373b053820
feat(server): implement serve loop, ServeOptions, graceful shutdown, and integration test
...
- Add ServeOptions struct with all CLI fields (key, authorized_keys, cert_authority,
transport_mode, listen_addr, tls_cert, tls_key, acme_domain, stealth, proxy,
iroh_relay, max_connections_per_ip, max_auth_attempts)
- ServeOptions::key/authorized_keys accept KeySource (file or in-memory)
- Server::new(opts) creates server with bound russh config, auth config, rate limiter
- Server::run(acceptor, endpoint_info) enters accept loop: rate limit check -> create
handler -> russh::server::run_stream()
- Stealth mode integration: protocol detection before run_stream() on TLS connections
- Graceful shutdown: Server::shutdown() sends SSH disconnect, waits drain timeout,
aborts remaining sessions
- SIGTERM/SIGINT handler on unix platforms
- iroh mode: prints endpoint ID on startup
- Integration test: start server, shutdown signal, verify clean exit
- Re-export Server, ServeOptions, ServeTransportMode, ServeError from lib.rs
2026-06-02 11:57:30 +00:00
f13a1c985f
Merge remote-tracking branch 'origin/feat/server/channel-proxy'
...
# Conflicts:
# crates/wraith-core/src/error.rs
# crates/wraith-core/src/server/mod.rs
2026-06-02 11:32:28 +00:00
49fe2b699f
Implement server channel proxy: direct, SOCKS5, and HTTP CONNECT outbound connections
...
- Add channel_proxy.rs with connect_outbound() supporting Direct, Socks5, and HttpConnect proxy modes
- Implement proxy_channel() with bidirectional copy between SSH channel and outbound TCP
- Channel errors close individual channels without affecting SSH session (ADR-006)
- Remove destination logging from handler to comply with ADR-006
- Add ForwardError to error.rs (was missing, needed by forward.rs)
- Fix TcpListener type annotation in forward.rs
- Add 11 unit tests: direct, SOCKS5 handshake, HTTP CONNECT, proxy rejection, unreachable targets
2026-06-02 11:24:32 +00:00
365b11d19e
Merge remote-tracking branch 'origin/feat/server/stealth-mode'
...
# Conflicts:
# crates/wraith-core/src/error.rs
# crates/wraith-core/src/server/mod.rs
2026-06-02 11:14:06 +00:00
7dcf7502b7
feat(server): implement stealth mode protocol multiplexing (ADR-017)
...
Add stealth mode detection that peeks at the first bytes after TLS handshake
to determine SSH vs HTTP protocol. SSH connections proceed to russh handler;
non-SSH connections receive a fake nginx 404 response, making the server
indistinguishable from an ordinary HTTPS site to scanners and DPI systems.
- ProtocolDetection enum (Ssh, Http) for protocol classification
- detect_protocol() uses BufReader::fill_buf() to peek without consuming bytes
- send_fake_nginx_404() writes HTTP/1.1 404 + Server: nginx headers
- validate_stealth_config() enforces TLS transport requirement for stealth
- 17 unit tests covering SSH banner, HTTP, random data, and edge cases
2026-06-02 11:13:15 +00:00
5a2b535605
Merge remote-tracking branch 'origin/feat/server/rate-limiting-and-logging'
...
# Conflicts:
# crates/wraith-core/src/error.rs
# crates/wraith-core/src/server/handler.rs
# crates/wraith-core/src/server/mod.rs
2026-06-02 11:06:18 +00:00
24b70f5651
Implement server rate limiting and fail2ban-friendly structured logging
...
Add ConnectionRateLimiter (HashMap<IpAddr, usize>) and AuthAttemptLimiter
with check/on_connect/on_disconnect and check/on_failure methods.
Integrate into ServerHandler with structured tracing::info! logging for
auth attempts, connection opened/closed events. No logging of tunnel
destinations per ADR-006. Also add ForwardError type and fix type
annotation in forward.rs to unblock compilation.
2026-06-02 11:02:55 +00:00
f963898a05
Implement control channel routing for wraith-* reserved destinations (ADR-018)
...
- Add control_channel.rs with WRAITH_CONTROL_DESTINATION, WRAITH_PREFIX constants
- Add ControlChannelHandler trait and ControlChannelRouter for routing logic
- Add DuplexStream supertrait for Box<dyn> compatibility
- Server handler rejects wraith-* destinations when no handler configured
- Add ForwardError type to fix pre-existing compilation error
- Unit tests: reserved detection, non-reserved pass-through, prefix matching
2026-06-02 11:01:54 +00:00
24b92227e7
Implement ServerHandler with auth delegation and channel dispatch
...
Convert server.rs to directory module (server/mod.rs + server/handler.rs).
ServerHandler implements russh::server::Handler with:
- auth_publickey() delegating to ServerAuthConfig with structured logging
- channel_open_direct_tcpip() routing wraith-* prefix to internal handler,
stub for regular TCP proxy
- ProxyConfig/ProxyMode types for outbound proxy configuration
- Unit tests for auth delegation, reserved destination routing, and
unknown channel type rejection
2026-06-02 10:40:05 +00:00
