CitrixPot: NetScaler / Citrix ADC Gateway honeypot (initial public release)

test_ingress_proxy.py

@@ -0,0 +1,50 @@
+"""Loopback-only PROXY metadata and binary stream regression."""
+import asyncio
+from ingress_proxy import forward
+
+
+async def test():
+    received = []
+    async def backend(reader, writer):
+        received.append(await reader.readline())
+        payload = await reader.readexactly(5)
+        writer.write(payload[::-1])
+        await writer.drain()
+        writer.close()
+    backend_server = await asyncio.start_server(backend, '127.0.0.1', 0)
+    async def ingress(reader, writer):
+        await forward(reader, writer, '127.0.0.1', backend_server.sockets[0].getsockname()[1])
+    proxy = await asyncio.start_server(ingress, '127.0.0.1', 0)
+    reader, writer = await asyncio.open_connection('127.0.0.1', proxy.sockets[0].getsockname()[1])
+    source_port = writer.get_extra_info('sockname')[1]
+    writer.write(b'\x00\xffabc')
+    await writer.drain()
+    writer.write_eof()
+    assert await reader.read() == b'cba\xff\x00'
+    assert received == [f'PROXY TCP4 127.0.0.1 127.0.0.1 {source_port} {proxy.sockets[0].getsockname()[1]}\r\n'.encode()]
+    writer.close()
+    proxy.close()
+    backend_server.close()
+    await proxy.wait_closed()
+    await backend_server.wait_closed()
+
+
+asyncio.run(test())
+print('ingress proxy regression passed')
+
+import socket
+from trusted_proxy import source
+left, right = socket.socketpair()
+try:
+    right.sendall(b'PROXY TCP4 192.0.2.10 192.0.2.20 12345 8443\r\nTLS')
+    peer, header = source(left, ('10.0.2.2', 123), '10.0.2.2')
+    assert peer == ('192.0.2.10', 12345) and left.recv(3) == b'TLS'
+    try:
+        source(left, ('192.0.2.99', 123), '10.0.2.2')
+        raise AssertionError('untrusted peer accepted')
+    except ValueError:
+        pass
+finally:
+    left.close()
+    right.close()
+print('trusted PROXY parser regression passed')