chore(restructure): reorganize project layout

- Reorganize internal packages and overall project structure - Update imports and wiring to match the new layout - Separate HTTP parsing and streaming from the server package - Separate middleware from the server package - Separate session registry from the session package - Move HTTP, HTTPS, and TCP servers to the transport package - Session package no longer starts the TCP server directly - Server package no longer starts HTTP/HTTPS servers on initialization - Forwarder no longer handles accepting TCP requests - Move session details to the types package - HTTP/HTTPS initialization is now the responsibility of main
2026-01-21 14:06:46 +07:00
parent 9a4539cc02
commit 1e12373359
30 changed files with 862 additions and 704 deletions
@@ -0,0 +1,40 @@
+package transport
+
+import (
+	"errors"
+	"log"
+	"net"
+	"tunnel_pls/internal/registry"
+)
+
+type httpServer struct {
+	handler *httpHandler
+	port    string
+}
+
+func NewHTTPServer(port string, sessionRegistry registry.Registry, redirectTLS bool) Transport {
+	return &httpServer{
+		handler: newHTTPHandler(sessionRegistry, redirectTLS),
+		port:    port,
+	}
+}
+
+func (ht *httpServer) Listen() (net.Listener, error) {
+	return net.Listen("tcp", ":"+ht.port)
+}
+
+func (ht *httpServer) Serve(listener net.Listener) error {
+	log.Printf("HTTP server is starting on port %s", ht.port)
+	for {
+		conn, err := listener.Accept()
+		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return err
+			}
+			log.Printf("Error accepting connection: %v", err)
+			continue
+		}
+
+		go ht.handler.handler(conn, false)
+	}
+}
@@ -0,0 +1,227 @@
+package transport
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+	"tunnel_pls/internal/config"
+	"tunnel_pls/internal/http/header"
+	"tunnel_pls/internal/http/stream"
+	"tunnel_pls/internal/middleware"
+	"tunnel_pls/internal/registry"
+	"tunnel_pls/types"
+
+	"golang.org/x/crypto/ssh"
+)
+
+type httpHandler struct {
+	sessionRegistry registry.Registry
+	redirectTLS     bool
+}
+
+func newHTTPHandler(sessionRegistry registry.Registry, redirectTLS bool) *httpHandler {
+	return &httpHandler{
+		sessionRegistry: sessionRegistry,
+		redirectTLS:     redirectTLS,
+	}
+}
+
+func (hh *httpHandler) redirect(conn net.Conn, status int, location string) error {
+	_, err := conn.Write([]byte(fmt.Sprintf("HTTP/1.1 %d Moved Permanently\r\n", status) +
+		fmt.Sprintf("Location: %s", location) +
+		"Content-Length: 0\r\n" +
+		"Connection: close\r\n" +
+		"\r\n"))
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func (hh *httpHandler) badRequest(conn net.Conn) error {
+	if _, err := conn.Write([]byte("HTTP/1.1 400 Bad Request\r\n\r\n")); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (hh *httpHandler) handler(conn net.Conn, isTLS bool) {
+	defer hh.closeConnection(conn)
+
+	dstReader := bufio.NewReader(conn)
+	reqhf, err := header.NewRequest(dstReader)
+	if err != nil {
+		log.Printf("Error creating request header: %v", err)
+		return
+	}
+
+	slug, err := hh.extractSlug(reqhf)
+	if err != nil {
+		_ = hh.badRequest(conn)
+		return
+	}
+
+	if hh.shouldRedirectToTLS(isTLS) {
+		_ = hh.redirect(conn, http.StatusMovedPermanently, fmt.Sprintf("Location: https://%s.%s/\r\n", slug, config.Getenv("DOMAIN", "localhost")))
+		return
+	}
+
+	if hh.handlePingRequest(slug, conn) {
+		return
+	}
+
+	sshSession, err := hh.getSession(slug)
+	if err != nil {
+		_ = hh.redirect(conn, http.StatusMovedPermanently, fmt.Sprintf("https://tunnl.live/tunnel-not-found?slug=%s\r\n", slug))
+		return
+	}
+
+	hw := stream.New(conn, dstReader, conn.RemoteAddr())
+	defer func(hw stream.HTTP) {
+		err = hw.Close()
+		if err != nil {
+			log.Printf("Error closing HTTP stream: %v", err)
+		}
+	}(hw)
+	hh.forwardRequest(hw, reqhf, sshSession)
+}
+
+func (hh *httpHandler) closeConnection(conn net.Conn) {
+	err := conn.Close()
+	if err != nil && !errors.Is(err, net.ErrClosed) {
+		log.Printf("Error closing connection: %v", err)
+	}
+}
+
+func (hh *httpHandler) extractSlug(reqhf header.RequestHeader) (string, error) {
+	host := strings.Split(reqhf.Value("Host"), ".")
+	if len(host) < 1 {
+		return "", errors.New("invalid host")
+	}
+	return host[0], nil
+}
+
+func (hh *httpHandler) shouldRedirectToTLS(isTLS bool) bool {
+	return !isTLS && hh.redirectTLS
+}
+
+func (hh *httpHandler) handlePingRequest(slug string, conn net.Conn) bool {
+	if slug != "ping" {
+		return false
+	}
+
+	_, err := conn.Write([]byte(
+		"HTTP/1.1 200 OK\r\n" +
+			"Content-Length: 0\r\n" +
+			"Connection: close\r\n" +
+			"Access-Control-Allow-Origin: *\r\n" +
+			"Access-Control-Allow-Methods: GET, HEAD, OPTIONS\r\n" +
+			"Access-Control-Allow-Headers: *\r\n" +
+			"\r\n",
+	))
+	if err != nil {
+		log.Println("Failed to write 200 OK:", err)
+	}
+	return true
+}
+
+func (hh *httpHandler) getSession(slug string) (registry.Session, error) {
+	sshSession, err := hh.sessionRegistry.Get(types.SessionKey{
+		Id:   slug,
+		Type: types.HTTP,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return sshSession, nil
+}
+
+func (hh *httpHandler) forwardRequest(hw stream.HTTP, initialRequest header.RequestHeader, sshSession registry.Session) {
+	channel, err := hh.openForwardedChannel(hw, sshSession)
+	defer func() {
+		err = channel.Close()
+		if err != nil {
+			log.Printf("Error closing forwarded channel: %v", err)
+		}
+	}()
+	if err != nil {
+		log.Printf("Failed to establish channel: %v", err)
+		sshSession.Forwarder().WriteBadGatewayResponse(hw)
+		return
+	}
+	hh.setupMiddlewares(hw)
+
+	if err = hh.sendInitialRequest(hw, initialRequest, channel); err != nil {
+		log.Printf("Failed to forward initial request: %v", err)
+		return
+	}
+	sshSession.Forwarder().HandleConnection(hw, channel)
+}
+
+func (hh *httpHandler) openForwardedChannel(hw stream.HTTP, sshSession registry.Session) (ssh.Channel, error) {
+	payload := sshSession.Forwarder().CreateForwardedTCPIPPayload(hw.RemoteAddr())
+
+	type channelResult struct {
+		channel ssh.Channel
+		reqs    <-chan *ssh.Request
+		err     error
+	}
+
+	resultChan := make(chan channelResult, 1)
+
+	go func() {
+		channel, reqs, err := sshSession.Lifecycle().Connection().OpenChannel("forwarded-tcpip", payload)
+		select {
+		case resultChan <- channelResult{channel, reqs, err}:
+		default:
+			hh.cleanupUnusedChannel(channel, reqs)
+		}
+	}()
+
+	select {
+	case result := <-resultChan:
+		if result.err != nil {
+			return nil, result.err
+		}
+		go ssh.DiscardRequests(result.reqs)
+		return result.channel, nil
+	case <-time.After(5 * time.Second):
+		return nil, errors.New("timeout opening forwarded-tcpip channel")
+	}
+}
+
+func (hh *httpHandler) cleanupUnusedChannel(channel ssh.Channel, reqs <-chan *ssh.Request) {
+	if channel != nil {
+		if err := channel.Close(); err != nil {
+			log.Printf("Failed to close unused channel: %v", err)
+		}
+		go ssh.DiscardRequests(reqs)
+	}
+}
+
+func (hh *httpHandler) setupMiddlewares(hw stream.HTTP) {
+	fingerprintMiddleware := middleware.NewTunnelFingerprint()
+	forwardedForMiddleware := middleware.NewForwardedFor(hw.RemoteAddr())
+
+	hw.UseResponseMiddleware(fingerprintMiddleware)
+	hw.UseRequestMiddleware(forwardedForMiddleware)
+}
+
+func (hh *httpHandler) sendInitialRequest(hw stream.HTTP, initialRequest header.RequestHeader, channel ssh.Channel) error {
+	hw.SetRequestHeader(initialRequest)
+
+	if err := hw.ApplyRequestMiddlewares(initialRequest); err != nil {
+		return fmt.Errorf("error applying request middlewares: %w", err)
+	}
+
+	if _, err := channel.Write(initialRequest.Finalize()); err != nil {
+		return fmt.Errorf("error writing to channel: %w", err)
+	}
+
+	return nil
+}
@@ -0,0 +1,48 @@
+package transport
+
+import (
+	"crypto/tls"
+	"errors"
+	"log"
+	"net"
+	"tunnel_pls/internal/registry"
+)
+
+type https struct {
+	httpHandler *httpHandler
+	domain      string
+	port        string
+}
+
+func NewHTTPSServer(domain, port string, sessionRegistry registry.Registry, redirectTLS bool) Transport {
+	return &https{
+		httpHandler: newHTTPHandler(sessionRegistry, redirectTLS),
+		domain:      domain,
+		port:        port,
+	}
+}
+
+func (ht *https) Listen() (net.Listener, error) {
+	tlsConfig, err := NewTLSConfig(ht.domain)
+	if err != nil {
+		return nil, err
+	}
+
+	return tls.Listen("tcp", ":"+ht.port, tlsConfig)
+
+}
+func (ht *https) Serve(listener net.Listener) error {
+	log.Printf("HTTPS server is starting on port %s", ht.port)
+	for {
+		conn, err := listener.Accept()
+		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return err
+			}
+			log.Printf("Error accepting connection: %v", err)
+			continue
+		}
+
+		go ht.httpHandler.handler(conn, true)
+	}
+}
@@ -0,0 +1,66 @@
+package transport
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+
+	"golang.org/x/crypto/ssh"
+)
+
+type tcp struct {
+	port      uint16
+	forwarder forwarder
+}
+
+type forwarder interface {
+	CreateForwardedTCPIPPayload(origin net.Addr) []byte
+	OpenForwardedChannel(payload []byte) (ssh.Channel, <-chan *ssh.Request, error)
+	HandleConnection(dst io.ReadWriter, src ssh.Channel)
+}
+
+func NewTCPServer(port uint16, forwarder forwarder) Transport {
+	return &tcp{
+		port:      port,
+		forwarder: forwarder,
+	}
+}
+
+func (tt *tcp) Listen() (net.Listener, error) {
+	return net.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", tt.port))
+}
+
+func (tt *tcp) Serve(listener net.Listener) error {
+	for {
+		conn, err := listener.Accept()
+		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return nil
+			}
+			log.Printf("Error accepting connection: %v", err)
+			continue
+		}
+		go tt.handleTcp(conn)
+	}
+}
+
+func (tt *tcp) handleTcp(conn net.Conn) {
+	defer func() {
+		err := conn.Close()
+		if err != nil {
+			log.Printf("Failed to close connection: %v", err)
+		}
+	}()
+	payload := tt.forwarder.CreateForwardedTCPIPPayload(conn.RemoteAddr())
+	channel, reqs, err := tt.forwarder.OpenForwardedChannel(payload)
+	if err != nil {
+		log.Printf("Failed to open forwarded-tcpip channel: %v", err)
+
+		return
+	}
+
+	go ssh.DiscardRequests(reqs)
+	tt.forwarder.HandleConnection(conn, channel)
+}
@@ -0,0 +1,330 @@
+package transport
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"log"
+	"os"
+	"sync"
+	"time"
+	"tunnel_pls/internal/config"
+
+	"github.com/caddyserver/certmagic"
+	"github.com/libdns/cloudflare"
+)
+
+type TLSManager interface {
+	userCertsExistAndValid() bool
+	loadUserCerts() error
+	startCertWatcher()
+	initCertMagic() error
+	getTLSConfig() *tls.Config
+	getCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
+}
+
+type tlsManager struct {
+	domain      string
+	certPath    string
+	keyPath     string
+	storagePath string
+
+	userCert   *tls.Certificate
+	userCertMu sync.RWMutex
+
+	magic *certmagic.Config
+
+	useCertMagic bool
+}
+
+var globalTLSManager TLSManager
+var tlsManagerOnce sync.Once
+
+func NewTLSConfig(domain string) (*tls.Config, error) {
+	var initErr error
+
+	tlsManagerOnce.Do(func() {
+		certPath := "certs/tls/cert.pem"
+		keyPath := "certs/tls/privkey.pem"
+		storagePath := "certs/tls/certmagic"
+
+		tm := &tlsManager{
+			domain:      domain,
+			certPath:    certPath,
+			keyPath:     keyPath,
+			storagePath: storagePath,
+		}
+
+		if tm.userCertsExistAndValid() {
+			log.Printf("Using user-provided certificates from %s and %s", certPath, keyPath)
+			if err := tm.loadUserCerts(); err != nil {
+				initErr = fmt.Errorf("failed to load user certificates: %w", err)
+				return
+			}
+			tm.useCertMagic = false
+			tm.startCertWatcher()
+		} else {
+			if !isACMEConfigComplete() {
+				log.Printf("User certificates missing or invalid, and ACME configuration is incomplete")
+				log.Printf("To enable automatic certificate generation, set CF_API_TOKEN environment variable")
+				initErr = fmt.Errorf("no valid certificates found and ACME configuration is incomplete (CF_API_TOKEN is required)")
+				return
+			}
+
+			log.Printf("User certificates missing or don't cover %s and *.%s, using CertMagic", domain, domain)
+			if err := tm.initCertMagic(); err != nil {
+				initErr = fmt.Errorf("failed to initialize CertMagic: %w", err)
+				return
+			}
+			tm.useCertMagic = true
+		}
+
+		globalTLSManager = tm
+	})
+
+	if initErr != nil {
+		return nil, initErr
+	}
+
+	return globalTLSManager.getTLSConfig(), nil
+}
+
+func isACMEConfigComplete() bool {
+	cfAPIToken := config.Getenv("CF_API_TOKEN", "")
+	return cfAPIToken != ""
+}
+
+func (tm *tlsManager) userCertsExistAndValid() bool {
+	if _, err := os.Stat(tm.certPath); os.IsNotExist(err) {
+		log.Printf("Certificate file not found: %s", tm.certPath)
+		return false
+	}
+	if _, err := os.Stat(tm.keyPath); os.IsNotExist(err) {
+		log.Printf("Key file not found: %s", tm.keyPath)
+		return false
+	}
+
+	return ValidateCertDomains(tm.certPath, tm.domain)
+}
+
+func ValidateCertDomains(certPath, domain string) bool {
+	certPEM, err := os.ReadFile(certPath)
+	if err != nil {
+		log.Printf("Failed to read certificate: %v", err)
+		return false
+	}
+
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		log.Printf("Failed to decode PEM block from certificate")
+		return false
+	}
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		log.Printf("Failed to parse certificate: %v", err)
+		return false
+	}
+
+	if time.Now().After(cert.NotAfter) {
+		log.Printf("Certificate has expired (NotAfter: %v)", cert.NotAfter)
+		return false
+	}
+
+	if time.Now().Add(30 * 24 * time.Hour).After(cert.NotAfter) {
+		log.Printf("Certificate expiring soon (NotAfter: %v), will use CertMagic for renewal", cert.NotAfter)
+		return false
+	}
+
+	var certDomains []string
+	if cert.Subject.CommonName != "" {
+		certDomains = append(certDomains, cert.Subject.CommonName)
+	}
+	certDomains = append(certDomains, cert.DNSNames...)
+
+	hasBase := false
+	hasWildcard := false
+	wildcardDomain := "*." + domain
+
+	for _, d := range certDomains {
+		if d == domain {
+			hasBase = true
+		}
+		if d == wildcardDomain {
+			hasWildcard = true
+		}
+	}
+
+	if !hasBase {
+		log.Printf("Certificate does not cover base domain: %s", domain)
+	}
+	if !hasWildcard {
+		log.Printf("Certificate does not cover wildcard domain: %s", wildcardDomain)
+	}
+
+	return hasBase && hasWildcard
+}
+
+func (tm *tlsManager) loadUserCerts() error {
+	cert, err := tls.LoadX509KeyPair(tm.certPath, tm.keyPath)
+	if err != nil {
+		return err
+	}
+
+	tm.userCertMu.Lock()
+	tm.userCert = &cert
+	tm.userCertMu.Unlock()
+
+	log.Printf("Loaded user certificates successfully")
+	return nil
+}
+
+func (tm *tlsManager) startCertWatcher() {
+	go func() {
+		var lastCertMod, lastKeyMod time.Time
+
+		if info, err := os.Stat(tm.certPath); err == nil {
+			lastCertMod = info.ModTime()
+		}
+		if info, err := os.Stat(tm.keyPath); err == nil {
+			lastKeyMod = info.ModTime()
+		}
+
+		ticker := time.NewTicker(30 * time.Second)
+		defer ticker.Stop()
+
+		for range ticker.C {
+			certInfo, certErr := os.Stat(tm.certPath)
+			keyInfo, keyErr := os.Stat(tm.keyPath)
+
+			if certErr != nil || keyErr != nil {
+				continue
+			}
+
+			if certInfo.ModTime().After(lastCertMod) || keyInfo.ModTime().After(lastKeyMod) {
+				log.Printf("Certificate files changed, reloading...")
+
+				if !ValidateCertDomains(tm.certPath, tm.domain) {
+					log.Printf("New certificates don't cover required domains")
+
+					if !isACMEConfigComplete() {
+						log.Printf("Cannot switch to CertMagic: ACME configuration is incomplete (CF_API_TOKEN is required)")
+						continue
+					}
+
+					log.Printf("Switching to CertMagic for automatic certificate management")
+					if err := tm.initCertMagic(); err != nil {
+						log.Printf("Failed to initialize CertMagic: %v", err)
+						continue
+					}
+					tm.useCertMagic = true
+					return
+				}
+
+				if err := tm.loadUserCerts(); err != nil {
+					log.Printf("Failed to reload certificates: %v", err)
+					continue
+				}
+
+				lastCertMod = certInfo.ModTime()
+				lastKeyMod = keyInfo.ModTime()
+				log.Printf("Certificates reloaded successfully")
+			}
+		}
+	}()
+}
+
+func (tm *tlsManager) initCertMagic() error {
+	if err := os.MkdirAll(tm.storagePath, 0700); err != nil {
+		return fmt.Errorf("failed to create cert storage directory: %w", err)
+	}
+
+	acmeEmail := config.Getenv("ACME_EMAIL", "admin@"+tm.domain)
+	cfAPIToken := config.Getenv("CF_API_TOKEN", "")
+	acmeStaging := config.Getenv("ACME_STAGING", "false") == "true"
+
+	if cfAPIToken == "" {
+		return fmt.Errorf("CF_API_TOKEN environment variable is required for automatic certificate generation")
+	}
+
+	cfProvider := &cloudflare.Provider{
+		APIToken: cfAPIToken,
+	}
+
+	storage := &certmagic.FileStorage{Path: tm.storagePath}
+
+	cache := certmagic.NewCache(certmagic.CacheOptions{
+		GetConfigForCert: func(cert certmagic.Certificate) (*certmagic.Config, error) {
+			return tm.magic, nil
+		},
+	})
+
+	magic := certmagic.New(cache, certmagic.Config{
+		Storage: storage,
+	})
+
+	acmeIssuer := certmagic.NewACMEIssuer(magic, certmagic.ACMEIssuer{
+		Email:  acmeEmail,
+		Agreed: true,
+		DNS01Solver: &certmagic.DNS01Solver{
+			DNSManager: certmagic.DNSManager{
+				DNSProvider: cfProvider,
+			},
+		},
+	})
+
+	if acmeStaging {
+		acmeIssuer.CA = certmagic.LetsEncryptStagingCA
+		log.Printf("Using Let's Encrypt staging server")
+	} else {
+		acmeIssuer.CA = certmagic.LetsEncryptProductionCA
+		log.Printf("Using Let's Encrypt production server")
+	}
+
+	magic.Issuers = []certmagic.Issuer{acmeIssuer}
+	tm.magic = magic
+
+	domains := []string{tm.domain, "*." + tm.domain}
+	log.Printf("Requesting certificates for: %v", domains)
+
+	ctx := context.Background()
+	if err := magic.ManageSync(ctx, domains); err != nil {
+		return fmt.Errorf("failed to obtain certificates: %w", err)
+	}
+
+	log.Printf("Certificates obtained successfully for %v", domains)
+	return nil
+}
+
+func (tm *tlsManager) getTLSConfig() *tls.Config {
+	return &tls.Config{
+		GetCertificate: tm.getCertificate,
+
+		MinVersion: tls.VersionTLS13,
+		MaxVersion: tls.VersionTLS13,
+
+		CurvePreferences: []tls.CurveID{
+			tls.X25519,
+		},
+
+		SessionTicketsDisabled: false,
+		ClientAuth:             tls.NoClientCert,
+	}
+}
+
+func (tm *tlsManager) getCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	if tm.useCertMagic {
+		return tm.magic.GetCertificate(hello)
+	}
+
+	tm.userCertMu.RLock()
+	defer tm.userCertMu.RUnlock()
+
+	if tm.userCert == nil {
+		return nil, fmt.Errorf("no certificate available")
+	}
+
+	return tm.userCert, nil
+}
@@ -0,0 +1,10 @@
+package transport
+
+import (
+	"net"
+)
+
+type Transport interface {
+	Listen() (net.Listener, error)
+	Serve(listener net.Listener) error
+}