spellshift
diff --git a/‎.github/workflows/e2e-portals.yml‎
Lines changed: 160 additions & 0 deletions b/‎.github/workflows/e2e-portals.yml‎
Lines changed: 160 additions & 0 deletions
diff --git a/‎.github/workflows/e2e-repl-test.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/e2e-repl-test.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎bin/socks5/auth.go‎
Lines changed: 65 additions & 0 deletions b/‎bin/socks5/auth.go‎
Lines changed: 65 additions & 0 deletions
diff --git a/‎bin/socks5/connect.go‎
Lines changed: 40 additions & 0 deletions b/‎bin/socks5/connect.go‎
Lines changed: 40 additions & 0 deletions
diff --git a/‎bin/socks5/main.go‎
Lines changed: 61 additions & 0 deletions b/‎bin/socks5/main.go‎
Lines changed: 61 additions & 0 deletions
@@ -0,0 +1,160 @@
+name: E2E Portals Test 🌀
+
+on:
+  workflow_dispatch: ~
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  e2e_portals_test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+    - uses: actions/checkout@v4
+    - name: ⚡ Setup Golang
+      uses: actions/setup-go@v5
+      with:
+        go-version-file: go.mod
+        cache: true
+
+    - name: Setup Rust
+      uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: 'stable'
+        default: true
+        profile: minimal
+        components: rustfmt, clippy
+
+    - name: ⚡ Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+        cache: 'npm'
+        cache-dependency-path: tests/e2e/package-lock.json
+
+    - name: 📦 Install System Dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y protobuf-compiler libssl-dev jq
+
+    - name: 🔨 Build Tavern & Socks5
+      run: |
+        go mod download
+        go build -v -o tavern_bin ./tavern
+        go build -v -o socks5_bin ./bin/socks5
+
+    - name: 🚀 Run Tavern
+      env:
+        HTTP_LISTEN_ADDR: ":8000"
+      run: |
+        ./tavern_bin > tavern.log 2>&1 &
+        echo "Waiting for Tavern to start..."
+        # Wait for port 8000
+        timeout 30 sh -c 'until nc -z $0 $1; do sleep 1; done' localhost 8000
+
+    - name: 🤖 Build & Run Agent
+      working-directory: implants/imixv2
+      env:
+        IMIX_CALLBACK_URI: "http://localhost:8000"
+        IMIX_CALLBACK_INTERVAL: 1
+      run: |
+        # Fetch the pubkey and verify it's not empty
+        PUBKEY=$(curl -s http://localhost:8000/status | jq -r .Pubkey)
+        if [ -z "$PUBKEY" ] || [ "$PUBKEY" == "null" ]; then
+          echo "Error: Could not fetch Pubkey from Tavern"
+          exit 1
+        fi
+        export IMIX_SERVER_PUBKEY=$PUBKEY
+        echo "Got pubkey: $IMIX_SERVER_PUBKEY"
+
+        echo "Building imixv2..."
+        cargo build --bin imixv2 --target-dir ./build
+        # Run agent and pipe logs to a file
+        ./build/debug/imixv2 > agent.log 2>&1 &
+
+        # Give the agent a moment to perform the initial handshake
+        echo "Agent started. Waiting for initial callback..."
+        sleep 5
+
+    - name: 🎭 Install Playwright
+      working-directory: tests/e2e
+      run: |
+        npm ci
+        npx playwright install --with-deps chromium
+
+    - name: 🧪 Run Portal Provisioning Test
+      working-directory: tests/e2e
+      run: |
+        npx playwright test tests/portal.spec.ts
+
+    - name: 🔍 Retrieve Portal ID
+      id: get_portal_id
+      run: |
+        QUERY='query { portals { edges { node { id } } } }'
+        # Send GraphQL query to Tavern
+        RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" \
+          -d "{\"query\": \"$QUERY\"}" http://localhost:8000/graphql)
+
+        echo "GraphQL Response: $RESPONSE"
+
+        PORTAL_ID=$(echo $RESPONSE | jq -r '.data.portals.edges[0].node.id')
+
+        if [ -z "$PORTAL_ID" ] || [ "$PORTAL_ID" == "null" ]; then
+          echo "Error: Could not retrieve Portal ID"
+          exit 1
+        fi
+
+        echo "PORTAL_ID=$PORTAL_ID" >> $GITHUB_ENV
+        echo "Retrieved Portal ID: $PORTAL_ID"
+
+    - name: 🌐 Start Socks5 Proxy
+      env:
+        TAVERN_API_TOKEN: ${{ secrets.TEST_TAVERN_API_TOKEN }}
+      run: |
+        ./socks5_bin -portal $PORTAL_ID -listen 127.0.0.1:1080 -upstream 127.0.0.1:8000 &
+        echo "Socks5 Proxy started on port 1080"
+        # Wait for port 1080
+        timeout 30 sh -c 'until nc -z $0 $1; do sleep 1; done' localhost 1080
+
+    - name: 📄 Prepare Mock Data & Server
+      run: |
+        # Generate 1MB random file
+        dd if=/dev/urandom of=test_data.bin bs=1M count=1
+        sha256sum test_data.bin > original_checksum.txt
+        echo "Original Checksum:"
+        cat original_checksum.txt
+
+        # Start Python HTTP Server on port 9000
+        python3 -m http.server 9000 &
+        echo "HTTP Server started on port 9000"
+        sleep 2
+
+    - name: 🔄 Transfer & Verification
+      run: |
+        # Download through proxy
+        curl -v -x socks5://127.0.0.1:1080 -o downloaded_data.bin http://127.0.0.1:9000/test_data.bin
+
+        sha256sum downloaded_data.bin > downloaded_checksum.txt
+        echo "Downloaded Checksum:"
+        cat downloaded_checksum.txt
+
+        # Compare hashes
+        ORIGINAL=$(awk '{print $1}' original_checksum.txt)
+        DOWNLOADED=$(awk '{print $1}' downloaded_checksum.txt)
+
+        if [ "$ORIGINAL" != "$DOWNLOADED" ]; then
+          echo "Error: Checksums do not match!"
+          exit 1
+        fi
+        echo "Success: Data integrity verified."
+
+    - name: 📂 Upload Service Logs
+      if: always()
+      uses: actions/upload-artifact@v4
+      with:
+        name: e2e-portal-logs
+        path: |
+          tavern.log
+          implants/imixv2/agent.log
@@ -82,7 +82,7 @@ jobs:
     - name: 🧪 Run E2E Tests
       working-directory: tests/e2e
       run: |
-        npx playwright test
+        npx playwright test tests/repl.spec.ts
     - name: 📂 Upload Service Logs
       if: always() # Runs even if tests fail
       uses: actions/upload-artifact@v4
 
@@ -0,0 +1,65 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+
+	"google.golang.org/grpc/metadata"
+	"realm.pub/tavern/cli/auth"
+)
+
+// EnvAPIToken is the name of the environment variable to optionally provide an API token
+const EnvAPIToken = "TAVERN_API_TOKEN"
+
+func getAuthToken(ctx context.Context, tavernURL, cachePath string) (auth.Token, error) {
+	if token := os.Getenv(EnvAPIToken); token != "" {
+		return auth.Token(token), nil
+	}
+
+	tokenData, err := os.ReadFile(cachePath)
+	if os.IsNotExist(err) {
+		token, err := auth.Authenticate(
+			ctx,
+			auth.BrowserFunc(
+				func(url string) error {
+					fmt.Printf("\n\nTavern Authentication URL: %s\n\n", url)
+					return nil
+				},
+			),
+			tavernURL,
+		)
+		if err != nil {
+			return auth.Token(""), err
+		}
+
+		if err := os.WriteFile(cachePath, []byte(token), 0640); err != nil {
+			log.Printf("[WARN] Failed to save token to credential cache (%q): %v", cachePath, err)
+		}
+		return token, nil
+	}
+	if err != nil {
+		return auth.Token(""), fmt.Errorf("failed to read credential cache (%q): %v", cachePath, err)
+	}
+
+	log.Printf("Loaded authentication credentials from %q", cachePath)
+	return auth.Token(tokenData), nil
+}
+
+func authGRPCContext(ctx context.Context, upstream string, authCachePath string) context.Context {
+	// Default to http if no scheme provided
+	if !strings.HasPrefix(upstream, "http://") && !strings.HasPrefix(upstream, "https://") {
+		upstream = fmt.Sprintf("http://%s", upstream)
+	}
+
+	token, err := getAuthToken(ctx, upstream, authCachePath)
+	if err != nil {
+		log.Fatalf("authentication failed: %v", err)
+	}
+
+	return metadata.AppendToOutgoingContext(ctx,
+		auth.HeaderAPIAccessToken, string(token),
+	)
+}
@@ -0,0 +1,40 @@
+package main
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func connect(upstream string) (*grpc.ClientConn, error) {
+	// Default to http if no scheme set
+	if !strings.HasPrefix(upstream, "https://") && !strings.HasPrefix(upstream, "http://") {
+		upstream = fmt.Sprintf("http://%s", upstream)
+	}
+
+	// Parse host:port to determine if TLS should be used
+	url, err := url.Parse(upstream)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse upstream address: %v", err)
+	}
+
+	// Default to TLS on 443
+	tc := credentials.NewTLS(&tls.Config{})
+
+	// If scheme is http or unset, use insecure credentials and default to port 80
+	if url.Scheme == "http" || url.Scheme == "" {
+		tc = insecure.NewCredentials()
+	}
+
+	conn, err := grpc.NewClient(url.Host, grpc.WithTransportCredentials(tc), grpc.WithWriteBufferSize(maxBuffSize), grpc.WithReadBufferSize(maxBuffSize))
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect to upstream: %w", err)
+	}
+
+	return conn, nil
+}
@@ -0,0 +1,61 @@
+package main
+
+import (
+	"flag"
+	"log"
+	"os"
+
+	"realm.pub/tavern/portals/portalpb"
+)
+
+const (
+	authCachePath = ".tavern-auth"
+)
+
+func main() {
+	if len(os.Args) > 1 && os.Args[1] == "trace" {
+		traceCommand(os.Args[2:])
+		return
+	}
+
+	proxyCommand()
+}
+
+func proxyCommand() {
+	// Re-parse flags for proxy command since flag.Parse() uses os.Args by default
+	// and we might have skipped "trace".
+	// But since we checked os.Args[1] manually, standard flag.Parse() will fail if we don't adjust os.Args
+	// or create a new FlagSet.
+	// Since the original code used the default flag set, let's stick to that but we need to ensure
+	// trace command doesn't interfere.
+
+	// Actually, best to just use a custom FlagSet for proxy too, or reset os.Args?
+	// The original code used global flags.
+
+	// Let's manually define the proxy flags again using a FlagSet to avoid conflict with `trace` flags if we were to define them globally.
+	fs := flag.NewFlagSet("proxy", flag.ExitOnError)
+	portalID := fs.Int64("portal", 0, "Portal ID")
+	listenAddr := fs.String("listen", "127.0.0.1:1080", "SOCKS5 Listen Address")
+	upstreamAddr := fs.String("upstream", "127.0.0.1:8000", "Upstream gRPC Address")
+
+	// Parse remaining args
+	// If main was called without subcommands, os.Args is [prog, flags...]
+	// If called with `trace`, we handled it.
+	// So just parse os.Args[1:]
+	fs.Parse(os.Args[1:])
+
+	if *portalID == 0 {
+		log.Fatal("portal is required")
+	}
+
+	p := &Proxy{
+		portalID:     *portalID,
+		listenAddr:   *listenAddr,
+		upstreamAddr: *upstreamAddr,
+		streams:      make(map[string]chan *portalpb.Mote),
+	}
+
+	if err := p.Run(); err != nil {
+		log.Fatalf("Proxy failed: %v", err)
+	}
+}