chore(restructure): reorganize project layout
- Reorganize internal packages and overall project structure - Update imports and wiring to match the new layout - Separate HTTP parsing and streaming from the server package - Separate middleware from the server package - Separate session registry from the session package - Move HTTP, HTTPS, and TCP servers to the transport package - Session package no longer starts the TCP server directly - Server package no longer starts HTTP/HTTPS servers on initialization - Forwarder no longer handles accepting TCP requests - Move session details to the types package - HTTP/HTTPS initialization is now the responsibility of main
This commit is contained in:
-276
@@ -1,276 +0,0 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"crypto/tls"
|
||||
"errors"
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"strings"
|
||||
"time"
|
||||
"tunnel_pls/internal/config"
|
||||
"tunnel_pls/internal/httpheader"
|
||||
"tunnel_pls/session"
|
||||
"tunnel_pls/types"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
)
|
||||
|
||||
type HTTPServer interface {
|
||||
ListenAndServe() error
|
||||
ListenAndServeTLS() error
|
||||
}
|
||||
type httpServer struct {
|
||||
sessionRegistry session.Registry
|
||||
redirectTLS bool
|
||||
}
|
||||
|
||||
func NewHTTPServer(sessionRegistry session.Registry, redirectTLS bool) HTTPServer {
|
||||
return &httpServer{
|
||||
sessionRegistry: sessionRegistry,
|
||||
redirectTLS: redirectTLS,
|
||||
}
|
||||
}
|
||||
|
||||
func (hs *httpServer) ListenAndServe() error {
|
||||
httpPort := config.Getenv("HTTP_PORT", "8080")
|
||||
listener, err := net.Listen("tcp", ":"+httpPort)
|
||||
if err != nil {
|
||||
return errors.New("Error listening: " + err.Error())
|
||||
}
|
||||
go func() {
|
||||
for {
|
||||
var conn net.Conn
|
||||
conn, err = listener.Accept()
|
||||
if err != nil {
|
||||
if errors.Is(err, net.ErrClosed) {
|
||||
return
|
||||
}
|
||||
log.Printf("Error accepting connection: %v", err)
|
||||
continue
|
||||
}
|
||||
|
||||
go hs.handler(conn, false)
|
||||
}
|
||||
}()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (hs *httpServer) ListenAndServeTLS() error {
|
||||
domain := config.Getenv("DOMAIN", "localhost")
|
||||
httpsPort := config.Getenv("HTTPS_PORT", "8443")
|
||||
|
||||
tlsConfig, err := NewTLSConfig(domain)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to initialize TLS config: %w", err)
|
||||
}
|
||||
|
||||
ln, err := tls.Listen("tcp", ":"+httpsPort, tlsConfig)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
go func() {
|
||||
for {
|
||||
var conn net.Conn
|
||||
conn, err = ln.Accept()
|
||||
if err != nil {
|
||||
if errors.Is(err, net.ErrClosed) {
|
||||
log.Println("https server closed")
|
||||
}
|
||||
log.Printf("Error accepting connection: %v", err)
|
||||
continue
|
||||
}
|
||||
|
||||
go hs.handler(conn, true)
|
||||
}
|
||||
}()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (hs *httpServer) redirect(conn net.Conn, status int, location string) error {
|
||||
_, err := conn.Write([]byte(fmt.Sprintf("HTTP/1.1 %d Moved Permanently\r\n", status) +
|
||||
fmt.Sprintf("Location: %s", location) +
|
||||
"Content-Length: 0\r\n" +
|
||||
"Connection: close\r\n" +
|
||||
"\r\n"))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (hs *httpServer) badRequest(conn net.Conn) error {
|
||||
if _, err := conn.Write([]byte("HTTP/1.1 400 Bad Request\r\n\r\n")); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (hs *httpServer) handler(conn net.Conn, isTLS bool) {
|
||||
defer hs.closeConnection(conn)
|
||||
|
||||
dstReader := bufio.NewReader(conn)
|
||||
reqhf, err := httpheader.NewRequestHeader(dstReader)
|
||||
if err != nil {
|
||||
log.Printf("Error creating request header: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
slug, err := hs.extractSlug(reqhf)
|
||||
if err != nil {
|
||||
_ = hs.badRequest(conn)
|
||||
return
|
||||
}
|
||||
|
||||
if hs.shouldRedirectToTLS(isTLS) {
|
||||
_ = hs.redirect(conn, http.StatusMovedPermanently, fmt.Sprintf("Location: https://%s.%s/\r\n", slug, config.Getenv("DOMAIN", "localhost")))
|
||||
return
|
||||
}
|
||||
|
||||
if hs.handlePingRequest(slug, conn) {
|
||||
return
|
||||
}
|
||||
|
||||
sshSession, err := hs.getSession(slug)
|
||||
if err != nil {
|
||||
_ = hs.redirect(conn, http.StatusMovedPermanently, fmt.Sprintf("https://tunnl.live/tunnel-not-found?slug=%s\r\n", slug))
|
||||
return
|
||||
}
|
||||
|
||||
hw := NewHTTPWriter(conn, dstReader, conn.RemoteAddr())
|
||||
hs.forwardRequest(hw, reqhf, sshSession)
|
||||
}
|
||||
|
||||
func (hs *httpServer) closeConnection(conn net.Conn) {
|
||||
err := conn.Close()
|
||||
if err != nil && !errors.Is(err, net.ErrClosed) {
|
||||
log.Printf("Error closing connection: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func (hs *httpServer) extractSlug(reqhf httpheader.RequestHeader) (string, error) {
|
||||
host := strings.Split(reqhf.Value("Host"), ".")
|
||||
if len(host) < 1 {
|
||||
return "", errors.New("invalid host")
|
||||
}
|
||||
return host[0], nil
|
||||
}
|
||||
|
||||
func (hs *httpServer) shouldRedirectToTLS(isTLS bool) bool {
|
||||
return !isTLS && hs.redirectTLS
|
||||
}
|
||||
|
||||
func (hs *httpServer) handlePingRequest(slug string, conn net.Conn) bool {
|
||||
if slug != "ping" {
|
||||
return false
|
||||
}
|
||||
|
||||
_, err := conn.Write([]byte(
|
||||
"HTTP/1.1 200 OK\r\n" +
|
||||
"Content-Length: 0\r\n" +
|
||||
"Connection: close\r\n" +
|
||||
"Access-Control-Allow-Origin: *\r\n" +
|
||||
"Access-Control-Allow-Methods: GET, HEAD, OPTIONS\r\n" +
|
||||
"Access-Control-Allow-Headers: *\r\n" +
|
||||
"\r\n",
|
||||
))
|
||||
if err != nil {
|
||||
log.Println("Failed to write 200 OK:", err)
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
func (hs *httpServer) getSession(slug string) (session.Session, error) {
|
||||
sshSession, err := hs.sessionRegistry.Get(types.SessionKey{
|
||||
Id: slug,
|
||||
Type: types.HTTP,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return sshSession, nil
|
||||
}
|
||||
|
||||
func (hs *httpServer) forwardRequest(hw HTTPWriter, initialRequest httpheader.RequestHeader, sshSession session.Session) {
|
||||
channel, err := hs.openForwardedChannel(hw, sshSession)
|
||||
if err != nil {
|
||||
log.Printf("Failed to establish channel: %v", err)
|
||||
sshSession.Forwarder().WriteBadGatewayResponse(hw)
|
||||
return
|
||||
}
|
||||
|
||||
hs.setupMiddlewares(hw)
|
||||
|
||||
if err := hs.sendInitialRequest(hw, initialRequest, channel); err != nil {
|
||||
log.Printf("Failed to forward initial request: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
sshSession.Forwarder().HandleConnection(hw, channel, hw.RemoteAddr())
|
||||
}
|
||||
|
||||
func (hs *httpServer) openForwardedChannel(hw HTTPWriter, sshSession session.Session) (ssh.Channel, error) {
|
||||
payload := sshSession.Forwarder().CreateForwardedTCPIPPayload(hw.RemoteAddr())
|
||||
|
||||
type channelResult struct {
|
||||
channel ssh.Channel
|
||||
reqs <-chan *ssh.Request
|
||||
err error
|
||||
}
|
||||
|
||||
resultChan := make(chan channelResult, 1)
|
||||
|
||||
go func() {
|
||||
channel, reqs, err := sshSession.Lifecycle().Connection().OpenChannel("forwarded-tcpip", payload)
|
||||
select {
|
||||
case resultChan <- channelResult{channel, reqs, err}:
|
||||
default:
|
||||
hs.cleanupUnusedChannel(channel, reqs)
|
||||
}
|
||||
}()
|
||||
|
||||
select {
|
||||
case result := <-resultChan:
|
||||
if result.err != nil {
|
||||
return nil, result.err
|
||||
}
|
||||
go ssh.DiscardRequests(result.reqs)
|
||||
return result.channel, nil
|
||||
case <-time.After(5 * time.Second):
|
||||
return nil, errors.New("timeout opening forwarded-tcpip channel")
|
||||
}
|
||||
}
|
||||
|
||||
func (hs *httpServer) cleanupUnusedChannel(channel ssh.Channel, reqs <-chan *ssh.Request) {
|
||||
if channel != nil {
|
||||
if err := channel.Close(); err != nil {
|
||||
log.Printf("Failed to close unused channel: %v", err)
|
||||
}
|
||||
go ssh.DiscardRequests(reqs)
|
||||
}
|
||||
}
|
||||
|
||||
func (hs *httpServer) setupMiddlewares(hw HTTPWriter) {
|
||||
fingerprintMiddleware := NewTunnelFingerprint()
|
||||
forwardedForMiddleware := NewForwardedFor(hw.RemoteAddr())
|
||||
|
||||
hw.UseResponseMiddleware(fingerprintMiddleware)
|
||||
hw.UseRequestMiddleware(forwardedForMiddleware)
|
||||
}
|
||||
|
||||
func (hs *httpServer) sendInitialRequest(hw HTTPWriter, initialRequest httpheader.RequestHeader, channel ssh.Channel) error {
|
||||
hw.SetRequestHeader(initialRequest)
|
||||
|
||||
if err := hw.ApplyRequestMiddlewares(initialRequest); err != nil {
|
||||
return fmt.Errorf("error applying request middlewares: %w", err)
|
||||
}
|
||||
|
||||
if _, err := channel.Write(initialRequest.Finalize()); err != nil {
|
||||
return fmt.Errorf("error writing to channel: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
@@ -1,254 +0,0 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io"
|
||||
"log"
|
||||
"net"
|
||||
"regexp"
|
||||
"tunnel_pls/internal/httpheader"
|
||||
)
|
||||
|
||||
type HTTPWriter interface {
|
||||
io.ReadWriteCloser
|
||||
CloseWrite() error
|
||||
RemoteAddr() net.Addr
|
||||
UseResponseMiddleware(mw ResponseMiddleware)
|
||||
UseRequestMiddleware(mw RequestMiddleware)
|
||||
SetRequestHeader(header httpheader.RequestHeader)
|
||||
RequestMiddlewares() []RequestMiddleware
|
||||
ResponseMiddlewares() []ResponseMiddleware
|
||||
ApplyResponseMiddlewares(resphf httpheader.ResponseHeader, body []byte) error
|
||||
ApplyRequestMiddlewares(reqhf httpheader.RequestHeader) error
|
||||
}
|
||||
|
||||
type httpWriter struct {
|
||||
remoteAddr net.Addr
|
||||
writer io.Writer
|
||||
reader io.Reader
|
||||
headerBuf []byte
|
||||
buf []byte
|
||||
respHeader httpheader.ResponseHeader
|
||||
reqHeader httpheader.RequestHeader
|
||||
respMW []ResponseMiddleware
|
||||
reqMW []RequestMiddleware
|
||||
}
|
||||
|
||||
var DELIMITER = []byte{0x0D, 0x0A, 0x0D, 0x0A}
|
||||
var requestLine = regexp.MustCompile(`^(GET|POST|PUT|DELETE|HEAD|OPTIONS|PATCH|TRACE|CONNECT) \S+ HTTP/\d\.\d$`)
|
||||
var responseLine = regexp.MustCompile(`^HTTP/\d\.\d \d{3} .+`)
|
||||
|
||||
func (hw *httpWriter) RemoteAddr() net.Addr {
|
||||
return hw.remoteAddr
|
||||
}
|
||||
|
||||
func (hw *httpWriter) UseResponseMiddleware(mw ResponseMiddleware) {
|
||||
hw.respMW = append(hw.respMW, mw)
|
||||
}
|
||||
|
||||
func (hw *httpWriter) UseRequestMiddleware(mw RequestMiddleware) {
|
||||
hw.reqMW = append(hw.reqMW, mw)
|
||||
}
|
||||
|
||||
func (hw *httpWriter) SetRequestHeader(header httpheader.RequestHeader) {
|
||||
hw.reqHeader = header
|
||||
}
|
||||
|
||||
func (hw *httpWriter) RequestMiddlewares() []RequestMiddleware {
|
||||
return hw.reqMW
|
||||
}
|
||||
|
||||
func (hw *httpWriter) ResponseMiddlewares() []ResponseMiddleware {
|
||||
return hw.respMW
|
||||
}
|
||||
func (hw *httpWriter) Close() error {
|
||||
return hw.writer.(io.Closer).Close()
|
||||
}
|
||||
|
||||
func (hw *httpWriter) CloseWrite() error {
|
||||
if closer, ok := hw.writer.(interface{ CloseWrite() error }); ok {
|
||||
return closer.CloseWrite()
|
||||
}
|
||||
return hw.Close()
|
||||
}
|
||||
|
||||
func (hw *httpWriter) Read(p []byte) (int, error) {
|
||||
tmp := make([]byte, len(p))
|
||||
read, err := hw.reader.Read(tmp)
|
||||
if read == 0 && err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
tmp = tmp[:read]
|
||||
|
||||
headerEndIdx := bytes.Index(tmp, DELIMITER)
|
||||
if headerEndIdx == -1 {
|
||||
return hw.handleNoDelimiter(p, tmp, err)
|
||||
}
|
||||
|
||||
header, body := hw.splitHeaderAndBody(tmp, headerEndIdx)
|
||||
|
||||
if !isHTTPHeader(header) {
|
||||
copy(p, tmp)
|
||||
return read, nil
|
||||
}
|
||||
|
||||
return hw.processHTTPRequest(p, header, body)
|
||||
}
|
||||
|
||||
func (hw *httpWriter) handleNoDelimiter(p, tmp []byte, err error) (int, error) {
|
||||
copy(p, tmp)
|
||||
return len(tmp), err
|
||||
}
|
||||
|
||||
func (hw *httpWriter) splitHeaderAndBody(data []byte, delimiterIdx int) ([]byte, []byte) {
|
||||
header := data[:delimiterIdx+len(DELIMITER)]
|
||||
body := data[delimiterIdx+len(DELIMITER):]
|
||||
return header, body
|
||||
}
|
||||
|
||||
func (hw *httpWriter) processHTTPRequest(p, header, body []byte) (int, error) {
|
||||
reqhf, err := httpheader.NewRequestHeader(header)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
if err = hw.ApplyRequestMiddlewares(reqhf); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
hw.reqHeader = reqhf
|
||||
combined := append(reqhf.Finalize(), body...)
|
||||
return copy(p, combined), nil
|
||||
}
|
||||
|
||||
func (hw *httpWriter) ApplyRequestMiddlewares(reqhf httpheader.RequestHeader) error {
|
||||
for _, m := range hw.RequestMiddlewares() {
|
||||
if err := m.HandleRequest(reqhf); err != nil {
|
||||
log.Printf("Error when applying request middleware: %v", err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (hw *httpWriter) Write(p []byte) (int, error) {
|
||||
if hw.shouldBypassBuffering(p) {
|
||||
hw.respHeader = nil
|
||||
}
|
||||
|
||||
if hw.respHeader != nil {
|
||||
return hw.writer.Write(p)
|
||||
}
|
||||
|
||||
hw.buf = append(hw.buf, p...)
|
||||
|
||||
headerEndIdx := bytes.Index(hw.buf, DELIMITER)
|
||||
if headerEndIdx == -1 {
|
||||
return len(p), nil
|
||||
}
|
||||
|
||||
return hw.processBufferedResponse(p, headerEndIdx)
|
||||
}
|
||||
|
||||
func (hw *httpWriter) shouldBypassBuffering(p []byte) bool {
|
||||
return hw.respHeader != nil && len(hw.buf) == 0 && len(p) >= 5 && string(p[0:5]) == "HTTP/"
|
||||
}
|
||||
|
||||
func (hw *httpWriter) processBufferedResponse(p []byte, delimiterIdx int) (int, error) {
|
||||
header, body := hw.splitHeaderAndBody(hw.buf, delimiterIdx)
|
||||
|
||||
if !isHTTPHeader(header) {
|
||||
return hw.writeRawBuffer()
|
||||
}
|
||||
|
||||
if err := hw.processHTTPResponse(header, body); err != nil {
|
||||
return 0, err
|
||||
}
|
||||
|
||||
hw.buf = nil
|
||||
return len(p), nil
|
||||
}
|
||||
|
||||
func (hw *httpWriter) writeRawBuffer() (int, error) {
|
||||
_, err := hw.writer.Write(hw.buf)
|
||||
length := len(hw.buf)
|
||||
hw.buf = nil
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return length, nil
|
||||
}
|
||||
|
||||
func (hw *httpWriter) processHTTPResponse(header, body []byte) error {
|
||||
resphf, err := httpheader.NewResponseHeader(header)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err = hw.ApplyResponseMiddlewares(resphf, body); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
hw.respHeader = resphf
|
||||
finalHeader := resphf.Finalize()
|
||||
|
||||
if err = hw.writeHeaderAndBody(finalHeader, body); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (hw *httpWriter) ApplyResponseMiddlewares(resphf httpheader.ResponseHeader, body []byte) error {
|
||||
for _, m := range hw.ResponseMiddlewares() {
|
||||
if err := m.HandleResponse(resphf, body); err != nil {
|
||||
log.Printf("Cannot apply middleware: %s\n", err)
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func (hw *httpWriter) writeHeaderAndBody(header, body []byte) error {
|
||||
if _, err := hw.writer.Write(header); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if len(body) > 0 {
|
||||
if _, err := hw.writer.Write(body); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func NewHTTPWriter(writer io.Writer, reader io.Reader, remoteAddr net.Addr) HTTPWriter {
|
||||
return &httpWriter{
|
||||
remoteAddr: remoteAddr,
|
||||
writer: writer,
|
||||
reader: reader,
|
||||
buf: make([]byte, 0, 4096),
|
||||
}
|
||||
}
|
||||
|
||||
func isHTTPHeader(buf []byte) bool {
|
||||
lines := bytes.Split(buf, []byte("\r\n"))
|
||||
|
||||
startLine := string(lines[0])
|
||||
if !requestLine.MatchString(startLine) && !responseLine.MatchString(startLine) {
|
||||
return false
|
||||
}
|
||||
|
||||
for _, line := range lines[1:] {
|
||||
if len(line) == 0 {
|
||||
break
|
||||
}
|
||||
colonIdx := bytes.IndexByte(line, ':')
|
||||
if colonIdx <= 0 {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
@@ -1,42 +0,0 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"net"
|
||||
"tunnel_pls/internal/httpheader"
|
||||
)
|
||||
|
||||
type RequestMiddleware interface {
|
||||
HandleRequest(header httpheader.RequestHeader) error
|
||||
}
|
||||
|
||||
type ResponseMiddleware interface {
|
||||
HandleResponse(header httpheader.ResponseHeader, body []byte) error
|
||||
}
|
||||
|
||||
type TunnelFingerprint struct{}
|
||||
|
||||
func NewTunnelFingerprint() *TunnelFingerprint {
|
||||
return &TunnelFingerprint{}
|
||||
}
|
||||
|
||||
func (h *TunnelFingerprint) HandleResponse(header httpheader.ResponseHeader, body []byte) error {
|
||||
header.Set("Server", "Tunnel Please")
|
||||
return nil
|
||||
}
|
||||
|
||||
type ForwardedFor struct {
|
||||
addr net.Addr
|
||||
}
|
||||
|
||||
func NewForwardedFor(addr net.Addr) *ForwardedFor {
|
||||
return &ForwardedFor{addr: addr}
|
||||
}
|
||||
|
||||
func (ff *ForwardedFor) HandleRequest(header httpheader.RequestHeader) error {
|
||||
host, _, err := net.SplitHostPort(ff.addr.String())
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
header.Set("X-Forwarded-For", host)
|
||||
return nil
|
||||
}
|
||||
+12
-27
@@ -7,9 +7,9 @@ import (
|
||||
"log"
|
||||
"net"
|
||||
"time"
|
||||
"tunnel_pls/internal/config"
|
||||
"tunnel_pls/internal/grpc/client"
|
||||
"tunnel_pls/internal/port"
|
||||
"tunnel_pls/internal/registry"
|
||||
"tunnel_pls/session"
|
||||
|
||||
"golang.org/x/crypto/ssh"
|
||||
@@ -20,38 +20,23 @@ type Server interface {
|
||||
Close() error
|
||||
}
|
||||
type server struct {
|
||||
listener net.Listener
|
||||
sshPort string
|
||||
sshListener net.Listener
|
||||
config *ssh.ServerConfig
|
||||
grpcClient client.Client
|
||||
sessionRegistry session.Registry
|
||||
portRegistry port.Registry
|
||||
sessionRegistry registry.Registry
|
||||
portRegistry port.Port
|
||||
}
|
||||
|
||||
func New(sshConfig *ssh.ServerConfig, sessionRegistry session.Registry, grpcClient client.Client, portRegistry port.Registry) (Server, error) {
|
||||
listener, err := net.Listen("tcp", fmt.Sprintf(":%s", config.Getenv("PORT", "2200")))
|
||||
func New(sshConfig *ssh.ServerConfig, sessionRegistry registry.Registry, grpcClient client.Client, portRegistry port.Port, sshPort string) (Server, error) {
|
||||
listener, err := net.Listen("tcp", fmt.Sprintf(":%s", sshPort))
|
||||
if err != nil {
|
||||
log.Fatalf("failed to listen on port 2200: %v", err)
|
||||
return nil, err
|
||||
}
|
||||
redirectTLS := config.Getenv("TLS_ENABLED", "false") == "true" && config.Getenv("TLS_REDIRECT", "false") == "true"
|
||||
|
||||
HttpServer := NewHTTPServer(sessionRegistry, redirectTLS)
|
||||
err = HttpServer.ListenAndServe()
|
||||
if err != nil {
|
||||
log.Fatalf("failed to start http server: %v", err)
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if config.Getenv("TLS_ENABLED", "false") == "true" {
|
||||
err = HttpServer.ListenAndServeTLS()
|
||||
if err != nil {
|
||||
log.Fatalf("failed to start https server: %v", err)
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
return &server{
|
||||
listener: listener,
|
||||
sshPort: sshPort,
|
||||
sshListener: listener,
|
||||
config: sshConfig,
|
||||
grpcClient: grpcClient,
|
||||
sessionRegistry: sessionRegistry,
|
||||
@@ -60,9 +45,9 @@ func New(sshConfig *ssh.ServerConfig, sessionRegistry session.Registry, grpcClie
|
||||
}
|
||||
|
||||
func (s *server) Start() {
|
||||
log.Println("SSH server is starting on port 2200...")
|
||||
log.Printf("SSH server is starting on port %s", s.sshPort)
|
||||
for {
|
||||
conn, err := s.listener.Accept()
|
||||
conn, err := s.sshListener.Accept()
|
||||
if err != nil {
|
||||
if errors.Is(err, net.ErrClosed) {
|
||||
log.Println("listener closed, stopping server")
|
||||
@@ -77,7 +62,7 @@ func (s *server) Start() {
|
||||
}
|
||||
|
||||
func (s *server) Close() error {
|
||||
return s.listener.Close()
|
||||
return s.sshListener.Close()
|
||||
}
|
||||
|
||||
func (s *server) handleConnection(conn net.Conn) {
|
||||
|
||||
-330
@@ -1,330 +0,0 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"log"
|
||||
"os"
|
||||
"sync"
|
||||
"time"
|
||||
"tunnel_pls/internal/config"
|
||||
|
||||
"github.com/caddyserver/certmagic"
|
||||
"github.com/libdns/cloudflare"
|
||||
)
|
||||
|
||||
type TLSManager interface {
|
||||
userCertsExistAndValid() bool
|
||||
loadUserCerts() error
|
||||
startCertWatcher()
|
||||
initCertMagic() error
|
||||
getTLSConfig() *tls.Config
|
||||
getCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error)
|
||||
}
|
||||
|
||||
type tlsManager struct {
|
||||
domain string
|
||||
certPath string
|
||||
keyPath string
|
||||
storagePath string
|
||||
|
||||
userCert *tls.Certificate
|
||||
userCertMu sync.RWMutex
|
||||
|
||||
magic *certmagic.Config
|
||||
|
||||
useCertMagic bool
|
||||
}
|
||||
|
||||
var globalTLSManager TLSManager
|
||||
var tlsManagerOnce sync.Once
|
||||
|
||||
func NewTLSConfig(domain string) (*tls.Config, error) {
|
||||
var initErr error
|
||||
|
||||
tlsManagerOnce.Do(func() {
|
||||
certPath := "certs/tls/cert.pem"
|
||||
keyPath := "certs/tls/privkey.pem"
|
||||
storagePath := "certs/tls/certmagic"
|
||||
|
||||
tm := &tlsManager{
|
||||
domain: domain,
|
||||
certPath: certPath,
|
||||
keyPath: keyPath,
|
||||
storagePath: storagePath,
|
||||
}
|
||||
|
||||
if tm.userCertsExistAndValid() {
|
||||
log.Printf("Using user-provided certificates from %s and %s", certPath, keyPath)
|
||||
if err := tm.loadUserCerts(); err != nil {
|
||||
initErr = fmt.Errorf("failed to load user certificates: %w", err)
|
||||
return
|
||||
}
|
||||
tm.useCertMagic = false
|
||||
tm.startCertWatcher()
|
||||
} else {
|
||||
if !isACMEConfigComplete() {
|
||||
log.Printf("User certificates missing or invalid, and ACME configuration is incomplete")
|
||||
log.Printf("To enable automatic certificate generation, set CF_API_TOKEN environment variable")
|
||||
initErr = fmt.Errorf("no valid certificates found and ACME configuration is incomplete (CF_API_TOKEN is required)")
|
||||
return
|
||||
}
|
||||
|
||||
log.Printf("User certificates missing or don't cover %s and *.%s, using CertMagic", domain, domain)
|
||||
if err := tm.initCertMagic(); err != nil {
|
||||
initErr = fmt.Errorf("failed to initialize CertMagic: %w", err)
|
||||
return
|
||||
}
|
||||
tm.useCertMagic = true
|
||||
}
|
||||
|
||||
globalTLSManager = tm
|
||||
})
|
||||
|
||||
if initErr != nil {
|
||||
return nil, initErr
|
||||
}
|
||||
|
||||
return globalTLSManager.getTLSConfig(), nil
|
||||
}
|
||||
|
||||
func isACMEConfigComplete() bool {
|
||||
cfAPIToken := config.Getenv("CF_API_TOKEN", "")
|
||||
return cfAPIToken != ""
|
||||
}
|
||||
|
||||
func (tm *tlsManager) userCertsExistAndValid() bool {
|
||||
if _, err := os.Stat(tm.certPath); os.IsNotExist(err) {
|
||||
log.Printf("Certificate file not found: %s", tm.certPath)
|
||||
return false
|
||||
}
|
||||
if _, err := os.Stat(tm.keyPath); os.IsNotExist(err) {
|
||||
log.Printf("Key file not found: %s", tm.keyPath)
|
||||
return false
|
||||
}
|
||||
|
||||
return ValidateCertDomains(tm.certPath, tm.domain)
|
||||
}
|
||||
|
||||
func ValidateCertDomains(certPath, domain string) bool {
|
||||
certPEM, err := os.ReadFile(certPath)
|
||||
if err != nil {
|
||||
log.Printf("Failed to read certificate: %v", err)
|
||||
return false
|
||||
}
|
||||
|
||||
block, _ := pem.Decode(certPEM)
|
||||
if block == nil {
|
||||
log.Printf("Failed to decode PEM block from certificate")
|
||||
return false
|
||||
}
|
||||
|
||||
cert, err := x509.ParseCertificate(block.Bytes)
|
||||
if err != nil {
|
||||
log.Printf("Failed to parse certificate: %v", err)
|
||||
return false
|
||||
}
|
||||
|
||||
if time.Now().After(cert.NotAfter) {
|
||||
log.Printf("Certificate has expired (NotAfter: %v)", cert.NotAfter)
|
||||
return false
|
||||
}
|
||||
|
||||
if time.Now().Add(30 * 24 * time.Hour).After(cert.NotAfter) {
|
||||
log.Printf("Certificate expiring soon (NotAfter: %v), will use CertMagic for renewal", cert.NotAfter)
|
||||
return false
|
||||
}
|
||||
|
||||
var certDomains []string
|
||||
if cert.Subject.CommonName != "" {
|
||||
certDomains = append(certDomains, cert.Subject.CommonName)
|
||||
}
|
||||
certDomains = append(certDomains, cert.DNSNames...)
|
||||
|
||||
hasBase := false
|
||||
hasWildcard := false
|
||||
wildcardDomain := "*." + domain
|
||||
|
||||
for _, d := range certDomains {
|
||||
if d == domain {
|
||||
hasBase = true
|
||||
}
|
||||
if d == wildcardDomain {
|
||||
hasWildcard = true
|
||||
}
|
||||
}
|
||||
|
||||
if !hasBase {
|
||||
log.Printf("Certificate does not cover base domain: %s", domain)
|
||||
}
|
||||
if !hasWildcard {
|
||||
log.Printf("Certificate does not cover wildcard domain: %s", wildcardDomain)
|
||||
}
|
||||
|
||||
return hasBase && hasWildcard
|
||||
}
|
||||
|
||||
func (tm *tlsManager) loadUserCerts() error {
|
||||
cert, err := tls.LoadX509KeyPair(tm.certPath, tm.keyPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
tm.userCertMu.Lock()
|
||||
tm.userCert = &cert
|
||||
tm.userCertMu.Unlock()
|
||||
|
||||
log.Printf("Loaded user certificates successfully")
|
||||
return nil
|
||||
}
|
||||
|
||||
func (tm *tlsManager) startCertWatcher() {
|
||||
go func() {
|
||||
var lastCertMod, lastKeyMod time.Time
|
||||
|
||||
if info, err := os.Stat(tm.certPath); err == nil {
|
||||
lastCertMod = info.ModTime()
|
||||
}
|
||||
if info, err := os.Stat(tm.keyPath); err == nil {
|
||||
lastKeyMod = info.ModTime()
|
||||
}
|
||||
|
||||
ticker := time.NewTicker(30 * time.Second)
|
||||
defer ticker.Stop()
|
||||
|
||||
for range ticker.C {
|
||||
certInfo, certErr := os.Stat(tm.certPath)
|
||||
keyInfo, keyErr := os.Stat(tm.keyPath)
|
||||
|
||||
if certErr != nil || keyErr != nil {
|
||||
continue
|
||||
}
|
||||
|
||||
if certInfo.ModTime().After(lastCertMod) || keyInfo.ModTime().After(lastKeyMod) {
|
||||
log.Printf("Certificate files changed, reloading...")
|
||||
|
||||
if !ValidateCertDomains(tm.certPath, tm.domain) {
|
||||
log.Printf("New certificates don't cover required domains")
|
||||
|
||||
if !isACMEConfigComplete() {
|
||||
log.Printf("Cannot switch to CertMagic: ACME configuration is incomplete (CF_API_TOKEN is required)")
|
||||
continue
|
||||
}
|
||||
|
||||
log.Printf("Switching to CertMagic for automatic certificate management")
|
||||
if err := tm.initCertMagic(); err != nil {
|
||||
log.Printf("Failed to initialize CertMagic: %v", err)
|
||||
continue
|
||||
}
|
||||
tm.useCertMagic = true
|
||||
return
|
||||
}
|
||||
|
||||
if err := tm.loadUserCerts(); err != nil {
|
||||
log.Printf("Failed to reload certificates: %v", err)
|
||||
continue
|
||||
}
|
||||
|
||||
lastCertMod = certInfo.ModTime()
|
||||
lastKeyMod = keyInfo.ModTime()
|
||||
log.Printf("Certificates reloaded successfully")
|
||||
}
|
||||
}
|
||||
}()
|
||||
}
|
||||
|
||||
func (tm *tlsManager) initCertMagic() error {
|
||||
if err := os.MkdirAll(tm.storagePath, 0700); err != nil {
|
||||
return fmt.Errorf("failed to create cert storage directory: %w", err)
|
||||
}
|
||||
|
||||
acmeEmail := config.Getenv("ACME_EMAIL", "admin@"+tm.domain)
|
||||
cfAPIToken := config.Getenv("CF_API_TOKEN", "")
|
||||
acmeStaging := config.Getenv("ACME_STAGING", "false") == "true"
|
||||
|
||||
if cfAPIToken == "" {
|
||||
return fmt.Errorf("CF_API_TOKEN environment variable is required for automatic certificate generation")
|
||||
}
|
||||
|
||||
cfProvider := &cloudflare.Provider{
|
||||
APIToken: cfAPIToken,
|
||||
}
|
||||
|
||||
storage := &certmagic.FileStorage{Path: tm.storagePath}
|
||||
|
||||
cache := certmagic.NewCache(certmagic.CacheOptions{
|
||||
GetConfigForCert: func(cert certmagic.Certificate) (*certmagic.Config, error) {
|
||||
return tm.magic, nil
|
||||
},
|
||||
})
|
||||
|
||||
magic := certmagic.New(cache, certmagic.Config{
|
||||
Storage: storage,
|
||||
})
|
||||
|
||||
acmeIssuer := certmagic.NewACMEIssuer(magic, certmagic.ACMEIssuer{
|
||||
Email: acmeEmail,
|
||||
Agreed: true,
|
||||
DNS01Solver: &certmagic.DNS01Solver{
|
||||
DNSManager: certmagic.DNSManager{
|
||||
DNSProvider: cfProvider,
|
||||
},
|
||||
},
|
||||
})
|
||||
|
||||
if acmeStaging {
|
||||
acmeIssuer.CA = certmagic.LetsEncryptStagingCA
|
||||
log.Printf("Using Let's Encrypt staging server")
|
||||
} else {
|
||||
acmeIssuer.CA = certmagic.LetsEncryptProductionCA
|
||||
log.Printf("Using Let's Encrypt production server")
|
||||
}
|
||||
|
||||
magic.Issuers = []certmagic.Issuer{acmeIssuer}
|
||||
tm.magic = magic
|
||||
|
||||
domains := []string{tm.domain, "*." + tm.domain}
|
||||
log.Printf("Requesting certificates for: %v", domains)
|
||||
|
||||
ctx := context.Background()
|
||||
if err := magic.ManageSync(ctx, domains); err != nil {
|
||||
return fmt.Errorf("failed to obtain certificates: %w", err)
|
||||
}
|
||||
|
||||
log.Printf("Certificates obtained successfully for %v", domains)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (tm *tlsManager) getTLSConfig() *tls.Config {
|
||||
return &tls.Config{
|
||||
GetCertificate: tm.getCertificate,
|
||||
|
||||
MinVersion: tls.VersionTLS13,
|
||||
MaxVersion: tls.VersionTLS13,
|
||||
|
||||
CurvePreferences: []tls.CurveID{
|
||||
tls.X25519,
|
||||
},
|
||||
|
||||
SessionTicketsDisabled: false,
|
||||
ClientAuth: tls.NoClientCert,
|
||||
}
|
||||
}
|
||||
|
||||
func (tm *tlsManager) getCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {
|
||||
if tm.useCertMagic {
|
||||
return tm.magic.GetCertificate(hello)
|
||||
}
|
||||
|
||||
tm.userCertMu.RLock()
|
||||
defer tm.userCertMu.RUnlock()
|
||||
|
||||
if tm.userCert == nil {
|
||||
return nil, fmt.Errorf("no certificate available")
|
||||
}
|
||||
|
||||
return tm.userCert, nil
|
||||
}
|
||||
Reference in New Issue
Block a user