Initial commit

Author: Nigel Sotelo

.dockerignore

@@ -0,0 +1,3 @@
+./Makefile
+./bin
+./python-client

.gitignore

@@ -0,0 +1,5 @@
+*.egg-info
+.venv
+__pycache__
+bin
+ninja-proxy

Dockerfile

@@ -0,0 +1,56 @@
+############################
+# STEP 1 build executable binary
+############################
+# golang alpine 1.15.1
+FROM golang@sha256:bc6f2b94340ed84ec22dab364505b0d1a339ecff99b583a63372ecf966129be2 as builder
+
+# Install git + SSL ca certificates.
+# Git is required for fetching the dependencies.
+# Ca-certificates is required to call HTTPS endpoints.
+RUN apk update && apk add --no-cache git ca-certificates tzdata && update-ca-certificates
+
+# Create appuser
+ENV USER=appuser
+ENV UID=10001
+
+# See https://stackoverflow.com/a/55757473/12429735
+RUN adduser \
+    --disabled-password \
+    --gecos "" \
+    --home "/nonexistent" \
+    --shell "/sbin/nologin" \
+    --no-create-home \
+    --uid "${UID}" \
+    "${USER}"
+WORKDIR $GOPATH/src/mypackage/myapp/
+COPY server-src/ .
+
+# Fetch dependencies.
+RUN go get -d -v
+
+# Build the binary
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
+      -ldflags='-w -s -extldflags "-static"' -a \
+      -o /go/bin/ninja-proxy .
+
+############################
+# STEP 2 build a small image
+############################
+FROM scratch
+
+# Import from builder.
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/group /etc/group
+
+# Copy our static executable
+COPY --from=builder /go/bin/ninja-proxy /go/bin/ninja-proxy
+
+# Use an unprivileged user.
+USER appuser:appuser
+
+EXPOSE 7777
+
+# Run the binary.
+ENTRYPOINT ["/go/bin/ninja-proxy"]

Makefile

@@ -0,0 +1,15 @@
+.DEFAULT_GOAL := help
+SHELL := /bin/bash
+
+.PHONY: help
+help: ## Print documentation
+	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+
+.PHONY: binary
+binary: ## Build the go binary
+	mkdir -p bin
+	cd server-src && go build -o ../bin/ninja-proxy
+
+.PHONY: docker
+docker: ## Build the docker image
+	docker build -t "ninja-proxy:latest" .

README.md

@@ -0,0 +1,76 @@
+# Ninja proxy
+<p align="center">
+  <img alt="ninja cat image" src="https://i.ibb.co/S54DPbc/ninja.png" />
+</p>
+
+## Generate temporary URLs with a stateless service
+This project grew out of the need to share authenticated proxies with third-party services, so that they can all operate with the same IP. Several proxy-providers provide mechanisms for this, but they usually require sending your username and password to the third-party and this can be very risky. Ideally you want some temporary URL that opaquely routes the traffic from the third-party to your proxy provider, and that is exactly what this project provides.
+
+### Quick start
+Clone this repo and build the project. Assuming that golang is installed, you build the server using
+
+`make binary`
+
+that will put it into `./bin/ninja-proxy`.
+
+You can install the helper utilities by running
+
+```bash
+source activate.sh
+```
+
+and load a key into your terminal with
+
+```bash
+KEY=$(ninja-key)
+```
+
+Now you can run the service (in the background) using
+
+```bash
+bin/ninja-proxy -key $KEY &
+```
+which by default will run on 0.0.0.0:7777.
+
+To generate a link for the service call
+
+```bash
+link=$(ninja-link 120 $KEY http://username:[email protected]:80 --headers test-header=foo another=bar)
+```
+
+```bash
+$ curl $link/headers
+{
+  "headers": {
+    "Accept": "*/*",
+    "Another": "bar",
+    "Authorization": "Basic dXNlcm5hbWU6cGFzc3dvcmQ=",
+    "Host": "httpbin.org",
+    "Test-Header": "foo",
+    "User-Agent": "curl/7.72.0",
+    "X-Amzn-Trace-Id": "Root=1-5f56788f-d9513fb01690f9080adeb528"
+  }
+}
+```
+Notice how the username and password are automatically added to the `Authorization` header, you can do the same thing with a proxy URL and it will just work.
+
+The generated link contains a username and header field with all of this information encrypted so that it can't be read. It looks quite messy, but it works.
+
+#### Proxies
+There's not very much else to say, use exactly the same procedure as above to wrap  your proxy URL and use it as normal
+
+```bash
+proxy_link=$(ninja-link 120 $KEY "http://$PROXY_USER:$PROXY_PASS@$PROXY_HOST:$PROXY_PORT")
+curl -x $proxy_link -k http://httpbin.org/ip
+```
+
+### Docker image
+A dockerfile has been included with this repository and can be built using `make docker`. Then you can run this using
+
+```
+NINJA_PORT=7777
+docker run --rm -d -p $NINJA_PORT:7777 ninja-proxy
+```
+
+### Limitations
+This is a young project created for a specific problem at hand. You can use this to proxy both HTTP and HTTPS connections, but right now it only supports HTTP proxies or URLs using HTTP/1.x.

activate.sh

@@ -0,0 +1,8 @@
+#! /usr/bin/env bash
+
+python3 -m venv .venv
+source .venv/bin/activate
+pip install ./utilities/
+
+echo -e "Run \e[32m\e[1mninja-key\e[0m to get a new key."
+echo -e "Run \e[32m\e[1mninja-link\e[0m to generate a temporary link (use -h for more information)"

server-src/encryption.go

@@ -0,0 +1,42 @@
+package main
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	b64 "encoding/base64"
+	"encoding/json"
+	"net/url"
+	"strings"
+	"time"
+)
+
+func decrypt(key []byte, nonceString, encryptedString string) (url url.URL, expiry time.Time, headers map[string]string) {
+	nonce, _ := b64.URLEncoding.DecodeString(nonceString)
+	ciphertext, _ := b64.URLEncoding.DecodeString(encryptedString)
+
+	//Create a new Cipher Block from the key
+	block, err := aes.NewCipher(key)
+	checkError(err)
+
+	//Create a new GCM
+	aesGCM, err := cipher.NewGCMWithNonceSize(block, len(nonce))
+	checkError(err)
+
+	//Decrypt the data
+	plaintext, err := aesGCM.Open(nil, nonce, ciphertext, nil)
+	checkError(err)
+
+	//Parse the URL and expiry
+	payload := strings.Split(string(plaintext), ";")
+	layout := "2006-01-02T15:04:05.000000"
+	t, err := time.Parse(layout, payload[1])
+	checkError(err)
+
+	var headerJson map[string]string
+	json.Unmarshal([]byte(payload[2]), &headerJson)
+
+	u, err := url.Parse(payload[0])
+	checkError(err)
+
+	return *u, t, headerJson
+}

server-src/errors.go

@@ -0,0 +1,25 @@
+package main
+
+import "log"
+
+func checkError(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
+
+func checkKey(key []byte) {
+	for _, size := range []int{16, 24, 32} {
+		if len(key) == size {
+			return
+		}
+	}
+	log.Fatal("The encryption key has to be 16, 24 or 32 characters in length.")
+}
+
+func trapError() {
+	r := recover()
+	if r != nil {
+		log.Printf("Warning: %s", r)
+	}
+}