Using Ghostunnel to assist authorization about ghostunnel HOT 4 OPEN

Ah, I see this operates as a direct copy of the byte stream once TLS is established, so it wouldn't really work.

from ghostunnel.

There's some prior art here, Squarespace/ghostunnel is a fork of ghostunnel that adds functionality for exposing a read-only memcache instance. I could see adding this via a plugin architecture, i.e. ghostunnel itself would continue operating on byte streams but users could select plugins to parse and intercept protocols on top of that. That would allow for things like filtering memcache, but also adding headers to HTTP, etc. What do you think?

from ghostunnel.

Having a plugin architecture would also allow for doing neat things like logging request and response data for debugging purposes. And thanks to https://golang.org/pkg/plugin/, third-party/custom plugins would be possible too.

from ghostunnel.

A plugin architecture seems really cool here. I'd love to make sure whatever we end up doing is flexible enough to support a wide variety of protocols.

A short list of desired features, I think:

1. Observing both directions of the network connection, so a protocol state machine can be maintained
2. Inject data into one side or the other (eg: HTTP headers, error responses)
3. Terminate the connection (eg: when access is denied)
4. Customize the handshake (custom cert validation, client cert selection, etc)

I think some example use-cases that should be able to be supported:

1. The existing auth code: All the handling of what client certs are allowed.
2. The memcache filter in the fork, and other protocols too (eg, Redis)
3. Telling the client and/or server the certificate provided at the far end.
4. Fine-grained HTTP or gRPC access control
5. Allow some connections to succeed with no client cert (eg, GET, but POST requires auth).

I think func fuse is probably going to be the most likely place for changes here. The biggest change is probably that we might not want to have two completely seperate io.Copy for input and output, as many protocols will need access to both sides.

This will add some complexity to Ghostunnel, but I feel this is probably worth it for the many added possibilities. It's possible we could even factor some existing code into the plugin architecture. I'm thinking about the auth package, as well as SPIFFE support.

from ghostunnel.