pypproxy 0.1.0__py3-none-any.whl

pypproxy/cert/client_cert.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+import ssl
+import threading
+from dataclasses import dataclass
+
+
+@dataclass
+class ClientCert:
+    name: str
+    cert_path: str
+    key_path: str
+    host_pattern: str = "*"  # glob pattern, "*" means all hosts
+
+    def matches(self, host: str) -> bool:
+        import fnmatch
+
+        return fnmatch.fnmatch(host, self.host_pattern)
+
+    def to_dict(self) -> dict:
+        return {
+            "name": self.name,
+            "cert_path": self.cert_path,
+            "key_path": self.key_path,
+            "host_pattern": self.host_pattern,
+        }
+
+
+class ClientCertManager:
+    def __init__(self) -> None:
+        self._certs: list[ClientCert] = []
+        self._lock = threading.Lock()
+
+    def add(self, cert: ClientCert) -> None:
+        with self._lock:
+            self._certs.append(cert)
+
+    def remove(self, name: str) -> None:
+        with self._lock:
+            self._certs = [c for c in self._certs if c.name != name]
+
+    def list(self) -> list[ClientCert]:
+        with self._lock:
+            return list(self._certs)
+
+    def get_for_host(self, host: str) -> ClientCert | None:
+        with self._lock:
+            for cert in self._certs:
+                if cert.matches(host):
+                    return cert
+        return None
+
+    def ssl_context_for(self, host: str) -> ssl.SSLContext | None:
+        cert = self.get_for_host(host)
+        if cert is None:
+            return None
+        try:
+            ctx = ssl.create_default_context()
+            ctx.load_cert_chain(cert.cert_path, cert.key_path)
+            return ctx
+        except Exception:
+            return None
+
+    def to_list(self) -> list[dict]:
+        return [c.to_dict() for c in self.list()]

pypproxy/codec.py

@@ -0,0 +1,176 @@
+from __future__ import annotations
+
+import gzip
+import json
+import logging
+import struct
+import zlib
+
+logger = logging.getLogger(__name__)
+
+
+# ---- content-encoding decode/encode ----
+
+
+def decode_body(body: bytes, content_encoding: str) -> tuple[bytes, str]:
+    """Decompress body according to Content-Encoding.
+    Returns (decoded_bytes, applied_encoding). Falls back to original on error.
+    """
+    if not body or not content_encoding:
+        return body, ""
+    encoding = content_encoding.lower().strip()
+    try:
+        if encoding == "gzip":
+            return gzip.decompress(body), "gzip"
+        if encoding == "br":
+            import brotli  # type: ignore[import-untyped]
+
+            return brotli.decompress(body), "br"
+        if encoding in ("deflate", "zlib"):
+            try:
+                return zlib.decompress(body), encoding
+            except zlib.error:
+                return zlib.decompress(body, -zlib.MAX_WBITS), encoding
+    except Exception as e:
+        logger.debug("decode_body failed (encoding=%s): %s", encoding, e)
+    return body, ""
+
+
+def encode_body(body: bytes, encoding: str) -> bytes:
+    if not encoding:
+        return body
+    try:
+        if encoding == "gzip":
+            return gzip.compress(body)
+        if encoding == "br":
+            import brotli  # type: ignore[import-untyped]
+
+            return brotli.compress(body)
+        if encoding in ("deflate", "zlib"):
+            return zlib.compress(body)
+    except Exception as e:
+        logger.debug("encode_body failed (encoding=%s): %s", encoding, e)
+    return body
+
+
+# ---- binary protocol decode ----
+
+
+def decode_msgpack(data: bytes) -> str:
+    """Decode MessagePack bytes to a pretty-printed JSON string."""
+    try:
+        import msgpack
+
+        obj = msgpack.unpackb(data, raw=False, strict_map_key=False)
+        return json.dumps(obj, indent=2, ensure_ascii=False, default=str)
+    except Exception as e:
+        return f"<msgpack decode error: {e}>"
+
+
+def decode_cbor(data: bytes) -> str:
+    """Decode CBOR bytes to a pretty-printed JSON string."""
+    try:
+        import cbor2
+
+        obj = cbor2.loads(data)
+        return json.dumps(obj, indent=2, ensure_ascii=False, default=str)
+    except Exception as e:
+        return f"<cbor decode error: {e}>"
+
+
+def decode_protobuf_raw(data: bytes) -> str:
+    """Decode raw protobuf bytes using wire-type heuristics (no schema needed)."""
+    try:
+        return _decode_proto_fields(data, indent=0)
+    except Exception as e:
+        return f"<protobuf decode error: {e}>"
+
+
+def _decode_proto_fields(data: bytes, indent: int) -> str:
+    lines: list[str] = []
+    pos = 0
+    pad = "  " * indent
+    while pos < len(data):
+        if pos >= len(data):
+            break
+        # read varint for tag+wire_type
+        tag_wire, pos = _read_varint(data, pos)
+        if tag_wire is None:
+            break
+        field_num = tag_wire >> 3
+        wire_type = tag_wire & 0x7
+        if wire_type == 0:  # varint
+            val, pos = _read_varint(data, pos)
+            lines.append(f"{pad}field {field_num} (varint): {val}")
+        elif wire_type == 1:  # 64-bit
+            if pos + 8 > len(data):
+                break
+            val = struct.unpack_from("<Q", data, pos)[0]
+            pos += 8
+            lines.append(f"{pad}field {field_num} (64-bit): {val}")
+        elif wire_type == 2:  # length-delimited
+            length, pos = _read_varint(data, pos)
+            if length is None or pos + length > len(data):
+                break
+            payload = data[pos : pos + length]
+            pos += length
+            # try nested message
+            try:
+                nested = _decode_proto_fields(payload, indent + 1)
+                lines.append(f"{pad}field {field_num} (embedded):")
+                lines.append(nested)
+            except Exception:
+                try:
+                    lines.append(f"{pad}field {field_num} (string): {payload.decode()!r}")
+                except Exception:
+                    lines.append(f"{pad}field {field_num} (bytes): {payload.hex()}")
+        elif wire_type == 5:  # 32-bit
+            if pos + 4 > len(data):
+                break
+            val = struct.unpack_from("<I", data, pos)[0]
+            pos += 4
+            lines.append(f"{pad}field {field_num} (32-bit): {val}")
+        else:
+            lines.append(f"{pad}field {field_num} (unknown wire type {wire_type})")
+            break
+    return "\n".join(lines)
+
+
+def _read_varint(data: bytes, pos: int) -> tuple[int | None, int]:
+    result, shift = 0, 0
+    while pos < len(data):
+        b = data[pos]
+        pos += 1
+        result |= (b & 0x7F) << shift
+        shift += 7
+        if not (b & 0x80):
+            return result, pos
+    return None, pos
+
+
+def sniff_content_type(body: bytes, content_type: str) -> str:
+    """Return a hint for how to display the body: json, xml, proto, msgpack, cbor, text, binary."""
+    ct = content_type.lower()
+    if "json" in ct:
+        return "json"
+    if "xml" in ct or "html" in ct:
+        return "xml"
+    if "grpc" in ct or "protobuf" in ct:
+        return "proto"
+    if "msgpack" in ct:
+        return "msgpack"
+    if "cbor" in ct:
+        return "cbor"
+    if not body:
+        return "text"
+    # heuristic: try JSON
+    try:
+        json.loads(body.decode("utf-8", errors="strict"))
+        return "json"
+    except Exception:
+        pass
+    # check binary
+    printable = sum(1 for b in body[:256] if 0x20 <= b < 0x7F or b in (9, 10, 13))
+    if len(body) > 0 and printable / min(len(body), 256) < 0.7:
+        return "binary"
+    return "text"

pypproxy/config/config.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import yaml
+
+
+@dataclass
+class ProxyConfig:
+    addr: str = "0.0.0.0"
+    port: int = 8080
+    ignore: list[str] = field(default_factory=list)
+    max_body: int = 1024 * 1024  # 1MB
+
+
+@dataclass
+class CAConfig:
+    cert_path: str = ""
+    key_path: str = ""
+
+
+@dataclass
+class UIConfig:
+    addr: str = "0.0.0.0"
+    port: int = 8081
+
+
+@dataclass
+class ScriptConfig:
+    path: str = ""
+
+
+@dataclass
+class Config:
+    proxy: ProxyConfig = field(default_factory=ProxyConfig)
+    ca: CAConfig = field(default_factory=CAConfig)
+    ui: UIConfig = field(default_factory=UIConfig)
+    script: ScriptConfig = field(default_factory=ScriptConfig)
+
+    @classmethod
+    def default(cls) -> Config:
+        cfg = cls()
+        home = Path.home()
+        cfg.ca.cert_path = str(home / ".paxy" / "ca-cert.pem")
+        cfg.ca.key_path = str(home / ".paxy" / "ca-key.pem")
+        return cfg
+
+    @classmethod
+    def load(cls, path: str) -> Config:
+        cfg = cls.default()
+        p = Path(path)
+        if not p.exists():
+            return cfg
+        with p.open() as f:
+            data = yaml.safe_load(f) or {}
+
+        if proxy := data.get("proxy"):
+            if "addr" in proxy:
+                cfg.proxy.addr = proxy["addr"]
+            if "port" in proxy:
+                cfg.proxy.port = int(proxy["port"])
+            if "ignore" in proxy:
+                cfg.proxy.ignore = proxy["ignore"]
+            if "max_body" in proxy:
+                cfg.proxy.max_body = int(proxy["max_body"])
+
+        if ca := data.get("ca"):
+            if "cert_path" in ca:
+                cfg.ca.cert_path = str(Path(ca["cert_path"]).resolve())
+            if "key_path" in ca:
+                cfg.ca.key_path = str(Path(ca["key_path"]).resolve())
+
+        if ui := data.get("ui"):
+            if "addr" in ui:
+                cfg.ui.addr = ui["addr"]
+            if "port" in ui:
+                cfg.ui.port = int(ui["port"])
+
+        if (script := data.get("script")) and "path" in script:
+            cfg.script.path = str(Path(script["path"]).resolve())
+
+        return cfg
+
+    def save(self, path: str) -> None:
+        data = {
+            "proxy": {
+                "addr": self.proxy.addr,
+                "port": self.proxy.port,
+                "ignore": self.proxy.ignore,
+                "max_body": self.proxy.max_body,
+            },
+            "ca": {
+                "cert_path": self.ca.cert_path,
+                "key_path": self.ca.key_path,
+            },
+            "ui": {
+                "addr": self.ui.addr,
+                "port": self.ui.port,
+            },
+            "script": {
+                "path": self.script.path,
+            },
+        }
+        with open(path, "w") as f:
+            yaml.dump(data, f, default_flow_style=False)

pypproxy/dns/server.py

@@ -0,0 +1,149 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+import socket
+import struct
+
+logger = logging.getLogger(__name__)
+
+DNS_PORT = 53153  # unprivileged default; use 53 with sudo
+
+
+class DNSServer:
+    """
+    Minimal DNS server that spoofs configured domains to a target IP.
+    All other queries are forwarded to an upstream resolver.
+    """
+
+    def __init__(
+        self,
+        overrides: dict[str, str],
+        upstream: str = "8.8.8.8",
+        port: int = DNS_PORT,
+    ) -> None:
+        self._overrides = {k.lower().rstrip("."): v for k, v in overrides.items()}
+        self._upstream = upstream
+        self._port = port
+        self._transport: asyncio.BaseTransport | None = None
+
+    async def start(self) -> None:
+        loop = asyncio.get_event_loop()
+        self._transport, _ = await loop.create_datagram_endpoint(
+            lambda: _DNSProtocol(self._overrides, self._upstream),
+            local_addr=("0.0.0.0", self._port),
+        )
+        logger.info("DNS server listening on UDP :%d (upstream: %s)", self._port, self._upstream)
+
+    def stop(self) -> None:
+        if self._transport:
+            self._transport.close()
+
+    def set_overrides(self, overrides: dict[str, str]) -> None:
+        self._overrides = {k.lower().rstrip("."): v for k, v in overrides.items()}
+        if self._transport:
+            proto = self._transport.get_protocol()
+            if hasattr(proto, "overrides"):
+                proto.overrides = self._overrides  # type: ignore[attr-defined]
+
+
+class _DNSProtocol(asyncio.DatagramProtocol):
+    def __init__(self, overrides: dict[str, str], upstream: str) -> None:
+        self.overrides = overrides
+        self._upstream = upstream
+        self._transport: asyncio.DatagramTransport | None = None
+
+    def connection_made(self, transport: asyncio.BaseTransport) -> None:
+        self._transport = transport  # type: ignore[assignment]
+
+    def datagram_received(self, data: bytes, addr: tuple) -> None:
+        asyncio.ensure_future(self._handle(data, addr))
+
+    async def _handle(self, data: bytes, addr: tuple) -> None:
+        try:
+            name, qtype = _parse_query(data)
+        except Exception:
+            return
+
+        name_lower = name.lower().rstrip(".")
+        logger.debug("DNS query: %s (type=%d) from %s", name, qtype, addr)
+
+        if qtype == 1 and name_lower in self.overrides:
+            ip = self.overrides[name_lower]
+            logger.info("DNS spoof: %s -> %s", name, ip)
+            reply = _build_reply(data, name, ip)
+            if self._transport:
+                self._transport.sendto(reply, addr)
+            return
+
+        # Forward to upstream
+        try:
+            reply = await _forward(data, self._upstream)
+            if self._transport and reply:
+                self._transport.sendto(reply, addr)
+        except Exception as e:
+            logger.debug("DNS forward error: %s", e)
+
+
+def _parse_query(data: bytes) -> tuple[str, int]:
+    offset = 12  # skip header
+    labels: list[str] = []
+    while offset < len(data):
+        length = data[offset]
+        offset += 1
+        if length == 0:
+            break
+        labels.append(data[offset : offset + length].decode())
+        offset += length
+    qtype = struct.unpack_from(">H", data, offset)[0]
+    return ".".join(labels), qtype
+
+
+def _build_reply(query: bytes, name: str, ip: str) -> bytes:
+    # Header: copy transaction ID, set QR=1, AA=1, QDCOUNT=1, ANCOUNT=1
+    tid = query[:2]
+    flags = b"\x81\x80"
+    counts = b"\x00\x01\x00\x01\x00\x00\x00\x00"
+    header = tid + flags + counts
+
+    # Question section (copy from query, up to and including QTYPE+QCLASS)
+    question_end = 12
+    while question_end < len(query):
+        length = query[question_end]
+        question_end += 1
+        if length == 0:
+            question_end += 4  # QTYPE + QCLASS
+            break
+        question_end += length
+    question = query[12:question_end]
+
+    # Answer: name pointer, A record, TTL=60, RDATA=ip
+    answer = b"\xc0\x0c"  # pointer to question name
+    answer += b"\x00\x01"  # TYPE A
+    answer += b"\x00\x01"  # CLASS IN
+    answer += b"\x00\x00\x00\x3c"  # TTL 60
+    answer += b"\x00\x04"  # RDLENGTH 4
+    answer += socket.inet_aton(ip)
+
+    return header + question + answer
+
+
+async def _forward(data: bytes, upstream: str) -> bytes | None:
+    loop = asyncio.get_event_loop()
+    fut: asyncio.Future[bytes] = loop.create_future()
+
+    class _Forwarder(asyncio.DatagramProtocol):
+        def datagram_received(self, d: bytes, _: tuple) -> None:
+            if not fut.done():
+                fut.set_result(d)
+
+        def error_received(self, exc: Exception) -> None:
+            if not fut.done():
+                fut.set_exception(exc)
+
+    transport, _ = await loop.create_datagram_endpoint(_Forwarder, remote_addr=(upstream, 53))
+    transport.sendto(data)
+    try:
+        return await asyncio.wait_for(fut, timeout=3)
+    finally:
+        transport.close()

pypproxy/exporter/exporter.py

@@ -0,0 +1,122 @@
+from __future__ import annotations
+
+import base64
+import json
+from typing import Any
+
+from pypproxy.rule.rule import RuleManager
+from pypproxy.store.models import Entry
+
+
+def export_entries(entries: list[Entry]) -> str:
+    """Export entries to JSON string."""
+    return json.dumps(
+        [e.to_dict() for e in entries],
+        indent=2,
+        ensure_ascii=False,
+    )
+
+
+def export_rules(rules: RuleManager) -> str:
+    """Export rules to JSON string."""
+    return json.dumps(
+        [r.to_dict() for r in rules.list()],
+        indent=2,
+        ensure_ascii=False,
+    )
+
+
+def export_all(entries: list[Entry], rules: RuleManager) -> str:
+    """Export everything to a single JSON string."""
+    return json.dumps(
+        {
+            "version": 1,
+            "entries": [e.to_dict() for e in entries],
+            "rules": [r.to_dict() for r in rules.list()],
+        },
+        indent=2,
+        ensure_ascii=False,
+    )
+
+
+def import_rules(data: str, rules: RuleManager) -> int:
+    """Import rules from JSON string. Returns count of imported rules."""
+    from pypproxy.rule.rule import Rule
+
+    parsed: list[dict[str, Any]] = json.loads(data)
+    if isinstance(parsed, dict):
+        parsed = parsed.get("rules", [])
+    count = 0
+    for item in parsed:
+        rule = Rule.from_dict(item)
+        rules.add(rule)
+        count += 1
+    return count
+
+
+def export_har(entries: list[Entry]) -> str:
+    """Export entries in HAR (HTTP Archive) format."""
+    har_entries = []
+    for e in entries:
+        req_headers = [{"name": k, "value": ", ".join(v)} for k, v in e.req_headers.items()]
+        resp_headers = [{"name": k, "value": ", ".join(v)} for k, v in e.resp_headers.items()]
+        body_text = ""
+        if e.resp_body:
+            try:
+                body_text = e.resp_body.decode("utf-8", errors="replace")
+            except Exception:
+                body_text = base64.b64encode(e.resp_body).decode()
+
+        url = f"{e.scheme}://{e.host}{e.path}"
+        if e.query:
+            url += f"?{e.query}"
+
+        har_entries.append(
+            {
+                "startedDateTime": e.created_at.isoformat(),
+                "time": e.duration_ms,
+                "request": {
+                    "method": e.method,
+                    "url": url,
+                    "httpVersion": "HTTP/1.1",
+                    "headers": req_headers,
+                    "queryString": [],
+                    "cookies": [],
+                    "headersSize": -1,
+                    "bodySize": len(e.req_body),
+                    "postData": {
+                        "mimeType": e.req_headers.get("content-type", [""])[0],
+                        "text": e.req_body.decode("utf-8", errors="replace") if e.req_body else "",
+                    },
+                },
+                "response": {
+                    "status": e.status_code,
+                    "statusText": "",
+                    "httpVersion": "HTTP/1.1",
+                    "headers": resp_headers,
+                    "cookies": [],
+                    "content": {
+                        "size": len(e.resp_body),
+                        "mimeType": e.resp_headers.get("content-type", [""])[0],
+                        "text": body_text,
+                    },
+                    "redirectURL": "",
+                    "headersSize": -1,
+                    "bodySize": len(e.resp_body),
+                },
+                "cache": {},
+                "timings": {"send": 0, "wait": e.duration_ms, "receive": 0},
+            }
+        )
+
+    return json.dumps(
+        {
+            "log": {
+                "version": "1.2",
+                "creator": {"name": "paxy", "version": "0.1.0"},
+                "entries": har_entries,
+            }
+        },
+        indent=2,
+        ensure_ascii=False,
+    )