Documentation
¶
Overview ¶
Package server provides the HTTP server and WebSocket handler for ShellGate.
Index ¶
- Constants
- type Config
- type IPWhitelist
- type RateLimiter
- type Server
- func (s *Server) ACL() *acl.DynamicACL
- func (s *Server) AddWhitelistIP(cidr string) error
- func (s *Server) Addr() string
- func (s *Server) Auth() auth.Authenticator
- func (s *Server) AutoCertManager() *autocert.Manager
- func (s *Server) CreateShareLink(sessionID string) (string, error)
- func (s *Server) GenerateOneTimeToken(ttl time.Duration) (string, error)
- func (s *Server) GetPort() int
- func (s *Server) GetStatus() ServerStatus
- func (s *Server) IsListening() bool
- func (s *Server) KillSession(id string) error
- func (s *Server) ListSessions() []SessionInfo
- func (s *Server) ListenAndServe() error
- func (s *Server) RecordAuthFailure(ip string)
- func (s *Server) RecordAuthSuccess(ip string)
- func (s *Server) RemoveWhitelistIP(cidr string) error
- func (s *Server) RevokeToken(token string) error
- func (s *Server) SetEventHandler(fn func(event string, detail map[string]string))
- func (s *Server) SetPort(port int)
- func (s *Server) Shutdown(ctx context.Context) error
- func (s *Server) StartListener() (string, error)
- func (s *Server) StopListener() error
- func (s *Server) ToggleRecording() bool
- type ServerStatus
- type SessionInfo
- type StealthConfig
- type StealthController
- type WSMessage
Constants ¶
const ( // MaxMessageSize is the maximum allowed WebSocket message size (64KB). MaxMessageSize = 64 * 1024 // WriteWait is the time allowed to write a message to the peer. WriteWait = 10 * time.Second // PongWait is the time allowed to read the next pong message from the peer. PongWait = 60 * time.Second // PingInterval is the interval at which pings are sent. Must be less than PongWait. PingInterval = (PongWait * 9) / 10 // PTYReadBufferSize is the buffer size for reading from PTY. PTYReadBufferSize = 4096 // FlushInterval is the interval for flushing buffered PTY output to WebSocket. FlushInterval = 10 * time.Millisecond )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
Host string
Port int
Shell string
Verbose bool
// Auth
AuthMode string // none, token, password, otp
Token string
Password string
OTPDir string
AllowIP string
RateLimit float64
NoAuthAck bool // --i-know-what-im-doing
// TLS
TLSEnabled bool
TLSConfig *tls.Config
AutoCert *autocert.Manager
// Session
MaxSessions int
Timeout time.Duration
IdleTimeout time.Duration
// Recording
RecordEnabled bool
RecordDir string
// Sharing
// Dynamic ACL (Phase 9)
MaxFailedAttempts int
BanDuration time.Duration
GeoIPEnabled bool
GeoIPDBPath string
AllowedCountries string
BlockedCountries string
AccessWindowStart string
AccessWindowEnd string
AccessWindowTZ string
// Stealth Mode (Phase 10)
StealthEnabled bool
RandomPort bool
PortRangeMin int
PortRangeMax int
AutoCloseTTL time.Duration
// Telegram (Phase 8)
TelegramEnabled bool
TelegramToken string
TelegramUserIDs []int64
ExternalHost string
// Audit (Phase 11)
AuditLogPath string
WebhookURL string
WebhookEvents string
MetricsEnabled bool
}
Config holds the server configuration.
type IPWhitelist ¶
type IPWhitelist struct {
// contains filtered or unexported fields
}
IPWhitelist restricts access to the given CIDR ranges.
func NewIPWhitelist ¶
func NewIPWhitelist(cidrs string) (*IPWhitelist, error)
NewIPWhitelist parses a comma-separated list of CIDR ranges.
func (*IPWhitelist) Middleware ¶
func (wl *IPWhitelist) Middleware(next http.Handler) http.Handler
Middleware returns an HTTP middleware that enforces the IP whitelist.
type RateLimiter ¶
type RateLimiter struct {
// contains filtered or unexported fields
}
RateLimiter provides per-IP rate limiting with TTL-based eviction.
func NewRateLimiter ¶
func NewRateLimiter(requestsPerSecond float64) *RateLimiter
NewRateLimiter creates a new per-IP rate limiter. Entries are evicted after 10 minutes of inactivity.
func (*RateLimiter) Middleware ¶
func (rl *RateLimiter) Middleware(next http.Handler) http.Handler
Middleware returns an HTTP middleware that enforces rate limits.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is the main ShellGate HTTP/WebSocket server.
func (*Server) AddWhitelistIP ¶
AddWhitelistIP adds a CIDR to the dynamic whitelist.
func (*Server) Auth ¶
func (s *Server) Auth() auth.Authenticator
Auth returns the configured authenticator.
func (*Server) AutoCertManager ¶
AutoCertManager returns the autocert manager for HTTP-01 challenge handler, if configured.
func (*Server) CreateShareLink ¶
CreateShareLink creates a share link for a session.
func (*Server) GenerateOneTimeToken ¶
GenerateOneTimeToken creates a single-use token with the given TTL.
func (*Server) GetStatus ¶
func (s *Server) GetStatus() ServerStatus
GetStatus returns the current server status.
func (*Server) IsListening ¶
IsListening returns whether the server is currently accepting connections.
func (*Server) KillSession ¶
KillSession terminates a session by ID.
func (*Server) ListSessions ¶
func (s *Server) ListSessions() []SessionInfo
ListSessions returns info about all active sessions.
func (*Server) ListenAndServe ¶
ListenAndServe starts the HTTP server (with TLS if configured). This is the traditional blocking method. For stealth mode, use StartListener()/StopListener().
func (*Server) RecordAuthFailure ¶
RecordAuthFailure records an auth failure for fail2ban and metrics.
func (*Server) RecordAuthSuccess ¶
RecordAuthSuccess records a successful auth for metrics.
func (*Server) RemoveWhitelistIP ¶
RemoveWhitelistIP removes a CIDR from the dynamic whitelist.
func (*Server) RevokeToken ¶
RevokeToken revokes a one-time token.
func (*Server) SetEventHandler ¶
SetEventHandler sets the notification callback for server events.
func (*Server) StartListener ¶
StartListener creates a net.Listener and starts serving. Non-blocking.
func (*Server) StopListener ¶
StopListener closes the listener and shuts down active sessions.
func (*Server) ToggleRecording ¶
ToggleRecording toggles session recording on/off.
type ServerStatus ¶
type ServerStatus struct {
Listening bool
Port int
Uptime time.Duration
Sessions int
TLSEnabled bool
RecordingOn bool
BannedIPs int
}
ServerStatus holds server status information for the Telegram bot.
type SessionInfo ¶
SessionInfo is a serializable snapshot of session metadata (for bot commands).
type StealthConfig ¶
type StealthConfig struct {
RandomPort bool
PortRangeMin int
PortRangeMax int
AutoCloseTTL time.Duration
}
StealthConfig configures the stealth controller.
type StealthController ¶
type StealthController struct {
// contains filtered or unexported fields
}
StealthController manages dynamic port selection and auto-close timers.
func NewStealthController ¶
func NewStealthController(srv *Server, cfg StealthConfig) *StealthController
NewStealthController creates a new stealth controller for the given server.
func (*StealthController) ActivePort ¶
func (sc *StealthController) ActivePort() int
ActivePort returns the port the server is currently listening on, or 0 if not listening.
func (*StealthController) Close ¶
func (sc *StealthController) Close() error
Close stops the listener and cancels any auto-close timer.
Source Files