init

.gitignore

@@ -0,0 +1,5 @@
+.idea/
+*.log
+dist/
+*.crt
+*.key

.goreleaser.yaml

@@ -0,0 +1,69 @@
+# This is an example .goreleaser.yml file with some sensible defaults.
+# Make sure to check the documentation at https://goreleaser.com
+
+# The lines below are called `modelines`. See `:help modeline`
+# Feel free to remove those if you don't want/need to use them.
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj
+
+version: 2
+
+before:
+  hooks:
+    - go mod tidy
+
+builds:
+  - env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+    goarch:
+      - amd64
+      - arm
+      - arm64
+    goarm:
+      - 6
+      - 7
+
+upx:
+  - enabled: true
+    compress: best
+
+archives:
+  - format: tar.gz
+    # this name template makes the OS and Arch compatible with the results of `uname`.
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    # use zip for windows archives
+    format_overrides:
+      - goos: windows
+        format: zip
+
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - "^docs:"
+      - "^test:"
+
+nfpms:
+  - package_name: concierge
+    maintainer: Andrii Kuzmin <jack.cvr@gmail.com>
+    bindir: /usr/local/bin
+    formats:
+      - apk
+      - deb
+    contents:
+      - src: openrc/concierge
+        dst: /etc/init.d/concierge
+        type: config|noreplace
+        packager: apk
+      - src: systemd/concierge.service
+        dst: /lib/systemd/system/concierge.service
+        type: config|noreplace
+        packager: deb

LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2024 Andrii Kuzmin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,68 @@
+# Concierge
+
+Concierge is a HTTP server that dynamically creates TCP listeners 
+upon requests to a predefined URLs. It responds with the new port number, which the client must connect to.
+Traffic from the first successful connection is then redirected to another(usually internal) 
+service on a designated port.
+
+Only the original requester’s IP is allowed to connect to the provided port.
+
+Requests to undefined URLs are tarpitted unless `-ntp` argument is provided.
+
+You can bind any number of URLs to endpoints by repeating `-a` argument.
+
+## Installation
+
+See [Releases](https://github.com/jackcvr/reverssh/releases)
+
+## Usage
+
+```shell
+Usage of concierge:
+  -a value
+    	Endpoint in format 'url:host:port' (e.g. /ssh:localhost:22)
+  -b string
+    	Local address to listen on (default "0.0.0.0:80")
+  -crt string
+    	Crt file for TLS
+  -f string
+    	Log file (default stdout)
+  -key string
+    	Key file for TLS
+  -ntp
+    	Do not tarpit wrong requests
+  -q	Do not print anything
+  -t duration
+    	Timeout for accepting connections (default 2s)
+  -v	Verbose mode
+```
+
+## Example
+
+On remote machine:
+
+- configure SSH server to bind to localhost.
+- start the Concierge HTTPS server, which responds to requests made to the /ssh URL:
+
+```shell
+$ sudo concierge -a /ssh:localhost:22 -crt server.crt -key server.key
+{"time":"2024-09-21T12:27:36.180365398+03:00","level":"INFO","msg":"http/listening","addr":{"IP":"0.0.0.0","Port":443,"Zone":""}}
+{"time":"2024-09-21T12:27:42.710054064+03:00","level":"INFO","msg":"http/connected","remoteAddr":{"IP":"127.0.0.1","Port":58664,"Zone":""},"agent":"curl/7.68.0","method":"GET","url":"/ssh"}
+{"time":"2024-09-21T12:27:42.71009367+03:00","level":"INFO","msg":"tcp/listening","addr":{"IP":"::","Port":46381,"Zone":""}}
+{"time":"2024-09-21T12:27:42.710104628+03:00","level":"INFO","msg":"http/closed","remoteAddr":{"IP":"127.0.0.1","Port":58664,"Zone":""},"url":"/ssh","lifetime":0}
+{"time":"2024-09-21T12:27:42.714576373+03:00","level":"INFO","msg":"tcp/connected","laddr":{"IP":"127.0.0.1","Port":46381,"Zone":""},"raddr":{"IP":"127.0.0.1","Port":33054,"Zone":""}}
+{"time":"2024-09-21T12:27:42.714741091+03:00","level":"INFO","msg":"tcp/closed","addr":{"IP":"::","Port":46381,"Zone":""}}
+{"time":"2024-09-21T12:27:42.715085155+03:00","level":"INFO","msg":"tcp/connected","laddr":{"IP":"127.0.0.1","Port":43768,"Zone":""},"raddr":{"IP":"127.0.0.1","Port":22,"Zone":""}}
+```
+
+On local machine:
+
+- connect to your SSH server (assuming the IP of your remote machine is 8.8.8.8):
+
+```shell
+$ ssh root@8.8.8.8 -p $(curl -sk https://8.8.8.8/ssh)
+```
+
+## License
+
+[MIT](https://spdx.org/licenses/MIT.html) 

app.go

@@ -0,0 +1,162 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+)
+
+const ContentLength = 1024 * 64 * 10
+
+type App struct {
+	Logger
+	bindAddress string
+	certFile    string
+	keyFile     string
+	timeout     time.Duration
+	endpoints   Endpoints
+	noTarpit    bool
+	mu          sync.Mutex
+}
+
+func (app *App) Run() error {
+	for url, ep := range app.endpoints {
+		http.HandleFunc(fmt.Sprintf("GET %s", url), func(w http.ResponseWriter, r *http.Request) {
+			app.mu.Lock()
+			defer app.mu.Unlock()
+
+			requestIP := strings.SplitN(r.RemoteAddr, ":", 2)[0]
+			ln, err := app.StartListener(requestIP, ep)
+			if err != nil {
+				app.PrintError(err.Error())
+			}
+			addr, _ := ln.Addr().(*net.TCPAddr)
+			port := fmt.Sprintf("%d", addr.Port)
+			if _, err = w.Write([]byte(port)); err != nil {
+				app.Error(err.Error())
+			}
+		})
+	}
+
+	http.HandleFunc("/robots.txt", func(w http.ResponseWriter, r *http.Request) {
+		content := []byte("User-agent: *\nDisallow: /\n")
+		if _, err := w.Write(content); err != nil {
+			app.Error(err.Error())
+		}
+	})
+
+	if !app.noTarpit {
+		http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Length", fmt.Sprintf("%d", ContentLength))
+			w.WriteHeader(http.StatusNotFound)
+			payload := []byte("💔")
+			for {
+				time.Sleep(time.Second)
+				if _, err := fmt.Fprint(w, payload); err != nil {
+					app.Debug(err.Error())
+					return
+				}
+				w.(http.Flusher).Flush()
+			}
+		})
+	}
+
+	logRequest := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		addr, _ := net.ResolveTCPAddr("tcp", r.RemoteAddr)
+		start := time.Now()
+		defer func() {
+			lifetime := int(time.Now().Sub(start).Seconds())
+			app.Info("http/closed", "remoteAddr", addr, "url", r.URL.String(), "lifetime", lifetime)
+		}()
+		app.Info("http/connected",
+			"remoteAddr", addr,
+			"agent", r.UserAgent(),
+			"method", r.Method,
+			"url", r.URL.String())
+		http.DefaultServeMux.ServeHTTP(w, r)
+	})
+
+	addr, _ := net.ResolveTCPAddr("tcp", app.bindAddress)
+	if app.certFile != "" && app.keyFile != "" {
+		if addr.Port == 80 {
+			addr.Port = 443
+		}
+		app.Info("http/listening", "addr", addr)
+		return http.ListenAndServeTLS(addr.String(), app.certFile, app.keyFile, logRequest)
+	} else {
+		app.Info("Cert and key files are not provided: TLS is disabled...")
+		app.Info("http/listening", "addr", addr)
+		return http.ListenAndServe(addr.String(), logRequest)
+	}
+}
+
+func (app *App) StartListener(clientIP, endpoint string) (net.Listener, error) {
+	ln, err := net.Listen("tcp", ":0")
+	if err != nil {
+		return nil, err
+	}
+	app.Info("tcp/listening", "addr", ln.Addr())
+	go app.Accept(clientIP, ln, endpoint)
+	return ln, nil
+}
+
+func (app *App) Accept(requestIP string, listener net.Listener, endpoint string) {
+	ln, _ := listener.(*net.TCPListener)
+	defer func() {
+		_ = ln.Close()
+		app.Info("tcp/closed", "addr", ln.Addr())
+	}()
+
+	if err := ln.SetDeadline(time.Now().Add(app.timeout)); err != nil {
+		app.Error(err.Error())
+		return
+	}
+	for {
+		remoteConn, err := ln.Accept()
+		if err != nil {
+			if !errors.Is(err, os.ErrDeadlineExceeded) {
+				app.Error(err.Error())
+			}
+			return
+		}
+		app.Info("tcp/connected", "laddr", remoteConn.LocalAddr(), "raddr", remoteConn.RemoteAddr())
+		addr, _ := remoteConn.RemoteAddr().(*net.TCPAddr)
+		remoteIP := fmt.Sprintf("%s", addr.IP)
+		if requestIP != remoteIP {
+			_ = remoteConn.Close()
+			app.Error("ip_mismatch", "requestIP", requestIP, "clientIP", remoteIP)
+			continue
+		}
+		go app.Connect(remoteConn, endpoint)
+		return
+	}
+}
+
+func (app *App) Connect(remoteConn net.Conn, localAddr string) {
+	defer func() {
+		_ = remoteConn.Close()
+		app.Debug("tcp/closed", "laddr", remoteConn.LocalAddr(), "raddr", remoteConn.RemoteAddr())
+	}()
+
+	localConn, err := net.Dial("tcp", localAddr)
+	if err != nil {
+		app.Error(err.Error())
+		return
+	}
+	defer func() {
+		_ = localConn.Close()
+		app.Debug("tcp/closed", "laddr", localConn.LocalAddr(), "raddr", localConn.RemoteAddr())
+	}()
+
+	app.Info("tcp/connected", "laddr", localConn.LocalAddr(), "raddr", localConn.RemoteAddr())
+	go io.Copy(remoteConn, localConn)
+	if _, err = io.Copy(localConn, remoteConn); err != nil {
+		app.Error(err.Error())
+	}
+}

gencrt

@@ -0,0 +1,5 @@
+#!/bin/sh
+set -e
+
+openssl ecparam -genkey -name secp384r1 -out server.key
+openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650

go.mod

@@ -0,0 +1,3 @@
+module github.com/jackcvr/concierge
+
+go 1.23.0