server

Documentation

Index

• type AllowConfig
  • func (a *AllowConfig) UnmarshalYAML(value *yaml.Node) error
• type AllowReverseTunnelConfig
  • func (art *AllowReverseTunnelConfig) Allows(claims *protocol.JwtTunnelConfig) bool
• type AllowTunnelConfig
  • func (at *AllowTunnelConfig) Allows(claims *protocol.JwtTunnelConfig) bool
• type CertReloader
  • func NewCertReloader(certFile, keyFile string) (*CertReloader, error)
  • func (r *CertReloader) GetCertificate(info *tls.ClientHelloInfo) (*tls.Certificate, error)
  • func (r *CertReloader) Reload() error
  • func (r *CertReloader) WatchFiles(interval time.Duration)
  • func (r *CertReloader) WatchSignals()
• type Config
  • func (c *Config) UnmarshalYAML(unmarshal func(any) error) error
• type MatchConfig
  • func (m *MatchConfig) UnmarshalYAML(value *yaml.Node) error
• type NetCIDR
  • func (n *NetCIDR) UnmarshalYAML(value *yaml.Node) error
• type PortRange
  • func (p *PortRange) UnmarshalYAML(value *yaml.Node) error
• type Regexp
  • func (r *Regexp) UnmarshalYAML(value *yaml.Node) error
• type RestrictionConfig
  • func (rc *RestrictionConfig) Allows(claims *protocol.JwtTunnelConfig) bool
  • func (rc *RestrictionConfig) Matches(path string, auth string, commonName string) bool
• type RestrictionsRules
  • func LoadRestrictions(path string) (*RestrictionsRules, error)
  • func (r *RestrictionsRules) Validate(claims *protocol.JwtTunnelConfig, path string, auth string, commonName string) bool
• type ReverseTunnelManager
  • func NewReverseTunnelManager(socketSoMark uint32, idleTimeout time.Duration) *ReverseTunnelManager
  • func (m *ReverseTunnelManager) Close()
  • func (m *ReverseTunnelManager) HandleClient(wsConn *wst.Conn, claims *protocol.JwtTunnelConfig)
  • func (m *ReverseTunnelManager) HandleClientH2(h2Conn io.ReadWriteCloser, claims *protocol.JwtTunnelConfig)
  • func (m *ReverseTunnelManager) HandleGorillaClient(wsConn *websocket.Conn, claims *protocol.JwtTunnelConfig)
• type Server
  • func NewServer(config Config) *Server
  • func (s *Server) GetRules() *RestrictionsRules
  • func (s *Server) ReloadCertificate() error
  • func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)
  • func (s *Server) SetRules(rules *RestrictionsRules)
  • func (s *Server) Start() error

Types

type AllowConfig

type AllowConfig struct {
	Tunnel        *AllowTunnelConfig
	ReverseTunnel *AllowReverseTunnelConfig
}

func (*AllowConfig) UnmarshalYAML

func (a *AllowConfig) UnmarshalYAML(value *yaml.Node) error

type AllowReverseTunnelConfig

type AllowReverseTunnelConfig struct {
	Protocol    []string          `yaml:"protocol"`
	Port        []PortRange       `yaml:"port"`
	PortMapping map[uint16]uint16 `yaml:"port_mapping"`
	CIDR        []NetCIDR         `yaml:"cidr"`
	UnixPath    *Regexp           `yaml:"unix_path"`
}

func (*AllowReverseTunnelConfig) Allows

func (art *AllowReverseTunnelConfig) Allows(claims *protocol.JwtTunnelConfig) bool

type AllowTunnelConfig

type AllowTunnelConfig struct {
	Protocol []string    `yaml:"protocol"`
	Port     []PortRange `yaml:"port"`
	Host     *Regexp     `yaml:"host"`
	CIDR     []NetCIDR   `yaml:"cidr"`
}

func (*AllowTunnelConfig) Allows

func (at *AllowTunnelConfig) Allows(claims *protocol.JwtTunnelConfig) bool

type CertReloader

type CertReloader struct {
	// contains filtered or unexported fields
}

func NewCertReloader

func NewCertReloader(certFile, keyFile string) (*CertReloader, error)

func (*CertReloader) GetCertificate

func (r *CertReloader) GetCertificate(info *tls.ClientHelloInfo) (*tls.Certificate, error)

func (*CertReloader) Reload

func (r *CertReloader) Reload() error

func (*CertReloader) WatchFiles

func (r *CertReloader) WatchFiles(interval time.Duration)

func (*CertReloader) WatchSignals

func (r *CertReloader) WatchSignals()

type Config

type Config struct {
	ListenAddr                     string        `yaml:"listen_addr"`
	PathPrefix                     string        `yaml:"http_upgrade_path_prefix"`
	JWTSecret                      string        `yaml:"jwt_secret"`
	InsecureNoJWTValidation        bool          `yaml:"insecure_no_jwt_validation"`
	SocketSoMark                   uint32        `yaml:"socket_so_mark"`
	WebsocketPingFrequency         time.Duration `yaml:"websocket_ping_frequency"`
	WebsocketMaskFrame             bool          `yaml:"websocket_mask_frame"`
	DnsResolver                    []string      `yaml:"dns_resolver"`
	DnsResolverPreferIpv4          bool          `yaml:"dns_resolver_prefer_ipv4"`
	RestrictTo                     []string      `yaml:"restrict_to"`
	RestrictHttpUpgradePathPrefix  []string      `yaml:"restrict_http_upgrade_path_prefix_list"` // Renamed list to avoid clash? No, Rust uses same name but different structure.
	RestrictConfig                 string        `yaml:"restrict_config"`
	Tls                            bool          `yaml:"tls"`
	TlsCertificate                 string        `yaml:"tls_certificate"`
	TlsPrivateKey                  string        `yaml:"tls_private_key"`
	TlsClientCaCerts               string        `yaml:"tls_client_ca_certs"`
	HttpProxy                      string        `yaml:"http_proxy"`
	HttpProxyLogin                 string        `yaml:"http_proxy_login"`
	HttpProxyPassword              string        `yaml:"http_proxy_password"`
	RemoteToLocalServerIdleTimeout time.Duration `yaml:"remote_to_local_server_idle_timeout"`
	WebsocketProtocol              string        `yaml:"mode"` // "rust" or "ws"
}

func (*Config) UnmarshalYAML

func (c *Config) UnmarshalYAML(unmarshal func(any) error) error

type MatchConfig

type MatchConfig struct {
	Any              bool
	PathPrefix       *regexp.Regexp
	Authorization    *regexp.Regexp
	ClientCommonName *regexp.Regexp
}

func (*MatchConfig) UnmarshalYAML

func (m *MatchConfig) UnmarshalYAML(value *yaml.Node) error

type NetCIDR

type NetCIDR struct {
	*net.IPNet
}

func (*NetCIDR) UnmarshalYAML

func (n *NetCIDR) UnmarshalYAML(value *yaml.Node) error

type PortRange

type PortRange struct {
	Min uint16
	Max uint16
}

func (*PortRange) UnmarshalYAML

func (p *PortRange) UnmarshalYAML(value *yaml.Node) error

type Regexp

type Regexp struct {
	*regexp.Regexp
}

func (*Regexp) UnmarshalYAML

func (r *Regexp) UnmarshalYAML(value *yaml.Node) error

type RestrictionConfig

type RestrictionConfig struct {
	Name  string        `yaml:"name"`
	Match []MatchConfig `yaml:"match"`
	Allow []AllowConfig `yaml:"allow"`
}

func (*RestrictionConfig) Allows

func (rc *RestrictionConfig) Allows(claims *protocol.JwtTunnelConfig) bool

func (*RestrictionConfig) Matches

func (rc *RestrictionConfig) Matches(path string, auth string, commonName string) bool

type RestrictionsRules

type RestrictionsRules struct {
	Restrictions []RestrictionConfig `yaml:"restrictions"`
}

func LoadRestrictions

func LoadRestrictions(path string) (*RestrictionsRules, error)

func (*RestrictionsRules) Validate

func (r *RestrictionsRules) Validate(claims *protocol.JwtTunnelConfig, path string, auth string, commonName string) bool

type ReverseTunnelManager

type ReverseTunnelManager struct {
	// contains filtered or unexported fields
}

func NewReverseTunnelManager

func NewReverseTunnelManager(socketSoMark uint32, idleTimeout time.Duration) *ReverseTunnelManager

func (*ReverseTunnelManager) Close

func (m *ReverseTunnelManager) Close()

func (*ReverseTunnelManager) HandleClient

func (m *ReverseTunnelManager) HandleClient(wsConn *wst.Conn, claims *protocol.JwtTunnelConfig)

func (*ReverseTunnelManager) HandleClientH2

func (m *ReverseTunnelManager) HandleClientH2(h2Conn io.ReadWriteCloser, claims *protocol.JwtTunnelConfig)

func (*ReverseTunnelManager) HandleGorillaClient

func (m *ReverseTunnelManager) HandleGorillaClient(wsConn *websocket.Conn, claims *protocol.JwtTunnelConfig)

type Server

type Server struct {
	Config Config
	// contains filtered or unexported fields
}

func NewServer

func NewServer(config Config) *Server

func (*Server) GetRules

func (s *Server) GetRules() *RestrictionsRules

func (*Server) ReloadCertificate

func (s *Server) ReloadCertificate() error

func (*Server) ServeHTTP

func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

func (*Server) SetRules

func (s *Server) SetRules(rules *RestrictionsRules)

func (*Server) Start

func (s *Server) Start() error