proxytcp.py

#!/usr/bin/env python3
"""
TCP Intercept Proxy with Flask Web GUI (dark theme)

Highlights:
- Intercept toggle: ON intercepts client->server messages for editing in hex/ASCII; OFF logs and forwards.
- History logs after send; CONNECT events logged. Modified rows highlighted.
- Preview shows at least 30 chars (ASCII if printable, newline preserved; otherwise hex).
- Message detail: ASCII respects newlines; hex/ASCII boxes have max height with vertical scrollbars.
- Intercept editor: dual cursors in hex and ASCII panes with real-time bidirectional sync.
- TLS on both sides:
  - Proxy acts as a TLS server for incoming clients using self-signed certs generated dynamically in the startup directory if missing.
  - Proxy acts as a TLS client to the upstream server.
  - Renegotiation is explicitly disabled on both contexts to avoid "This TLS version forbids renegotiation".
  - Traffic is decrypted inside the proxy and shown in cleartext in the GUI.

CLI:
  python proxytcp.py [--tls] <listen_host:listen_port> <remote_host:remote_port> [--gui-host 127.0.0.1] [--gui-port 5000]
"""

import argparse
import binascii
import datetime
import socket
import ssl
import threading
import queue
import select
import uuid
import os
import subprocess
from dataclasses import dataclass, field
from typing import Optional, Tuple, List, Dict

from flask import Flask, request, render_template_string, jsonify

# ---------------------------
# Data models and utilities
# ---------------------------

@dataclass
class MessageRecord:
    id: str
    timestamp: datetime.datetime
    src_ip: str
    src_port: int
    dst_ip: str
    dst_port: int
    length: int
    direction: str  # "client->server" or "server->client"
    flags: str      # "CONNECT", "DATA", "DATA (sent)"
    preview: str    # icon + content: ASCII with 📄 if any printable present, else hex with 🔢
    raw_original: bytes = field(default_factory=bytes)   # original payload (for intercepted client->server)
    raw_modified: Optional[bytes] = None                 # modified payload if any

    @property
    def modified(self) -> bool:
        return self.raw_modified is not None and self.raw_modified != self.raw_original


@dataclass
class InterceptItem:
    id: str
    conn_id: str
    direction: str            # "client->server"
    src_ip: str
    src_port: int
    dst_ip: str
    dst_port: int
    payload: bytes
    created_at: datetime.datetime


def now() -> datetime.datetime:
    return datetime.datetime.now()


def preview_with_icon(data: bytes, head_len: int = 30) -> str:
    """
    Preview with icon:
    - If any printable bytes exist in the first 'head_len' bytes, show ASCII with 📄:
      printable bytes as characters, newline preserved, non-printables as '.'
    - Otherwise hex with 🔢
    """
    head = data[:head_len]
    if not head:
        return "📄 "
    ascii_chars = []
    has_printable = False
    for b in head:
        if 32 <= b < 127:
            ascii_chars.append(chr(b)); has_printable = True
        elif b == 10:  # newline
            ascii_chars.append('\n'); has_printable = True
        else:
            ascii_chars.append('.')
    if has_printable:
        return "📄 " + ''.join(ascii_chars)
    return "🔢 " + binascii.hexlify(head).upper().decode()


def bytes_to_hex_ascii(data: bytes, width: int = 16) -> Tuple[str, str, str]:
    """Return hex dump, ASCII (respecting newline), and preview."""
    lines_hex = []
    lines_ascii = []
    for i in range(0, len(data), width):
        chunk = data[i:i+width]
        hex_part = ' '.join(f'{b:02X}' for b in chunk)
        ascii_part = ''.join(chr(b) if (32 <= b < 127) or b == 10 else '.' for b in chunk)
        lines_hex.append(hex_part)
        lines_ascii.append(ascii_part)
    preview = preview_with_icon(data)
    return '\n'.join(lines_hex), '\n'.join(lines_ascii), preview


def hex_str_to_bytes(s: str) -> bytes:
    """Convert a hex string (spaces/newlines allowed) to bytes."""
    cleaned = ''.join(c for c in s if c in '0123456789abcdefABCDEF')
    if len(cleaned) % 2 != 0:
        raise ValueError("Hex input length must be even.")
    return binascii.unhexlify(cleaned)


def diff_hex_ascii(original: bytes, modified: bytes, width: int = 16) -> Tuple[str, str, str, str]:
    """
    HTML-safe hex and ASCII dumps for original and modified, highlighting changes in red.
    Returns (hex_original_html, hex_modified_html, ascii_original_html, ascii_modified_html).
    """
    o_hex, _, _ = bytes_to_hex_ascii(original, width)
    m_hex, _, _ = bytes_to_hex_ascii(modified, width)
    o_hex_list = o_hex.split()
    m_hex_list = m_hex.split()
    max_len = max(len(o_hex_list), len(m_hex_list))
    o_hex_list += ['..'] * (max_len - len(o_hex_list))
    m_hex_list += ['..'] * (max_len - len(m_hex_list))

    o_hex_spans = []
    m_hex_spans = []
    for i in range(max_len):
        oh = o_hex_list[i]; mh = m_hex_list[i]
        changed = (oh != mh)
        o_hex_spans.append(f'<span class="{("red" if changed else "")}">{oh}</span>')
        m_hex_spans.append(f'<span class="{("red" if changed else "")}">{mh}</span>')

    max_ascii = max(len(original), len(modified))
    o_ascii_spans = []
    m_ascii_spans = []
    for i in range(max_ascii):
        oc = original[i] if i < len(original) else None
        mc = modified[i] if i < len(modified) else None
        o_char = chr(oc) if (oc is not None and ((32 <= oc < 127) or oc == 10)) else ('.' if oc is not None else ' ')
        m_char = chr(mc) if (mc is not None and ((32 <= mc < 127) or mc == 10)) else ('.' if mc is not None else ' ')
        changed = (oc != mc)
        o_ascii_spans.append(f'<span class="{("red" if changed else "")}">{o_char}</span>')
        m_ascii_spans.append(f'<span class="{("red" if changed else "")}">{m_char}</span>')

    def group_hex(spans: List[str], w: int) -> str:
        return '\n'.join([' '.join(spans[i:i+w]) for i in range(0, len(spans), w)])

    def group_ascii(spans: List[str], w: int) -> str:
        return '\n'.join([''.join(spans[i:i+w]) for i in range(0, len(spans), w)])

    return group_hex(o_hex_spans, width), group_hex(m_hex_spans, width), group_ascii(o_ascii_spans, width), group_ascii(m_ascii_spans, width)


# ---------------------------
# Cert generation (Linux) and TLS helpers
# ---------------------------

CERT_FILE = "cert.pem"
KEY_FILE = "key.pem"

def ensure_self_signed_cert() -> Tuple[str, str]:
    """
    Ensure a self-signed RSA cert/key pair exists in the startup directory.
    On Linux, uses 'openssl' CLI to generate if missing.
    """
    cert_exists = os.path.isfile(CERT_FILE)
    key_exists = os.path.isfile(KEY_FILE)
    if cert_exists and key_exists:
        return CERT_FILE, KEY_FILE

    print("[*] Generating self-signed TLS certificate (RSA 2048) in current directory...")
    cmd = [
        "openssl", "req",
        "-x509", "-newkey", "rsa:2048",
        "-nodes",
        "-keyout", KEY_FILE,
        "-out", CERT_FILE,
        "-days", "365",
        "-subj", "/CN=localhost"
    ]
    try:
        subprocess.run(cmd, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        print(f"[+] Generated {CERT_FILE} and {KEY_FILE}")
    except Exception as e:
        raise RuntimeError(f"Failed to generate self-signed certificate via openssl: {e}")
    return CERT_FILE, KEY_FILE


def create_tls_server_context(cert_file: str, key_file: str) -> ssl.SSLContext:
    """
    TLS server context for incoming client connections (uses our self-signed cert).
    Renegotiation is disabled to avoid errors with TLS 1.3.
    """
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    ctx.load_cert_chain(certfile=cert_file, keyfile=key_file)

    # Recommended protocol bounds
    if hasattr(ssl, "TLSVersion"):
        ctx.minimum_version = ssl.TLSVersion.TLSv1_2
        ctx.maximum_version = ssl.TLSVersion.TLSv1_3

    # Disable renegotiation (TLS 1.3) if supported
    if hasattr(ssl, "OP_NO_RENEGOTIATION"):
        ctx.options |= ssl.OP_NO_RENEGOTIATION

    # Disable post-handshake auth which may trigger renegotiation-like flows
    if hasattr(ctx, "post_handshake_auth"):
        ctx.post_handshake_auth = False

    # Strong default ciphers (optional)
    # ctx.set_ciphers("ECDHE+AESGCM")
    return ctx


def create_tls_client_context() -> ssl.SSLContext:
    """
    TLS client context for upstream connection.
    Renegotiation is disabled to avoid 'This TLS version forbids renegotiation'.
    For lab use, server verification is disabled; adjust for production as needed.
    """
    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    # Lab/testing settings; for production, set CERT_REQUIRED and load CA
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    if hasattr(ssl, "TLSVersion"):
        ctx.minimum_version = ssl.TLSVersion.TLSv1_2
        ctx.maximum_version = ssl.TLSVersion.TLSv1_3

    if hasattr(ssl, "OP_NO_RENEGOTIATION"):
        ctx.options |= ssl.OP_NO_RENEGOTIATION

    if hasattr(ctx, "post_handshake_auth"):
        ctx.post_handshake_auth = False

    return ctx


# ---------------------------
# Proxy core
# ---------------------------

class InterceptController:
    """Manages intercepts, history, and intercept toggle."""

    def __init__(self):
        self.pending_map: Dict[str, InterceptItem] = {}
        self.history_lock = threading.Lock()
        self.history: List[MessageRecord] = []
        self.intercept_enabled = True

    def add_history(self, rec: MessageRecord):
        with self.history_lock:
            self.history.append(rec)

    def add_intercept(self, item: InterceptItem):
        self.pending_map[item.id] = item

    def get_oldest_intercept(self) -> Optional[InterceptItem]:
        if not self.pending_map:
            return None
        items = list(self.pending_map.values())
        items.sort(key=lambda it: it.created_at)
        return items[0]

    def resolve_intercept(self, item_id: str):
        self.pending_map.pop(item_id, None)


class ConnectionHandler(threading.Thread):
    """
    Handles one client connection:
      - Wraps incoming client socket with TLS server context (decrypts inside proxy).
      - Connects upstream with TLS client context (encrypts transparently).
      - Intercepts client->server messages when enabled.
    """

    def __init__(self, client_sock: socket.socket, client_addr: Tuple[str, int],
                 remote_addr: Tuple[str, int], tls_enabled: bool,
                 tls_server_ctx: Optional[ssl.SSLContext],
                 controller: InterceptController):
        super().__init__(daemon=True)
        self.client_sock = client_sock
        self.client_addr = client_addr
        self.remote_addr = remote_addr
        self.tls_enabled = tls_enabled
        self.tls_server_ctx = tls_server_ctx
        self.controller = controller
        self.conn_id = f"{client_addr[0]}:{client_addr[1]}->{remote_addr[0]}:{remote_addr[1]}"
        self._stop_event = threading.Event()

    def stop(self):
        self._stop_event.set()

    def run(self):
        # Upgrade client connection to TLS (server side) if enabled
        if self.tls_enabled and self.tls_server_ctx is not None:
            try:
                self.client_sock = self.tls_server_ctx.wrap_socket(self.client_sock, server_side=True)
            except Exception:
                self._safe_close(self.client_sock)
                return

        # Connect to remote server
        server_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
            server_sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
            server_sock.settimeout(10.0)
            server_sock.connect(self.remote_addr)
            if self.tls_enabled:
                tls_client_ctx = create_tls_client_context()
                server_sock = tls_client_ctx.wrap_socket(server_sock, server_hostname=self.remote_addr[0])
        except Exception:
            self._safe_close(self.client_sock)
            self._safe_close(server_sock)
            return

        # Log CONNECT event with TLS state
        self._log_connect_event(tls_on=self.tls_enabled)

        # Non-blocking sockets
        self.client_sock.setblocking(False)
        server_sock.setblocking(False)

        to_server_queue: "queue.Queue[bytes]" = queue.Queue()

        while not self._stop_event.is_set():
            try:
                rlist, _, elist = select.select([self.client_sock, server_sock], [], [self.client_sock, server_sock], 0.2)
            except Exception:
                break

            if self.client_sock in rlist:
                try:
                    data = self.client_sock.recv(65536)
                except Exception:
                    data = b""
                if not data:
                    break
                # Data from client is cleartext at this point (TLS decrypted if enabled)
                if self.controller.intercept_enabled:
                    self._intercept_and_wait(data, to_server_queue)
                else:
                    self._log_payload(direction="client->server", payload=data, flags="DATA")
                    to_server_queue.put(data)

            if server_sock in rlist:
                try:
                    data = server_sock.recv(65536)
                except Exception:
                    data = b""
                if not data:
                    break
                # Data from upstream (TLS decrypted if enabled) — log cleartext and relay to client
                self._log_payload(direction="server->client", payload=data, flags="DATA")
                try:
                    self.client_sock.sendall(data)
                except Exception:
                    break

            if elist:
                break

            # Flush queued payloads upstream (TLS encryption handled by socket)
            while True:
                try:
                    payload = to_server_queue.get_nowait()
                except queue.Empty:
                    break
                try:
                    server_sock.sendall(payload)
                except Exception:
                    break

        self._safe_close(self.client_sock)
        self._safe_close(server_sock)

    def _safe_close(self, s: socket.socket):
        try:
            s.shutdown(socket.SHUT_RDWR)
        except Exception:
            pass
        try:
            s.close()
        except Exception:
            pass

    def _intercept_and_wait(self, data: bytes, to_server_queue: "queue.Queue[bytes]"):
        item = InterceptItem(
            id=str(uuid.uuid4()),
            conn_id=self.conn_id,
            direction="client->server",
            src_ip=self.client_addr[0],
            src_port=self.client_addr[1],
            dst_ip=self.remote_addr[0],
            dst_port=self.remote_addr[1],
            payload=data,
            created_at=now()
        )
        self.controller.add_intercept(item)

        approved_payload = self._wait_for_approval(item.id)
        if approved_payload is None:
            self.controller.resolve_intercept(item.id)
            return

        self._log_payload(direction="client->server", payload=approved_payload, flags="DATA (sent)", original=data)
        to_server_queue.put(approved_payload)
        self.controller.resolve_intercept(item.id)

    def _wait_for_approval(self, item_id: str, timeout_sec: int = 300) -> Optional[bytes]:
        start = now()
        while (now() - start).total_seconds() < timeout_sec and not self._stop_event.is_set():
            approved = approved_payloads.pop(item_id, None)
            if approved is not None:
                return approved
            threading.Event().wait(0.1)
        return None

    def _log_connect_event(self, tls_on: bool):
        label = "📄 CONNECT (TLS ON)" if tls_on else "📄 CONNECT"
        rec = MessageRecord(
            id=str(uuid.uuid4()),
            timestamp=now(),
            src_ip=self.client_addr[0],
            src_port=self.client_addr[1],
            dst_ip=self.remote_addr[0],
            dst_port=self.remote_addr[1],
            length=0,
            direction="client->server",
            flags="CONNECT",
            preview=label,
            raw_original=b"",
            raw_modified=None
        )
        controller.add_history(rec)

    def _log_payload(self, direction: str, payload: bytes, flags: str = "DATA", original: Optional[bytes] = None):
        preview = preview_with_icon(payload)
        rec = MessageRecord(
            id=str(uuid.uuid4()),
            timestamp=now(),
            src_ip=self.client_addr[0] if direction == "client->server" else self.remote_addr[0],
            src_port=self.client_addr[1] if direction == "client->server" else self.remote_addr[1],
            dst_ip=self.remote_addr[0] if direction == "client->server" else self.client_addr[0],
            dst_port=self.remote_addr[1] if direction == "client->server" else self.client_addr[1],
            length=len(payload),
            direction=direction,
            flags=flags,
            preview=preview,
            raw_original=original if original is not None else payload,
            raw_modified=(payload if original is not None else None),
        )
        controller.add_history(rec)


# ---------------------------
# Flask app (GUI)
# ---------------------------

app = Flask(__name__)
controller = InterceptController()
approved_payloads: Dict[str, bytes] = {}
TLS_STATE = {"enabled": False}

INDEX_HTML = """
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>TCP Intercept Proxy</title>
<style>
  :root {
    --bg: #0E1217; --panel: #141A22; --accent: #2B6CB0; --accent-2: #3B82F6;
    --muted: #7A8CA0; --text: #E5EAF1; --danger: #D0616B; --border: #1F2630;
    --row-modified: #245b24;
  }
  body { margin:0; font-family: ui-monospace, Menlo, Monaco, Consolas, "Liberation Mono", monospace; background: var(--bg); color: var(--text); }
  header { background: #0D1117; border-bottom: 1px solid #222a33; padding: 14px 20px; display:flex; gap:12px; align-items:center; }
  h1 { margin:0; font-size: 18px; color: var(--text); }
  .header-tools { margin-left:auto; display:flex; gap:8px; align-items:center; }
  .pill { display:inline-block; padding:4px 10px; border-radius:16px; background:#162030; color:var(--accent-2); border:1px solid #283a4f; }
  .container { padding:16px; display:grid; grid-template-columns: 1fr 1fr; gap:16px; transition: grid-template-columns .2s ease; }
  .panel { background: var(--panel); border:1px solid var(--border); border-radius:8px; padding:12px; }
  .panel h2 { margin-top:0; font-size:16px; color:var(--accent-2); }
  .label { color: var(--muted); font-size:12px; }
  textarea, input, button, table { font-family: inherit; font-size:12px; color: var(--text); background:#0F141B; border:1px solid #28303A; border-radius:6px; }
  textarea { width:100%; padding:8px; white-space: pre; }
  .grid-2 { display:grid; grid-template-columns: 1fr 1fr; gap:8px; }
  button { padding:8px 12px; cursor:pointer; }
  .btn-primary { background: var(--accent); border-color:#2B3A52; }
  .btn-danger { background: var(--danger); border-color:#8A3A41; }
  .btn-muted  { background:#1A202A; border-color:#2A3340; }
  .btn-toggle { background:#1c2a3a; border:1px solid #2f3e52; color:#cfe1ff; }
  .btn-on { background:#214b77; color:#eaf4ff; }
  .btn-off { background:#3a2324; color:#ffd9d9; }
  .history-wrapper { max-height:360px; overflow-y:auto; border:1px solid #28303A; border-radius:6px; }
  table { width:100%; border-collapse:collapse; }
  thead { position:sticky; top:0; background:#121820; }
  th, td { padding:8px; border-bottom:1px solid #2a3340; text-align:left; }
  tr:hover { background:#121820; }
  tr.modified { background: var(--row-modified); }
  .meta { display:flex; gap:12px; flex-wrap:wrap; margin-bottom:8px; }
  .mono { font-family: inherit; }
  footer { padding:16px; color:var(--muted); font-size:12px; }
  .toolbar { display:flex; gap:8px; align-items:center; margin-bottom:8px; }
  .small { height:30px; }
  .red { color: var(--danger); font-weight:bold; }
  pre { background:#0F141B; border:1px solid #28303A; border-radius:6px; padding:8px; overflow:auto; max-height:280px; }
  .ascii-pre { white-space: pre-wrap; word-break: break-word; max-height:280px; overflow-y:auto; }
  .hex-pre   { white-space: pre;       max-height:280px; overflow-y:auto; }
  .hidden { display:none; }
  .fullwidth { grid-template-columns: 1fr; }
</style>
</head>
<body>
<header>
  <h1>TCP Intercept Proxy</h1>
  <div class="header-tools">
    <span id="intercept_state" class="pill">Intercept: <b id="intercept_state_text">ON</b></span>
    <button id="toggle_intercept" class="btn-toggle btn-on">Intercept</button>
    <span id="tls_state" class="pill">TLS: <b id="tls_state_text">OFF</b></span>
  </div>
</header>

<div id="mainGrid" class="container">
  <div id="interceptPanel" class="panel">
    <h2>Pending intercept</h2>
    <div id="pending"><div class="label">No pending messages.</div></div>
  </div>

  <div id="historyPanel" class="panel">
    <h2>History</h2>
    <div class="toolbar">
      <input type="text" id="history_filter" class="small" placeholder="Filter by keyword (IP, port, flags, preview, etc.)" style="flex:1;">
      <button class="btn-muted small" id="clear_filter">Clear</button>
    </div>
    <div class="history-wrapper">
      <table id="history">
        <thead>
          <tr>
            <th>Date & time</th><th>Src IP</th><th>Src port</th><th>Dst IP</th><th>Dst port</th><th>Length</th><th>Flags</th><th>Preview</th>
          </tr>
        </thead>
        <tbody></tbody>
      </table>
    </div>
  </div>
</div>

<div class="container">
  <div class="panel" style="grid-column: 1 / span 2;">
    <h2>Message detail</h2>
    <div id="detail">
      <div class="label">Select a row in History to view original and modified bytes (hex + ASCII). Traffic is cleartext even with TLS.</div>
    </div>
  </div>
</div>

<footer>When Intercept is OFF, proxy logs and forwards without blocking. When ON, client->server messages are intercepted for editing.</footer>

<script>
let currentInterceptId = null;
let interceptEnabled = true;
let tlsEnabled = false;

function updateInterceptStateUI(on) {
  interceptEnabled = on;
  const stateText = document.getElementById('intercept_state_text');
  const toggleBtn = document.getElementById('toggle_intercept');
  const interceptPanel = document.getElementById('interceptPanel');
  const mainGrid = document.getElementById('mainGrid');
  if (on) {
    stateText.textContent = 'ON';
    toggleBtn.classList.remove('btn-off'); toggleBtn.classList.add('btn-on');
    interceptPanel.classList.remove('hidden'); mainGrid.classList.remove('fullwidth');
  } else {
    stateText.textContent = 'OFF';
    toggleBtn.classList.remove('btn-on'); toggleBtn.classList.add('btn-off');
    interceptPanel.classList.add('hidden'); mainGrid.classList.add('fullwidth');
  }
}
function updateTlsStateUI(on) {
  tlsEnabled = on;
  document.getElementById('tls_state_text').textContent = on ? 'ON' : 'OFF';
}
async function loadStates() {
  const r1 = await fetch('/api/intercept/state'); if (r1.ok) updateInterceptStateUI((await r1.json()).enabled);
  const r2 = await fetch('/api/tls/state'); if (r2.ok) updateTlsStateUI((await r2.json()).enabled);
}
document.getElementById('toggle_intercept').addEventListener('click', async () => {
  const r = await fetch('/api/intercept/toggle', { method: 'POST' }); if (!r.ok) return;
  updateInterceptStateUI((await r.json()).enabled); fetchPending(); fetchHistory();
});

// --- Intercept editor: hex <-> ASCII sync with dual cursors ---
function hexClean(s) { return s.replace(/[^0-9a-fA-F]/g, ''); }
function hexToBytes(hex) {
  const cleaned = hexClean(hex); const out = [];
  for (let i=0;i<cleaned.length;i+=2) { const pair = cleaned.substr(i,2); if (pair.length===2) out.push(parseInt(pair,16)); }
  return new Uint8Array(out);
}
function bytesToAscii(bytes) {
  return Array.from(bytes).map(b => (b >= 32 && b < 127) ? String.fromCharCode(b) : (b===10? '\\n' : '.')).join('');
}
function asciiToBytes(s) {
  const out = []; for (let i=0;i<s.length;i++) { const ch = s[i]; out.push(ch === '\\n' ? 10 : ch.charCodeAt(0)); }
  return new Uint8Array(out);
}
function bytesToHexSpaced(bytes, width=16) {
  const parts = Array.from(bytes).map(b => b.toString(16).toUpperCase().padStart(2,'0'));
  const lines = []; for (let i=0;i<parts.length;i+=width) lines.push(parts.slice(i,i+width).join(' '));
  return lines.join('\\n');
}
function hexCaretToByteIndex(hex, caretPos) {
  let digits=0; for (let i=0;i<caretPos;i++) { const c=hex[i]; if (/[0-9a-fA-F]/.test(c)) digits++; }
  return Math.floor(digits/2);
}
function byteIndexToHexCaret(hex, byteIndex) {
  let target = byteIndex*2, pos=0, digits=0;
  while (pos<hex.length && digits<target) { const c=hex[pos]; if (/[0-9a-fA-F]/.test(c)) digits++; pos++; }
  return pos;
}

async function fetchPending() {
  const el = document.getElementById('pending');
  if (!interceptEnabled) { el.innerHTML = '<div class="label">Intercept disabled.</div>'; return; }
  const r = await fetch('/api/intercepts/next'); if (!r.ok) return;
  const data = await r.json();
  if (!data || !data.id) { if (!currentInterceptId) el.innerHTML = '<div class="label">No pending messages.</div>'; return; }
  if (currentInterceptId === data.id) return;
  currentInterceptId = data.id;

  const form = document.createElement('div');
  form.innerHTML = `
    <div class="meta mono">
      <span class="pill">ID: ${data.id}</span>
      <span class="pill">${data.src_ip}:${data.src_port} → ${data.dst_ip}:${data.dst_port}</span>
      <span class="pill">${data.direction}</span>
      <span class="pill">Length: ${data.length} bytes</span>
      <span class="pill">Received: ${data.created_at}</span>
    </div>
    <div class="grid-2">
      <div><div class="label">Hex bytes (editable)</div><textarea id="hex_edit" style="height:220px"></textarea></div>
      <div><div class="label">ASCII (editable)</div><textarea id="ascii_edit" style="height:220px"></textarea></div>
    </div>
    <div style="margin-top:8px; display:flex; gap:8px;">
      <button class="btn-primary" id="send_btn">Send</button>
      <button class="btn-danger" id="drop_btn">Drop</button>
      <button class="btn-muted" id="refresh_btn">Refresh</button>
      <span class="label" id="status_msg" style="margin-left:auto;"></span>
    </div>`;
  el.innerHTML = ''; el.appendChild(form);

  const hexEl = document.getElementById('hex_edit');
  const asciiEl = document.getElementById('ascii_edit');
  hexEl.value = data.hex_dump; asciiEl.value = data.ascii_dump;

  let updating = false;
  hexEl.addEventListener('input', () => {
    if (updating) return; updating = true;
    try {
      const caret = hexEl.selectionStart || 0;
      const bytes = hexToBytes(hexEl.value);
      asciiEl.value = bytesToAscii(bytes);
      const byteIdx = hexCaretToByteIndex(hexEl.value, caret);
      asciiEl.selectionStart = asciiEl.selectionEnd = Math.min(byteIdx, asciiEl.value.length);
      setStatus('');
    } catch (e) { setStatus('Invalid hex'); }
    updating = false;
  });
  asciiEl.addEventListener('input', () => {
    if (updating) return; updating = true;
    const caret = asciiEl.selectionStart || 0;
    const bytes = asciiToBytes(asciiEl.value);
    const hexSpaced = bytesToHexSpaced(bytes);
    hexEl.value = hexSpaced;
    const hexCaret = byteIndexToHexCaret(hexSpaced, Math.min(caret, bytes.length));
    hexEl.selectionStart = hexEl.selectionEnd = hexCaret;
    updating = false;
  });
  hexEl.addEventListener('keyup', () => {
    const caret = hexEl.selectionStart || 0;
    const byteIdx = hexCaretToByteIndex(hexEl.value, caret);
    asciiEl.selectionStart = asciiEl.selectionEnd = Math.min(byteIdx, asciiEl.value.length);
  });
  asciiEl.addEventListener('keyup', () => {
    const caret = asciiEl.selectionStart || 0;
    const bytes = asciiToBytes(asciiEl.value);
    const hexSpaced = bytesToHexSpaced(bytes);
    const hexCaret = byteIndexToHexCaret(hexSpaced, Math.min(caret, bytes.length));
    hexEl.selectionStart = hexEl.selectionEnd = hexCaret;
  });

  function setStatus(msg) { document.getElementById('status_msg').textContent = msg || ''; }

  document.getElementById('send_btn').onclick = async () => {
    const resp = await fetch('/api/intercept/' + data.id + '/send', {
      method: 'POST', headers: {'Content-Type': 'application/json'}, body: JSON.stringify({hex: hexEl.value})
    });
    if (resp.ok) { el.innerHTML = '<div class="label">Message sent.</div>'; currentInterceptId = null; fetchHistory(); setTimeout(fetchPending, 400); }
    else { alert('Failed to send: ' + (await resp.text())); }
  };
  document.getElementById('drop_btn').onclick = async () => {
    const resp = await fetch('/api/intercept/' + data.id + '/drop', { method: 'POST' });
    if (resp.ok) { el.innerHTML = '<div class="label">Message dropped.</div>'; currentInterceptId = null; setTimeout(fetchPending, 400); }
    else { alert('Failed to drop: ' + (await resp.text())); }
  };
  document.getElementById('refresh_btn').onclick = async () => { currentInterceptId = null; fetchPending(); };
}

async function fetchHistory() {
  const r = await fetch('/api/history'); if (!r.ok) return;
  const data = await r.json();
  const tbody = document.querySelector('#history tbody'); tbody.innerHTML = '';
  for (const row of data.slice().reverse()) {
    const tr = document.createElement('tr'); if (row.modified) tr.classList.add('modified');
    tr.innerHTML = `
      <td>${row.timestamp}</td><td>${row.src_ip}</td><td>${row.src_port}</td>
      <td>${row.dst_ip}</td><td>${row.dst_port}</td><td>${row.length}</td>
      <td>${row.flags}</td><td class="mono">${row.preview}</td>`;
    tr.onclick = () => showDetail(row.id); tbody.appendChild(tr);
  }
  applyHistoryFilter();
}
function applyHistoryFilter() {
  const filter = document.getElementById('history_filter').value.toLowerCase();
  const rows = document.querySelectorAll('#history tbody tr');
  rows.forEach(row => { const text = row.innerText.toLowerCase(); row.style.display = text.includes(filter) ? '' : 'none'; });
}
async function showDetail(id) {
  const r = await fetch('/api/message/' + id); if (!r.ok) return;
  const data = await r.json(); const detail = document.getElementById('detail');
  detail.innerHTML = `
    <div class="meta mono">
      <span class="pill">${data.direction}</span>
      <span class="pill">${data.src_ip}:${data.src_port} → ${data.dst_ip}:${data.dst_port}</span>
      <span class="pill">Length: ${data.length} bytes</span>
      <span class="pill">Flags: ${data.flags}</span>
      <span class="pill">${data.timestamp}</span>
      <span class="pill">${data.modified ? 'Modified: Yes' : 'Modified: No'}</span>
    </div>
    <div class="grid-2">
      <div>
        <div class="label">Original — hex</div>
        <pre class="hex-pre">${data.hex_original_html}</pre>
        <div class="label">Original — ASCII</div>
        <pre class="ascii-pre">${data.ascii_original_html}</pre>
      </div>
      <div>
        <div class="label">Modified — hex</div>
        <pre class="hex-pre">${data.hex_modified_html || '(none)'}</pre>
        <div class="label">Modified — ASCII</div>
        <pre class="ascii-pre">${data.ascii_modified_html || '(none)'}</pre>
      </div>
    </div>`;
}
document.getElementById('history_filter').addEventListener('input', applyHistoryFilter);
document.getElementById('clear_filter').addEventListener('click', () => { document.getElementById('history_filter').value=''; applyHistoryFilter(); });

loadStates(); fetchPending(); fetchHistory();
setInterval(fetchPending, 2000); setInterval(fetchHistory, 5000);
</script>
</body>
</html>
"""

@app.route("/")
def index():
    return render_template_string(INDEX_HTML)

@app.route("/api/intercepts/next")
def api_next_intercept():
    if not controller.intercept_enabled:
        return jsonify({}), 200
    item = controller.get_oldest_intercept()
    if not item:
        return jsonify({}), 200
    hex_dump, ascii_dump, _ = bytes_to_hex_ascii(item.payload)
    return jsonify({
        "id": item.id, "conn_id": item.conn_id, "direction": item.direction,
        "src_ip": item.src_ip, "src_port": item.src_port,
        "dst_ip": item.dst_ip, "dst_port": item.dst_port,
        "length": len(item.payload), "created_at": item.created_at.strftime("%Y-%m-%d %H:%M:%S"),
        "hex_dump": hex_dump, "ascii_dump": ascii_dump
    })

@app.route("/api/intercept/<item_id>/send", methods=["POST"])
def api_send_intercept(item_id):
    data = request.get_json(force=True, silent=True) or {}
    hex_str = data.get("hex", "")
    try:
        payload = hex_str_to_bytes(hex_str)
    except Exception as e:
        return f"Invalid hex: {e}", 400
    approved_payloads[item_id] = payload
    return "OK", 200

@app.route("/api/intercept/<item_id>/drop", methods=["POST"])
def api_drop_intercept(item_id):
    approved_payloads.pop(item_id, None)
    controller.resolve_intercept(item_id)
    return "OK", 200

@app.route("/api/history")
def api_history():
    with controller.history_lock:
        rows = [{
            "id": rec.id,
            "timestamp": rec.timestamp.strftime("%Y-%m-%d %H:%M:%S"),
            "src_ip": rec.src_ip, "src_port": rec.src_port,
            "dst_ip": rec.dst_ip, "dst_port": rec.dst_port,
            "length": rec.length, "flags": rec.flags,
            "preview": rec.preview, "modified": rec.modified
        } for rec in controller.history]
    return jsonify(rows)

@app.route("/api/message/<msg_id>")
def api_message_detail(msg_id):
    rec = None
    with controller.history_lock:
        for r in controller.history:
            if r.id == msg_id:
                rec = r; break
    if not rec:
        return "Not found", 404
    hex_o, ascii_o, _ = bytes_to_hex_ascii(rec.raw_original)
    if rec.raw_modified is not None:
        hex_o_html, hex_m_html, ascii_o_html, ascii_m_html = diff_hex_ascii(rec.raw_original, rec.raw_modified)
    else:
        hex_o_html = hex_o; hex_m_html = ""; ascii_o_html = ascii_o; ascii_m_html = ""
    return jsonify({
        "id": rec.id, "timestamp": rec.timestamp.strftime("%Y-%m-%d %H:%M:%S"),
        "src_ip": rec.src_ip, "src_port": rec.src_port, "dst_ip": rec.dst_ip, "dst_port": rec.dst_port,
        "length": rec.length, "flags": rec.flags, "direction": rec.direction, "modified": rec.modified,
        "hex_original_html": hex_o_html, "hex_modified_html": hex_m_html,
        "ascii_original_html": ascii_o_html, "ascii_modified_html": ascii_m_html
    })

@app.route("/api/intercept/state")
def api_intercept_state():
    return jsonify({"enabled": controller.intercept_enabled})

@app.route("/api/tls/state")
def api_tls_state():
    return jsonify({"enabled": TLS_STATE["enabled"]})

@app.route("/api/intercept/toggle", methods=["POST"])
def api_intercept_toggle():
    controller.intercept_enabled = not controller.intercept_enabled
    if not controller.intercept_enabled:
        controller.pending_map.clear()
    return jsonify({"enabled": controller.intercept_enabled})


# ---------------------------
# Listener setup and CLI
# ---------------------------

def start_listener(listen_host: str, listen_port: int, remote_host: str, remote_port: int, tls_enabled: bool):
    # Prepare TLS server context (for incoming clients) if enabled
    tls_server_ctx = None
    if tls_enabled:
        cert_file, key_file = ensure_self_signed_cert()
        tls_server_ctx = create_tls_server_context(cert_file, key_file)
        TLS_STATE["enabled"] = True
    else:
        TLS_STATE["enabled"] = False

    # TCP listener (plain accept, wrap client-side as needed)
    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    srv.bind((listen_host, listen_port))
    srv.listen(128)
    print(f"[+] Listening on {listen_host}:{listen_port} (TLS {'ON' if tls_enabled else 'OFF'}), forwarding to {remote_host}:{remote_port} (TLS client)")

    def accept_loop():
        while True:
            try:
                client_sock, client_addr = srv.accept()
            except Exception:
                break
            handler = ConnectionHandler(
                client_sock=client_sock,
                client_addr=client_addr,
                remote_addr=(remote_host, remote_port),
                tls_enabled=tls_enabled,
                tls_server_ctx=tls_server_ctx,
                controller=controller
            )
            handler.start()

    t = threading.Thread(target=accept_loop, daemon=True)
    t.start()
    return srv, t

def parse_args():
    parser = argparse.ArgumentParser(description="Raw TCP intercepting proxy with Flask Web GUI. TLS on both sides.")
    parser.add_argument("--tls", action="store_true", help="Enable TLS for incoming client connections and upstream to remote server.")
    parser.add_argument("listen", help="Listen interface and port in the form <host:port>")
    parser.add_argument("remote", help="Remote address and port in the form <host:port>")
    parser.add_argument("--gui-host", default="127.0.0.1", help="Flask GUI bind address (default 127.0.0.1)")
    parser.add_argument("--gui-port", type=int, default=5000, help="Flask GUI port (default 5000)")
    args = parser.parse_args()

    def split_host_port(s: str) -> Tuple[str, int]:
        if s.count(':') == 0:
            raise ValueError("Expected <host:port>")
        host, port = s.rsplit(':', 1)
        return host, int(port)

    listen_host, listen_port = split_host_port(args.listen)
    remote_host, remote_port = split_host_port(args.remote)
    return args.tls, listen_host, listen_port, remote_host, remote_port, args.gui_host, args.gui_port

def main():
    tls_enabled, listen_host, listen_port, remote_host, remote_port, gui_host, gui_port = parse_args()
    start_listener(listen_host, listen_port, remote_host, remote_port, tls_enabled)
    app.run(host=gui_host, port=gui_port, threaded=True, debug=False)

if __name__ == "__main__":
    main()