# TCP Proksilarni Qurish ## Bu darsda nima qilamiz? TCP proxy — client va server o'rtasida trafik uzatuvchi vositachi. Bu darsda basic proxy'dan boshlab, trafik kuzatuvchi, autentifikatsiya qo'shilgan, va load balancing qiluvchi proksilarni quramiz. Oxirida production-ready server — signal bilan to'g'ri yopilish, ulanish statistikasi bilan. ## Basic TCP proxy (takrorlash) Oldingi darsdan bilishimiz kerak: `io.Copy` ikki goroutine'da ikki tomonlama trafik uzatadi. ```go package main import ( "io" "log" "net" ) type Proxy struct { ListenAddr string RemoteAddr string } func (p *Proxy) Start() error { listener, err := net.Listen("tcp", p.ListenAddr) if err != nil { return err } defer listener.Close() log.Printf("Proxy: %s → %s\n", p.ListenAddr, p.RemoteAddr) for { conn, err := listener.Accept() if err != nil { log.Println("Qabul qilishda xatolik:", err) continue } go p.handle(conn) } } func (p *Proxy) handle(client net.Conn) { defer client.Close() remote, err := net.Dial("tcp", p.RemoteAddr) if err != nil { log.Println("Remote'ga ulanib bo'lmadi:", err) return } defer remote.Close() done := make(chan struct{}, 2) go func() { io.Copy(remote, client); done <- struct{}{} }() go func() { io.Copy(client, remote); done <- struct{}{} }() <-done } func main() { p := &Proxy{ListenAddr: "0.0.0.0:8080", RemoteAddr: "example.com:80"} log.Fatal(p.Start()) } ``` ## Trafik kuzatuvchi proxy Pentest paytida yoki debugging uchun o'tgan trafikni ko'rish kerak. Quyidagi versiya har o'tgan ma'lumot qismini logga yozadi: ```go package main import ( "bytes" "fmt" "io" "log" "net" "time" ) type LoggingProxy struct { ListenAddr string RemoteAddr string } func (p *LoggingProxy) Start() error { listener, err := net.Listen("tcp", p.ListenAddr) if err != nil { return err } defer listener.Close() log.Printf("Logging proxy: %s → %s", p.ListenAddr, p.RemoteAddr) for { conn, err := listener.Accept() if err != nil { continue } go p.handle(conn) } } func (p *LoggingProxy) handle(client net.Conn) { defer client.Close() remote, err := net.Dial("tcp", p.RemoteAddr) if err != nil { return } defer remote.Close() sessionID := fmt.Sprintf("%d", time.Now().UnixNano()%100000) log.Printf("[%s] Yangi ulanish: %s", sessionID, client.RemoteAddr()) done := make(chan struct{}, 2) go func() { p.copyLog(remote, client, sessionID, "C→R"); done <- struct{}{} }() go func() { p.copyLog(client, remote, sessionID, "R→C"); done <- struct{}{} }() <-done log.Printf("[%s] Yopildi", sessionID) } func (p *LoggingProxy) copyLog(dst io.Writer, src io.Reader, id, dir string) { buf := make([]byte, 32*1024) for { n, err := src.Read(buf) if err != nil { return } data := buf[:n] // Bosilmaydigan belgilarni '.' bilan almashtiramiz printable := bytes.Map(func(r rune) rune { if r >= 32 && r <= 126 { return r } return '.' }, data) preview := string(printable) if len(preview) > 80 { preview = preview[:80] + "..." } log.Printf("[%s] [%s] %d bayt: %s", id, dir, n, preview) if _, err := dst.Write(data); err != nil { return } } } ``` ## Autentifikatsiya qo'shish Ba'zan proxy'ga token bilan kirishni cheklash kerak — masalan, ekspluatatsiya vositasiga faqat ma'lum tokenli ulanishlar: ```go type AuthProxy struct { ListenAddr string RemoteAddr string ValidTokens map[string]bool } func (p *AuthProxy) handle(client net.Conn) { defer client.Close() // Birinchi kelgan xabar — token bo'lishi kerak client.SetReadDeadline(time.Now().Add(5 * time.Second)) buf := make([]byte, 256) n, err := client.Read(buf) if err != nil { client.Write([]byte("AUTH_FAILED\n")) return } token := string(bytes.TrimSpace(buf[:n])) if !p.ValidTokens[token] { log.Printf("Noto'g'ri token: %s — %s", client.RemoteAddr(), token) client.Write([]byte("INVALID_TOKEN\n")) return } client.SetReadDeadline(time.Time{}) // Deadline ni olib tashlaymiz client.Write([]byte("AUTH_OK\n")) log.Printf("Tasdiqlandi: %s", client.RemoteAddr()) // Oddiy proxy ishlaydi remote, err := net.Dial("tcp", p.RemoteAddr) if err != nil { return } defer remote.Close() done := make(chan struct{}, 2) go func() { io.Copy(remote, client); done <- struct{}{} }() go func() { io.Copy(client, remote); done <- struct{}{} }() <-done } ``` ## Load balancing proxy Bir necha backend server bo'lsa, ulanishlarni **round-robin** (ketma-ket) taqsimlash: ```go package main import ( "io" "log" "net" "sync/atomic" ) type LoadBalancer struct { ListenAddr string Backends []string current uint32 } func (lb *LoadBalancer) nextBackend() string { // Atomic increment — thread-safe, mutex kerak emas n := atomic.AddUint32(&lb.current, 1) return lb.Backends[(int(n)-1)%len(lb.Backends)] } func (lb *LoadBalancer) Start() error { listener, err := net.Listen("tcp", lb.ListenAddr) if err != nil { return err } defer listener.Close() log.Printf("Load balancer: %s → %v", lb.ListenAddr, lb.Backends) for { conn, err := listener.Accept() if err != nil { continue } go lb.handle(conn) } } func (lb *LoadBalancer) handle(client net.Conn) { defer client.Close() backend := lb.nextBackend() remote, err := net.Dial("tcp", backend) if err != nil { log.Printf("Backend %s ishlamayapti: %v", backend, err) return } defer remote.Close() log.Printf("%s → %s", client.RemoteAddr(), backend) done := make(chan struct{}, 2) go func() { io.Copy(remote, client); done <- struct{}{} }() go func() { io.Copy(client, remote); done <- struct{}{} }() <-done } func main() { lb := &LoadBalancer{ ListenAddr: "0.0.0.0:8080", Backends: []string{ "server1.example.com:80", "server2.example.com:80", "server3.example.com:80", }, } log.Fatal(lb.Start()) } ``` ```mermaid flowchart LR C1[Client 1] --> LB[Load Balancer :8080] C2[Client 2] --> LB C3[Client 3] --> LB LB -->|"1-ulanish"| S1[Server 1] LB -->|"2-ulanish"| S2[Server 2] LB -->|"3-ulanish"| S3[Server 3] LB -->|"4-ulanish"| S1 ``` ## TLS termination proxy Client bilan HTTPS (shifrlangan), backend bilan oddiy HTTP — backend serverda sertifikat kerak emas: ```go import "crypto/tls" type TLSProxy struct { ListenAddr string RemoteAddr string CertFile string KeyFile string } func (p *TLSProxy) Start() error { cert, err := tls.LoadX509KeyPair(p.CertFile, p.KeyFile) if err != nil { return err } config := &tls.Config{Certificates: []tls.Certificate{cert}} listener, err := tls.Listen("tcp", p.ListenAddr, config) if err != nil { return err } defer listener.Close() log.Printf("TLS proxy: %s (HTTPS) → %s (HTTP)", p.ListenAddr, p.RemoteAddr) for { conn, err := listener.Accept() if err != nil { continue } go func(c net.Conn) { defer c.Close() // Shifr ochilgan trafik backend'ga plaintext ketadi remote, err := net.Dial("tcp", p.RemoteAddr) if err != nil { return } defer remote.Close() done := make(chan struct{}, 2) go func() { io.Copy(remote, c); done <- struct{}{} }() go func() { io.Copy(c, remote); done <- struct{}{} }() <-done }(conn) } } ``` ## Production proxy (statistika va graceful shutdown) ```go package main import ( "context" "flag" "io" "log" "net" "os" "os/signal" "sync/atomic" "syscall" "time" ) type ProxyServer struct { listenAddr string remoteAddr string maxConns int timeout time.Duration totalConns int64 activeConns int64 bytesIn int64 bytesOut int64 ctx context.Context cancel context.CancelFunc } func (ps *ProxyServer) Start() error { listener, err := net.Listen("tcp", ps.listenAddr) if err != nil { return err } // Signal bilan graceful shutdown sigChan := make(chan os.Signal, 1) signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM) go func() { <-sigChan log.Println("To'xtatish signali. Yopilmoqda...") ps.cancel() listener.Close() }() // Har 10 sekundda statistika go ps.reportStats() log.Printf("Proxy: %s → %s (maks %d ulanish)", ps.listenAddr, ps.remoteAddr, ps.maxConns) for { select { case <-ps.ctx.Done(): return nil default: } conn, err := listener.Accept() if err != nil { if ps.ctx.Err() != nil { return nil } continue } if int(atomic.LoadInt64(&ps.activeConns)) >= ps.maxConns { log.Println("Maks ulanish — rad etildi") conn.Close() continue } go ps.handle(conn) } } func (ps *ProxyServer) handle(client net.Conn) { defer client.Close() atomic.AddInt64(&ps.totalConns, 1) atomic.AddInt64(&ps.activeConns, 1) defer atomic.AddInt64(&ps.activeConns, -1) remote, err := net.DialTimeout("tcp", ps.remoteAddr, ps.timeout) if err != nil { return } defer remote.Close() done := make(chan struct{}, 2) go func() { n, _ := io.Copy(remote, client) atomic.AddInt64(&ps.bytesIn, n) done <- struct{}{} }() go func() { n, _ := io.Copy(client, remote) atomic.AddInt64(&ps.bytesOut, n) done <- struct{}{} }() <-done } func (ps *ProxyServer) reportStats() { ticker := time.NewTicker(10 * time.Second) defer ticker.Stop() start := time.Now() for { select { case <-ps.ctx.Done(): return case <-ticker.C: log.Printf("Ishlash vaqti: %v | Jami: %d | Faol: %d | Kirdi: %.1f MB | Chiqdi: %.1f MB", time.Since(start).Round(time.Second), atomic.LoadInt64(&ps.totalConns), atomic.LoadInt64(&ps.activeConns), float64(atomic.LoadInt64(&ps.bytesIn))/1024/1024, float64(atomic.LoadInt64(&ps.bytesOut))/1024/1024) } } } func main() { listen := flag.String("listen", "0.0.0.0:8080", "Tinglash manzili") remote := flag.String("remote", "", "Remote manzil (host:port)") maxConns := flag.Int("max-conns", 1000, "Maks bir vaqtdagi ulanishlar") timeout := flag.Duration("timeout", 10*time.Second, "Ulanish timeout") flag.Parse() if *remote == "" { log.Fatal("-remote kerak (misol: db.internal:3306)") } ctx, cancel := context.WithCancel(context.Background()) server := &ProxyServer{ listenAddr: *listen, remoteAddr: *remote, maxConns: *maxConns, timeout: *timeout, ctx: ctx, cancel: cancel, } log.Fatal(server.Start()) } ``` ```bash # Oddiy proxy go run proxy.go -remote example.com:80 # Katta yuklamali, timeout bilan go run proxy.go -listen :8443 -remote db.internal:3306 -max-conns 500 -timeout 30s ``` ## Qisqacha 1. **Basic proxy** — `io.Copy` ikki goroutine'da, `done` channel bilan bitta yopilishni kutamiz. 2. **Logging proxy** — bosilmaydigan belgilarni `.` bilan almashtirib, trafik preview ko'rsatamiz. 3. **Load balancer** — `atomic.AddUint32` bilan thread-safe round-robin backend tanlash. 4. **TLS termination** — `tls.Listen` client tomonida HTTPS, backend'ga oddiy TCP. 5. **Production proxy** — `context`, signal, atomic statistika — to'g'ri yopiladi, statistika beradi. ## Keyingi qadam Keyingi darsda TCP vositalarning klassikini — **Netcat** ni Go'da qayta quramiz: interaktiv rejim, fayl uzatish, reverse shell.