Encrypt TCP tunnel payload with AES-GCM.

TCP forwardData copied plaintext after the handshake. Frame each chunk as uint32 length plus AES-GCM ciphertext in both client and server, both directions.

internal/server/server.go

@@ -35,6 +35,7 @@ type TeleportServer struct {
 	goroutineSem      chan struct{} // Semaphore for limiting concurrent goroutines
 	maxGoroutines     int           // Maximum concurrent goroutines
 	metrics           *metrics.Metrics
+	derivedKey        []byte
 }
 
 // NewTeleportServer creates a new teleport server
@@ -76,6 +77,7 @@ func NewTeleportServer(config *config.Config) *TeleportServer {
 		goroutineSem:     make(chan struct{}, maxGoroutines),
 		maxGoroutines:    maxGoroutines,
 		metrics:          metricsInstance,
+		derivedKey:       encryption.DeriveKey(config.EncryptionKey),
 	}
 }
 
@@ -403,12 +405,12 @@ func (ts *TeleportServer) handleTCPForward(clientConn net.Conn, rule *config.Por
 
 	go func() {
 		defer wg.Done()
-		ts.forwardData(clientConn, targetConn)
+		ts.forwardData(clientConn, targetConn, false) // decrypt from tunnel
 	}()
 
 	go func() {
 		defer wg.Done()
-		ts.forwardData(targetConn, clientConn)
+		ts.forwardData(targetConn, clientConn, true) // encrypt onto tunnel
 	}()
 
 	wg.Wait()
@@ -704,8 +706,19 @@ func (ts *TeleportServer) deserializeTaggedUDPPacket(data []byte) (types.TaggedU
 	}, nil
 }
 
-// forwardData forwards data between two connections
-func (ts *TeleportServer) forwardData(src, dst net.Conn) {
+// forwardData copies between a local/target conn and the tunnel.
+// When toTunnel is true, plaintext is AES-GCM encrypted and written as
+// uint32 length + ciphertext. When false, framed ciphertext is decrypted
+// and written as plaintext.
+func (ts *TeleportServer) forwardData(src, dst net.Conn, toTunnel bool) {
+	if toTunnel {
+		ts.forwardPlainToTunnel(src, dst)
+		return
+	}
+	ts.forwardTunnelToPlain(src, dst)
+}
+
+func (ts *TeleportServer) forwardPlainToTunnel(src, dst net.Conn) {
 	buffer := make([]byte, 4096)
 	for {
 		select {
@@ -714,14 +727,32 @@ func (ts *TeleportServer) forwardData(src, dst net.Conn) {
 		default:
 			n, err := src.Read(buffer)
 			if err != nil {
-				// Close the destination connection when source closes
 				dst.Close()
 				return
 			}
+			if n == 0 {
+				continue
+			}
+			if err := encryption.WriteEncryptedFrame(dst, buffer[:n], ts.derivedKey); err != nil {
+				src.Close()
+				return
+			}
+		}
+	}
+}
 
-			_, err = dst.Write(buffer[:n])
+func (ts *TeleportServer) forwardTunnelToPlain(src, dst net.Conn) {
+	for {
+		select {
+		case <-ts.ctx.Done():
+			return
+		default:
+			plain, err := encryption.ReadEncryptedFrame(src, ts.derivedKey)
 			if err != nil {
-				// Close the source connection when destination closes
+				dst.Close()
+				return
+			}
+			if _, err := dst.Write(plain); err != nil {
 				src.Close()
 				return
 			}
@@ -757,9 +788,8 @@ func (ts *TeleportServer) readRequest(conn net.Conn, request *types.PortForwardR
 		bytesRead += n
 	}
 
-	// Decrypt the data
-	key := encryption.DeriveKey(ts.config.EncryptionKey)
-	decryptedData, err := encryption.DecryptData(encryptedData, key)
+	// Decrypt the data (key derived once at process start)
+	decryptedData, err := encryption.DecryptData(encryptedData, ts.derivedKey)
 	if err != nil {
 		logger.WithFields(map[string]interface{}{
 			"error":                 err,