Dynamic Tunnel Manager (DTM)

🚨 TODO & Current Status

UI & Navigation

• Rich CLI interface with live updates
• Process status visualization
• Scrollable process list with pagination
• AI analysis results view with pagination
• Arrow key navigation between views
• Group process analysis display
• Process selection interface
• Web interface for remote management
• Mobile monitoring interface

AI Analysis Integration

• OpenRouter API integration
• Group process analysis
• Basic error handling
• Process context gathering
• Proper JSON response handling
• Retry mechanism for API failures
• Rate limiting implementation
• Analysis result caching
• Enhanced application metrics
• Custom model training support

State Security Integration

• Basic certificate management
• Initial state security implementation
• Group-based security analysis
• PGP-based state encryption system
• Secure memory management for keys
• Certificate rotation and verification
• Secure backup and recovery mechanisms
• Runtime security verification
• State integrity checking
• Hardware security module support
• TPM integration

Performance & Optimization

• Basic UI responsiveness
• Process monitoring
• Memory usage optimization
• Grouped API calls
• Resource usage reduction
• Startup time improvement
• Operation speed increase
• Network performance optimization

Creator's Note

Hi! I created the Dynamic Tunnel Manager (DTM) out of a personal need to protect applications from local tampering. While I'm not a cybersecurity researcher, I noticed a significant gap in how traditional tunneling solutions handle local application security. Most existing solutions use static configurations that can be easily predicted and manipulated.

The idea for DTM came from a simple question: "What if the target kept moving?" By implementing continuous port rotation and adding AI-powered analysis, I aimed to create a system where potential threats would face a constantly changing landscape. While I've successfully implemented the core tunneling and port rotation features, I'm actively seeking collaboration from the community, especially in:

1. AI Integration: The GPT-4 integration needs improvement to provide better security analysis
2. State Security: The PGP-based security system requires expertise to properly implement
3. Performance Optimization: Ensuring smooth operation with minimal resource usage

I believe in open collaboration and welcome contributions from security experts, developers, and enthusiasts who share the vision of making application security more dynamic and resilient. If you're interested in contributing, especially in the areas marked as TODO, please reach out!

Current Development Context

Immediate Implementation Needs

1. OpenRouter Analysis Integration

The AI analysis system currently needs improvements:

# Current implementation in ai_analysis.py
async def analyze_application(self, app_info: ApplicationInfo) -> Dict[str, Any]:
    """
    Needed improvements:
    - Proper error handling for API responses
    - Retry mechanism for failed requests
    - Rate limiting implementation
    - Response validation
    - Fallback model support
    """

Help Needed:

• Structured JSON response handling
• Retry mechanism for API failures
• Rate limiting implementation
• Response validation and error handling
• Fallback model implementation

2. State Security Integration

The state_security.py module provides robust security features but needs integration:

# Need to integrate with main application
class SecureStateManager:
    """State manager with PGP encryption and verification."""
    def __init__(self, pgp: PGPStateEncryption, progress: Optional[Progress] = None):
        self.pgp = pgp
        self.state_dirs = {
            'state': Path("~/.dtm/state").expanduser(),
            'backups': Path("~/.dtm/backups").expanduser(),
            'certificates': Path("~/.dtm/certificates").expanduser()
        }

Integration Points Needed:

1. Certificate Management

   • Integration with TunnelManager for secure certificate handling
   • Implementation of certificate rotation
   • Secure cleanup procedures

2. State Management

   • Integration with main application state
   • Secure configuration storage
   • Runtime state protection

3. Memory Security

   • Implementation of secure memory allocation
   • Platform-specific memory protection
   • Anti-dumping mechanisms

Current Priorities

1. AI Analysis

   # Example of desired AI analysis implementation
   async def analyze_application(self, app_info: ApplicationInfo) -> Dict[str, Any]:
       """
       Needed: Proper implementation of application analysis
       - Structured context creation
       - Reliable API communication
       - Error handling and retries
       - Response validation
       """
       pass

2. State Security

   # Example of needed state security integration
   class DTMApplication:
       async def initialize(self):
           """
           Need to implement:
           - Secure state initialization
           - Certificate management
           - Memory protection
           - State backup/recovery
           """
           self.state_manager = SecureStateManager(...)
           await self.state_manager.initialize()

How to Contribute

If you have expertise in:

1. OpenAI API integration
2. Memory security implementation
3. PGP-based encryption systems
4. Python async programming

Please consider contributing to these critical areas. The core functionality works, but these security enhancements will make the application more robust and secure.

🚨 TODO: Critical Updates Required

1. AI Analysis Integration Fix

• Update to OpenRouter API implementation
• Implement proper JSON response handling
• Add retry mechanism for API failures
• Enhance analysis context with more detailed application metrics
• Implement rate limiting and error handling
• Add caching for repeated analysis requests
• Improve error messages for failed analyses
• Add fallback model support (Claude-2)
• Implement streaming responses for real-time analysis

2. State Security Integration

• Integrate PGP-based state encryption system
• Implement secure memory management for keys
• Add certificate rotation and verification
• Setup secure backup and recovery mechanisms
• Implement runtime security verification
• Add state integrity checking

Overview

A secure and automated system for managing dynamic, encrypted tunnels for network applications with AI-driven optimization and state-based security.

Core Features

Application Security

• SSL/TLS Tunneling: Automated tunnel creation with certificate management
• Dynamic Port Rotation: Automatic port changes every 10 seconds
• Traffic Isolation: Secure encapsulation of application traffic
• State Security: PGP-based encryption for all state data
• Group Process Analysis: Automatic analysis of all instances of the same application

AI-Driven Analysis

• Real-time traffic pattern analysis
• Security risk assessment
• Behavioral anomaly detection
• Automatic threat response
• Performance optimization recommendations
• OpenRouter API integration with GPT-4
• Grouped application analysis for better context

Process Management

• Automatic application discovery
• Real-time connection monitoring
• Process state tracking
• Dynamic resource allocation
• Multi-instance process handling

User Interface

• Rich CLI interface with live updates
• Process status visualization
• Security metrics display
• Interactive controls
• Scrollable process list with pagination
• AI analysis results view with pagination
• Intuitive navigation between views
• Group process analysis display

Interactive Controls

Main View

• ↑/↓: Scroll through processes
• →: Switch to AI Analysis view
• T: Toggle auto-tunneling
• R: Force port rotation
• Q: Quit

AI Analysis View

• ←: Switch back to Main view
• ↑/↓: Scroll through analyses
• P: Analyze process (includes all instances)
• ESC: Cancel input
• Q: Quit

Process Selection

• ↑/↓: Navigate through processes
• ENTER: Select process for analysis
• ESC: Cancel selection

Configuration

Port Configuration

• Default port range: 5000-6000
• Rotation interval: 10 seconds
• Configurable in config/config.json

Security Configuration

• Certificate directory: config/certificates/
• State directory: ~/.dtm/state/
• Backup directory: ~/.dtm/backups/

AI Analysis Settings

• Model: GPT-4 via OpenRouter
• Analysis interval: 60 seconds
• Security threshold: 0.7
• Configurable in config/config.json

Recent Changes

UI Improvements

• Implemented pagination for process list
• Added scrolling functionality with visual indicators
• Improved navigation between views using arrow keys
• Enhanced process selection interface
• Added group process analysis for better context

AI Analysis Enhancements

• Integrated OpenRouter API for improved analysis
• Added support for analyzing multiple instances of the same application
• Enhanced analysis context with application state information
• Improved error handling and retry mechanisms

Security Updates

• Enhanced certificate management
• Improved state security implementation
• Added group-based security analysis
• Enhanced memory protection mechanisms

Performance Optimizations

• Improved UI responsiveness
• Enhanced process monitoring
• Optimized memory usage
• Reduced API calls through grouped analysis

Installation

1. Clone the repository:

git clone https://github.com/yourusername/dynamic-tunnel-manager.git
cd dynamic-tunnel-manager

2. Create and activate a virtual environment:

python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

3. Install dependencies:

pip install -r requirements.txt

4. Configure OpenRouter API: Create config/config.json with your OpenRouter API key:

{
    "openrouter": {
        "api_key": "your-api-key-here",
        "base_url": "https://openrouter.ai/api/v1",
        "model": "openai/gpt-4",
        "fallback_model": "anthropic/claude-2"
    }
}

Usage

1. Start the Dynamic Tunnel Manager:

python main.py

2. Use arrow keys to navigate:

   • Right arrow (→) to switch to AI Analysis
   • Left arrow (←) to return to Main view
   • Up/Down arrows (↑/↓) to scroll through lists
   • Enter to select a process for analysis

3. The application will automatically analyze all instances of the same process when selected.

State Security System

Overview

The state security system provides multiple layers of protection:

1. PGP Encryption Layer

   • Runtime key generation
   • Secure key storage
   • State encryption/decryption
   • Certificate management

2. Memory Protection

   • Secure memory allocation
   • Runtime memory locking
   • Key isolation
   • Anti-dumping mechanisms

3. State Verification

   • Hash-based integrity checking
   • State backup management
   • Atomic state updates
   • Recovery mechanisms

4. Certificate Management

   • Automatic certificate rotation
   • Secure storage
   • Verification chains
   • Backup management

Security Features

• Runtime memory protection
• State integrity verification
• Secure key management
• Atomic state operations
• Automatic backup creation
• Platform-specific security
• Certificate rotation
• Secure cleanup procedures

Requirements

• Python 3.9+
• OpenRouter API key (for AI analysis)
• GnuPG (for state security)
• Required Python packages (see requirements.txt)

Development

Running Tests

pytest tests/

Security Guidelines

1. Never store sensitive data in plaintext
2. Use atomic operations for state changes
3. Implement proper cleanup procedures
4. Follow secure coding practices
5. Regular security audits

Logging

• Application logs: logs/dtm.json
• Structured JSON format
• Security event tracking
• Performance metrics
• Error tracking

Contributing

1. Fork the repository
2. Create feature branch
3. Implement changes
4. Add tests
5. Submit pull request

License

MIT License - see LICENSE file for details

Support

For support:

1. Check documentation
2. Search existing issues
3. Create new issue

Security Notice

This tool handles sensitive security operations. Always:

1. Keep your API keys secure
2. Regularly update dependencies
3. Monitor security advisories
4. Follow security best practices
5. Regularly rotate certificates

State Security System Deep Dive

Zero-Trust Architecture

The state security system implements a zero-trust architecture where no data is permanently stored on disk in its original form. All state data, including certificates and configurations, exists only in secure, isolated memory during runtime.

Secure Memory Management

Runtime Key Initialization

1. Secure Memory Allocation

   • Platform-specific secure memory pages are allocated
   • Memory is locked to prevent swapping to disk
   • Anti-dumping mechanisms prevent memory extraction

2. Runtime Password Generation

   # Example of runtime password generation
   password = [
       random(uppercase),
       random(lowercase),
       random(digits),
       random(special)
   ] + random(all_chars, length=28)
   shuffle(password)  # Cryptographically secure shuffle

3. Key Isolation

   • Private keys are generated in isolated memory blocks
   • Keys never touch disk storage
   • Memory is protected from other processes
   • Automatic cleanup on process termination

State Encryption Flow

1. Initial State

   Runtime Start
   ├── Generate Runtime ID (32 bytes random)
   ├── Create Secure Memory Store
   └── Initialize PGP State Encryption
   

2. Memory Protection

   Secure Memory
   ├── Platform Detection
   │   ├── Windows: Basic Memory Mapping
   │   └── Unix: MAP_PRIVATE | MAP_ANONYMOUS
   ├── Memory Locking
   │   ├── mlock() on Unix
   │   └── VirtualLock() on Windows
   └── Anti-Dumping Mechanisms
   

3. Key Management

   Key Lifecycle
   ├── Runtime Password Generation
   ├── Private Key Generation in Memory
   ├── Public Key Derivation
   └── Secure Key Storage in Memory
   

State Data Protection

Memory-Only Storage

• All sensitive data exists only in memory
• No sensitive data is written to disk
• Encrypted backups use different keys
• Automatic memory wiping on exit

Double Encryption

1. Memory Layer

   • Fernet symmetric encryption
   • Runtime-generated keys
   • Memory-only key storage

2. State Layer

   • PGP asymmetric encryption
   • Runtime-generated keypair
   • Zero-disk-exposure

Certificate Management

Secure Certificate Handling

Certificate Lifecycle
├── Generation
│   ├── In-Memory Generation
│   ├── Runtime Encryption
│   └── Encrypted Storage
├── Usage
│   ├── Decrypt in Secure Memory
│   ├── Use for Tunneling
│   └── Immediate Cleanup
└── Rotation
    ├── New Certificate Generation
    ├── Atomic Replacement
    └── Old Certificate Cleanup

Backup and Recovery

Secure Backup System

• Backups are always encrypted
• Different encryption keys than runtime
• Atomic write operations
• Secure cleanup of old backups

Recovery Process

Recovery Flow
├── Backup Verification
├── Secure Memory Allocation
├── Encrypted State Loading
└── State Verification

🔐 Security Analysis: Current State vs. Enhanced Protection

Current Security Vulnerabilities

1. Certificate Exposure 🚨

Current Implementation:
config/certificates/
├── cert.pem  # Unencrypted, vulnerable to tampering
└── key.pem   # Sensitive key material exposed on disk

The current system stores SSL/TLS certificates and private keys in plaintext, making them vulnerable to:

• Direct file manipulation
• Key extraction
• Certificate tampering
• Unauthorized copying

2. State Management Risks 📛

Current State Storage:
- Configuration stored in plaintext JSON
- No runtime state protection
- Predictable file locations
- No integrity verification

3. Memory Security Gaps 💭

Current Memory Handling:
- Keys loaded directly into process memory
- No protection against memory dumps
- Swappable memory pages
- No secure cleanup procedures

🛡️ Enhanced Security with state_security.py

1. Zero-Trust Certificate Management

class CertificateManager:
    async def store_certificate(self, cert_id: str, cert_data: bytes, metadata: Dict[str, Any]):
        # Double encryption for certificates
        fernet = Fernet(Fernet.generate_key())
        memory_encrypted = fernet.encrypt(cert_data)
        
        # PGP encryption for storage
        encrypted_cert = await self.state_manager.encrypt_state({
            "data": b64encode(memory_encrypted).decode(),
            "hash": cert_hash,
            "encrypted": True
        })

• ✅ Certificates never exist unencrypted on disk
• ✅ Double-encryption protection
• ✅ Runtime-only key access
• ✅ Automatic rotation and cleanup

2. Secure Memory Architecture

class SecureMemoryStore:
    def __init__(self):
        if platform.system() == 'Windows':
            self._secure_memory = mmap.mmap(-1, 4096)
        else:
            self._secure_memory = mmap.mmap(
                -1, 4096,
                flags=mmap.MAP_PRIVATE | mmap.MAP_ANONYMOUS,
                prot=mmap.PROT_READ | mmap.PROT_WRITE
            )

• ✅ Platform-specific memory protection
• ✅ Anti-dumping mechanisms
• ✅ Memory page locking
• ✅ Secure key isolation

3. State Protection System

class SecureStateManager:
    async def save_state(self, state_data: Dict, filename: str):
        # Encrypt state data
        encrypted_data = await self.encrypt_state(state_data)
        
        # Atomic write with backup
        temp_file = self.state_dirs['state'] / f"{filename}.{os.urandom(8).hex()}.tmp"
        target_file = self.state_dirs['state'] / filename

• ✅ All state data encrypted
• ✅ Atomic file operations
• ✅ Automatic backups
• ✅ Integrity verification

🔄 Runtime Security Flow

Application Start
├── Generate Runtime ID (32 bytes random)
├── Initialize Secure Memory
│   ├── Allocate Protected Pages
│   └── Lock Memory (prevent swapping)
├── Generate Runtime Keys
│   ├── Create PGP Keypair
│   └── Store in Secure Memory
└── Initialize State Manager
    ├── Load Encrypted State
    ├── Verify Integrity
    └── Setup Certificate Manager

🛡️ Security Improvements

1. Certificate Protection

   • Before: Plaintext files on disk
   • After: Double-encrypted, memory-only access

2. Memory Security

   • Before: Standard process memory
   • After: Protected pages, anti-dumping

3. State Management

   • Before: Plaintext JSON files
   • After: PGP-encrypted, integrity-verified

4. Key Management

   • Before: Static keys on disk
   • After: Runtime-generated, memory-only

🔍 Security Guarantees

1. Zero Disk Exposure

   • No sensitive data written unencrypted
   • All state changes atomic and verified
   • Secure backup management

2. Memory Protection

   • Platform-specific security
   • Memory page locking
   • Anti-dumping mechanisms
   • Secure cleanup

3. Runtime Security

   • Dynamic key generation
   • Continuous verification
   • Automatic rotation
   • Secure cleanup

⚠️ Integration Requirements

To fully implement these security features:

1. Replace current certificate handling
2. Integrate secure memory store
3. Implement state manager
4. Add runtime security checks
5. Update backup procedures

🔒 Advanced Security Considerations

Memory Attack Vectors

• Memory dumping attempts
• Cold boot attacks
• DMA attacks
• Swap file analysis
• Process memory inspection

Mitigations

1. Memory Protection

   • Secure memory allocation
   • Page locking
   • Memory wiping
   • Anti-dumping techniques

2. Runtime Protection

   • Process isolation
   • Privilege separation
   • Resource cleanup
   • Signal handling

🛠️ Development Guidelines

Code Quality

• Type hints required
• Docstrings mandatory
• Unit tests for all features
• Integration tests for security features

Security Practices

• Regular dependency updates
• Code review requirements
• Security audit logging
• Performance monitoring

📚 Documentation Standards

Code Documentation

• Function documentation
• Security considerations
• Implementation notes
• Usage examples

Security Documentation

• Threat models
• Security assumptions
• Implementation details
• Recovery procedures

🤝 Community Guidelines

Contributing

• Security-first approach
• Code review process
• Testing requirements
• Documentation updates

Issue Reporting

• Security issue template
• Bug report format
• Feature request format
• Pull request guidelines

🔄 Version Control

Branch Strategy

• main: Stable releases
• develop: Development
• feature/*: New features
• security/*: Security updates
• hotfix/*: Critical fixes

Release Process

1. Security audit
2. Integration testing
3. Documentation update
4. Version tagging
5. Release notes

📋 Project Roadmap

Short Term

• GPT-4 integration fixes
• State security implementation
• Memory protection enhancements
• Certificate management updates

Long Term

• Additional AI models support
• Enhanced threat detection
• Performance optimizations
• Extended platform support

🎯 Future Enhancements

Planned Features

1. Enhanced AI Analysis

   • Multiple AI model support
   • Custom model training
   • Behavioral learning
   • Pattern recognition

2. Advanced Security

   • Hardware security module support
   • TPM integration
   • Secure enclave usage
   • Enhanced memory protection

3. Performance Optimization

   • Resource usage reduction
   • Startup time improvement
   • Memory footprint reduction
   • Operation speed increase

4. User Experience

   • Web interface option
   • Mobile monitoring
   • Remote management
   • Custom dashboards

📊 Performance Metrics

Monitoring

• CPU usage tracking
• Memory utilization
• Network performance
• Security overhead

Benchmarks

• Port rotation speed
• Encryption performance
• Memory protection impact
• Overall system load

🌐 Network Considerations

Firewall Configuration

• Required ports
• Protocol requirements
• Security rules
• Network isolation

Traffic Management

• Bandwidth control
• Connection limits
• Traffic prioritization
• Load balancing

💻 System Requirements

Minimum Requirements

• CPU: Dual-core
• RAM: 4GB
• Storage: 1GB
• Python 3.9+

Recommended

• CPU: Quad-core
• RAM: 8GB
• Storage: 5GB
• SSD recommended

🔧 Troubleshooting

Common Issues

1. Certificate Problems

   • Generation failures
   • Rotation issues
   • Permission errors
   • Storage problems

2. Memory Issues

   • Allocation failures
   • Protection errors
   • Cleanup problems
   • Resource leaks

3. State Management

   • Encryption errors
   • Backup failures
   • Recovery issues
   • Integrity problems

---

License

MIT License - See LICENSE file for details.

Acknowledgments

• OpenRouter API
• Python Cryptography Community
• Security Researchers
• Open Source Contributors

---

Last Updated: January 2024