Encrypt TCP tunnel payload with AES-GCM #6

Merged

Ghost merged 1 commit from fix/teleport-2-tcp-gcm into master

2026-09-01 03:30:40 +00:00

Ghost commented

2026-09-01 03:29:06 +00:00

Closes #2

Severity: High

TCP forwardData copied the payload in the clear after the AES-GCM handshake. UDP was already encrypted per datagram; README claimed all traffic is AES-GCM.

What changed

Derive the AES key once at process start (client and server), not per TCP chunk.
Shared frame helper: AES-GCM encrypt, then uint32 length + ciphertext. Reader caps length, decrypts, writes plaintext.
Applied in both forwardData implementations (internal/client and internal/server), both directions of the tunnel (encrypt onto the tunnel, decrypt off it).
Handshake and UDP wire format unchanged.

Tests

Framed encrypt/decrypt round-trip, oversize/zero length rejected.
Sniffer on the framed tunnel does not see HTTP plaintext; client and server forwardData covered in both directions.

Do not merge from this bot.

Closes #2 **Severity:** High TCP `forwardData` copied the payload in the clear after the AES-GCM handshake. UDP was already encrypted per datagram; README claimed all traffic is AES-GCM. ## What changed - Derive the AES key once at process start (client and server), not per TCP chunk. - Shared frame helper: AES-GCM encrypt, then `uint32` length + ciphertext. Reader caps length, decrypts, writes plaintext. - Applied in **both** `forwardData` implementations (`internal/client` and `internal/server`), **both directions** of the tunnel (encrypt onto the tunnel, decrypt off it). - Handshake and UDP wire format unchanged. ## Tests - Framed encrypt/decrypt round-trip, oversize/zero length rejected. - Sniffer on the framed tunnel does not see HTTP plaintext; client and server `forwardData` covered in both directions. Do not merge from this bot.

Ghost added 1 commit

2026-09-01 03:29:06 +00:00

Encrypt TCP tunnel payload with AES-GCM.

CI / check-and-test (pull_request) Successful in 11s

Details

2d46d313d1

TCP forwardData copied plaintext after the handshake. Frame each chunk as uint32 length plus AES-GCM ciphertext in both client and server, both directions.

Ghost merged commit 283781fd47 into master

2026-09-01 03:30:40 +00:00

Ghost deleted branch fix/teleport-2-tcp-gcm

2026-09-01 03:30:40 +00:00

Ghost referenced this pull request

2026-09-01 04:11:36 +00:00

Default local listeners to 127.0.0.1 #7

Ghost referenced this pull request

2026-09-01 04:13:42 +00:00

Default local listeners to 127.0.0.1 #7