-
-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
9 changed files
with
367 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| package client | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/tls" | ||
| "errors" | ||
| "fmt" | ||
| "github.com/jsiebens/brink/internal/api" | ||
| "github.com/jsiebens/brink/internal/key" | ||
| "github.com/jsiebens/brink/internal/util" | ||
| stream "github.com/nknorg/encrypted-stream" | ||
| "io" | ||
| "net" | ||
| "net/http" | ||
| "net/http/httptrace" | ||
| "net/url" | ||
| ) | ||
|
|
||
| func NewDialer(proxyPublicKey key.PublicKey, clientPrivateKey key.PrivateKey, target string, tlsConfig *tls.Config) func(context.Context, string, string) (net.Conn, error) { | ||
| return func(ctx context.Context, network, addr string) (net.Conn, error) { | ||
| u, err := url.Parse(target) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| u.Path = "/p/upgrade" | ||
|
|
||
| tr := &http.Transport{ | ||
| ForceAttemptHTTP2: false, | ||
| TLSClientConfig: tlsConfig, | ||
| TLSNextProto: map[string]func(string, *tls.Conn) http.RoundTripper{}, | ||
| } | ||
|
|
||
| connCh := make(chan net.Conn, 1) | ||
| trace := httptrace.ClientTrace{ | ||
| GotConn: func(info httptrace.GotConnInfo) { | ||
| connCh <- info.Conn | ||
| }, | ||
| } | ||
| traceCtx := httptrace.WithClientTrace(ctx, &trace) | ||
| req := &http.Request{ | ||
| Method: "GET", | ||
| URL: u, | ||
| Header: http.Header{ | ||
| "Upgrade": []string{api.UpgradeHeaderValue}, | ||
| "Connection": []string{"upgrade"}, | ||
| api.HandshakeHeaderName: []string{clientPrivateKey.Public().String()}, | ||
| }, | ||
| } | ||
| req = req.WithContext(traceCtx) | ||
|
|
||
| resp, err := tr.RoundTrip(req) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if resp.StatusCode != http.StatusSwitchingProtocols { | ||
| return nil, fmt.Errorf("unexpected HTTP response: %s", resp.Status) | ||
| } | ||
|
|
||
| var switchedConn net.Conn | ||
| select { | ||
| case switchedConn = <-connCh: | ||
| default: | ||
| } | ||
| if switchedConn == nil { | ||
| _ = resp.Body.Close() | ||
| return nil, fmt.Errorf("httptrace didn't provide a connection") | ||
| } | ||
|
|
||
| if next := resp.Header.Get("Upgrade"); next != api.UpgradeHeaderValue { | ||
| _ = resp.Body.Close() | ||
| return nil, fmt.Errorf("server switched to unexpected protocol %q", next) | ||
| } | ||
|
|
||
| rwc, ok := resp.Body.(io.ReadWriteCloser) | ||
| if !ok { | ||
| _ = resp.Body.Close() | ||
| return nil, errors.New("http Transport did not provide a writable body") | ||
| } | ||
|
|
||
| return stream.NewEncryptedStream(util.NewAltReadWriteCloserConn(rwc, switchedConn), &stream.Config{ | ||
| Cipher: key.NewBoxCipher(clientPrivateKey, proxyPublicKey), | ||
| SequentialNonce: false, // only when key is unique for every stream | ||
| Initiator: true, // only on the dialer side | ||
| }) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| package key | ||
|
|
||
| import ( | ||
| "fmt" | ||
| stream "github.com/nknorg/encrypted-stream" | ||
| "golang.org/x/crypto/nacl/box" | ||
| ) | ||
|
|
||
| type BoxCipher struct { | ||
| privateKey *[32]byte | ||
| publicKey *[32]byte | ||
| } | ||
|
|
||
| func NewBoxCipher(pr PrivateKey, pu PublicKey) stream.Cipher { | ||
| return &BoxCipher{ | ||
| privateKey: &pr.k, | ||
| publicKey: &pu.k, | ||
| } | ||
| } | ||
|
|
||
| // Encrypt implements Cipher. | ||
| func (c *BoxCipher) Encrypt(ciphertext, plaintext, nonce []byte) ([]byte, error) { | ||
| var n [24]byte | ||
| copy(n[:], nonce[:24]) | ||
|
|
||
| encrypted := box.Seal(ciphertext[:0], plaintext, &n, c.publicKey, c.privateKey) | ||
|
|
||
| return ciphertext[:len(encrypted)], nil | ||
| } | ||
|
|
||
| // Decrypt implements Cipher. | ||
| func (c *BoxCipher) Decrypt(plaintext, ciphertext, nonce []byte) ([]byte, error) { | ||
| var n [24]byte | ||
| copy(n[:], nonce[:24]) | ||
|
|
||
| plaintext, ok := box.Open(plaintext[:0], ciphertext, &n, c.publicKey, c.privateKey) | ||
| if !ok { | ||
| return nil, fmt.Errorf("decrypt failed") | ||
| } | ||
|
|
||
| return plaintext, nil | ||
| } | ||
|
|
||
| // MaxOverhead implements Cipher. | ||
| func (c *BoxCipher) MaxOverhead() int { | ||
| return box.Overhead | ||
| } | ||
|
|
||
| // NonceSize implements Cipher. | ||
| func (c *BoxCipher) NonceSize() int { | ||
| return 24 | ||
| } | ||
|
|
||
| func parseKey(key string) (*[32]byte, error) { | ||
| k := new([32]byte) | ||
| err := parseHex(k[:], key) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return k, nil | ||
| } |
Oops, something went wrong.