Harden config perms and key derivation

Write generated configs 0600, treat new keys as raw AES-256, keep
PBKDF2 for unprefixed material, and cache derivation at startup.

internal/client/client.go

@@ -50,7 +50,7 @@ func NewTeleportClient(config *config.Config) *TeleportClient {
 		cancel:           cancel,
 		connectionPool:   make(chan net.Conn, maxPoolSize),
 		maxPoolSize:      maxPoolSize,
-		derivedKey:       encryption.DeriveKey(config.EncryptionKey),
+		derivedKey:       mustResolveKey(config.EncryptionKey),
 	}
 }
 
@@ -63,6 +63,7 @@ func (tc *TeleportClient) Start() error {
 	if err != nil {
 		return fmt.Errorf("failed to connect to server: %v", err)
 	}
+	config.ApplyTCPKeepAlive(conn, tc.config.KeepAlive)
 	tc.serverConn = conn
 
 	// Start DNS server if enabled
@@ -187,6 +188,7 @@ func (tc *TeleportClient) getConnection() (net.Conn, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to create connection: %v", err)
 	}
+	config.ApplyTCPKeepAlive(conn, tc.config.KeepAlive)
 
 	// Set connection timeouts
 	if tc.config.ReadTimeout > 0 {
@@ -343,6 +345,7 @@ func (tc *TeleportClient) sendTaggedUDPPacketWithResponse(packet types.TaggedUDP
 		return
 	}
 	defer serverConn.Close()
+	config.ApplyTCPKeepAlive(serverConn, tc.config.KeepAlive)
 
 	logger.WithField("packetID", packet.Header.PacketID).Debug("UDP CLIENT: Connected to server, sending port forward request")
 
@@ -399,9 +402,8 @@ func (tc *TeleportClient) sendTaggedUDPPacketToConnection(conn net.Conn, packet
 		"data_length": len(data),
 	}).Debug("UDP CLIENT: Serialized packet")
 
-	// Encrypt the data
-	key := encryption.DeriveKey(tc.config.EncryptionKey)
-	encryptedData, err := encryption.EncryptData(data, key)
+	// Encrypt the data (key resolved once at process start)
+	encryptedData, err := encryption.EncryptData(data, tc.derivedKey)
 	if err != nil {
 		logger.WithFields(map[string]interface{}{
 			"packetID": packet.Header.PacketID,
@@ -453,9 +455,8 @@ func (tc *TeleportClient) waitForUDPResponseAndForward(conn net.Conn, expectedPa
 				"bytes_received": n,
 			}).Debug("UDP CLIENT: Received response bytes")
 
-			// Decrypt the response
-			key := encryption.DeriveKey(tc.config.EncryptionKey)
-			decryptedData, err := encryption.DecryptData(buffer[:n], key)
+			// Decrypt the response (key resolved once at process start)
+			decryptedData, err := encryption.DecryptData(buffer[:n], tc.derivedKey)
 			if err != nil {
 				logger.WithFields(map[string]interface{}{
 					"packetID": expectedPacketID,
@@ -638,6 +639,7 @@ func (tc *TeleportClient) deserializeTaggedUDPPacket(data []byte) (types.TaggedU
 // handleTCPConnection handles a TCP connection from a local client
 func (tc *TeleportClient) handleTCPConnection(clientConn net.Conn, rule config.PortRule) {
 	defer clientConn.Close()
+	config.ApplyTCPKeepAlive(clientConn, tc.config.KeepAlive)
 
 	// Get a connection from the pool or create a new one
 	serverConn, err := tc.getConnection()
@@ -825,3 +827,12 @@ func (tc *TeleportClient) serializeRequest(request types.PortForwardRequest) ([]
 
 	return data, nil
 }
+
+func mustResolveKey(material string) []byte {
+	key, err := encryption.ResolveKey(material)
+	if err != nil {
+		logger.WithField("error", err).Error("Failed to resolve encryption key")
+		return nil
+	}
+	return key
+}

internal/server/server.go

@@ -77,7 +77,7 @@ func NewTeleportServer(config *config.Config) *TeleportServer {
 		goroutineSem:     make(chan struct{}, maxGoroutines),
 		maxGoroutines:    maxGoroutines,
 		metrics:          metricsInstance,
-		derivedKey:       encryption.DeriveKey(config.EncryptionKey),
+		derivedKey:       mustResolveKey(config.EncryptionKey),
 	}
 }
 
@@ -254,9 +254,8 @@ func (ts *TeleportServer) sendTaggedUDPPacket(clientConn *net.UDPConn, packet ty
 		return
 	}
 
-	// Encrypt the data
-	key := encryption.DeriveKey(ts.config.EncryptionKey)
-	encryptedData, err := encryption.EncryptData(data, key)
+	// Encrypt the data (key resolved once at process start)
+	encryptedData, err := encryption.EncryptData(data, ts.derivedKey)
 	if err != nil {
 		logger.WithField("error", err).Debug("Failed to encrypt UDP packet")
 		return
@@ -310,6 +309,8 @@ func (ts *TeleportServer) handleConnectionWithLimit(conn net.Conn) {
 		ts.metrics.DecrementActiveConnections()
 	}()
 
+	config.ApplyTCPKeepAlive(conn, ts.config.KeepAlive)
+
 	// Set connection timeouts
 	if ts.config.ReadTimeout > 0 {
 		conn.SetReadDeadline(time.Now().Add(ts.config.ReadTimeout))
@@ -393,6 +394,7 @@ func (ts *TeleportServer) handleTCPForward(clientConn net.Conn, rule *config.Por
 		return
 	}
 	defer targetConn.Close()
+	config.ApplyTCPKeepAlive(targetConn, ts.config.KeepAlive)
 
 	logger.WithFields(map[string]interface{}{
 		"client": clientConn.RemoteAddr(),
@@ -478,9 +480,8 @@ func (ts *TeleportServer) handleUDPForward(clientConn net.Conn, rule *config.Por
 
 				logger.WithField("bytes_received", n).Debug("UDP SERVER: Received bytes from client")
 
-				// Decrypt the data
-				key := encryption.DeriveKey(ts.config.EncryptionKey)
-				decryptedData, err := encryption.DecryptData(buffer[:n], key)
+				// Decrypt the data (key resolved once at process start)
+				decryptedData, err := encryption.DecryptData(buffer[:n], ts.derivedKey)
 				if err != nil {
 					logger.WithField("error", err).Debug("UDP SERVER: Failed to decrypt UDP packet")
 					continue
@@ -595,8 +596,7 @@ func (ts *TeleportServer) handleUDPForward(clientConn net.Conn, rule *config.Por
 					continue
 				}
 
-				key := encryption.DeriveKey(ts.config.EncryptionKey)
-				encryptedData, err := encryption.EncryptData(data, key)
+				encryptedData, err := encryption.EncryptData(data, ts.derivedKey)
 				if err != nil {
 					logger.WithFields(map[string]interface{}{
 						"packetID": originalPacketID,
@@ -897,3 +897,12 @@ func (ts *TeleportServer) deserializeRequest(data []byte, request *types.PortFor
 
 	return nil
 }
+
+func mustResolveKey(material string) []byte {
+	key, err := encryption.ResolveKey(material)
+	if err != nil {
+		logger.WithField("error", err).Error("Failed to resolve encryption key")
+		return nil
+	}
+	return key
+}