Merged all workspace projects into a single binary project
This commit is contained in:
125
src/tcp_relay_server/mod.rs
Normal file
125
src/tcp_relay_server/mod.rs
Normal file
@ -0,0 +1,125 @@
|
||||
use std::sync::Arc;
|
||||
|
||||
use actix_web::web::Data;
|
||||
use actix_web::{middleware, web, App, HttpRequest, HttpResponse, HttpServer, Responder};
|
||||
|
||||
use crate::base::{cert_utils, RelayedPort};
|
||||
|
||||
use crate::tcp_relay_server::relay_ws::relay_ws;
|
||||
use crate::tcp_relay_server::server_config::ServerConfig;
|
||||
use crate::tcp_relay_server::tls_cert_client_verifier::CustomCertClientVerifier;
|
||||
|
||||
mod relay_ws;
|
||||
pub mod server_config;
|
||||
mod tls_cert_client_verifier;
|
||||
|
||||
pub async fn hello_route() -> &'static str {
|
||||
"Hello world!"
|
||||
}
|
||||
|
||||
pub async fn config_route(req: HttpRequest, data: Data<Arc<ServerConfig>>) -> impl Responder {
|
||||
if data.has_token_auth() {
|
||||
let token = req
|
||||
.headers()
|
||||
.get("Authorization")
|
||||
.map(|t| t.to_str().unwrap_or_default())
|
||||
.unwrap_or_default()
|
||||
.strip_prefix("Bearer ")
|
||||
.unwrap_or_default();
|
||||
|
||||
if !data.tokens.iter().any(|t| t.eq(token)) {
|
||||
return HttpResponse::Unauthorized().json("Missing / invalid token");
|
||||
}
|
||||
}
|
||||
|
||||
HttpResponse::Ok().json(
|
||||
data.ports
|
||||
.iter()
|
||||
.enumerate()
|
||||
.map(|(id, port)| RelayedPort {
|
||||
id,
|
||||
port: port + data.increment_ports,
|
||||
})
|
||||
.collect::<Vec<_>>(),
|
||||
)
|
||||
}
|
||||
|
||||
pub async fn run_app(mut config: ServerConfig) -> std::io::Result<()> {
|
||||
// Check if no port are to be forwarded
|
||||
if config.ports.is_empty() {
|
||||
log::error!("No port to forward!");
|
||||
std::process::exit(2);
|
||||
}
|
||||
|
||||
// Read tokens from file, if any
|
||||
if let Some(file) = &config.tokens_file {
|
||||
std::fs::read_to_string(file)
|
||||
.expect("Failed to read tokens file!")
|
||||
.split('\n')
|
||||
.filter(|l| !l.is_empty())
|
||||
.for_each(|t| config.tokens.push(t.to_string()));
|
||||
}
|
||||
|
||||
if !config.has_auth() {
|
||||
log::error!("No authentication method specified!");
|
||||
std::process::exit(3);
|
||||
}
|
||||
|
||||
if config.has_tls_client_auth() && !config.has_tls_config() {
|
||||
log::error!("Cannot provide client auth without TLS configuration!");
|
||||
panic!();
|
||||
}
|
||||
|
||||
let args = Arc::new(config);
|
||||
|
||||
// Load TLS configuration, if any
|
||||
let tls_config = if let (Some(cert), Some(key)) = (&args.tls_cert, &args.tls_key) {
|
||||
// Load TLS certificate & private key
|
||||
let cert_file = std::fs::read(cert).expect("Failed to read certificate file");
|
||||
let key_file = std::fs::read(key).expect("Failed to read server private key");
|
||||
|
||||
// Get certificates chain
|
||||
let cert_chain =
|
||||
cert_utils::parse_pem_certificates(&cert_file).expect("Failed to extract certificates");
|
||||
|
||||
// Get private key
|
||||
let key =
|
||||
cert_utils::parse_pem_private_key(&key_file).expect("Failed to extract private key!");
|
||||
|
||||
let config = rustls::ServerConfig::builder().with_safe_defaults();
|
||||
|
||||
let config = match args.has_tls_client_auth() {
|
||||
true => config
|
||||
.with_client_cert_verifier(Arc::new(CustomCertClientVerifier::new(args.clone()))),
|
||||
false => config.with_no_client_auth(),
|
||||
};
|
||||
|
||||
let config = config
|
||||
.with_single_cert(cert_chain, key)
|
||||
.expect("Failed to load TLS certificate!");
|
||||
|
||||
Some(config)
|
||||
} else {
|
||||
None
|
||||
};
|
||||
|
||||
log::info!("Starting relay on http://{}", args.listen_address);
|
||||
|
||||
let args_clone = args.clone();
|
||||
let server = HttpServer::new(move || {
|
||||
App::new()
|
||||
.wrap(middleware::Logger::default())
|
||||
.app_data(Data::new(args_clone.clone()))
|
||||
.route("/", web::get().to(hello_route))
|
||||
.route("/config", web::get().to(config_route))
|
||||
.route("/ws", web::get().to(relay_ws))
|
||||
});
|
||||
|
||||
if let Some(tls_conf) = tls_config {
|
||||
server.bind_rustls(&args.listen_address, tls_conf)?
|
||||
} else {
|
||||
server.bind(&args.listen_address)?
|
||||
}
|
||||
.run()
|
||||
.await
|
||||
}
|
||||
206
src/tcp_relay_server/relay_ws.rs
Normal file
206
src/tcp_relay_server/relay_ws.rs
Normal file
@ -0,0 +1,206 @@
|
||||
use std::sync::Arc;
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
use actix::{Actor, ActorContext, AsyncContext, Handler, Message, StreamHandler};
|
||||
use actix_web::{web, Error, HttpRequest, HttpResponse};
|
||||
use actix_web_actors::ws;
|
||||
use actix_web_actors::ws::{CloseCode, CloseReason};
|
||||
use tokio::io::{AsyncReadExt, AsyncWriteExt};
|
||||
use tokio::net::tcp::{OwnedReadHalf, OwnedWriteHalf};
|
||||
use tokio::net::TcpStream;
|
||||
|
||||
use crate::tcp_relay_server::server_config::ServerConfig;
|
||||
|
||||
/// How often heartbeat pings are sent
|
||||
const HEARTBEAT_INTERVAL: Duration = Duration::from_secs(5);
|
||||
|
||||
/// How long before lack of client response causes a timeout
|
||||
const CLIENT_TIMEOUT: Duration = Duration::from_secs(60);
|
||||
|
||||
#[derive(Message)]
|
||||
#[rtype(result = "bool")]
|
||||
pub struct DataForWebSocket(Vec<u8>);
|
||||
|
||||
#[derive(Message)]
|
||||
#[rtype(result = "()")]
|
||||
pub struct TCPReadEndClosed;
|
||||
|
||||
/// Define HTTP actor
|
||||
struct RelayWS {
|
||||
tcp_read: Option<OwnedReadHalf>,
|
||||
tcp_write: OwnedWriteHalf,
|
||||
|
||||
// Client must respond to ping at a specific interval, otherwise we drop connection
|
||||
hb: Instant,
|
||||
// TODO : handle socket close
|
||||
}
|
||||
|
||||
impl RelayWS {
|
||||
/// helper method that sends ping to client every second.
|
||||
///
|
||||
/// also this method checks heartbeats from client
|
||||
fn hb(&self, ctx: &mut ws::WebsocketContext<Self>) {
|
||||
ctx.run_interval(HEARTBEAT_INTERVAL, |act, ctx| {
|
||||
// check client heartbeats
|
||||
if Instant::now().duration_since(act.hb) > CLIENT_TIMEOUT {
|
||||
// heartbeat timed out
|
||||
log::warn!("WebSocket Client heartbeat failed, disconnecting!");
|
||||
|
||||
// stop actor
|
||||
ctx.stop();
|
||||
|
||||
// don't try to send a ping
|
||||
return;
|
||||
}
|
||||
|
||||
log::debug!("Send ping message...");
|
||||
ctx.ping(b"");
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
impl Actor for RelayWS {
|
||||
type Context = ws::WebsocketContext<Self>;
|
||||
|
||||
fn started(&mut self, ctx: &mut Self::Context) {
|
||||
self.hb(ctx);
|
||||
|
||||
// Start to read on remote socket
|
||||
let mut read_half = self.tcp_read.take().unwrap();
|
||||
let addr = ctx.address();
|
||||
let future = async move {
|
||||
let mut buff: [u8; 5000] = [0; 5000];
|
||||
loop {
|
||||
match read_half.read(&mut buff).await {
|
||||
Ok(l) => {
|
||||
if l == 0 {
|
||||
log::info!("Got empty read. Closing read end...");
|
||||
addr.do_send(TCPReadEndClosed);
|
||||
return;
|
||||
}
|
||||
|
||||
let to_send = DataForWebSocket(Vec::from(&buff[0..l]));
|
||||
if let Err(e) = addr.send(to_send).await {
|
||||
log::error!("Failed to send to websocket. Stopping now... {:?}", e);
|
||||
return;
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
log::error!("Failed to read from remote socket. Stopping now... {:?}", e);
|
||||
break;
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
log::info!("Exited read loop");
|
||||
};
|
||||
|
||||
tokio::spawn(future);
|
||||
}
|
||||
}
|
||||
|
||||
/// Handler for ws::Message message
|
||||
impl StreamHandler<Result<ws::Message, ws::ProtocolError>> for RelayWS {
|
||||
fn handle(&mut self, msg: Result<ws::Message, ws::ProtocolError>, ctx: &mut Self::Context) {
|
||||
match msg {
|
||||
Ok(ws::Message::Ping(msg)) => ctx.pong(&msg),
|
||||
Ok(ws::Message::Pong(_)) => self.hb = Instant::now(),
|
||||
Ok(ws::Message::Text(text)) => ctx.text(text),
|
||||
Ok(ws::Message::Close(_reason)) => ctx.stop(),
|
||||
Ok(ws::Message::Binary(data)) => {
|
||||
if let Err(e) =
|
||||
futures::executor::block_on(self.tcp_write.write_all(&data.to_vec()))
|
||||
{
|
||||
log::error!("Failed to forward some data, closing connection! {:?}", e);
|
||||
ctx.stop();
|
||||
}
|
||||
|
||||
if data.is_empty() {
|
||||
log::info!("Got empty binary message. Closing websocket...");
|
||||
ctx.stop();
|
||||
}
|
||||
}
|
||||
_ => (),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Handler<DataForWebSocket> for RelayWS {
|
||||
type Result = bool;
|
||||
|
||||
fn handle(&mut self, msg: DataForWebSocket, ctx: &mut Self::Context) -> Self::Result {
|
||||
ctx.binary(msg.0);
|
||||
true
|
||||
}
|
||||
}
|
||||
|
||||
impl Handler<TCPReadEndClosed> for RelayWS {
|
||||
type Result = ();
|
||||
|
||||
fn handle(&mut self, _msg: TCPReadEndClosed, ctx: &mut Self::Context) -> Self::Result {
|
||||
ctx.close(Some(CloseReason {
|
||||
code: CloseCode::Away,
|
||||
description: Some("TCP read end closed.".to_string()),
|
||||
}));
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(serde::Deserialize)]
|
||||
pub struct WebSocketQuery {
|
||||
id: usize,
|
||||
token: Option<String>,
|
||||
}
|
||||
|
||||
pub async fn relay_ws(
|
||||
req: HttpRequest,
|
||||
stream: web::Payload,
|
||||
query: web::Query<WebSocketQuery>,
|
||||
conf: web::Data<Arc<ServerConfig>>,
|
||||
) -> Result<HttpResponse, Error> {
|
||||
if conf.has_token_auth()
|
||||
&& !conf
|
||||
.tokens
|
||||
.iter()
|
||||
.any(|t| t == query.token.as_deref().unwrap_or_default())
|
||||
{
|
||||
log::error!(
|
||||
"Rejected WS request from {:?} due to invalid token!",
|
||||
req.peer_addr()
|
||||
);
|
||||
return Ok(HttpResponse::Unauthorized().json("Invalid / missing token!"));
|
||||
}
|
||||
|
||||
if conf.ports.len() <= query.id {
|
||||
log::error!(
|
||||
"Rejected WS request from {:?} due to invalid port number!",
|
||||
req.peer_addr()
|
||||
);
|
||||
return Ok(HttpResponse::BadRequest().json("Invalid port number!"));
|
||||
}
|
||||
|
||||
let upstream_addr = format!("{}:{}", conf.upstream_server, conf.ports[query.id]);
|
||||
|
||||
let (tcp_read, tcp_write) = match TcpStream::connect(&upstream_addr).await {
|
||||
Ok(s) => s.into_split(),
|
||||
Err(e) => {
|
||||
log::error!(
|
||||
"Failed to establish connection with upstream server! {:?}",
|
||||
e
|
||||
);
|
||||
return Ok(HttpResponse::InternalServerError().json("Failed to establish connection!"));
|
||||
}
|
||||
};
|
||||
|
||||
let relay = RelayWS {
|
||||
tcp_read: Some(tcp_read),
|
||||
tcp_write,
|
||||
hb: Instant::now(),
|
||||
};
|
||||
let resp = ws::start(relay, &req, stream);
|
||||
log::info!(
|
||||
"Opening new WS connection for {:?} to {}",
|
||||
req.peer_addr(),
|
||||
upstream_addr
|
||||
);
|
||||
resp
|
||||
}
|
||||
84
src/tcp_relay_server/server_config.rs
Normal file
84
src/tcp_relay_server/server_config.rs
Normal file
@ -0,0 +1,84 @@
|
||||
use clap::Parser;
|
||||
|
||||
/// TCP relay server mode
|
||||
#[derive(Parser, Debug, Clone)]
|
||||
#[clap(
|
||||
author,
|
||||
version,
|
||||
about,
|
||||
long_about = "TCP-over-HTTP server. This program can be configured behind a reverse-proxy (without TLS authentication)."
|
||||
)]
|
||||
pub struct ServerConfig {
|
||||
/// Access tokens
|
||||
#[clap(short, long)]
|
||||
pub tokens: Vec<String>,
|
||||
|
||||
/// Access tokens stored in a file, one token per line
|
||||
#[clap(long)]
|
||||
pub tokens_file: Option<String>,
|
||||
|
||||
/// Forwarded ports
|
||||
#[clap(short, long)]
|
||||
pub ports: Vec<u16>,
|
||||
|
||||
/// Upstream server
|
||||
#[clap(short, long, default_value = "127.0.0.1")]
|
||||
pub upstream_server: String,
|
||||
|
||||
/// HTTP server listen address
|
||||
#[clap(short, long, default_value = "0.0.0.0:8000")]
|
||||
pub listen_address: String,
|
||||
|
||||
/// Increment ports on client. Useful for debugging and running both client and server
|
||||
/// on the same machine
|
||||
#[clap(short, long, default_value_t = 0)]
|
||||
pub increment_ports: u16,
|
||||
|
||||
/// TLS certificate. Specify also private key to use HTTPS/TLS instead of HTTP
|
||||
#[clap(long)]
|
||||
pub tls_cert: Option<String>,
|
||||
|
||||
/// TLS private key. Specify also certificate to use HTTPS/TLS instead of HTTP
|
||||
#[clap(long)]
|
||||
pub tls_key: Option<String>,
|
||||
|
||||
/// Restrict TLS client authentication to certificates signed directly or indirectly by the
|
||||
/// provided root certificates
|
||||
///
|
||||
/// This option automatically enable TLS client authentication
|
||||
#[clap(long)]
|
||||
pub tls_client_auth_root_cert: Option<String>,
|
||||
|
||||
/// TLS client authentication revocation list (CRL file)
|
||||
#[clap(long)]
|
||||
pub tls_revocation_list: Option<String>,
|
||||
}
|
||||
|
||||
impl ServerConfig {
|
||||
pub fn has_token_auth(&self) -> bool {
|
||||
!self.tokens.is_empty()
|
||||
}
|
||||
|
||||
pub fn has_tls_config(&self) -> bool {
|
||||
self.tls_cert.is_some() && self.tls_key.is_some()
|
||||
}
|
||||
|
||||
pub fn has_tls_client_auth(&self) -> bool {
|
||||
self.tls_client_auth_root_cert.is_some()
|
||||
}
|
||||
|
||||
pub fn has_auth(&self) -> bool {
|
||||
self.has_token_auth() || self.has_tls_client_auth()
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod test {
|
||||
use crate::server_config::ServerConfig;
|
||||
|
||||
#[test]
|
||||
fn verify_cli() {
|
||||
use clap::CommandFactory;
|
||||
ServerConfig::command().debug_assert()
|
||||
}
|
||||
}
|
||||
103
src/tcp_relay_server/tls_cert_client_verifier.rs
Normal file
103
src/tcp_relay_server/tls_cert_client_verifier.rs
Normal file
@ -0,0 +1,103 @@
|
||||
use std::sync::Arc;
|
||||
use std::time::SystemTime;
|
||||
|
||||
use rustls::internal::msgs::enums::AlertDescription;
|
||||
use rustls::server::{AllowAnyAuthenticatedClient, ClientCertVerified, ClientCertVerifier};
|
||||
use rustls::{Certificate, DistinguishedNames, Error, RootCertStore};
|
||||
use x509_parser::prelude::{CertificateRevocationList, FromDer, X509Certificate};
|
||||
|
||||
use crate::base::cert_utils::parse_pem_certificates;
|
||||
|
||||
use crate::tcp_relay_server::server_config::ServerConfig;
|
||||
|
||||
pub struct CustomCertClientVerifier {
|
||||
upstream_cert_verifier: Box<Arc<dyn ClientCertVerifier>>,
|
||||
crl: Option<Vec<u8>>,
|
||||
}
|
||||
|
||||
impl CustomCertClientVerifier {
|
||||
pub fn new(conf: Arc<ServerConfig>) -> Self {
|
||||
// Build root certifications list
|
||||
let cert_path = conf
|
||||
.tls_client_auth_root_cert
|
||||
.as_deref()
|
||||
.expect("No root certificates for client authentication provided!");
|
||||
let cert_file = std::fs::read(cert_path)
|
||||
.expect("Failed to read root certificates for client authentication!");
|
||||
|
||||
let root_certs = parse_pem_certificates(&cert_file)
|
||||
.expect("Failed to read root certificates for server authentication!");
|
||||
|
||||
if root_certs.is_empty() {
|
||||
log::error!("No certificates found for client authentication!");
|
||||
panic!();
|
||||
}
|
||||
|
||||
let mut store = RootCertStore::empty();
|
||||
for cert in root_certs {
|
||||
store
|
||||
.add(&cert)
|
||||
.expect("Failed to add certificate to root store");
|
||||
}
|
||||
|
||||
// Parse CRL file (if any)
|
||||
let crl = if let Some(crl_file) = &conf.tls_revocation_list {
|
||||
let crl_file = std::fs::read(crl_file).expect("Failed to open / read CRL file!");
|
||||
|
||||
let parsed_crl = pem::parse(crl_file).expect("Failed to decode CRL file!");
|
||||
|
||||
Some(parsed_crl.contents)
|
||||
} else {
|
||||
None
|
||||
};
|
||||
|
||||
Self {
|
||||
upstream_cert_verifier: Box::new(AllowAnyAuthenticatedClient::new(store)),
|
||||
crl,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl ClientCertVerifier for CustomCertClientVerifier {
|
||||
fn offer_client_auth(&self) -> bool {
|
||||
true
|
||||
}
|
||||
|
||||
fn client_auth_mandatory(&self) -> Option<bool> {
|
||||
Some(true)
|
||||
}
|
||||
|
||||
fn client_auth_root_subjects(&self) -> Option<DistinguishedNames> {
|
||||
Some(vec![])
|
||||
}
|
||||
|
||||
fn verify_client_cert(
|
||||
&self,
|
||||
end_entity: &Certificate,
|
||||
intermediates: &[Certificate],
|
||||
now: SystemTime,
|
||||
) -> Result<ClientCertVerified, Error> {
|
||||
// Check the certificates sent by the client has been revoked
|
||||
if let Some(crl) = &self.crl {
|
||||
let (_rem, crl) =
|
||||
CertificateRevocationList::from_der(crl).expect("Failed to read CRL!");
|
||||
|
||||
let (_rem, cert) =
|
||||
X509Certificate::from_der(&end_entity.0).expect("Failed to read certificate!");
|
||||
|
||||
for revoked in crl.iter_revoked_certificates() {
|
||||
if revoked.user_certificate == cert.serial {
|
||||
log::error!(
|
||||
"Client attempted to use a revoked certificate! Serial={:?} Subject={}",
|
||||
cert.serial,
|
||||
cert.subject
|
||||
);
|
||||
return Err(Error::AlertReceived(AlertDescription::CertificateRevoked));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
self.upstream_cert_verifier
|
||||
.verify_client_cert(end_entity, intermediates, now)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user