proxy: use SNI rather than localhost addresses

JJTech0130 · JJTech0130 · May 18, 2024 · May 11, 2024 · May 11, 2024 · May 11, 2024
commit bb727af213110b8229c9e3203d8da2ad41083bd1
diff --git a/pypush/cli/__init__.py b/pypush/cli/__init__.py
@@ -13,12 +13,6 @@ def proxy(
     attach: Annotated[
         bool, typer.Option(help="Use Frida to attach to the running `apsd`")
     ] = True,
-    dual: Annotated[
-        bool,
-        typer.Option(
-            help="EXPERIMENTAL: Listen on both 127.0.0.2 and 127.0.0.3, to proxy both production and sandbox connections"
-        ),
-    ] = False,
 ):
     """
     Proxy APNs traffic between the local machine and the APNs courier
@@ -27,7 +21,7 @@ def proxy(
     """
     from . import apnsproxy
 
-    apnsproxy.main(attach, dual)
+    apnsproxy.main(attach)
 
 
 @app.command()

diff --git a/pypush/cli/_frida.py b/pypush/cli/_frida.py
@@ -34,7 +34,7 @@ def redirect_courier(
         + """');
                         console.log('getaddrinfo("' + node + '", ...) => getaddrinfo("localhost", ...)');
                     } else {
-                        console.log('getaddrinfo("' + node + '", ...)');
+                        //console.log('getaddrinfo("' + node + '", ...)');
                     }
                 }
             });

diff --git a/pypush/cli/apnsproxy.py b/pypush/cli/apnsproxy.py
@@ -40,26 +40,31 @@ async def forward_packets(
 connection_cnt = 0
 
 
-async def handle(client: TLSStream, forward):
+async def handle(client: TLSStream):
     global connection_cnt
     connection_cnt += 1
+
+    sni = client._ssl_object.server_name  # type: ignore
+    logging.debug(f"Got SNI: {sni}")
+    sandbox = "sandbox" in sni
+
     # TODO: Check what SNI the client is connecting to, use that instead of guessing based on local IP
     async with client:
         client_pkt = transport.PacketStream(client)
         logging.debug("Client connected")
+
+        forward = (
+            "1-courier.push.apple.com"
+            if not sandbox
+            else "1-courier.sandbox.push.apple.com"
+        )
+        name = f"prod-{connection_cnt}" if not sandbox else f"sandbox-{connection_cnt}"
+
         async with await transport.create_courier_connection(forward) as conn:
             logging.debug("Connected to courier")
             async with anyio.create_task_group() as tg:
-                tg.start_soon(
-                    forward_packets, client_pkt, conn, f"client-{connection_cnt}"
-                )
-                tg.start_soon(
-                    forward_packets, conn, client_pkt, f"server-{connection_cnt}"
-                )
-                # await anyio.sleep(4)
-                # await conn.send(protocol.SetStateCommand(1, 0x7FFFFFFF).to_packet())
-                # tg.start_soon(forward_commands, client_cmd, conn, "client")
-                # tg.start_soon(forward_commands, conn, client_cm, "server")
+                tg.start_soon(forward_packets, client_pkt, conn, f"client-{name}")
+                tg.start_soon(forward_packets, conn, client_pkt, f"server-{name}")
                 logging.debug("Started forwarding")
         logging.debug("Courier disconnected")
 
@@ -101,7 +106,12 @@ def temp_certs():
     return cert_path, key_path
 
 
-async def courier_proxy(host, forward):
+def sni_callback(conn, server_name, ssl_context):
+    # Set the server name in the conn so we can use it later
+    conn.server_name = server_name  # type: ignore
+
+
+async def courier_proxy(host):
     # Start listening on localhost:COURIER_PORT
     listener = await anyio.create_tcp_listener(
         local_port=transport.COURIER_PORT, local_host=host
@@ -110,55 +120,64 @@ async def courier_proxy(host, forward):
     context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
     context.set_alpn_protocols(["apns-security-v3"])
     context.load_cert_chain(*temp_certs())
+    context.set_servername_callback(sni_callback)
     listener = TLSListener(listener, ssl_context=context, standard_compatible=False)
     logging.info(f"Listening on {host}:{transport.COURIER_PORT}")
-    logging.debug(f"Forwarding to {forward}")
-
-    async def handle_wrap(client: TLSStream):
-        await handle(client, forward)
 
-    await listener.serve(handle_wrap)
+    await listener.serve(handle)
 
 
 async def ainput(prompt: str = "") -> str:
     print(prompt, end="")
     return await anyio.to_thread.run_sync(input)
 
 
-async def start(attach, double_courier=False):
-    # Attach to the target app
-    if attach:
-        apsd = _frida.attach_to_apsd()
-
-        async with anyio.create_task_group() as tg:
-            if double_courier:
-                logging.info("Double courier mode enabled")
-                logging.info(
-                    "Make sure to run `sudo ifconfig lo0 alias 127.0.0.2` and `sudo ifconfig lo0 alias 127.0.0.3` to add the extra IPs"
-                )
-                tg.start_soon(courier_proxy, "127.0.0.2", "2-courier.push.apple.com")
-                tg.start_soon(
-                    courier_proxy, "127.0.0.3", "7-courier.sandbox.push.apple.com"
-                )
-                _frida.redirect_courier(apsd, "courier.push.apple.com", "127.0.0.2")
-                _frida.redirect_courier(
-                    apsd, "courier.sandbox.push.apple.com", "127.0.0.3"
-                )
-            else:
-                tg.start_soon(courier_proxy, "localhost", "1-courier.push.apple.com")
-                _frida.redirect_courier(apsd, "courier.push.apple.com", "localhost")
+async def start(attach):
+    async with anyio.create_task_group() as tg:
+        tg.start_soon(courier_proxy, "localhost")
+        if attach:
+            apsd = _frida.attach_to_apsd()
+            _frida.redirect_courier(apsd, "courier.push.apple.com", "localhost")
+            _frida.redirect_courier(apsd, "courier.sandbox.push.apple.com", "localhost")
             _frida.trust_all_hosts(apsd)
-
-            logging.info("Press Enter to exit...")
-            await ainput()
-            tg.cancel_scope.cancel()
-    else:
-        async with anyio.create_task_group() as tg:
-            tg.start_soon(courier_proxy, "localhost", "1-courier.push.apple.com")
-            logging.info("Press Enter to exit...")
-            await ainput()
-            tg.cancel_scope.cancel()
-
-
-def main(attach, double_courier=False):
-    anyio.run(start, attach, double_courier)
+        logging.info("Press Enter to exit...")
+        await ainput()
+        tg.cancel_scope.cancel()
+
+    # # Attach to the target app
+    # if attach:
+    #     apsd = _frida.attach_to_apsd()
+
+    #     async with anyio.create_task_group() as tg:
+    #         if double_courier:
+    #             logging.info("Double courier mode enabled")
+    #             logging.info(
+    #                 "Make sure to run `sudo ifconfig lo0 alias 127.0.0.2` and `sudo ifconfig lo0 alias 127.0.0.3` to add the extra IPs"
+    #             )
+    #             tg.start_soon(courier_proxy, "127.0.0.2", "2-courier.push.apple.com")
+    #             tg.start_soon(
+    #                 courier_proxy, "127.0.0.3", "7-courier.sandbox.push.apple.com"
+    #             )
+    #             _frida.redirect_courier(apsd, "courier.push.apple.com", "127.0.0.2")
+    #             _frida.redirect_courier(
+    #                 apsd, "courier.sandbox.push.apple.com", "127.0.0.3"
+    #             )
+    #         else:
+    #             tg.start_soon(courier_proxy, "localhost", "1-courier.push.apple.com")
+
+    #             _frida.redirect_courier(apsd, "courier.push.apple.com", "localhost")
+    #         _frida.trust_all_hosts(apsd)
+
+    #         logging.info("Press Enter to exit...")
+    #         await ainput()
+    #         tg.cancel_scope.cancel()
+    # else:
+    #     async with anyio.create_task_group() as tg:
+    #         tg.start_soon(courier_proxy, "localhost", "1-courier.push.apple.com")
+    #         logging.info("Press Enter to exit...")
+    #         await ainput()
+    #         tg.cancel_scope.cancel()
+
+
+def main(attach):
+    anyio.run(start, attach)