s1d3sw1ped/teleport
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Encrypt TCP tunnel payload with AES-GCM #6

Merged
Ghost merged 1 commits from fix/teleport-2-tcp-gcm into master 2026-08-31 22:30:40 -05:00
Conversation 0 Commits 1 Files Changed 6
+524 -22
Ghost commented 2026-08-31 22:29:06 -05:00
Copy Link
Copy Source

Closes #2

Severity: High

TCP forwardData copied the payload in the clear after the AES-GCM handshake. UDP was already encrypted per datagram; README claimed all traffic is AES-GCM.

What changed

  • Derive the AES key once at process start (client and server), not per TCP chunk.
  • Shared frame helper: AES-GCM encrypt, then uint32 length + ciphertext. Reader caps length, decrypts, writes plaintext.
  • Applied in both forwardData implementations (internal/client and internal/server), both directions of the tunnel (encrypt onto the tunnel, decrypt off it).
  • Handshake and UDP wire format unchanged.

Tests

  • Framed encrypt/decrypt round-trip, oversize/zero length rejected.
  • Sniffer on the framed tunnel does not see HTTP plaintext; client and server forwardData covered in both directions.

Do not merge from this bot.

Closes #2 **Severity:** High TCP `forwardData` copied the payload in the clear after the AES-GCM handshake. UDP was already encrypted per datagram; README claimed all traffic is AES-GCM. ## What changed - Derive the AES key once at process start (client and server), not per TCP chunk. - Shared frame helper: AES-GCM encrypt, then `uint32` length + ciphertext. Reader caps length, decrypts, writes plaintext. - Applied in **both** `forwardData` implementations (`internal/client` and `internal/server`), **both directions** of the tunnel (encrypt onto the tunnel, decrypt off it). - Handshake and UDP wire format unchanged. ## Tests - Framed encrypt/decrypt round-trip, oversize/zero length rejected. - Sniffer on the framed tunnel does not see HTTP plaintext; client and server `forwardData` covered in both directions. Do not merge from this bot.
Ghost added 1 commit 2026-08-31 22:29:06 -05:00
Encrypt TCP tunnel payload with AES-GCM.
CI / check-and-test (pull_request) Successful in 11s
Details
2d46d313d1 
TCP forwardData copied plaintext after the handshake. Frame each chunk as uint32 length plus AES-GCM ciphertext in both client and server, both directions.
Ghost merged commit 283781fd47 into master 2026-08-31 22:30:40 -05:00
Ghost deleted branch fix/teleport-2-tcp-gcm 2026-08-31 22:30:40 -05:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 draft
Draft for review — do not merge without Eva review
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ash blake eva linus moss pike s1d3sw1ped
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: s1d3sw1ped/teleport#6
Delete Branch "fix/teleport-2-tcp-gcm"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?