mirror of
https://github.com/Li4n0/revsuit.git
synced 2026-09-21 22:30:46 +08:00
feat: complete basic functions
Support http,dns and mysql connection. Support custom http, dns response. Support dns rebinding. Support mysql load local files and jdbc deserialize exploit.
This commit is contained in:
Li4n0
@@ -0,0 +1,5 @@
|
||||
package rhttp
|
||||
|
||||
type Config struct {
|
||||
IpHeader string
|
||||
}
|
||||
@@ -0,0 +1,197 @@
|
||||
package rhttp
|
||||
|
||||
import (
|
||||
"math/rand"
|
||||
"net/http"
|
||||
"net/http/httputil"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/li4n0/revsuit/internal/database"
|
||||
"github.com/li4n0/revsuit/internal/qqwry"
|
||||
log "unknwon.dev/clog/v2"
|
||||
)
|
||||
|
||||
type Server struct {
|
||||
Addr string
|
||||
Token string
|
||||
IpHeader string
|
||||
Router *gin.Engine
|
||||
ApiGroup *gin.RouterGroup
|
||||
rules []*Rule
|
||||
rulesLock sync.RWMutex
|
||||
}
|
||||
|
||||
const (
|
||||
queryVar = `\$\{query\.(.+?)\}`
|
||||
bodyVar = `\$\{body\.(.+?)\}`
|
||||
headerVar = `\$\{header\.(.+?)\}`
|
||||
)
|
||||
|
||||
var (
|
||||
server *Server
|
||||
once sync.Once
|
||||
queryVarMatcher = regexp.MustCompile(queryVar)
|
||||
bodyVarMatcher = regexp.MustCompile(bodyVar)
|
||||
headerVarMatcher = regexp.MustCompile(headerVar)
|
||||
)
|
||||
|
||||
func GetServer() *Server {
|
||||
once.Do(func() {
|
||||
letterBytes := "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
|
||||
randString := func(n int) string {
|
||||
b := make([]byte, n)
|
||||
for i := range b {
|
||||
b[i] = letterBytes[rand.Intn(len(letterBytes))]
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
server = &Server{
|
||||
Addr: ":80",
|
||||
Token: randString(9),
|
||||
rules: make([]*Rule, 0),
|
||||
}
|
||||
})
|
||||
return server
|
||||
}
|
||||
|
||||
func (s *Server) SetAddr(addr string) *Server {
|
||||
s.Addr = addr
|
||||
return s
|
||||
}
|
||||
|
||||
func (s *Server) SetToken(token string) *Server {
|
||||
s.Token = token
|
||||
return s
|
||||
}
|
||||
|
||||
func (s *Server) SetIpHeader(header string) *Server {
|
||||
s.IpHeader = header
|
||||
return s
|
||||
}
|
||||
|
||||
func (s *Server) getRules() []*Rule {
|
||||
defer s.rulesLock.RUnlock()
|
||||
s.rulesLock.RLock()
|
||||
return s.rules
|
||||
}
|
||||
|
||||
func (s *Server) updateRules() error {
|
||||
db := database.DB.Model(new(Rule))
|
||||
s.rulesLock.Lock()
|
||||
db.Order("rank desc").Find(&s.rules)
|
||||
s.rulesLock.Unlock()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *Server) Run() {
|
||||
if err := s.updateRules(); err != nil {
|
||||
log.Error(err.Error())
|
||||
}
|
||||
log.Info("Starting HTTP Server at %s, token:%s", s.Addr, s.Token)
|
||||
err := s.Router.Run(s.Addr)
|
||||
if err != nil {
|
||||
log.Fatal(err.Error())
|
||||
}
|
||||
}
|
||||
|
||||
func getRawRequest(r *http.Request) ([]byte, error) {
|
||||
// to resolve httputil.DumpRequestOut error with "" protocol
|
||||
r.URL.Scheme = "http"
|
||||
r.URL.Host = "revsuit"
|
||||
|
||||
return httputil.DumpRequestOut(r, true)
|
||||
}
|
||||
|
||||
func compileTpl(c *gin.Context, tpl string) (compiled string) {
|
||||
compiled = tpl
|
||||
if queryVarMatcher.FindString(tpl) != "" {
|
||||
compiled = queryVarMatcher.ReplaceAllString(compiled, c.Query(queryVarMatcher.FindStringSubmatch(tpl)[1]))
|
||||
}
|
||||
|
||||
if bodyVarMatcher.FindString(tpl) != "" {
|
||||
compiled = bodyVarMatcher.ReplaceAllString(compiled, c.PostForm(bodyVarMatcher.FindStringSubmatch(tpl)[1]))
|
||||
}
|
||||
|
||||
if headerVarMatcher.FindString(tpl) != "" {
|
||||
compiled = headerVarMatcher.ReplaceAllString(compiled, c.GetHeader(headerVarMatcher.FindStringSubmatch(tpl)[1]))
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
func (s *Server) Receive(c *gin.Context) {
|
||||
u := c.Request.URL.String()
|
||||
for _, _rule := range s.getRules() {
|
||||
flag, flagGroup := _rule.Match(u)
|
||||
if flag == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
var (
|
||||
ip = strings.Split(c.Request.RemoteAddr, ":")[0]
|
||||
area = qqwry.Area(ip)
|
||||
)
|
||||
|
||||
if ip1 := c.Request.Header.Get(s.IpHeader); s.IpHeader != "" && ip1 != "" {
|
||||
ip = ip1
|
||||
delete(c.Request.Header, s.IpHeader)
|
||||
}
|
||||
|
||||
raw, err := getRawRequest(c.Request)
|
||||
if err != nil {
|
||||
log.Warn(err.Error())
|
||||
}
|
||||
|
||||
// create new record
|
||||
r, err := NewRecord(_rule, flag, c.Request.Method, u, ip, area, string(raw))
|
||||
if err != nil {
|
||||
log.Error("HTTP record(rule_id:%d) created failed :%s", _rule.ID, err.Error())
|
||||
code, err := strconv.Atoi(compileTpl(c, _rule.ResponseStatusCode))
|
||||
if err != nil || code < 100 || code > 600 {
|
||||
code = 400
|
||||
}
|
||||
|
||||
c.String(code, compileTpl(c, _rule.ResponseBody))
|
||||
return
|
||||
}
|
||||
log.Trace("HTTP record(id:%d) has been created", r.ID)
|
||||
|
||||
//only send to client when this connection recorded first time.
|
||||
if _rule.PushToClient {
|
||||
if flagGroup != "" {
|
||||
var count int64
|
||||
database.DB.Where("rule_name=? and raw like ?", _rule.Name, "%"+flagGroup+"%").Model(&Record{}).Count(&count)
|
||||
if count <= 1 {
|
||||
r.PushToClient()
|
||||
log.Trace("HTTP record(id:%d) has been put to client message queue", r.ID)
|
||||
}
|
||||
}
|
||||
r.PushToClient()
|
||||
log.Trace("HTTP record(id:%d) has been put to client message queue", r.ID)
|
||||
}
|
||||
|
||||
//send notice
|
||||
if _rule.Notice {
|
||||
go func() {
|
||||
r.Notice()
|
||||
log.Trace("HTTP record(id:%d) notice has been sent", r.ID)
|
||||
}()
|
||||
}
|
||||
|
||||
for header, value := range _rule.ResponseHeaders {
|
||||
c.Header(compileTpl(c, header), compileTpl(c, value))
|
||||
}
|
||||
|
||||
code, err := strconv.Atoi(compileTpl(c, _rule.ResponseStatusCode))
|
||||
if err != nil || code < 100 || code > 600 {
|
||||
code = 400
|
||||
}
|
||||
|
||||
c.String(code, compileTpl(c, _rule.ResponseBody))
|
||||
return
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,106 @@
|
||||
package rhttp
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/li4n0/revsuit/internal/database"
|
||||
"github.com/li4n0/revsuit/internal/notice"
|
||||
"github.com/li4n0/revsuit/internal/record"
|
||||
)
|
||||
|
||||
var _ record.Record = (*Record)(nil)
|
||||
|
||||
type Record struct {
|
||||
Method string `gorm:"index" form:"method" json:"method"`
|
||||
Path string `form:"path" json:"path"`
|
||||
record.BaseRecord
|
||||
RawRequest string `json:"raw_request" notice:"-"`
|
||||
Rule Rule `gorm:"foreignKey:RuleName;references:Name;constraint:OnUpdate:CASCADE,OnDelete:SET NULL;" form:"-" json:"-" notice:"-"`
|
||||
}
|
||||
|
||||
func (Record) TableName() string {
|
||||
return "http_records"
|
||||
}
|
||||
|
||||
func (r Record) Notice() {
|
||||
notice.Notice(r)
|
||||
}
|
||||
|
||||
func NewRecord(rule *Rule, flag, method, url, ip, area, raw string) (r *Record, err error) {
|
||||
r = &Record{
|
||||
BaseRecord: record.BaseRecord{
|
||||
Flag: flag,
|
||||
RemoteIP: ip,
|
||||
IpArea: area,
|
||||
RequestTime: time.Now(),
|
||||
},
|
||||
Method: method,
|
||||
Path: url,
|
||||
RawRequest: raw,
|
||||
Rule: *rule,
|
||||
}
|
||||
err = database.DB.Create(r).Error
|
||||
return
|
||||
}
|
||||
|
||||
func ListRecords(c *gin.Context) {
|
||||
var (
|
||||
httpRecord Record
|
||||
res []Record
|
||||
count int64
|
||||
order = c.Query("order")
|
||||
)
|
||||
|
||||
if err := c.ShouldBind(&httpRecord); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err,
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
db := database.DB.Model(&httpRecord)
|
||||
if httpRecord.Flag != "" {
|
||||
db.Where("flag = ?", httpRecord.Flag)
|
||||
}
|
||||
if httpRecord.Method != "" {
|
||||
db.Where("method = ?", httpRecord.Method)
|
||||
}
|
||||
if httpRecord.Path != "" {
|
||||
db.Where("path like ?", "%"+httpRecord.Path+"%")
|
||||
}
|
||||
if httpRecord.RemoteIP != "" {
|
||||
db.Where("remote_ip = ?", httpRecord.RemoteIP)
|
||||
}
|
||||
if httpRecord.RuleName != "" {
|
||||
db.Where("rule_name = ?", httpRecord.RuleName)
|
||||
}
|
||||
|
||||
page, err := strconv.Atoi(c.Query("page"))
|
||||
if err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if err := db.Order("id" + " " + order).Count(&count).Offset((page - 1) * 10).Limit(10).Find(&res).Error; err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"result": gin.H{"count": count, "data": res},
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,199 @@
|
||||
package rhttp
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/li4n0/revsuit/internal/database"
|
||||
"github.com/li4n0/revsuit/internal/rule"
|
||||
"gorm.io/gorm/clause"
|
||||
log "unknwon.dev/clog/v2"
|
||||
)
|
||||
|
||||
// Http rule struct
|
||||
type Rule struct {
|
||||
rule.BaseRule
|
||||
ResponseStatusCode string `gorm:"index;default:200;not null" form:"response_status_code" json:"response_status_code"`
|
||||
ResponseHeaders database.MapField `form:"response_headers" json:"response_headers"`
|
||||
ResponseBody string `gorm:"default:Hello RevSuit!" form:"response_body" json:"response_body"`
|
||||
}
|
||||
|
||||
func (Rule) TableName() string {
|
||||
return "http_rules"
|
||||
}
|
||||
|
||||
// New http rule struct
|
||||
func NewRule(name, flagFormat, responseBody string, pushToClient, notice bool, responseStatus string, responseHeaders database.MapField, ) *Rule {
|
||||
return &Rule{
|
||||
BaseRule: rule.BaseRule{
|
||||
Name: name,
|
||||
FlagFormat: flagFormat,
|
||||
PushToClient: pushToClient,
|
||||
Notice: notice,
|
||||
},
|
||||
ResponseStatusCode: responseStatus,
|
||||
ResponseHeaders: responseHeaders,
|
||||
ResponseBody: responseBody,
|
||||
}
|
||||
}
|
||||
|
||||
// Create or update the http rule in database and ruleSet
|
||||
func (r *Rule) CreateOrUpdate() (err error) {
|
||||
db := database.DB.Model(r)
|
||||
err = db.Clauses(clause.OnConflict{
|
||||
Columns: []clause.Column{{Name: "id"}},
|
||||
DoUpdates: clause.AssignmentColumns(
|
||||
[]string{
|
||||
"name",
|
||||
"flag_format",
|
||||
"rank",
|
||||
"response_status_code",
|
||||
"response_headers",
|
||||
"response_body",
|
||||
"push_to_client",
|
||||
"notice",
|
||||
}),
|
||||
}).Create(r).Error
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
err = GetServer().updateRules()
|
||||
return
|
||||
}
|
||||
|
||||
// Delete the http rule in database and ruleSet
|
||||
func (r *Rule) Delete() (err error) {
|
||||
db := database.DB.Model(r)
|
||||
err = db.Delete(r).Error
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
err = GetServer().updateRules()
|
||||
return
|
||||
}
|
||||
|
||||
// List all http rules those satisfy the filter
|
||||
func ListRules(c *gin.Context) {
|
||||
var (
|
||||
httpRule Rule
|
||||
res []Rule
|
||||
count int64
|
||||
order = c.Query("order")
|
||||
)
|
||||
|
||||
if err := c.ShouldBind(&httpRule); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err,
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
db := database.DB.Model(&httpRule)
|
||||
if httpRule.Name != "" {
|
||||
db.Where("name = ?", httpRule.Name)
|
||||
}
|
||||
db.Count(&count)
|
||||
|
||||
page, err := strconv.Atoi(c.Query("page"))
|
||||
if err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if err := db.Order("rank desc").Order("id" + " " + order).Count(&count).Offset((page - 1) * 10).Limit(10).Find(&res).Error; err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"result": gin.H{"count": count, "data": res},
|
||||
})
|
||||
}
|
||||
|
||||
// Create or update http rule from user submit
|
||||
func UpsertRules(c *gin.Context) {
|
||||
var (
|
||||
httpRule Rule
|
||||
update bool
|
||||
)
|
||||
|
||||
if err := c.ShouldBind(&httpRule); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if httpRule.ID != 0 {
|
||||
update = true
|
||||
}
|
||||
|
||||
if err := httpRule.CreateOrUpdate(); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if update {
|
||||
log.Trace("HTTP rule(id:%d) has been updated", httpRule.ID)
|
||||
} else {
|
||||
log.Trace("HTTP rule(id:%d) has been created", httpRule.ID)
|
||||
}
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"result": nil,
|
||||
})
|
||||
}
|
||||
|
||||
// Delete http rule from user submit
|
||||
func DeleteRules(c *gin.Context) {
|
||||
var httpRule Rule
|
||||
|
||||
if err := c.ShouldBind(&httpRule); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if err := httpRule.Delete(); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
log.Trace("HTTP rule(id:%d) has been deleted", httpRule.ID)
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
Reference in New Issue
Block a user