|
| 1 | +package main |
| 2 | + |
| 3 | +import ( |
| 4 | + "bytes" |
| 5 | + "crypto/ed25519" |
| 6 | + "crypto/tls" |
| 7 | + "crypto/x509" |
| 8 | + "errors" |
| 9 | + "flag" |
| 10 | + "io" |
| 11 | + "log" |
| 12 | + "net" |
| 13 | + "os" |
| 14 | + "sync" |
| 15 | + |
| 16 | + "golang.org/x/crypto/ssh" |
| 17 | +) |
| 18 | + |
| 19 | +var verbose bool |
| 20 | + |
| 21 | +func parseSSHPubKey(path string) (ed25519.PublicKey, error) { |
| 22 | + type sshPubKey struct { |
| 23 | + Algo string |
| 24 | + Data []byte |
| 25 | + } |
| 26 | + |
| 27 | + data, err := os.ReadFile(path) |
| 28 | + if err != nil { |
| 29 | + return nil, err |
| 30 | + } |
| 31 | + |
| 32 | + pub, _, _, _, err := ssh.ParseAuthorizedKey(data) |
| 33 | + if err != nil { |
| 34 | + return nil, err |
| 35 | + } |
| 36 | + |
| 37 | + var key sshPubKey |
| 38 | + if err := ssh.Unmarshal(pub.Marshal(), &key); err != nil { |
| 39 | + return nil, err |
| 40 | + } |
| 41 | + |
| 42 | + if key.Algo != "ssh-ed25519" { |
| 43 | + return nil, errors.New("not ed25519") |
| 44 | + } |
| 45 | + |
| 46 | + return ed25519.PublicKey(key.Data), nil |
| 47 | +} |
| 48 | + |
| 49 | +var ( |
| 50 | + activeConn net.Conn |
| 51 | + activeConnMu sync.Mutex |
| 52 | +) |
| 53 | + |
| 54 | +func main() { |
| 55 | + certFile := flag.String("cert", "", "Server TLS certificate file") |
| 56 | + keyFile := flag.String("key", "", "Server TLS private key file") |
| 57 | + clientKeyFile := flag.String("client-key", "", "Client SSH ed25519 public key file") |
| 58 | + listenAddr := flag.String("listen", ":8443", "Address to listen on (host:port)") |
| 59 | + socketPath := flag.String("socket", "", "Unix domain socket path") |
| 60 | + bufferSize := flag.Int("buffer", 1024, "Buffer size in messages") |
| 61 | + flag.BoolVar(&verbose, "v", false, "Verbose logging") |
| 62 | + flag.Parse() |
| 63 | + |
| 64 | + if *certFile == "" || *keyFile == "" || *clientKeyFile == "" || *socketPath == "" { |
| 65 | + log.Fatal("Required flags: -cert, -key, -client-key, -socket") |
| 66 | + } |
| 67 | + |
| 68 | + serverCert, err := tls.LoadX509KeyPair(*certFile, *keyFile) |
| 69 | + if err != nil { |
| 70 | + log.Fatalf("Failed to load server certificate: %v", err) |
| 71 | + } |
| 72 | + |
| 73 | + expectedKey, err := parseSSHPubKey(*clientKeyFile) |
| 74 | + if err != nil { |
| 75 | + log.Fatalf("Failed to parse client SSH public key: %v", err) |
| 76 | + } |
| 77 | + log.Printf("Loaded client public key from %s", *clientKeyFile) |
| 78 | + |
| 79 | + tlsConfig := &tls.Config{ |
| 80 | + Certificates: []tls.Certificate{serverCert}, |
| 81 | + ClientAuth: tls.RequireAnyClientCert, |
| 82 | + VerifyPeerCertificate: func(rawCerts [][]byte, _ [][]*x509.Certificate) error { |
| 83 | + cert, err := x509.ParseCertificate(rawCerts[0]) |
| 84 | + if err != nil { |
| 85 | + return err |
| 86 | + } |
| 87 | + if ed, ok := cert.PublicKey.(ed25519.PublicKey); ok && bytes.Equal(ed, expectedKey) { |
| 88 | + return nil |
| 89 | + } |
| 90 | + return errors.New("key mismatch") |
| 91 | + }, |
| 92 | + } |
| 93 | + |
| 94 | + listener, err := tls.Listen("tcp", *listenAddr, tlsConfig) |
| 95 | + if err != nil { |
| 96 | + log.Fatalf("Failed to listen on %s: %v", *listenAddr, err) |
| 97 | + } |
| 98 | + defer listener.Close() |
| 99 | + |
| 100 | + log.Printf("Listening on %s, forwarding to %s", *listenAddr, *socketPath) |
| 101 | + |
| 102 | + for { |
| 103 | + conn, err := listener.Accept() |
| 104 | + if err != nil { |
| 105 | + log.Printf("Accept error: %v", err) |
| 106 | + continue |
| 107 | + } |
| 108 | + |
| 109 | + tlsConn := conn.(*tls.Conn) |
| 110 | + if err := tlsConn.Handshake(); err != nil { |
| 111 | + log.Printf("TLS handshake failed: %v", err) |
| 112 | + conn.Close() |
| 113 | + continue |
| 114 | + } |
| 115 | + |
| 116 | + activeConnMu.Lock() |
| 117 | + if activeConn != nil { |
| 118 | + log.Printf("Closing previous connection from %s", activeConn.RemoteAddr()) |
| 119 | + activeConn.Close() |
| 120 | + } |
| 121 | + activeConn = conn |
| 122 | + activeConnMu.Unlock() |
| 123 | + |
| 124 | + log.Printf("Connection accepted from %s", conn.RemoteAddr()) |
| 125 | + go handleConnection(conn, *socketPath, *bufferSize) |
| 126 | + } |
| 127 | +} |
| 128 | + |
| 129 | +func handleConnection(conn net.Conn, socketPath string, bufferSize int) { |
| 130 | + defer conn.Close() |
| 131 | + defer func() { |
| 132 | + activeConnMu.Lock() |
| 133 | + if activeConn == conn { |
| 134 | + activeConn = nil |
| 135 | + } |
| 136 | + activeConnMu.Unlock() |
| 137 | + }() |
| 138 | + |
| 139 | + udsConn, err := net.Dial("unix", socketPath) |
| 140 | + if err != nil { |
| 141 | + log.Printf("Failed to connect to UDS %s: %v", socketPath, err) |
| 142 | + return |
| 143 | + } |
| 144 | + defer udsConn.Close() |
| 145 | + |
| 146 | + ch := make(chan []byte, bufferSize) |
| 147 | + |
| 148 | + // Writer goroutine: reads from channel and writes to UDS |
| 149 | + var wg sync.WaitGroup |
| 150 | + wg.Add(1) |
| 151 | + go func() { |
| 152 | + defer wg.Done() |
| 153 | + for data := range ch { |
| 154 | + if verbose { |
| 155 | + log.Printf("Writing %d bytes to UDS: %q", len(data), string(data)) |
| 156 | + } |
| 157 | + if _, err := udsConn.Write(data); err != nil { |
| 158 | + log.Printf("UDS write error: %v", err) |
| 159 | + return |
| 160 | + } |
| 161 | + } |
| 162 | + }() |
| 163 | + |
| 164 | + // Reader: reads from TLS conn and sends to channel (non-blocking) |
| 165 | + buf := make([]byte, 1024) |
| 166 | + for { |
| 167 | + n, err := conn.Read(buf) |
| 168 | + if err != nil { |
| 169 | + if err != io.EOF { |
| 170 | + log.Printf("Read error: %v", err) |
| 171 | + } |
| 172 | + break |
| 173 | + } |
| 174 | + |
| 175 | + data := make([]byte, n) |
| 176 | + copy(data, buf[:n]) |
| 177 | + |
| 178 | + select { |
| 179 | + case ch <- data: |
| 180 | + default: |
| 181 | + log.Printf("Buffer full, disconnecting client") |
| 182 | + conn.Close() |
| 183 | + break |
| 184 | + } |
| 185 | + } |
| 186 | + |
| 187 | + close(ch) |
| 188 | + wg.Wait() |
| 189 | + log.Printf("Connection closed from %s", conn.RemoteAddr()) |
| 190 | +} |
0 commit comments