdrsSGy3AWPyBgZMAGfxZNfgntdJG+11KU4QvbU= +github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4= +github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U= +github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= +github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= +github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= +github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= +github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg= +github.com/rs/zerolog v1.33.0 h1:1cU2KZkvPxNyfgEmhHAz/1A9Bz+llsdYzklWFzgp0r8= +github.com/rs/zerolog v1.33.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= +github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= +github.com/stretchr/testify v1.2.1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= +github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= +github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +go.mongodb.org/mongo-driver v1.17.3 h1:TQyXhnsWfWtgAhMtOgtYHMTkZIfBTpMTsMnd9ZBeHxQ= +go.mongodb.org/mongo-driver v1.17.3/go.mod h1:Hy04i7O2kC4RS06ZrhPRqj/u4DTYkFDAAccj+rVKqgQ= +golang.org/x/crypto v0.0.0-20190123085648-057139ce5d2b/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4= +golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus= +golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M= +golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= +golang.org/x/net v0.0.0-20210610132358-84b48f89b13b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= +golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8= +golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sys v0.0.0-20180606202747-9527bec2660b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201214210602-f9fddec55a1e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= +golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= +golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= +golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM= +golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +gopkg.in/AlecAivazis/survey.v1 v1.8.5/go.mod h1:iBNOmqKz/NUbZx3bA+4hAGLRC7fSK7tgtVDT4tB22XA= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/pkg/protocol/base.go b/pkg/protocol/base.go new file mode 100644 index 0000000..55ae858 --- /dev/null +++ b/pkg/protocol/base.go @@ -0,0 +1,264 @@ +package protocol + +import ( + "context" + "sync" + "time" + + "proxyblob/pkg/transport" + + "github.com/google/uuid" +) + +// PacketHandler processes protocol packets and manages connection lifecycle. +// Implementations must be safe for concurrent use by multiple goroutines. +type PacketHandler interface { + // Start begins packet processing and listens on the specified address (listen only on proxy side) + Start(string) + + // Stop gracefully terminates all connections and processing + Stop() + + // ReceiveLoop processes incoming packets until stopped + ReceiveLoop() + + // OnNew handles connection establishment request + OnNew(uuid.UUID, []byte) byte + + // OnAck handles connection establishment acknowledgment + OnAck(uuid.UUID, []byte) byte + + // OnData handles payload transfer for established connection + OnData(uuid.UUID, []byte) byte + + // OnClose handles connection termination request + OnClose(uuid.UUID, byte) byte +} + +// BaseHandler implements common protocol functionality for proxy and agent. +// It provides connection management, packet routing, and error handling. +type BaseHandler struct { + // transport handles underlying packet transmission + transport transport.Transport + + // Connections maps UUIDs to active Connection objects + Connections sync.Map + + // Ctx controls handler lifecycle + Ctx context.Context + + // Cancel terminates handler context + Cancel context.CancelFunc + + // PacketHandler routes packets to specific handlers + PacketHandler +} + +// NewBaseHandler creates a handler with specified context and transport. +// Uses background context if parent context is nil. +func NewBaseHandler(parentCtx context.Context, transport transport.Transport) *BaseHandler { + if parentCtx == nil { + parentCtx = context.Background() + } + ctx, cancel := context.WithCancel(parentCtx) + return &BaseHandler{ + transport: transport, + Ctx: ctx, + Cancel: cancel, + } +} + +// ReceiveLoop processes incoming packets until context cancellation. +// Implements exponential backoff for consecutive errors. +func (h *BaseHandler) ReceiveLoop() { + consecutiveErrors := 0 + maxConsecutiveErrors := 5 + + for { + select { + case <-h.Ctx.Done(): + return + default: + data, errCode := h.transport.Receive(h.Ctx) + if errCode != ErrNone { + if h.transport.IsClosed(errCode) { + h.Stop() + return + } + + if h.Ctx.Err() == nil && errCode != ErrTransportError { + consecutiveErrors++ + if consecutiveErrors == maxConsecutiveErrors { + return // Too many errors, just exit + } + time.Sleep(time.Duration(consecutiveErrors*50) * time.Millisecond) + } + continue + } + + consecutiveErrors = 0 + + if len(data) == 0 { + continue + } + + packet := Decode(data) + if packet == nil { + continue + } + + errCode = h.handlePacket(packet) + if errCode != ErrNone { + if h.Ctx.Err() != nil && errCode == ErrConnectionClosed { + continue + } + h.SendClose(packet.ConnectionID, errCode) + } + } + } +} + +// handlePacket routes packet to appropriate handler based on command. +// Returns error code indicating success or specific failure. +func (h *BaseHandler) handlePacket(packet *Packet) byte { + switch packet.Command { + case CmdNew: + return h.PacketHandler.OnNew(packet.ConnectionID, packet.Data) + case CmdAck: + return h.PacketHandler.OnAck(packet.ConnectionID, packet.Data) + case CmdData: + return h.PacketHandler.OnData(packet.ConnectionID, packet.Data) + case CmdClose: + return h.PacketHandler.OnClose(packet.ConnectionID, packet.Data[0]) + default: + return ErrInvalidCommand + } +} + +// SendNewConnection initiates key exchange for new connection. +// Returns error code indicating success or specific failure. +func (h *BaseHandler) SendNewConnection(connectionID uuid.UUID) byte { + privateKey, publicKey := GenerateKeyPair() + nonce := GenerateNonce() + + connObj, exists := h.Connections.Load(connectionID) + if !exists { + return ErrConnectionNotFound + } + conn := connObj.(*Connection) + + // Store nonce and private key for key derivation during ACK + tempData := make([]byte, len(nonce)+len(privateKey)) + copy(tempData[:len(nonce)], nonce) + copy(tempData[len(nonce):], privateKey) + conn.SecretKey = tempData + + // Send nonce and public key to peer + data := make([]byte, len(nonce)+len(publicKey)) + copy(data[:len(nonce)], nonce) + copy(data[len(nonce):], publicKey) + + return h.sendPacket(CmdNew, connectionID, data) +} + +// SendConnAck completes key exchange by deriving shared key. +// Returns error code indicating success or specific failure. +func (h *BaseHandler) SendConnAck(connectionID uuid.UUID) byte { + connObj, exists := h.Connections.Load(connectionID) + if !exists { + return ErrConnectionNotFound + } + conn := connObj.(*Connection) + + privateKey, publicKey := GenerateKeyPair() + + // The first 24 bytes of SecretKey should be the nonce, + // and the server's public key should be in the data field from OnNew + serverData := conn.SecretKey + nonce := serverData[:24] + serverPublicKey := serverData[24:] + + symmetricKey, errCode := DeriveKey(privateKey, serverPublicKey, nonce) + if errCode != ErrNone { + return errCode + } + + conn.SecretKey = symmetricKey + + // Send public key in CmdAck + return h.sendPacket(CmdAck, connectionID, publicKey) +} + +func (h *BaseHandler) SendData(connectionID uuid.UUID, data []byte) byte { + // Get connection + connObj, exists := h.Connections.Load(connectionID) + if !exists { + return ErrConnectionNotFound + } + conn := connObj.(*Connection) + + encrypted, errCode := Encrypt(conn.SecretKey, data) + if errCode != ErrNone { + return errCode + } + data = encrypted + + return h.sendPacket(CmdData, connectionID, data) +} + +// SendClose sends a connection termination packet with an error code. +func (h *BaseHandler) SendClose(connectionID uuid.UUID, errCode byte) byte { + connObj, exists := h.Connections.Load(connectionID) + if !exists { + return ErrConnectionNotFound + } + conn := connObj.(*Connection) + + conn.Close() + return h.sendPacket(CmdClose, connectionID, []byte{errCode}) +} + +// sendPacket is the internal method that encodes and sends all packet types. +// It handles error checking and context checking. +func (h *BaseHandler) sendPacket(cmd byte, connectionID uuid.UUID, data []byte) byte { + if h.Ctx.Err() != nil { + return ErrHandlerStopped + } + + packet := NewPacket(cmd, connectionID, data) + if packet == nil { + return ErrInvalidPacket + } + + encoded := packet.Encode() + if encoded == nil { + return ErrInvalidPacket + } + + errCode := h.transport.Send(h.Ctx, encoded) + if errCode != ErrNone { + // Check if this is a transport closure + if h.transport.IsClosed(errCode) { + return ErrTransportClosed + } + return ErrPacketSendFailed + } + + return ErrNone +} + +func (h *BaseHandler) CloseAllConnections() { + h.Connections.Range(func(key, value interface{}) bool { + conn := value.(*Connection) + + // Only notify if not already closed + select { + case <-conn.Closed: + // Already closed + default: + conn.Close() + } + + return true + }) +} diff --git a/pkg/protocol/connection.go b/pkg/protocol/connection.go new file mode 100644 index 0000000..b55dc6e --- /dev/null +++ b/pkg/protocol/connection.go @@ -0,0 +1,89 @@ +package protocol + +import ( + "net" + "time" + + "github.com/google/uuid" +) + +// ConnectionState tracks the lifecycle of a proxy connection +type ConnectionState int + +const ( + // StateNew indicates a pending connection awaiting establishment + StateNew ConnectionState = iota + + // StateConnected indicates an active connection with data flow + StateConnected + + // StateClosed indicates a terminated connection + StateClosed +) + +// Connection manages a proxy connection between client and target. +// It is safe for concurrent use by multiple goroutines. +type Connection struct { + // ID uniquely identifies the connection + ID uuid.UUID + + // State indicates current connection lifecycle phase + State ConnectionState + + // Conn holds the network connection (optional) + Conn net.Conn + + // ReadBuffer receives data from the remote endpoint + ReadBuffer chan []byte + + // Closed signals connection termination + Closed chan struct{} + + // CreatedAt records connection creation time + CreatedAt time.Time + + // LastActivity tracks most recent data transfer + LastActivity time.Time + + // SecretKey holds encryption key for secure communication + SecretKey []byte +} + +// NewConnection creates a connection with specified ID. +// Initializes channels and sets initial timestamps. +func NewConnection(id uuid.UUID) *Connection { + return &Connection{ + ID: id, + State: StateNew, + ReadBuffer: make(chan []byte), + Closed: make(chan struct{}), + CreatedAt: time.Now(), + LastActivity: time.Now(), + } +} + +// Close terminates the connection and its resources. +// Safe to call multiple times. Returns ErrNone on success. +func (c *Connection) Close() byte { + if c.State == StateClosed { + return ErrNone + } + + c.State = StateClosed + + select { + case <-c.Closed: + // Already closed + default: + close(c.Closed) + } + + if c.Conn != nil { + err := c.Conn.Close() + if err != nil { + return ErrConnectionClosed + } + } + + return ErrNone +} diff --git a/pkg/protocol/crypto.go b/pkg/protocol/crypto.go new file mode 100644 index 0000000..f329c66 --- /dev/null +++ b/pkg/protocol/crypto.go @@ -0,0 +1,98 @@ +package protocol + +import ( + "crypto/rand" + "io" + + "golang.org/x/crypto/chacha20poly1305" + "golang.org/x/crypto/curve25519" + "golang.org/x/crypto/hkdf" + "golang.org/x/crypto/sha3" +) + +// GenerateKeyPair creates a new X25519 key pair for key exchange. +// Returns a properly clamped private key and its corresponding public key. +func GenerateKeyPair() (privateKey, publicKey []byte) { + privateKey = make([]byte, curve25519.ScalarSize) + io.ReadFull(rand.Reader, privateKey) + + // Clamp private key according to X25519 spec + privateKey[0] &= 248 + privateKey[31] &= 127 + privateKey[31] |= 64 + + publicKey, _ = curve25519.X25519(privateKey, curve25519.Basepoint) + return privateKey, publicKey +} + +// GenerateNonce creates a random nonce for ChaCha20-Poly1305. +// Returns a cryptographically secure random nonce. +func GenerateNonce() []byte { + nonce := make([]byte, chacha20poly1305.NonceSizeX) + io.ReadFull(rand.Reader, nonce) + return nonce +} + +// DeriveKey performs X25519 key exchange and HKDF key derivation. +// Returns a symmetric key and status code. Key is nil on error. +func DeriveKey(privateKey, peerPublicKey, nonce []byte) ([]byte, byte) { + // Derive shared secret using X25519 + sharedSecret, err := curve25519.X25519(privateKey, peerPublicKey) + if err != nil { + return nil, ErrInvalidCrypto + } + + // Derive symmetric key using HKDF-SHA3 + kdf := hkdf.New(sha3.New256, sharedSecret, nonce, nil) + symmetricKey := make([]byte, chacha20poly1305.KeySize) + if _, err := io.ReadFull(kdf, symmetricKey); err != nil { + return nil, ErrInvalidCrypto + } + + return symmetricKey, ErrNone +} + +// Encrypt performs authenticated encryption using ChaCha20-Poly1305. +// Returns (nonce || ciphertext || tag) or nil on error. +func Encrypt(key, plaintext []byte) ([]byte, byte) { + aead, err := chacha20poly1305.NewX(key) + if err != nil { + return nil, ErrInvalidCrypto + } + + nonce := GenerateNonce() + ciphertext := aead.Seal(nonce, nonce, plaintext, nil) + return ciphertext, ErrNone +} + +// Decrypt performs authenticated decryption using ChaCha20-Poly1305. +// Returns decrypted plaintext or nil if authentication fails. +func Decrypt(key, ciphertext []byte) ([]byte, byte) { + aead, err := chacha20poly1305.NewX(key) + if err != nil { + return nil, ErrInvalidCrypto + } + + if len(ciphertext) < chacha20poly1305.NonceSizeX { + return nil, ErrInvalidCrypto + } + + nonce := ciphertext[:chacha20poly1305.NonceSizeX] + ciphertextBody := ciphertext[chacha20poly1305.NonceSizeX:] + + plaintext, err := aead.Open(nil, nonce, ciphertextBody, nil) + if err != nil { + return nil, ErrInvalidCrypto + } + + return plaintext, ErrNone +} + +// Xor performs byte-wise XOR of data with a repeating key. +// Warning: This is NOT cryptographically secure, use only for basic obfuscation. +func Xor(data []byte, key []byte) []byte { + for i := range data { + data[i] ^= key[i%len(key)] + } + return data +} diff --git a/pkg/protocol/errors.go b/pkg/protocol/errors.go new file mode 100644 index 0000000..26eddca --- /dev/null +++ b/pkg/protocol/errors.go @@ -0,0 +1,44 @@ +// Package protocol defines the communication protocol between proxy and agent. +package protocol + +import ( + "proxyblob/pkg/transport" +) + +// Protocol error codes for agent-server communication. +// Uses byte values to minimize binary size and network traffic. +const ( + // General errors (0-9) + ErrNone byte = 0 // Operation completed successfully + ErrInvalidCommand byte = 1 // Command type is not recognized + ErrContextCanceled byte = 2 // Context canceled + + // Connection errors (10-19) + ErrConnectionClosed byte = 10 // Connection was terminated + ErrConnectionNotFound byte = 11 // Connection ID does not exist + ErrConnectionExists byte = 12 // Connection ID already in use + ErrInvalidState byte = 13 // Connection in wrong state for operation + ErrPacketSendFailed byte = 14 // Packet transmission failed + ErrHandlerStopped byte = 15 // Protocol handler is not running + ErrUnexpectedPacket byte = 16 // Received unexpected packet type + + // Transport errors (20-29) + ErrTransportClosed byte = transport.ErrTransportClosed // Transport layer terminated + ErrTransportTimeout byte = transport.ErrTransportTimeout // Transport operation timed out + ErrTransportError byte = transport.ErrTransportError // Transport operation failed + + // SOCKS errors (30-39) + ErrInvalidSocksVersion byte = 30 // Unsupported SOCKS protocol version + ErrUnsupportedCommand byte = 31 // SOCKS command not implemented + ErrHostUnreachable byte = 32 // Target host not accessible + ErrConnectionRefused byte = 33 // Target refused connection + ErrNetworkUnreachable byte = 34 // Network path not accessible + ErrAddressNotSupported byte = 35 // Address format not supported + ErrTTLExpired byte = 36 // Time-to-live exceeded + ErrGeneralSocksFailure byte = 37 // Unspecified SOCKS failure + ErrAuthFailed byte = 38 // Authentication rejected + + // Packet errors (40-49) + ErrInvalidPacket byte = 40 // Malformed packet structure + ErrInvalidCrypto byte = 41 // Cryptographic operation failed +) diff --git a/pkg/protocol/protocol.go b/pkg/protocol/protocol.go new file mode 100644 index 0000000..8995e2b --- /dev/null +++ b/pkg/protocol/protocol.go @@ -0,0 +1,108 @@ +// Package protocol implements the communication protocol between proxy server and agent. +// It provides packet encoding/decoding, connection management, and secure data transfer +// using ChaCha20-Poly1305. +// +// The protocol uses a binary packet format with fixed-size headers and variable-length +// payloads. Each packet contains a command type, connection ID, and optional data. +package protocol + +import ( + "bytes" + "encoding/binary" + + "github.com/google/uuid" +) + +// Command types for protocol operations. +const ( + CmdNew byte = iota + 1 // Request new connection + CmdAck // Acknowledge connection + CmdData // Transfer data + CmdClose // Terminate connection +) + +// Protocol packet field sizes in bytes. +const ( + CommandSize = 1 // Command field + UUIDSize = 16 // Connection ID field + DataLengthSize = 4 // Payload length field + HeaderSize = CommandSize + UUIDSize + DataLengthSize +) + +// Packet represents a protocol message with the following binary format: +// +// +---------+----------------+--------------+---------+ +// | Command | Connection ID | Data Length | Payload | +// +---------+----------------+--------------+---------+ +// | 1B | 16B | 4B | var | +type Packet struct { + Command byte // Operation type (CmdNew, CmdAck, etc.) + ConnectionID uuid.UUID // Unique connection identifier + Data []byte // Optional payload data +} + +// NewPacket creates a protocol packet with the given parameters. +// The data parameter is optional and may be nil. +func NewPacket(command byte, connectionID uuid.UUID, data []byte) *Packet { + return &Packet{ + Command: command, + ConnectionID: connectionID, + Data: data, + } +} + +// Encode serializes the packet into a byte slice following the protocol format. +// Returns nil if any encoding operation fails. +func (p *Packet) Encode() []byte { + buf := bytes.NewBuffer(make([]byte, 0, HeaderSize+len(p.Data))) + + if err := buf.WriteByte(p.Command); err != nil { + return nil + } + + if _, err := buf.Write(p.ConnectionID[:]); err != nil { + return nil + } + + if err := binary.Write(buf, binary.BigEndian, uint32(len(p.Data))); err != nil { + return nil + } + + if len(p.Data) > 0 { + if _, err := buf.Write(p.Data); err != nil { + return nil + } + } + + return buf.Bytes() +} + +// Decode deserializes a byte slice into a protocol packet. +// Returns nil if the data is malformed, incomplete, or contains an invalid command. +// The input must contain at least HeaderSize bytes and match the encoded length. +func Decode(data []byte) *Packet { + if len(data) < HeaderSize { + return nil + } + + command := data[0] + if command < CmdNew || command > CmdClose { + return nil + } + + var id uuid.UUID + copy(id[:], data[CommandSize:CommandSize+UUIDSize]) + + dataLength := binary.BigEndian.Uint32(data[CommandSize+UUIDSize : HeaderSize]) + if uint32(len(data)) != uint32(HeaderSize)+dataLength { + return nil + } + + var packetData []byte + if dataLength > 0 { + packetData = make([]byte, dataLength) + copy(packetData, data[HeaderSize:]) + } + + return NewPacket(command, id, packetData) +} diff --git a/pkg/proxy/server/errors.go b/pkg/proxy/server/errors.go new file mode 100644 index 0000000..2c5db6a --- /dev/null +++ b/pkg/proxy/server/errors.go @@ -0,0 +1,44 @@ +// Package proxy implements a SOCKS proxy server. +package proxy + +import ( + "proxyblob/pkg/protocol" +) + +// ErrToString maps protocol error codes to human-readable messages. +// These messages are only used on the server side for logging and debugging. +var ErrToString = map[byte]string{ + // General errors + protocol.ErrNone: "no error", + protocol.ErrInvalidCommand: "invalid command", + protocol.ErrContextCanceled: "context canceled", + + // Connection state errors + protocol.ErrConnectionClosed: "connection closed", + protocol.ErrConnectionNotFound: "connection not found", + protocol.ErrConnectionExists: "connection already exists", + protocol.ErrInvalidState: "invalid connection state", + protocol.ErrPacketSendFailed: "failed to send packet", + protocol.ErrHandlerStopped: "handler stopped", + protocol.ErrUnexpectedPacket: "unexpected packet received", + + // Transport layer errors + protocol.ErrTransportClosed: "transport closed", + protocol.ErrTransportTimeout: "transport timeout", + protocol.ErrTransportError: "general transport error", + + // SOCKS reply codes + protocol.ErrInvalidSocksVersion: "invalid SOCKS version", + protocol.ErrUnsupportedCommand: "unsupported command", + protocol.ErrHostUnreachable: "host unreachable", + protocol.ErrConnectionRefused: "connection refused", + protocol.ErrNetworkUnreachable: "network unreachable", + protocol.ErrAddressNotSupported: "address type not supported", + protocol.ErrTTLExpired: "TTL expired", + protocol.ErrGeneralSocksFailure: "general SOCKS server failure", + protocol.ErrAuthFailed: "authentication failed", + + // Protocol packet errors + protocol.ErrInvalidPacket: "invalid protocol packet structure", + protocol.ErrInvalidCrypto: "invalid cryptographic operation", +} \ No newline at end of file diff --git a/pkg/proxy/server/server.go b/pkg/proxy/server/server.go new file mode 100644 index 0000000..16e19af --- /dev/null +++ b/pkg/proxy/server/server.go @@ -0,0 +1,302 @@ +// Package proxy implements a SOCKS proxy server. +// It accepts client connections and forwards traffic through transport channels +// to remote agents. The server manages connection lifecycle, encryption, and +// bidirectional data transfer. +package proxy + +import ( + "context" + "errors" + "io" + "net" + "proxyblob/pkg/protocol" + "proxyblob/pkg/transport" + "time" + + "github.com/google/uuid" + "github.com/rs/zerolog/log" +) + +// ProxyServer implements a SOCKS proxy server that forwards traffic transparently. +// It accepts client connections and manages the protocol flow between clients and +// remote agents. +type ProxyServer struct { + // BaseHandler provides common protocol functionality + *protocol.BaseHandler + + // Listener accepts incoming TCP connections + Listener net.Listener +} + +// NewProxyServer creates a proxy server instance with the given transport. +// The transport is used for communication with remote agents. +func NewProxyServer(ctx context.Context, transport transport.Transport) *ProxyServer { + server := &ProxyServer{} + server.BaseHandler = protocol.NewBaseHandler(ctx, transport) + server.PacketHandler = server + return server +} + +// Start begins listening for client connections on the specified address. +// It launches background goroutines for accepting connections and processing +// protocol messages. If listening fails, the server is stopped. +func (s *ProxyServer) Start(address string) { + var err error + s.Listener, err = net.Listen("tcp", address) + if err != nil { + log.Error().Err(err).Str("addr", address).Msg("Failed to listen on address") + s.Stop() + return + } + + go s.ReceiveLoop() + go s.acceptLoop() +} + +// Stop gracefully terminates the proxy server by closing all active +// connections, canceling the handler's context, and stopping the listener. +func (s *ProxyServer) Stop() { + s.CloseAllConnections() + s.Cancel() + if s.Listener != nil { + s.Listener.Close() + } +} + +// OnNew handles new connection requests. The server is the only one initiating +// connections, so this always returns ErrUnexpectedPacket. +func (s *ProxyServer) OnNew(connectionID uuid.UUID, data []byte) byte { + return protocol.ErrUnexpectedPacket +} + +// OnAck processes connection acknowledgments from agents. It derives a shared +// encryption key using the agent's public key and updates the connection state. +// Returns an error code indicating success or failure. +func (s *ProxyServer) OnAck(connectionID uuid.UUID, data []byte) byte { + value, ok := s.Connections.Load(connectionID) + if !ok { + return protocol.ErrConnectionNotFound + } + conn := value.(*protocol.Connection) + + if conn.State != protocol.StateNew { + return protocol.ErrInvalidState + } + + clientPublicKey := data[:32] + + // At this point,conn.SecretKey contains [24B nonce][32B server private key] + nonce := conn.SecretKey[:24] + serverPrivateKey := conn.SecretKey[24:] + + // Derive the shared key + symmetricKey, errCode := protocol.DeriveKey(serverPrivateKey, clientPublicKey, nonce) + if errCode != protocol.ErrNone { + return errCode + } + + // Store the symmetric key + conn.SecretKey = symmetricKey + + // Signal connection acknowledgment (non-blocking) + conn.ReadBuffer <- []byte{} + conn.State = protocol.StateConnected + conn.LastActivity = time.Now() + return protocol.ErrNone +} + +// OnData processes data received from agents. It decrypts the data and forwards +// it to the client. Returns an error code indicating success or failure. +func (s *ProxyServer) OnData(connectionID uuid.UUID, data []byte) byte { + value, ok := s.Connections.Load(connectionID) + if !ok { + return protocol.ErrConnectionNotFound + } + conn := value.(*protocol.Connection) + conn.LastActivity = time.Now() + + decrypted, errCode := protocol.Decrypt(conn.SecretKey, data) + if errCode != protocol.ErrNone { + return errCode + } + data = decrypted + + // Writing to client is handled by forwardToClient goroutine + select { + case <-s.Ctx.Done(): + return protocol.ErrConnectionClosed + case conn.ReadBuffer <- data: + return protocol.ErrNone + + } +} + +// OnClose handles connection termination from agents. It cleans up the +// connection state. +func (s *ProxyServer) OnClose(connectionID uuid.UUID, errorCode byte) byte { + value, ok := s.Connections.Load(connectionID) + if !ok { + return protocol.ErrNone // Connection already removed, nothing to do + } + conn := value.(*protocol.Connection) + conn.Close() + s.Connections.Delete(connectionID) + return errorCode +} + +// acceptLoop accepts incoming TCP connections and spawns goroutines to handle +// each one. It continues until the context is canceled or a non-temporary +// error occurs. +func (s *ProxyServer) acceptLoop() { + for { + select { + case <-s.Ctx.Done(): + return + default: + conn, err := s.Listener.Accept() + if err != nil { + if s.Ctx.Err() != nil { + return // Exit quietly on shutdown + } + + if _, ok := err.(net.Error); ok { + continue // Retry on temporary network errors + } + return + } + + go s.handleConnection(conn) + } + } +} + +// handleConnection processes a new client connection by: +// - Generating a unique connection ID +// - Initiating connection with remote agent +// - Setting up bidirectional data forwarding +// - Managing connection lifecycle and cleanup +func (s *ProxyServer) handleConnection(clientConn net.Conn) { + defer clientConn.Close() + + connID := uuid.New() + proxyConn := protocol.NewConnection(connID) + s.Connections.Store(proxyConn.ID, proxyConn) + + // 1. Initiate connection with the agent + errCode := s.SendNewConnection(connID) + if errCode != protocol.ErrNone { + s.Connections.Delete(connID) + return + } + + // 2. Wait for agent acknowledgment with timeout + select { + case <-s.Ctx.Done(): + s.SendClose(connID, protocol.ErrHandlerStopped) + s.Connections.Delete(connID) + return + case <-time.After(5 * time.Second): + s.SendClose(connID, protocol.ErrTransportTimeout) + s.Connections.Delete(connID) + return + case <-proxyConn.ReadBuffer: + // Agent acknowledged connection + } + + // 3. Connection established, start bidirectional forwarding + proxyConn.State = protocol.StateConnected + proxyConn.LastActivity = time.Now() + + errCh := make(chan byte, 2) + go s.forwardToAgent(clientConn, proxyConn, errCh) + go s.forwardToClient(clientConn, proxyConn, errCh) + + // Wait for error, closed connection, or context cancellation + select { + case <-s.Ctx.Done(): + // Context cancelled, closing connection + case <-proxyConn.Closed: + // Connection closed by agent + case errCode := <-errCh: + if errCode != protocol.ErrNone && errCode != protocol.ErrConnectionClosed { + log.Error().Str("msg", ErrToString[errCode]).Msg("Connection error") + } + } + + // Clean up the connection + s.SendClose(connID, protocol.ErrConnectionClosed) + proxyConn.Close() + s.Connections.Delete(connID) +} + +// forwardToAgent reads data from the client connection and forwards it to +// the remote agent. It continues until an error occurs or the connection +// is closed. +func (s *ProxyServer) forwardToAgent(clientConn net.Conn, proxyConn *protocol.Connection, errCh chan<- byte) { + buffer := make([]byte, 64*1024) + + for { + // Check early termination conditions + if proxyConn.State == protocol.StateClosed { + return + } + + select { + case <-s.Ctx.Done(): + return + case <-proxyConn.Closed: + return + default: + // Continue processing + } + + n, err := clientConn.Read(buffer) + if err != nil { + if errors.Is(err, io.EOF) { + errCh <- protocol.ErrConnectionClosed + } else if netErr, ok := err.(net.Error); ok && netErr.Timeout() { + errCh <- protocol.ErrTransportTimeout + } else { + // General network error + errCh <- protocol.ErrNetworkUnreachable + } + return + } + + errCode := s.SendData(proxyConn.ID, buffer[:n]) + if errCode != protocol.ErrNone { + errCh <- protocol.ErrPacketSendFailed + return + } + + proxyConn.LastActivity = time.Now() + } +} + +// forwardToClient reads data from the connection's read buffer and forwards +// it to the client. It continues until an error occurs or the connection +// is closed. +func (s *ProxyServer) forwardToClient(clientConn net.Conn, proxyConn *protocol.Connection, errCh chan<- byte) { + for { + select { + case <-s.Ctx.Done(): + return + case <-proxyConn.Closed: + return + case data := <-proxyConn.ReadBuffer: + proxyConn.LastActivity = time.Now() + _, err := clientConn.Write(data) + if err != nil { + if errors.Is(err, io.EOF) { + errCh <- protocol.ErrConnectionClosed + } else if netErr, ok := err.(net.Error); ok && netErr.Timeout() { + errCh <- protocol.ErrTransportTimeout + } else { + // General network error + errCh <- protocol.ErrNetworkUnreachable + } + return + } + } + } +} diff --git a/pkg/proxy/socks/address.go b/pkg/proxy/socks/address.go new file mode 100644 index 0000000..aba7b1d --- /dev/null +++ b/pkg/proxy/socks/address.go @@ -0,0 +1,97 @@ +// Package proxy implements SOCKS5 proxy functionality. +package proxy + +import ( + "encoding/binary" + "fmt" + "net" + + "proxyblob/pkg/protocol" +) + +// ParseAddress extracts a target address from SOCKS5 address data. +// It returns the address in host:port format and any error encountered. +// The address format follows RFC 1928 Section 4. +func ParseAddress(data []byte) (string, byte) { + addr, _, err := ParseNetworkAddress(data[0], data[1:]) + if err != protocol.ErrNone { + return "", err + } + return addr, protocol.ErrNone +} + +// ParseNetworkAddress parses a network address from SOCKS5 formatted data. +// The format is: +// +// +------+----------+----------+ +// | ATYP | DST.ADDR | DST.PORT | +// +------+----------+----------+ +// | 1 | Variable | 2 | +// +// Returns the address string in host:port format, bytes consumed, and any error. +func ParseNetworkAddress(addrType byte, data []byte) (string, int, byte) { + cursor := 0 + var addr string + + switch addrType { + case IPv4: + if len(data) < cursor+4+2 { // 4 bytes IPv4 + 2 bytes port + return "", 0, protocol.ErrAddressNotSupported + } + ip := net.IPv4(data[cursor], data[cursor+1], data[cursor+2], data[cursor+3]) + addr = ip.String() + cursor += 4 + + case IPv6: + if len(data) < cursor+16+2 { // 16 bytes IPv6 + 2 bytes port + return "", 0, protocol.ErrAddressNotSupported + } + ip := net.IP(data[cursor : cursor+16]) + addr = fmt.Sprintf("[%s]", ip.String()) + cursor += 16 + + case Domain: + if len(data) < cursor+1 { // Need length byte + return "", 0, protocol.ErrAddressNotSupported + } + domainLen := int(data[cursor]) + cursor++ + if len(data) < cursor+domainLen+2 { // +2 for port + return "", 0, protocol.ErrAddressNotSupported + } + addr = string(data[cursor : cursor+domainLen]) + cursor += domainLen + + default: + return "", 0, protocol.ErrAddressNotSupported + } + + if len(data) < cursor+2 { + return "", 0, protocol.ErrAddressNotSupported + } + + port := binary.BigEndian.Uint16(data[cursor : cursor+2]) + cursor += 2 + + return fmt.Sprintf("%s:%d", addr, port), cursor, protocol.ErrNone +} + +// ExtractUDPHeader parses a SOCKS5 UDP datagram header and returns the target address. +// The format is: +// +// +-----+------+------+----------+----------+----------+ +// | RSV | FRAG | ATYP | DST.ADDR | DST.PORT | DATA | +// +-----+------+------+----------+----------+----------+ +// | 2 | 1 | 1 | Variable | 2 | Variable | +// +// Returns the target address, header length, and any error encountered. +func ExtractUDPHeader(data []byte) (string, int, byte) { + headerLen := 4 // RSV(2) + FRAG(1) + ATYP(1) + + // Parse the address part of the header + addr, addrLen, err := ParseNetworkAddress(data[3], data[4:]) // Use ATYP and pass remaining data + if err != protocol.ErrNone { + return "", 0, err + } + return addr, headerLen + addrLen, protocol.ErrNone +} diff --git a/pkg/proxy/socks/bind.go b/pkg/proxy/socks/bind.go new file mode 100644 index 0000000..063aef3 --- /dev/null +++ b/pkg/proxy/socks/bind.go @@ -0,0 +1,15 @@ +package proxy + +import ( + "proxyblob/pkg/protocol" +) + +// handleBind processes the SOCKS5 BIND command. +// The BIND command is used to accept incoming TCP connections +// on behalf of the client. This implementation returns +// ErrUnsupportedCommand as BIND is not currently supported. +// +// The command format follows RFC 1928 Section 4. +func (h *SocksHandler) handleBind(conn *protocol.Connection, data []byte) byte { + return protocol.ErrUnsupportedCommand +} diff --git a/pkg/proxy/socks/connect.go b/pkg/proxy/socks/connect.go new file mode 100644 index 0000000..5271dfb --- /dev/null +++ b/pkg/proxy/socks/connect.go @@ -0,0 +1,172 @@ +package proxy + +import ( + "encoding/binary" + "io" + "net" + "time" + + "proxyblob/pkg/protocol" +) + +// handleConnect processes the SOCKS5 CONNECT command. +// It establishes a TCP connection to the requested target and +// sets up bidirectional data transfer between client and target. +// +// The CONNECT command format is: +// +// +-----+-----+-----+------+----------+----------+ +// | VER | CMD | RSV | ATYP | DST.ADDR | DST.PORT | +// +-----+-----+-----+------+----------+----------+ +// | 1 | 1 | 1 | 1 | Variable | 2 | +// +// Returns an error code indicating success or specific failure reason. +func (h *SocksHandler) handleConnect(conn *protocol.Connection, cmdData []byte) byte { + if len(cmdData) < 4 { + // Send malformed request response + response := []byte{Version5, GeneralFailure, 0x00, IPv4, 0, 0, 0, 0, 0, 0} + h.SendData(conn.ID, response) + return protocol.ErrAddressNotSupported + } + + // Parse target address + target, errCode := ParseAddress(cmdData[3:]) + if errCode != protocol.ErrNone { + h.SendError(conn, errCode) + return errCode + } + + // Establish TCP connection to target + targetConn, err := net.DialTimeout("tcp", target, 10*time.Second) + if err != nil { + // Map network error to appropriate SOCKS5 error code + if netErr, ok := err.(net.Error); ok && netErr.Timeout() { + errCode = protocol.ErrTTLExpired + } else if opErr, ok := err.(*net.OpError); ok { + if opErr.Op == "dial" { + errCode = protocol.ErrNetworkUnreachable + } else if opErr.Op == "read" { + errCode = protocol.ErrHostUnreachable + } + } else if _, ok := err.(*net.DNSError); ok { + errCode = protocol.ErrHostUnreachable + } else { + errCode = protocol.ErrConnectionRefused + } + + // Send failure response with appropriate code + h.SendError(conn, errCode) + return errCode + } + + // Send success response + localAddr := targetConn.LocalAddr().(*net.TCPAddr) + response := make([]byte, 10) + response[0] = Version5 + response[1] = Succeeded + response[2] = 0x00 + response[3] = IPv4 + copy(response[4:8], localAddr.IP.To4()) + binary.BigEndian.PutUint16(response[8:], uint16(localAddr.Port)) + + errCode = h.SendData(conn.ID, response) + if errCode != protocol.ErrNone { + targetConn.Close() + return protocol.ErrPacketSendFailed + } + + // Store connection and set state + conn.Conn = targetConn + conn.State = protocol.StateConnected + + // Start data transfer + return h.handleTCPDataTransfer(conn, targetConn) +} + +// handleTCPDataTransfer manages bidirectional data transfer for TCP connections. +// It spawns two goroutines: +// - One reads from client and writes to target +// - One reads from target and writes to client +// +// The transfer continues until either: +// - The connection is closed by either end +// - The context is canceled +// - An error occurs +func (h *SocksHandler) handleTCPDataTransfer(conn *protocol.Connection, tcpConn net.Conn) byte { + // Create channels for communication + clientToTarget := make(chan []byte) + targetToClient := make(chan []byte) + errorCh := make(chan byte, 2) + + // Read from SOCKS client and forward to target + go func() { + for { + select { + case <-conn.Closed: + return + case <-h.Ctx.Done(): + return + case data, ok := <-conn.ReadBuffer: + if !ok { + return + } + clientToTarget <- data + } + } + }() + + // Read from target and forward to SOCKS client + go func() { + buffer := make([]byte, 128*1024) + for { + n, err := tcpConn.Read(buffer) + if err != nil { + if err == io.EOF { + errorCh <- protocol.ErrConnectionClosed + } else if netErr, ok := err.(net.Error); ok && netErr.Timeout() { + errorCh <- protocol.ErrTTLExpired + } else { + errorCh <- protocol.ErrHostUnreachable + } + return + } + // Copy data since buffer will be reused + data := make([]byte, n) + copy(data, buffer[:n]) + targetToClient <- data + } + }() + + // Main data transfer loop + for { + select { + case <-conn.Closed: + tcpConn.Close() + return protocol.ErrNone + + case <-h.Ctx.Done(): + tcpConn.Close() + return protocol.ErrHandlerStopped + + case errCode := <-errorCh: + tcpConn.Close() + return errCode + + case data := <-clientToTarget: + _, err := tcpConn.Write(data) + if err != nil { + tcpConn.Close() + if netErr, ok := err.(net.Error); ok && netErr.Timeout() { + return protocol.ErrTTLExpired + } + return protocol.ErrHostUnreachable + } + case data := <-targetToClient: + errCode := h.SendData(conn.ID, data) + if errCode != protocol.ErrNone { + tcpConn.Close() + return protocol.ErrPacketSendFailed + } + } + } +} diff --git a/pkg/proxy/socks/constants.go b/pkg/proxy/socks/constants.go new file mode 100644 index 0000000..7f66844 --- /dev/null +++ b/pkg/proxy/socks/constants.go @@ -0,0 +1,48 @@ +// Package proxy implements SOCKS5 proxy functionality. +package proxy + +// SOCKS protocol versions. +const ( + Version5 byte = 0x05 // SOCKS Protocol Version 5 +) + +// Authentication methods as defined in RFC 1928. +const ( + NoAuth byte = 0x00 // No authentication required + GSSAPI byte = 0x01 // GSSAPI + UsernamePassword byte = 0x02 // Username/Password (RFC 1929) + NoAcceptableMethods byte = 0xFF // No acceptable methods +) + +// SOCKS5 commands that clients may request. +const ( + Connect byte = 0x01 // Establish TCP/IP stream connection + Bind byte = 0x02 // Listen for incoming TCP connection + UDPAssociate byte = 0x03 // Set up UDP relay +) + +// Address types for target addresses. +const ( + IPv4 byte = 0x01 // IPv4 address (4 bytes) + Domain byte = 0x03 // Domain name (variable length) + IPv6 byte = 0x04 // IPv6 address (16 bytes) +) + +// Reply codes sent from server to client. +const ( + Succeeded byte = 0x00 // Request granted + GeneralFailure byte = 0x01 // General failure + ConnectionNotAllowed byte = 0x02 // Connection not allowed by ruleset + NetworkUnreachable byte = 0x03 // Network unreachable + HostUnreachable byte = 0x04 // Host unreachable + ConnectionRefused byte = 0x05 // Connection refused by destination + TTLExpired byte = 0x06 // TTL expired + CommandNotSupported byte = 0x07 // Command not supported + AddressTypeNotSupported byte = 0x08 // Address type not supported +) + +// Buffer size limits. +const ( + MaxSocksHeaderSize = 262 // Maximum size of SOCKS header in bytes + MaxUDPPacketSize = 65535 // Maximum size of UDP datagram in bytes +) diff --git a/pkg/proxy/socks/socks.go b/pkg/proxy/socks/socks.go new file mode 100644 index 0000000..f86ecc0 --- /dev/null +++ b/pkg/proxy/socks/socks.go @@ -0,0 +1,264 @@ +// Package proxy implements SOCKS5 proxy functionality. +// It provides a complete SOCKS5 implementation following RFC 1928, supporting +// CONNECT and UDP ASSOCIATE (BIND not implemented) commands with NoAuth authentication. +package proxy + +import ( + "context" + "slices" + + "proxyblob/pkg/protocol" + "proxyblob/pkg/transport" + + "github.com/google/uuid" +) + +// SocksHandler implements a SOCKS5 protocol handler. +// It processes authentication, commands, and data transfer between clients +// and remote targets. The handler is safe for concurrent use. +type SocksHandler struct { + *protocol.BaseHandler +} + +// NewSocksHandler creates a SOCKS5 handler with the given transport. +// The transport is used for sending and receiving protocol messages. +func NewSocksHandler(ctx context.Context, transport transport.Transport) *SocksHandler { + handler := &SocksHandler{} + handler.BaseHandler = protocol.NewBaseHandler(ctx, transport) + handler.PacketHandler = handler + return handler +} + +// Start begins processing SOCKS5 requests. The address parameter is ignored +// as there are no listeners on the agent side. +func (h *SocksHandler) Start(address string) { + go h.ReceiveLoop() +} + +// Stop gracefully terminates the handler, closing all active connections +// and canceling the context. +func (h *SocksHandler) Stop() { + h.CloseAllConnections() + h.Cancel() +} + +// OnNew handles new connection requests by initializing it and +// starting the SOCKS5 protocol flow. +func (h *SocksHandler) OnNew(connectionID uuid.UUID, data []byte) byte { + // Check if the connection already exists + if _, ok := h.Connections.Load(connectionID); ok { + return protocol.ErrConnectionExists + } + + // Create new connection + conn := protocol.NewConnection(connectionID) + h.Connections.Store(conn.ID, conn) + + // Process the server's nonce and public key from data + if len(data) >= 24+32 { + // Extract nonce and server public key + nonce := data[:24] + serverPublicKey := data[24 : 24+32] + + // Store temporary data for key derivation during ACK + tmp := make([]byte, len(nonce)+len(serverPublicKey)) + copy(tmp[:len(nonce)], nonce) + copy(tmp[len(nonce):], serverPublicKey) + conn.SecretKey = tmp + } + + // Send connection acknowledgment + errCode := h.SendConnAck(connectionID) + if errCode != protocol.ErrNone { + return errCode + } + + // Process the connection + go h.processConnection(conn) + return protocol.ErrNone +} + +// OnAck reports ErrUnexpectedPacket as the agent only accepts incoming +// connections and does not initiate them. +func (h *SocksHandler) OnAck(connectionID uuid.UUID, data []byte) byte { + return protocol.ErrUnexpectedPacket +} + +// OnData processes incoming data for a connection. +// It decrypts the data and forwards it to the connection's read buffer. +func (h *SocksHandler) OnData(connectionID uuid.UUID, data []byte) byte { + value, ok := h.Connections.Load(connectionID) + if !ok { + return protocol.ErrConnectionNotFound + } + conn := value.(*protocol.Connection) + + decrypted, errCode := protocol.Decrypt(conn.SecretKey, data) + if errCode != protocol.ErrNone { + h.SendClose(connectionID, protocol.ErrInvalidCrypto) + return errCode + } + data = decrypted + + select { + case <-h.Ctx.Done(): + return protocol.ErrConnectionClosed + case conn.ReadBuffer <- data: + return protocol.ErrNone + + } +} + +// OnClose cleans up resources associated with a connection. +// It is safe to call multiple times. +func (h *SocksHandler) OnClose(connectionID uuid.UUID, errorCode byte) byte { + value, ok := h.Connections.Load(connectionID) + if !ok { + return protocol.ErrNone // Connection already removed, nothing to do + } + conn := value.(*protocol.Connection) + conn.Close() + + h.Connections.Delete(connectionID) + return protocol.ErrNone +} + +// processConnection handles the SOCKS5 protocol flow for a single connection. +// The flow consists of three phases: +// +// 1. Authentication method negotiation +// 2. Command processing (CONNECT, UDP ASSOCIATE) +// 3. Data transfer between client and target +func (h *SocksHandler) processConnection(conn *protocol.Connection) { + // SOCKS protocol has 3 sequential phases + errCode := h.handleAuthNegotiation(conn) + if errCode != protocol.ErrNone { + h.SendClose(conn.ID, errCode) + return + } + + errCode = h.handleCommand(conn) + if errCode != protocol.ErrNone { + h.SendClose(conn.ID, errCode) + return + } + + errCode = h.handleDataTransfer(conn) + if errCode != protocol.ErrNone { + h.SendClose(conn.ID, errCode) + return + } +} + +// SendError sends a SOCKS5 error reply to the client. +// It maps internal error codes to SOCKS5 reply codes as defined in RFC 1928. +func (h *SocksHandler) SendError(conn *protocol.Connection, errCode byte) { + // Default to general failure + socksReplyCode := GeneralFailure + + // Map internal error codes to SOCKS reply codes + switch errCode { + case protocol.ErrNone: + socksReplyCode = Succeeded + case protocol.ErrNetworkUnreachable: + socksReplyCode = NetworkUnreachable + case protocol.ErrHostUnreachable: + socksReplyCode = HostUnreachable + case protocol.ErrConnectionRefused: + socksReplyCode = ConnectionRefused + case protocol.ErrTTLExpired: + socksReplyCode = TTLExpired + case protocol.ErrUnsupportedCommand: + socksReplyCode = CommandNotSupported + case protocol.ErrAddressNotSupported: + socksReplyCode = AddressTypeNotSupported + case protocol.ErrAuthFailed: + socksReplyCode = NoAcceptableMethods + } + + // Build and send error response + response := []byte{Version5, socksReplyCode, 0x00, IPv4, 0, 0, 0, 0, 0, 0} + h.SendData(conn.ID, response) +} + +// handleAuthNegotiation processes the client's authentication method selection. +// Currently only the NO AUTHENTICATION REQUIRED (0x00) method is supported. +func (h *SocksHandler) handleAuthNegotiation(conn *protocol.Connection) byte { + select { + case methods := <-conn.ReadBuffer: + // Currently we only support NoAuth (0x00) + if !slices.Contains(methods, NoAuth) { + h.SendError(conn, protocol.ErrAuthFailed) + return protocol.ErrAuthFailed + } + + // Send response + errCode := h.SendData(conn.ID, []byte{Version5, NoAuth}) + if errCode != protocol.ErrNone { + return errCode + } + + return protocol.ErrNone + + case <-conn.Closed: + return protocol.ErrConnectionClosed + + case <-h.Ctx.Done(): + return protocol.ErrHandlerStopped + } +} + +// handleCommand processes SOCKS5 commands from the client. +// Supported commands are: +// +// - CONNECT (0x01): Establish TCP/IP stream connection +// - UDP ASSOCIATE (0x03): UDP relay +// +// Unsupported commands are: +// +// - BIND (0x02): TCP/IP port binding +func (h *SocksHandler) handleCommand(conn *protocol.Connection) byte { + select { + case cmdData := <-conn.ReadBuffer: + // Validate command format + if len(cmdData) < 4 { + h.SendError(conn, protocol.ErrInvalidPacket) + return protocol.ErrInvalidPacket + } + + // Check SOCKS version + if cmdData[0] != Version5 { + h.SendError(conn, protocol.ErrInvalidSocksVersion) + return protocol.ErrInvalidSocksVersion + } + + var errCode byte + switch cmdData[1] { + case Connect: + errCode = h.handleConnect(conn, cmdData) + case Bind: + errCode = h.handleBind(conn, cmdData) + case UDPAssociate: + errCode = h.handleUDPAssociate(conn) + default: + h.SendError(conn, protocol.ErrUnsupportedCommand) + return protocol.ErrUnsupportedCommand + } + + return errCode + + case <-conn.Closed: + return protocol.ErrConnectionClosed + case <-h.Ctx.Done(): + return protocol.ErrHandlerStopped + } +} + +// handleDataTransfer manages the flow of data between client and target. +// Each command handler implements its own data transfer mechanism. +func (h *SocksHandler) handleDataTransfer(conn *protocol.Connection) byte { + // Each command handler takes care of data transfer + // Just wait for connection to be closed + <-conn.Closed + return protocol.ErrNone +} diff --git a/pkg/proxy/socks/udp_associate.go b/pkg/proxy/socks/udp_associate.go new file mode 100644 index 0000000..2f2e828 --- /dev/null +++ b/pkg/proxy/socks/udp_associate.go @@ -0,0 +1,323 @@ +package proxy + +import ( + "encoding/binary" + "errors" + "net" + "time" + + "proxyblob/pkg/protocol" +) + +// handleUDPAssociate processes the SOCKS5 UDP ASSOCIATE command. +// It creates a UDP relay that allows clients to send and receive +// UDP datagrams through the SOCKS server. +// +// The process involves: +// 1. Creating a UDP socket for client communication +// 2. Sending the socket address back to the client +// 3. Maintaining the TCP control connection +// 4. Relaying UDP datagrams between client and targets +// +// The command format follows RFC 1928 Section 4. +func (h *SocksHandler) handleUDPAssociate(conn *protocol.Connection) byte { + // Create UDP socket + udpAddr, err := net.ResolveUDPAddr("udp", "0.0.0.0:0") + if err != nil { + // Send network unreachable error + h.SendError(conn, protocol.ErrNetworkUnreachable) + return protocol.ErrNetworkUnreachable + } + + udpConn, err := net.ListenUDP("udp", udpAddr) + if err != nil { + // Determine specific error type + errCode := protocol.ErrGeneralSocksFailure + if opErr, ok := err.(*net.OpError); ok { + if errors.Is(opErr, net.ErrClosed) { + errCode = protocol.ErrTransportClosed + } else if opErr.Op == "listen" { + errCode = protocol.ErrNetworkUnreachable + } + } + + // Send appropriate error response + h.SendError(conn, errCode) + return errCode + } + + // Get the allocated port + localAddr := udpConn.LocalAddr().(*net.UDPAddr) + port := localAddr.Port + + // Create response + // Format: |VER|REP|RSV|ATYP|BND.ADDR|BND.PORT| + response := []byte{ + Version5, // VER + Succeeded, // REP - success + 0, // RSV - reserved, must be 0 + IPv4, // ATYP - IPv4 + 0, 0, 0, 0, // BND.ADDR - 0.0.0.0 (any address) + byte(port >> 8), // BND.PORT - high byte + byte(port & 0xff), // BND.PORT - low byte + } + + errCode := h.SendData(conn.ID, response) + if errCode != protocol.ErrNone { + udpConn.Close() + return protocol.ErrPacketSendFailed + } + + // Store UDP connection and start handling packets + conn.Conn = udpConn + conn.State = protocol.StateConnected + + go h.handleUDPPackets(conn) + + // Keep the control connection open until it's closed elsewhere + select { + case <-conn.Closed: + // Control connection closed, UDP associate terminated + case <-h.Ctx.Done(): + udpConn.Close() + } + + return protocol.ErrNone +} + +// handleUDPPackets manages the UDP relay for a client. +// It: +// - Receives UDP packets from the client +// - Extracts target addresses from SOCKS headers +// - Forwards packets to targets +// - Receives responses from targets +// - Wraps responses in SOCKS headers +// - Returns them to the client +// +// The relay operates until the control connection closes or +// the context is canceled. +func (h *SocksHandler) handleUDPPackets(conn *protocol.Connection) { + udpConn := conn.Conn.(*net.UDPConn) + buffer := make([]byte, 64*1024) + var clientAddr *net.UDPAddr + + // Create a UDP connection for sending to targets + targetConn, err := net.ListenUDP("udp", nil) + if err != nil { + h.SendClose(conn.ID, protocol.ErrNetworkUnreachable) + return + } + + // Ensure connections are properly closed when this handler exits + defer targetConn.Close() + + // Map to track target addresses and their corresponding responses + type targetInfo struct { + addr *net.UDPAddr + lastActive time.Time + } + targets := make(map[string]*targetInfo) + + // Channel for receiving UDP responses + responses := make(chan struct { + data []byte + addr *net.UDPAddr + }, 100) + + // Start a goroutine to handle responses + go func() { + respBuf := make([]byte, 128*1024) + for { + // Check for cancellation + select { + case <-h.Ctx.Done(): + return + case <-conn.Closed: + return + default: + // Continue processing + } + + // Set read deadline + if err := targetConn.SetReadDeadline(time.Now().Add(300 * time.Millisecond)); err != nil { + if errors.Is(err, net.ErrClosed) { + return + } + continue // Non-fatal, just retry + } + + n, addr, err := targetConn.ReadFromUDP(respBuf) + if err != nil { + if errors.Is(err, net.ErrClosed) { + return + } + continue + } + + if n > 0 { + // Make a copy of the data since respBuf will be reused + data := make([]byte, n) + copy(data, respBuf[:n]) + + // Send response through channel + select { + case responses <- struct { + data []byte + addr *net.UDPAddr + }{data, addr}: + // Successfully sent + default: + // Channel full, log and continue + } + } + } + }() + + // Timeout to clean up inactive targets + ticker := time.NewTicker(30 * time.Second) + defer ticker.Stop() + + for { + select { + case <-h.Ctx.Done(): + return + case <-conn.Closed: + return + case resp := <-responses: + // Find the target that matches this response + var found bool + + for _, target := range targets { + if target.addr.IP.Equal(resp.addr.IP) && target.addr.Port == resp.addr.Port { + // Update last active time + target.lastActive = time.Now() + found = true + break + } + } + + if !found { + // Skip unknown targets + continue + } + + if clientAddr == nil { + // Skip client address not set + continue + } + + // Create response packet with appropriate header + // For simplicity, we'll just use a minimal header with the correct address type + var respHeader []byte + + // Determine address type + var addrType byte + if resp.addr.IP.To4() != nil { + addrType = IPv4 + } else { + addrType = IPv6 + } + + // header: RSV(2) + FRAG(0) + ATYP(1) + ADDR + PORT(2) + respHeader = append(respHeader, 0, 0, 0, addrType) + + if addrType == IPv4 { + respHeader = append(respHeader, resp.addr.IP.To4()...) + } else { + respHeader = append(respHeader, resp.addr.IP.To16()...) + } + + // Add port + portBytes := make([]byte, 2) + binary.BigEndian.PutUint16(portBytes, uint16(resp.addr.Port)) + respHeader = append(respHeader, portBytes...) + + // Combine header and payload + respPacket := append(respHeader, resp.data...) + + _, err = udpConn.WriteToUDP(respPacket, clientAddr) + if err != nil { + if errors.Is(err, net.ErrClosed) { + return + } + } + + case <-ticker.C: + // Clean up inactive targets + now := time.Now() + for targetKey, targetInfo := range targets { + if now.Sub(targetInfo.lastActive) > 1*time.Minute { + delete(targets, targetKey) + } + } + + default: + // Set read deadline to prevent blocking forever + if err := udpConn.SetReadDeadline(time.Now().Add(300 * time.Millisecond)); err != nil { + if errors.Is(err, net.ErrClosed) { + return + } + continue // Non-fatal + } + + n, remoteAddr, err := udpConn.ReadFromUDP(buffer) + if err != nil { + // Handle various error conditions + if errors.Is(err, net.ErrClosed) { + return + } + + if netErr, ok := err.(net.Error); ok { + if netErr.Timeout() { + // This is expected due to deadline, don't log + continue + } + } + + h.SendClose(conn.ID, protocol.ErrNetworkUnreachable) + return + } + + // Store client address from first packet + if clientAddr == nil { + clientAddr = remoteAddr + } + + // Only accept packets from original client + if !remoteAddr.IP.Equal(clientAddr.IP) { + continue + } + + // Handle UDP packet + if n > 3 { + // Extract target address from UDP header + targetAddr, headerLen, errCode := ExtractUDPHeader(buffer[:n]) + if errCode != protocol.ErrNone { + continue + } + + // Resolve target address + targetUDPAddr, err := net.ResolveUDPAddr("udp", targetAddr) + if err != nil { + continue + } + + // Store target information + targetKey := targetAddr + targets[targetKey] = &targetInfo{ + addr: targetUDPAddr, + lastActive: time.Now(), + } + + // Send payload to target + _, err = targetConn.WriteToUDP(buffer[headerLen:n], targetUDPAddr) + if err != nil { + if errors.Is(err, net.ErrClosed) { + return + } + continue + } + } + } + } +} diff --git a/pkg/transport/blob.go b/pkg/transport/blob.go new file mode 100644 index 0000000..a59b55d --- /dev/null +++ b/pkg/transport/blob.go @@ -0,0 +1,266 @@ +// Package transport provides interfaces and implementations for communication +// between proxy components. It abstracts the underlying transport mechanism +// and ensures reliable data transfer with proper error handling. +package transport + +import ( + "bytes" + "context" + "errors" + "io" + "time" + + "github.com/Azure/azure-storage-blob-go/azblob" +) + +// Retry configuration for blob operations. +const ( + InitialRetryDelay = 50 * time.Millisecond // Starting delay between retries + MaxRetryDelay = 3 * time.Second // Maximum delay between retries + BackoffFactor = 1.5 // Multiplier for exponential backoff +) + +// BlobTransport implements the Transport interface using Azure Blob Storage. +// It uses separate blobs for reading and writing to provide bidirectional +// communication. All operations are retried with exponential backoff. +type BlobTransport struct { + readBlob azblob.BlockBlobURL // Blob for receiving data + writeBlob azblob.BlockBlobURL // Blob for sending data +} + +// NewBlobTransport creates a transport that uses the provided blobs for +// bidirectional communication. The readBlob is used for receiving data, +// and the writeBlob is used for sending data. +func NewBlobTransport(readBlob, writeBlob azblob.BlockBlobURL) *BlobTransport { + return &BlobTransport{ + readBlob: readBlob, + writeBlob: writeBlob, + } +} + +// Send writes data to the write blob. It blocks until the data is written +// or the context is canceled. Returns an error code indicating success or +// specific failure reason. +func (t *BlobTransport) Send(ctx context.Context, data []byte) byte { + return WriteBlob(ctx, t.writeBlob, data) +} + +// Receive reads and clears data from the read blob. It blocks until data +// is available or the context is canceled. Returns the read data and an +// error code indicating success or failure reason. +func (t *BlobTransport) Receive(ctx context.Context) ([]byte, byte) { + return WaitForData(ctx, t.readBlob) +} + +// IsClosed reports whether the transport is permanently closed. +func (t *BlobTransport) IsClosed(errCode byte) bool { + return errCode == ErrTransportClosed +} + +// WriteBlob attempts to write data to a blob with retry and exponential backoff. +// The operation is retried until successful or the context is canceled. +// Returns an error code indicating success or specific failure reason. +func WriteBlob(ctx context.Context, blobURL azblob.BlockBlobURL, data []byte) byte { + retryDelay := InitialRetryDelay + + // Try the operation with unlimited retries + for { + // Check if blob is empty + isEmpty, errCode := IsBlobEmpty(ctx, blobURL) + if errCode != ErrNone { + return errCode + } + + if !isEmpty { + // If the blob isn't empty, wait before retrying + retryDelay, errCode = WaitDelay(ctx, retryDelay) + if errCode != ErrNone { + return errCode + } + continue + } + + // Reset delay when we find empty blob + retryDelay = InitialRetryDelay + + // Upload data to the blob + _, err := blobURL.Upload( + ctx, + bytes.NewReader(data), + azblob.BlobHTTPHeaders{ContentType: "application/octet-stream"}, + azblob.Metadata{}, + azblob.BlobAccessConditions{}, + azblob.DefaultAccessTier, + nil, + azblob.ClientProvidedKeyOptions{}, + azblob.ImmutabilityPolicyOptions{}, + ) + + if err != nil { + // If upload fails, check context and retry + if ctx.Err() != nil { + return ErrContextCanceled + } + + // Wait before retrying with exponential backoff + retryDelay, errCode = WaitDelay(ctx, retryDelay) + if errCode != ErrNone { + return errCode + } + continue + } + + // Success + return ErrNone + } +} + +// WaitForData polls a blob until data is available, then reads and clears it. +// The operation is retried with exponential backoff until data is found or +// the context is canceled. Returns the read data and an error code indicating +// success or failure reason. +func WaitForData(ctx context.Context, blobURL azblob.BlockBlobURL) ([]byte, byte) { + var data []byte + retryDelay := InitialRetryDelay + + for { + // Check for cancellation + if ctx.Err() != nil { + return nil, ErrContextCanceled + } + + // Poll until the blob contains data + isEmpty, errCode := IsBlobEmpty(ctx, blobURL) + if errCode != ErrNone { + return nil, errCode + } + + if isEmpty { + // If empty, wait before checking again with exponential backoff + retryDelay, errCode = WaitDelay(ctx, retryDelay) + if errCode != ErrNone { + return nil, errCode + } + continue + } + + // Reset delay when we find data + retryDelay = InitialRetryDelay + + // Found data, download the blob content + response, err := blobURL.Download(ctx, 0, azblob.CountToEnd, azblob.BlobAccessConditions{}, false, azblob.ClientProvidedKeyOptions{}) + if err != nil { + return nil, BlobError(err) + } + + bodyReader := response.Body(azblob.RetryReaderOptions{MaxRetryRequests: 3}) + defer bodyReader.Close() + + // Read the data + data, err = io.ReadAll(bodyReader) + if err != nil { + return nil, ErrTransportError + } + + // Clear the blob - no retries here + errCode = ClearBlob(ctx, blobURL) + if errCode != ErrNone { + return nil, errCode + } + + return data, ErrNone + } +} + +// IsBlobEmpty checks if a blob is empty by retrieving its properties. +// Returns true if the blob has zero content length, and an error code +// indicating success or failure reason. +func IsBlobEmpty(ctx context.Context, blobURL azblob.BlockBlobURL) (bool, byte) { + // Check for cancelation + props, err := blobURL.GetProperties(ctx, azblob.BlobAccessConditions{}, azblob.ClientProvidedKeyOptions{}) + if err != nil { + return false, BlobError(err) + } + + return props.ContentLength() == 0, ErrNone +} + +// ClearBlob empties a blob's contents by uploading an empty byte slice. +// The operation is retried with exponential backoff until successful or +// the context is canceled. Returns an error code indicating success or +// specific failure reason. +func ClearBlob(ctx context.Context, blobURL azblob.BlockBlobURL) byte { + var errCode byte + retryDelay := InitialRetryDelay + + // Try the operation with unlimited retries + for { + _, err := blobURL.Upload( + ctx, + bytes.NewReader([]byte{}), + azblob.BlobHTTPHeaders{ContentType: "application/octet-stream"}, + azblob.Metadata{}, + azblob.BlobAccessConditions{}, + azblob.DefaultAccessTier, + nil, + azblob.ClientProvidedKeyOptions{}, + azblob.ImmutabilityPolicyOptions{}, + ) + + if err == nil { + // Success, no error + return ErrNone + } + + // Wait before retrying with exponential backoff + retryDelay, errCode = WaitDelay(ctx, retryDelay) + if errCode != ErrNone { + return errCode + } + } +} + +// BlobError maps Azure Blob Storage errors to transport error codes. +// It handles common error cases like container not found, network issues, +// and authentication failures. +func BlobError(err error) byte { + // Quick check for nil + if err == nil { + return ErrNone + } + + // Check for context cancellation + if errors.Is(err, context.Canceled) { + return ErrContextCanceled + } + + // Check for container-related errors (indicating transport is closed) + if storageErr, ok := err.(azblob.StorageError); ok { + serviceCode := storageErr.ServiceCode() + if serviceCode == azblob.ServiceCodeContainerNotFound || + serviceCode == azblob.ServiceCodeContainerBeingDeleted || + serviceCode == azblob.ServiceCodeAccountBeingCreated { + return ErrTransportClosed + } + } + + // All other errors are treated as general transport errors + return ErrTransportError +} + +// WaitDelay implements exponential backoff for retry operations. +// It sleeps for the current delay and returns the next delay duration, +// which is the current delay multiplied by BackoffFactor, capped at +// MaxRetryDelay. Returns an error code if the context is canceled. +func WaitDelay(ctx context.Context, retryDelay time.Duration) (time.Duration, byte) { + select { + case <-ctx.Done(): + return 0, ErrContextCanceled + case <-time.After(retryDelay): + retryDelay = time.Duration(float64(retryDelay) * BackoffFactor) + if retryDelay > MaxRetryDelay { + retryDelay = MaxRetryDelay + } + return retryDelay, ErrNone + } +} diff --git a/pkg/transport/transport.go b/pkg/transport/transport.go new file mode 100644 index 0000000..f8fcbb0 --- /dev/null +++ b/pkg/transport/transport.go @@ -0,0 +1,38 @@ +// Package transport provides interfaces and implementations for communication +// between proxy components. It abstracts the underlying transport mechanism +// and ensures reliable data transfer with proper error handling. +package transport + +import ( + "context" +) + +// Error codes for transport operations. +const ( + ErrNone byte = 0 // Operation completed successfully + ErrContextCanceled byte = 2 // Context was canceled during operation + + // Transport errors (20-29) + ErrTransportClosed byte = 20 // Transport is permanently closed + ErrTransportTimeout byte = 21 // Operation exceeded time limit + ErrTransportError byte = 22 // Generic transport error +) + +// Transport defines an interface for bidirectional packet communication. +// Implementations must ensure reliable delivery and proper error handling. +// All methods are safe for concurrent use. +type Transport interface { + // Send transmits data to the recipient. It blocks until the data is sent + // or the context is canceled. Returns an error code indicating success + // or specific failure reason. + Send(ctx context.Context, data []byte) byte + + // Receive waits for and returns available data. It blocks until data + // is available or the context is canceled. Returns the received data + // and an error code indicating success or failure reason. + Receive(ctx context.Context) ([]byte, byte) + + // IsClosed reports whether the transport is permanently closed. + // The error code parameter helps determine the closure reason. + IsClosed(byte) bool +}