README.md

@@ -30,24 +30,6 @@ cURL
 $ curl http://localhost:3000 -H 'Host: whatever.com'
 ```
 
-Inverse SSH proxy (ssh over https):
-
-```bash
-$ sclient ssh user@example.com
-```
-
-(this is the same as a normal SSH Proxy, just easier to type):
-
-```bash
-$ ssh -o ProxyCommand="sclient %h" user@example.com
-```
-
-Inverse rsync proxy (rsync over https):
-
-```bash
-$ sclient rsync user@example.com:path/ path/
-```
-
 A poor man's (or Windows user's) makeshift replacement for `openssl s_client`, `stunnel`, or `socat`.
 
 Install
@@ -69,12 +51,13 @@ Usage
 =====
 
 ```bash
-sclient [flags] [ssh|rsync] <remote> [local]
+sclient [flags] <remote> <local>
 ```
 
 * flags
   * `-k, --insecure` ignore invalid TLS (SSL/HTTPS) certificates
   * `--servername <string>` spoof SNI (to disable use IP as &lt;remote&gt; and do not use this option)
+  * `--ssh proxy` proxy ssh over https (_inverse_ ssh proxy, like stunnel)
 * remote
   * must have servername (i.e. example.com)
   * port is optional (default is 443)
@@ -116,13 +99,7 @@ sclient telebit.cloud:443 - </path/to/file
 ### ssh over https
 
 ```bash
-sclient ssh user@telebit.cloud
+sclient --ssh user@telebit.cloud
-```
-
-### rsync over https
-
-```bash
-sclient rsync -av user@telebit.cloud:my-project/ ~/my-project/
 ```
 
 ### Piping

bin/sclient.js

@@ -1,4 +1,3 @@
-#!/usr/bin/env node
 'use strict';
 
 var pkg = require('../package.json');
@@ -7,6 +6,9 @@ var local;
 var isPiped = !process.stdin.isTTY;
 var localAddress;
 var localPort;
+var rejectUnauthorized;
+var servername;
+var sshProxy;
 
 function usage() {
   console.info("");
@@ -18,174 +20,54 @@ function usage() {
   console.info("");
 }
 
-function parseFlags(argv) {
+function parseFlags() {
-  var args = argv.slice();
+  process.argv.some(function (arg, i) {
-  var flags = {};
-
-  args.some(function (arg, i) {
     if (/^-k|--?insecure$/.test(arg)) {
-      flags.rejectUnauthorized = false;
+      rejectUnauthorized = false;
-      args.splice(i, 1);
+      process.argv.splice(i, 1);
       return true;
     }
   });
-  args.some(function (arg, i) {
+  process.argv.some(function (arg, i) {
     if (/^--?servername$/.test(arg)) {
-      flags.servername = args[i + 1];
+      servername = process.argv[i + 1];
-      if (!flags.servername || /^-/.test(flags.servername)) {
+      if (!servername || /^-/.test(servername)) {
         usage();
         process.exit(2);
       }
-      args.splice(i, 2);
+      process.argv.splice(i, 2);
       return true;
     }
   });
-  args.some(function (arg, i) {
+  process.argv.some(function (arg, i) {
-    if (/^--?p(ort)?$/.test(arg)) {
-      flags.port = args[i + 1];
-      if (!flags.port || /^-/.test(flags.port)) {
-        usage();
-        process.exit(201);
-      }
-      args.splice(i, 2);
-      return true;
-    }
-  });
-  args.some(function (arg, i) {
     if (/^--?ssh$/.test(arg)) {
-      flags.wrapSsh = true;
+      sshProxy = true;
-      args.splice(i, 1);
+      process.argv.splice(i, 1);
+      process.argv[3] = '$';
       return true;
     }
   });
-  args.some(function (arg, i) {
-    if (/^--?socks5$/.test(arg)) {
-      flags.socks5 = args[i + 1];
-      if (!flags.socks5 || /^-/.test(flags.socks5)) {
-        usage();
-        process.exit(202);
-      }
-      args.splice(i, 2);
-      return true;
-    }
-  });
-
-  // This works for most (but not all)
-  // of the ssh and rsync flags - because they mostly don't have arguments
-  args.sort(function (a, b) {
-    if ('-' === a[0]) {
-      if ('-' === b[0]) {
-        return 0;
-      }
-      return 1;
-    }
-    if ('-' === b[0]) {
-      return -1;
-    }
-    return 0;
-  });
-
-  return {
-    flags: flags
-  , args: args
-  };
 }
 
-var sclient = require('../');
+parseFlags();
 
-function testRemote(opts) {
+remote = (process.argv[2]||'').split(':');
-  var emitter = new (require('events').EventEmitter)();
+local = (process.argv[3]||'').split(':');
 
-  sclient._test(opts).then(function () {
+if ('ssh' === remote[0]) {
-    // connected successfully (and closed)
+  sshProxy = true;
-    sclient._listen(emitter, opts);
+  remote = local;
-  }).catch(function (err) {
+  local = ['$'];
-    // did not connect succesfully
+} else if ('ssh' === local[0]) {
-    sclient._listen(emitter, opts);
+  sshProxy = true;
-    console.warn("[warn] '" + opts.remoteAddr + ":" + opts.remotePort
+  local[0] = '$';
-      + "' may not be accepting connections: ", err.toString(), '\n');
-  });
-
-  emitter.once('listening', function (opts) {
-    console.info('[listening] ' + opts.remoteAddr + ":" + opts.remotePort
-      + " <= " + opts.localAddress + ":" + opts.localPort);
-
-    if (opts.command) {
-      var args = [
-        opts.remoteUser + 'localhost'
-      , '-p', opts.localPort
-      // we're _inverse_ proxying ssh, so we must alias the serveranem and ignore the IP
-      , '-o', 'HostKeyAlias=' + opts.remoteAddr
-      , '-o', 'CheckHostIP=no'
-      ];
-      var spawn = require('child_process').spawn;
-      if ('rsync' === opts.command) {
-        var remote = args.shift() + ':' + opts.remotePath;
-        args = [ remote, '-e', 'ssh ' + args.join(' ') ];
-      }
-      if (opts.socks5) {
-        args.push('-D');
-        args.push('localhost:' + opts.socks5);
-      }
-      args = args.concat(opts.args);
-      var child = spawn(opts.command, args, { stdio: 'inherit' });
-      child.on('exit', function () {
-        console.info('closing...');
-      });
-      child.on('close', function () {
-        opts.server.close();
-      });
-    }
-  });
-  emitter.on('connect', function (sock) {
-    console.info('[connect] ' + sock.localAddress.replace('::1', 'localhost') + ":" + sock.localPort
-      + " => " + opts.remoteAddr + ":" + opts.remotePort);
-  });
-  emitter.on('remote-error', function (err) {
-    console.error('[error] (remote) ' + err.toString());
-  });
-  emitter.on('local-error', function (err) {
-    console.error('[error] (local) ' + err.toString());
-  });
 }
 
-function main() {
-  var cmd = parseFlags(process.argv);
-  var binParam;
-  var remoteUser;
-
-  // Re-arrange argument order for ssh
-  if (cmd.flags.wrapSsh) {
-    cmd.args.splice(3, 0, 'ssh');
-  } else if (-1 !== [ 'ssh', 'rsync', 'vpn' ].indexOf((cmd.args[2]||'').split(':')[0])) {
-    cmd.flags.wrapSsh = true;
-    binParam = cmd.args.splice(2, 1);
-    cmd.args.splice(3, 0, binParam[0]);
-  }
-
-  remoteUser = (cmd.args[2]||'').split('@');
-  if (remoteUser[1]) {
-    // has 'user@' in front
-    remote = (remoteUser[1]||'').split(':');
-    remoteUser = remoteUser[0] + '@';
-  } else {
-    // no 'user@' in front
-    remote = (remoteUser[0]||'').split(':');
-    remoteUser = '';
-  }
-  local = (cmd.args[3]||'').split(':');
-
-  if (-1 !== [ 'ssh', 'rsync', 'vpn' ].indexOf(local[0])) {
-    cmd.flags.wrapSsh = true;
-  }
-
-  if (cmd.flags.wrapSsh) {
-    process.argv = cmd.args;
-  } else if (4 !== cmd.args.length) {
 // arg 0 is node
 // arg 1 is sclient
 // arg 2 is remote
-    // arg 3 is local (or ssh or rsync)
+// arg 3 is local
+if (4 !== process.argv.length) {
   if (isPiped) {
     local = ['|'];
   } else {
@@ -204,8 +86,6 @@ function main() {
   usage();
   return;
 }
-
-  // check if it looks like a port number
 if (local[0] === String(parseInt(local[0], 10))) {
   localPort = parseInt(local[0], 10);
   localAddress = 'localhost';
@@ -214,14 +94,15 @@ function main() {
   localPort = parseInt(local[1], 10);
 }
 
+var rparts = remote[0].split('@');
+var username = rparts[1] ? (rparts[0] + '@') : '';
 var opts = {
-    remoteUser: remoteUser
+  remoteAddr: rparts[1] || rparts[0]
-  , remoteAddr: remote[0]
 , remotePort: remote[1] || 443
 , localAddress: localAddress
 , localPort: localPort
-  , rejectUnauthorized: cmd.flags.rejectUnauthorized
+, rejectUnauthorized: rejectUnauthorized
-  , servername: cmd.flags.servername
+, servername: servername
 , stdin: null
 , stdout: null
 };
@@ -230,33 +111,36 @@ function main() {
   opts.stdin = process.stdin;
   opts.stdout = process.stdout;
   // no need for port
-  } else if (-1 !== [ 'ssh', 'rsync', 'vpn' ].indexOf(localAddress)) {
+} else if ('$' === localAddress) {
-    cmd.flags.wrapSsh = true;
+  sshProxy = true;
   opts.localAddress = 'localhost';
-    opts.localPort = local[1] || 0; // choose at random
+  opts.localPort = 0; // choose at random
-    opts.command = localAddress;
-    opts.args = cmd.args.slice(4); // node, sclient, ssh, addr
-    opts.socks5 = cmd.flags.socks5;
-    if ('rsync' === opts.command) {
-      opts.remotePath = opts.remotePort;
-      opts.remotePort = 0;
-    }
-    if ('vpn' === opts.command) {
-      opts.command = 'ssh';
-      if (!opts.socks5) {
-        usage();
-        return;
-      }
-    }
-    if (!opts.remotePort) {
-      opts.remotePort = cmd.flags.port || 443;
-    }
 } else if (!localPort) {
   usage();
   return;
 }
 
-  testRemote(opts);
+var emitter = require('../')(opts);
-}
+emitter.once('listening', function (opts) {
+  var port = opts.localPort;
+  console.info('[listening] ' + opts.remoteAddr + ":" + opts.remotePort
+    + " <= " + opts.localAddress + ":" + opts.localPort);
 
-main();
+  if (sshProxy) {
+    // TODO choose at random and connect to ssh after test
+    var spawn = require('child_process').spawn;
+    var ssh = spawn('ssh', [
+      username + 'localhost'
+    , '-p', port
+    // we're _inverse_ proxying ssh, so we must alias the serveranem and ignore the IP
+    , '-o', 'HostKeyAlias=' + opts.remoteAddr
+    , '-o', 'CheckHostIP=no'
+    ], { stdio: 'inherit' });
+    ssh.on('exit', function () {
+      console.info('shutting down...');
+    });
+    ssh.on('close', function () {
+      opts.server.close();
+    });
+  }
+});

index.js

@@ -1,7 +1,5 @@
 'use strict';
 
-var PromiseA = global.Promise;
-
 var net = require('net');
 var tls = require('tls');
 
@@ -11,19 +9,20 @@ function listenForConns(emitter, opts) {
       servername: opts.remoteAddr, host: opts.remoteAddr, port: opts.remotePort
     , rejectUnauthorized: opts.rejectUnauthorized
     }, function () {
-      emitter.emit('connect', sclient);
+      console.info('[connect] ' + sclient.localAddress.replace('::1', 'localhost') + ":" + sclient.localPort
+        + " => " + opts.remoteAddr + ":" + opts.remotePort);
       c.pipe(sclient);
       sclient.pipe(out || c);
     });
     sclient.on('error', function (err) {
-      emitter.emit('remote-error', err);
+      console.error('[error] (remote) ' + err.toString());
     });
     c.on('error', function (err) {
-      emitter.emit('local-error', err);
+      console.error('[error] (local) ' + err.toString());
     });
     if (out) {
       out.on('error', function (err) {
-        emitter.emit('local-error', err);
+        console.error('[error] (local) ' + err.toString());
       });
     }
   }
@@ -48,7 +47,8 @@ function listenForConns(emitter, opts) {
 }
 
 function testConn(opts) {
-  return new PromiseA(function (resolve, reject) {
+  var emitter = new (require('events').EventEmitter)();
+
   // Test connection first
   var tlsOpts = {
     host: opts.remoteAddr, port: opts.remotePort
@@ -63,16 +63,17 @@ function testConn(opts) {
     tlsOpts.ALPNProtocols = [ 'http', 'h2' ];
   }
   var tlsSock = tls.connect(tlsOpts, function () {
+    setTimeout(function () {
       tlsSock.end();
-      resolve();
+      listenForConns(emitter, opts);
+    }, 200);
   });
   tlsSock.on('error', function (err) {
-      reject(err);
+    console.warn("[warn] '" + opts.remoteAddr + ":" + opts.remotePort + "' may not be accepting connections: ", err.toString(), '\n');
-    });
+    listenForConns(emitter, opts);
   });
+
+  return emitter;
 }
 
-// no public exports yet
+module.exports = testConn;
-// the API is for the commandline only
-module.exports._test = testConn;
-module.exports._listen = listenForConns;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sclient",
-  "version": "1.4.3",
+  "version": "1.3.0",
   "description": "Secure Client for exposing TLS (aka SSL) secured services as plain-text connections locally. Also ideal for multiplexing a single port with multiple protocols using SNI.",
   "main": "index.js",
   "homepage": "https://telebit.cloud/sclient/",