README
¶
tcprouter
A down to earth tcp router based on traefik tcp streaming and supports multiple backends using valkyrie
Build
git clone https://github.com/threefoldtech/tcprouter
make
This will generate two binaries in bin dir
trs: tcp router servertrc: tcp router client
Running
Example configuration file
[server]
addr = "0.0.0.0" # listening address for all entrypoints (http, https, tcp router client)
port = 443 # TLS listening port
httpport = 80 # HTTP listening port
[server.dbbackend] # configuration for the redis backend
type = "redis"
addr = "127.0.0.1"
port = 6379
refresh = 10 # make the tcp router poll for new configuration every 10 seconds
[server.services]
[server.services."mydomain.com"]
addr = "172.217.19.46"
tlsport = 443
httpport = 80
then trs -config router.toml
Please notice if you are using low numbered port like 80 or 443 you can use sudo or setcap before running the binary.
sudo setcap CAP_NET_BIND_SERVICE=+eip trs
router.toml
We have two 3 sections so far
[server]
[server]
addr = "0.0.0.0"
port = 443
httpport = 80
in [server] section we define the listening interface/port the tcprouter intercepting: typically that's 443 for TLS connections.
[server.dbbackend]
[server.dbbackend]
type = "redis"
addr = "127.0.0.1"
port = 6379
refresh = 10
in server.dbbackend we define the backend kv store and its connection information addr,port and how often we want to reload the data from the kv store using refresh key in seconds.
[server.services]
[server.services]
[server.services."mydomain.com"]
addr = "172.217.19.46"
tlsport = 443
httpport = 80
Services are static configuration that are hardcoded in the configuration file instead of coming from the database backend.
In this example the request for domain mydomain.com will be forwarded to the backend server at 172.217.19.46:443 for TLS traffic and 172.217.19.46:80 for non TLS traffic.
Data representation in KV
127.0.0.1:6379> KEYS *
1) "/tcprouter/services/www.bing.com"
2) "/tcprouter/services/www.google.com"
3) "/tcprouter/services/www.facebook.com"
127.0.0.1:6379> get /tcprouter/services/www.google.com
"{\"Key\":\"tcprouter/services/www.google.com\",\"Value\":\"eyJhZGRyIjogIjE3Mi4yMTcuMTkuNDYiLCAiaHR0cHBvcnQiIDgwLCAidGxzcG9ydCI6IDQ0M30=\",\"LastIndex\":75292246}"
Decoding data from python
In [64]: res = r.get("/tcprouter/service/www.google.com")
In [65]: decoded = json.loads(res)
In [66]: decoded
Out[66]:
{'Key': '/tcprouter/service/www.google.com',
'Value': 'eyJhZGRyIjogIjE3Mi4yMTcuMTkuNDYiLCAiaHR0cHBvcnQiIDgwLCAidGxzcG9ydCI6IDQ0M30='}
Value payload is base64 encoded because of how golang is marshaling.
In [67]: base64.b64decode(decoded['Value'])
Out[67]: b'{"addr": "172.217.19.46", "httpport" 80, "tlsport": 443}'
Examples
Go
This example can be found at examples/main.go
package main
import (
"encoding/json"
"log"
"time"
"github.com/abronan/valkeyrie"
"github.com/abronan/valkeyrie/store"
"github.com/abronan/valkeyrie/store/redis"
)
func init() {
redis.Register()
}
type Service struct {
Addr string `json:"addr"`
SNI string `json:"sni"`
Name string `json:"bing"`
}
func main() {
// Initialize a new store with redis
kv, err := valkeyrie.NewStore(
store.REDIS,
[]string{"127.0.0.1:6379" },
&store.Config{
ConnectionTimeout: 10 * time.Second,
},
)
if err != nil {
log.Fatal("Cannot create store redis")
}
google := &Service{Addr:"172.217.19.46:443", SNI:"www.google.com", Name:"google"}
encGoogle, _ := json.Marshal(google)
bing := &Service{Addr:"13.107.21.200:443", SNI:"www.bing.com", Name:"bing"}
encBing, _ := json.Marshal(bing)
kv.Put("/tcprouter/services/google", encGoogle, nil)
kv.Put("/tcprouter/services/bing", encBing, nil)
}
Python
import base64
import json
import redis
r = redis.Redis()
def create_service(name, sni, addr):
service = {}
service['Key'] = '/tcprouter/service/{}'.format(name)
record = {"addr":addr, "sni":sni, "name":name}
json_dumped_record_bytes = json.dumps(record).encode()
b64_record = base64.b64encode(json_dumped_record_bytes).decode()
service['Value'] = b64_record
r.set(service['Key'], json.dumps(service))
create_service('facebook', "www.facebook.com", "102.132.97.35:443")
create_service('google', 'www.google.com', '172.217.19.46:443')
create_service('bing', 'www.bing.com', '13.107.21.200:443')
If you want to test that locally you can modify /etc/hosts
127.0.0.1 www.google.com
127.0.0.1 www.bing.com
127.0.0.1 www.facebook.com
So your browser go to your 127.0.0.1:443 on requesting google or bing.
CATCH_ALL
to add a global catch all service
python3 create_service.py CATCH_ALL 'CATCH_ALL' '127.0.0.1:9092'
Reverse tunneling
TCP router also support to forward connection to a server that is hidden behind NAT. The way it works is on the hidden client side, a small client runs and opens a connection to the tcp router server. The client sends a secret during an handshake with the server to authenticate the connection.
The server then keeps the connection opens and is able to forward incoming public traffic to the open connection. This is specially useful if there is no way for the tcp router server to open a connection to the backend. Usually because of NAT.
example
Fist create the configuration on the server side. The only required field in the configuration is the secret for the client connection:
[server.services]
[server.services."mydomain.com"]
clientsecret = "TB2pbZ5FR8GQZp9W2z97jBjxSgWgQKaQTxEgrZNBa4pEFzv3PJcRVEtG2a5BU9qd"
Second starts the tcp router client and make it opens a connection to the tcp router server:
The following command will connect the the server located at tcprouter-1.com, forward traffic for mydomain.com to the local application running at localhost:8080 and send the response back.
trc -local localhost:8080 -remote tcprouter-1.com -secret TB2pbZ5FR8GQZp9W2z97jBjxSgWgQKaQTxEgrZNBa4pEFzv3PJcRVEtG2a5BU9qd
To forward tls traffic to a difference port than none-tls traffic add the --local-tls flag
trc -local localhost:8080 -local-tls localhost:443 -remote tcprouter-1.com -secret TB2pbZ5FR8GQZp9W2z97jBjxSgWgQKaQTxEgrZNBa4pEFzv3PJcRVEtG2a5BU9qd
Documentation
¶
Index ¶
Constants ¶
const ( // MagicNr is the bytes sent during handshake to identity a tcprouter client connection // TODO: chose a valid magic number MagicNr = 0x1111 )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client connect to a tpc router server and opens a reverse tunnel
type Config ¶
type Config struct {
Server ServerConfig `toml:"server"`
}
Config hold the server configuration
type Conn ¶
type Conn struct {
// Peeked are the bytes that have been read from Conn for the
// purposes of route matching, but have not yet been consumed
// by Read calls. It set to nil by Read when fully consumed.
Peeked []byte
// Conn is the underlying connection.
// It can be type asserted against *net.TCPConn or other types
// as needed. It should not be read from directly unless
// Peeked is nil.
WriteCloser
}
Conn is a connection proxy that handles Peeked bytes
type DbBackendConfig ¶
type DbBackendConfig struct {
DbType string `toml:"type"`
Host string `toml:"addr"`
Port uint `toml:"port"`
Username string `toml:"username"`
Password string `toml:"password"`
Token string `toml:"token"`
Refresh uint `toml:"refresh"`
}
DbBackendConfig define the connection to a backend store
func (DbBackendConfig) Addr ¶
func (b DbBackendConfig) Addr() string
Addr returns the listenting address of the server
func (DbBackendConfig) Backend ¶
func (b DbBackendConfig) Backend() store.Backend
Backend return the Backend object of the b.DbType
type Handler ¶
type Handler interface {
ServeTCP(conn WriteCloser)
}
Handler is the TCP Handlers interface
type HandlerFunc ¶
type HandlerFunc func(conn WriteCloser)
The HandlerFunc type is an adapter to allow the use of ordinary functions as handlers.
type Server ¶
type Server struct {
ServerOptions ServerOptions
DbStore store.Store
Services map[string]Service
// contains filtered or unexported fields
}
Server is tcp router server
type ServerConfig ¶
type ServerConfig struct {
Host string `toml:"addr"`
Port uint `toml:"port"`
HTTPPort uint `toml:"httpport"`
ClientsPort uint `toml:"clientsport"`
DbBackend DbBackendConfig `toml:"dbbackend"`
Services map[string]Service `toml:"services"`
}
ServerConfig configures the server listeners and backend
func (ServerConfig) Addr ¶
func (s ServerConfig) Addr() string
Addr returns the listenting address of the server
type ServerOptions ¶
type ServerOptions struct {
ListeningAddr string
ListeningTLSPort uint
ListeningHTTPPort uint
ListeningForClientsPort uint
}
ServerOptions hold the configuration of server listeners
func (ServerOptions) ClientsAddr ¶
func (o ServerOptions) ClientsAddr() string
ClientsAddr returns the client listener address
func (ServerOptions) HTTPAddr ¶
func (o ServerOptions) HTTPAddr() string
HTTPAddr returns the HTTP listener address
func (ServerOptions) TLSAddr ¶
func (o ServerOptions) TLSAddr() string
TLSAddr returns the TLS listener address
type Service ¶
type Service struct {
Addr string `toml:"addr"`
ClientSecret string `toml:"clientsecret` // will forward connection to it directly instead of hitting the Addr.
TLSPort int `toml:"tlsport"`
HTTPPort int `toml:"httpport"`
}
Service defines a proxy configuration
type WriteCloser ¶
type WriteCloser interface {
net.Conn
// CloseWrite on a network connection, indicates that the issuer of the call
// has terminated sending on that connection.
// It corresponds to sending a FIN packet.
CloseWrite() error
}
WriteCloser describes a net.Conn with a CloseWrite method.
func GetConn ¶
func GetConn(conn WriteCloser, peeked string) WriteCloser
GetConn creates a connection proxy with a peeked string
func WrapConn ¶
func WrapConn(conn *yamux.Stream) WriteCloser
WrapConn wraps a stream into a wrappedCon so it implements the WriteCloser interface
Source Files
Directories