s1d3sw1ped/teleport
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Harden config perms and key derivation
CI / check-and-test (pull_request) Successful in 11s
Details

Browse Source 
Write generated configs 0600, treat new keys as raw AES-256, keep
PBKDF2 for unprefixed material, and cache derivation at startup.
This commit is contained in:
s1d3sw1ped_bot
2026-09-01 04:22:57 +00:00
parent 45778ac528
commit bc486eb49d
8 changed files with 293 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/server.go
+18 -9
View File
@@ -77,7 +77,7 @@ func NewTeleportServer(config *config.Config) *TeleportServer {
goroutineSem: make(chan struct{}, maxGoroutines),
maxGoroutines: maxGoroutines,
metrics: metricsInstance,
derivedKey: encryption.DeriveKey(config.EncryptionKey),
derivedKey: mustResolveKey(config.EncryptionKey),
}
}
@@ -254,9 +254,8 @@ func (ts *TeleportServer) sendTaggedUDPPacket(clientConn *net.UDPConn, packet ty
return
}
// Encrypt the data
key := encryption.DeriveKey(ts.config.EncryptionKey)
encryptedData, err := encryption.EncryptData(data, key)
// Encrypt the data (key resolved once at process start)
encryptedData, err := encryption.EncryptData(data, ts.derivedKey)
if err != nil {
logger.WithField("error", err).Debug("Failed to encrypt UDP packet")
return
@@ -310,6 +309,8 @@ func (ts *TeleportServer) handleConnectionWithLimit(conn net.Conn) {
ts.metrics.DecrementActiveConnections()
}()
config.ApplyTCPKeepAlive(conn, ts.config.KeepAlive)
// Set connection timeouts
if ts.config.ReadTimeout > 0 {
conn.SetReadDeadline(time.Now().Add(ts.config.ReadTimeout))
@@ -393,6 +394,7 @@ func (ts *TeleportServer) handleTCPForward(clientConn net.Conn, rule *config.Por
return
}
defer targetConn.Close()
config.ApplyTCPKeepAlive(targetConn, ts.config.KeepAlive)
logger.WithFields(map[string]interface{}{
"client": clientConn.RemoteAddr(),
@@ -478,9 +480,8 @@ func (ts *TeleportServer) handleUDPForward(clientConn net.Conn, rule *config.Por
logger.WithField("bytes_received", n).Debug("UDP SERVER: Received bytes from client")
// Decrypt the data
key := encryption.DeriveKey(ts.config.EncryptionKey)
decryptedData, err := encryption.DecryptData(buffer[:n], key)
// Decrypt the data (key resolved once at process start)
decryptedData, err := encryption.DecryptData(buffer[:n], ts.derivedKey)
if err != nil {
logger.WithField("error", err).Debug("UDP SERVER: Failed to decrypt UDP packet")
continue
@@ -595,8 +596,7 @@ func (ts *TeleportServer) handleUDPForward(clientConn net.Conn, rule *config.Por
continue
}
key := encryption.DeriveKey(ts.config.EncryptionKey)
encryptedData, err := encryption.EncryptData(data, key)
encryptedData, err := encryption.EncryptData(data, ts.derivedKey)
if err != nil {
logger.WithFields(map[string]interface{}{
"packetID": originalPacketID,
@@ -897,3 +897,12 @@ func (ts *TeleportServer) deserializeRequest(data []byte, request *types.PortFor
return nil
}
func mustResolveKey(material string) []byte {
key, err := encryption.ResolveKey(material)
if err != nil {
logger.WithField("error", err).Error("Failed to resolve encryption key")
return nil
}
return key
}