bastion,cmd/litebastion: add option to accept HTTP on localhost only

Closes #38

Co-authored-by: Rasmus Dahlberg <rasmus@rgdd.se>

Author: FiloSottile

bastion/bastion.go

@@ -20,8 +20,10 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"net/http/httputil"
+	"slices"
 	"strings"
 	"sync"
 	"time"
@@ -51,6 +53,7 @@ type Bastion struct {
 	c     *Config
 	proxy *httputil.ReverseProxy
 	pool  *backendConnectionsPool
+	tls   *tls.Config
 }
 
 type keyHash [sha256.Size]byte
@@ -84,27 +87,14 @@ func New(c *Config) (*Bastion, error) {
 		Transport: b.pool,
 		ErrorLog:  slog.NewLogLogger(b.pool.log.Handler(), slog.LevelDebug),
 	}
-	return b, nil
-}
-
-// ConfigureServer sets up srv to handle backend connections to the bastion. It
-// wraps TLSConfig.GetConfigForClient to intercept backend connections, and sets
-// TLSNextProto for the bastion ALPN protocol. The original tls.Config is still
-// used for non-bastion backend connections.
-//
-// Note that since TLSNextProto won't be nil after a call to ConfigureServer,
-// the caller might want to call [http2.ConfigureServer] as well.
-func (b *Bastion) ConfigureServer(srv *http.Server) error {
-	if srv.TLSNextProto == nil {
-		srv.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
-	}
-	srv.TLSNextProto["bastion/0"] = b.pool.handleBackend
-
-	bastionTLSConfig := &tls.Config{
+	b.tls = &tls.Config{
 		MinVersion: tls.VersionTLS13,
 		NextProtos: []string{"bastion/0"},
 		ClientAuth: tls.RequireAnyClientCert,
 		VerifyConnection: func(cs tls.ConnectionState) error {
+			if cs.NegotiatedProtocol != "bastion/0" {
+				return fmt.Errorf("missing ALPN")
+			}
 			h, err := backendHash(cs)
 			if err != nil {
 				return err
@@ -116,17 +106,47 @@ func (b *Bastion) ConfigureServer(srv *http.Server) error {
 		},
 		GetCertificate: b.c.GetCertificate,
 	}
+	return b, nil
+}
+
+// HandleBackendConnection handles a new backend connection.
+//
+// It can be used alternatively to [Bastion.ConfigureServer] to accept backend
+// connections on a dedicated listener.
+func (b *Bastion) HandleBackendConnection(conn net.Conn) {
+	tlsConn := tls.Server(conn, b.tls)
+	if err := tlsConn.Handshake(); err != nil {
+		b.pool.log.Debug("failed TLS handshake from backend", "err", err, "remote", conn.RemoteAddr())
+		conn.Close()
+		return
+	}
+	b.pool.Handle(tlsConn)
+	conn.Close()
+}
+
+// ConfigureServer sets up srv to handle backend connections to the bastion. It
+// wraps TLSConfig.GetConfigForClient to intercept backend connections, and sets
+// TLSNextProto for the bastion ALPN protocol. The original tls.Config is still
+// used for non-bastion backend connections.
+//
+// Note that since TLSNextProto won't be nil after a call to ConfigureServer,
+// the caller might want to call [http2.ConfigureServer] as well.
+func (b *Bastion) ConfigureServer(srv *http.Server) error {
+	if srv.TLSNextProto == nil {
+		srv.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))
+	}
+	srv.TLSNextProto["bastion/0"] = func(_ *http.Server, c *tls.Conn, _ http.Handler) {
+		b.pool.Handle(c)
+	}
 
 	if srv.TLSConfig == nil {
 		srv.TLSConfig = &tls.Config{}
 	}
 	oldGetConfigForClient := srv.TLSConfig.GetConfigForClient
 	srv.TLSConfig.GetConfigForClient = func(chi *tls.ClientHelloInfo) (*tls.Config, error) {
-		for _, proto := range chi.SupportedProtos {
-			if proto == "bastion/0" {
-				// This is a bastion connection from a backend.
-				return bastionTLSConfig, nil
-			}
+		if slices.Contains(chi.SupportedProtos, "bastion/0") {
+			// This is a bastion connection from a backend.
+			return b.tls, nil
 		}
 		if oldGetConfigForClient != nil {
 			return oldGetConfigForClient(chi)
@@ -212,7 +232,7 @@ func (p *backendConnectionsPool) RoundTrip(r *http.Request) (*http.Response, err
 	return cc.RoundTrip(r)
 }
 
-func (p *backendConnectionsPool) handleBackend(hs *http.Server, c *tls.Conn, h http.Handler) {
+func (p *backendConnectionsPool) Handle(c *tls.Conn) {
 	backend, err := backendHash(c.ConnectionState())
 	if err != nil {
 		p.log.Info("failed to get backend hash", "err", err)

cmd/litebastion/README.md

@@ -23,6 +23,13 @@ acceptable client/witness key hashes.
     -host string
             host to obtain ACME certificate for
 
+If you intend to protect backends from unwanted traffic and not forward
+arbitrary requests from the internet, you can accept request on localhost.
+This is for example useful when running a bastion for your own log.
+
+    -listen-http PORT
+            only accept HTTP requests at http://127.0.0.1:PORT
+
 Since litebastion needs to operate at a lower level than HTTPS on the witness
 side, it can't be behind a reverse proxy, and needs to configure its own TLS
 certificate. Use the `-cache`, `-email`, and `-host` flags to configure the ACME

cmd/litebastion/litebastion.go

@@ -18,6 +18,7 @@ import (
 	"flag"
 	"fmt"
 	"log/slog"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -31,9 +32,11 @@ import (
 	"golang.org/x/crypto/acme"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/net/http2"
+	"golang.org/x/sync/errgroup"
 )
 
 var listenAddr = flag.String("listen", "localhost:8443", "host and port to listen at")
+var listenHTTPPort = flag.String("listen-http", "", "localhost port to listen for HTTP requests")
 var testCertificates = flag.Bool("testcert", false, "use localhost.pem and localhost-key.pem instead of ACME")
 var autocertCache = flag.String("cache", "", "directory to cache ACME certificates at")
 var autocertHost = flag.String("host", "", "host to obtain ACME certificate for")
@@ -145,6 +148,50 @@ func main() {
 		})
 	}
 
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer stop()
+	serveGroup, ctx := errgroup.WithContext(ctx)
+
+	if *listenHTTPPort != "" {
+		hs := &http.Server{
+			Addr:         net.JoinHostPort("localhost", *listenHTTPPort),
+			Handler:      http.MaxBytesHandler(mux, 10*1024),
+			ReadTimeout:  5 * time.Second,
+			WriteTimeout: 5 * time.Second,
+		}
+		l, err := net.Listen("tcp", *listenAddr)
+		if err != nil {
+			logFatal("failed to listen for backends", "err", err)
+		}
+		serveGroup.Go(func() error {
+			slog.Info("listening for HTTP", "addr", hs.Addr)
+			return hs.ListenAndServe()
+		})
+		serveGroup.Go(func() error {
+			slog.Info("listening for backends", "addr", *listenAddr)
+			for {
+				c, err := l.Accept()
+				if err != nil {
+					return err
+				}
+				go b.HandleBackendConnection(c)
+			}
+		})
+		serveGroup.Go(func() error {
+			<-ctx.Done()
+			slog.Info("shutting down bastion listener")
+			l.Close()
+			slog.Info("shutting down HTTP server")
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			hs.Shutdown(ctx)
+			return nil
+		})
+		err = serveGroup.Wait()
+		slog.Info("exiting", "err", err)
+		return
+	}
+
 	hs := &http.Server{
 		Addr:         *listenAddr,
 		Handler:      http.MaxBytesHandler(mux, 10*1024),
@@ -163,8 +210,6 @@ func main() {
 	}
 
 	slog.Info("listening", "addr", *listenAddr)
-	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
-	defer stop()
 	e := make(chan error, 1)
 	go func() { e <- hs.ListenAndServeTLS("", "") }()
 	select {