Identity aware TCP forwarding over HTTPS

[mathieuancelin]

Like in GCP IAP. The idea here is to provide a client that will expose a local port for TCP connections. This client will wrap every tcp packet in an https connection and send it to Otoroshi. Otoroshi will verify if the connection is okay (user, etc ...) and then unwrap packet and forward it to the target tcp service.

To do that we need to

• write a client (node js or rust) based on https://github.com/mathieuancelin/node-httptunnel
  • can establish a connection with a public service
  • can establish a connection with a private service (apikey)
  • can establish a connection with a secured service (auth. modules)
• write the logic to unwrap packets and send it to target service in handler.scala
  • add special event log with identity
  • possible strategies
    • Websocket wrapping
    • Classic GET / POST / PUT / DELETE, but we need to handle the loadbalancing issue (client side ?)
      • need to check if we can enforce sticky on nginx or haproxy or whatever
    • Stateful and distributed with db and pubsub stuff
    • Http tunnel with CONNECT (not sure play can handle it)
    • the crappy way using http streams
    • we need to encode the logic in an external module usage by all these strategies
• support private app session id extraction from places other than cookies (Private app. session id in/from http header and query param #202)
  • header
  • query param
  • config. will be set in auth. module config.
• Support private apps redirection to urn:ietf:wg:oauth:2.0:oob (Support something like urn:ietf:wg:oauth:2.0:oob in private apps. #297)
• Support full OAuth2 lifecyle through private apps (Support full OIDC / OAuth2 lifecycle with forwarded access token #298)
• TCP forwarding over https will allow to
  • setup a target address and port (tls flag)
  • get address and or port from headers or query params (flag)

Tasks for MVP

• add TCP tunneling flag in descriptor
• authorize only routes for /.well-known/otoroshi/me and /.well-known/otoroshi/tunnel
• write basic client
• write handler with TCP client based on Websocket tunneling
• support multiple token extraction (from header and query param) (Private app. session id in/from http header and query param #202)
• support private app redirection for cli (Support something like urn:ietf:wg:oauth:2.0:oob in private apps. #297)

Tasks for stable version

• Support full OAuth2 lifecyle through private apps (Support full OIDC / OAuth2 lifecycle with forwarded access token #298)
• TCP forwarding flags

Docs

• https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts
• https://cloud.google.com/iap/docs/using-tcp-forwarding
• https://cloud.google.com/solutions/building-internet-connectivity-for-private-vms