ssh2でSSHトンネルとSOCKS5プロキシをNode.jsで自動構築してみた

function cleanupBastion(done) {
  const killCmd = "fuser -k " + BASTION_TUNNEL_PORT + "/tcp 2>/dev/null; exit 0";
  bastionExec(killCmd, (err, stream) => {
    if (err) { done(); return; }
    stream.on("close", () => done());
    stream.resume();
  });
}

function startLocalServer() {
  const server = net.createServer((socket) => {
    const id = socket.remoteAddress + ":" + socket.remotePort;
    outer.forwardOut("127.0.0.1", LOCAL_PORT, "localhost", BASTION_TUNNEL_PORT, (err, stream) => {
      if (err) {
        socket.destroy();
        return;
      }
      // 双方向パイプ
      socket.pipe(stream).pipe(socket);

      // クリーンアップ
      stream.on("close", () => socket.destroy());
      socket.on("close", () => stream.destroy());
      socket.on("error", () => stream.destroy());
      stream.on("error", () => socket.destroy());
    });
  });

  server.listen(LOCAL_PORT, "127.0.0.1", () => {
    console.log("[3/3] Tunnel ready — " + LOCAL_URL);
    execFile("open", [LOCAL_URL]);  // ブラウザ自動オープン
  });
}

function makeHostVerifier(host) {
  return (key) => {
    const fp = "SHA256:" + crypto.createHash("sha256")
      .update(key).digest("base64").replace(/=+$/, "");
    let out;
    try {
      out = execFileSync("ssh-keygen", ["-F", host, "-l"],
        { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
    } catch {
      console.error("[!] " + host + " not in ~/.ssh/known_hosts. Run once:");
      console.error("    ssh-keyscan -H " + host + " >> ~/.ssh/known_hosts");
      return false;
    }
    if (out.includes(fp)) return true;
    console.error("[!] Host key MISMATCH for " + host + " — possible MITM attack!");
    return false;
  };
}

pnpm proxy

[1/3] Connecting to bastion (10.xxx.x.xxx) as user...
[auth] agent: /private/tmp/com.apple.launchd.xxx/Listeners
[2/3] Bastion connected. Cleaning up stale tunnel on port 9090...
[2/3] Bastion->target tunnel up (bastion:9090 -> target:40001)

[3/3] Tunnel ready — http://localhost:8080/your-app
Ctrl+C to close.

const MOCK_PORT = Number(process.env.MOCK_PORT ?? 80);            // nginxのポート
const BASTION_TUNNEL_PORT = Number(process.env.BASTION_TUNNEL_PORT ?? 9091);  // proxyと衝突しないよう別ポート
const LOCAL_PORT = Number(process.env.LOCAL_PORT ?? 8081);

pnpm proxy   # localhost:8080 → デプロイ先:40001（直接）
pnpm nginx   # localhost:8081 → デプロイ先:80（nginx経由）

class Reader {
  constructor() { this.buf = Buffer.alloc(0); this.pending = null; }

  push(chunk) {
    this.buf = Buffer.concat([this.buf, chunk]);
    if (this.pending && this.buf.length >= this.pending.n) {
      const { n, resolve } = this.pending;
      this.pending = null;
      resolve(this._take(n));
    }
  }

  read(n) {
    return this.buf.length >= n
      ? Promise.resolve(this._take(n))
      : new Promise((resolve) => { this.pending = { n, resolve }; });
  }

  _take(n) {
    const out = this.buf.slice(0, n);
    this.buf = this.buf.slice(n);
    return out;
  }

  flush() {
    const out = this.buf;
    this.buf = Buffer.alloc(0);
    return out;
  }
}

async function handleClient(socket) {
  const br = new Reader();
  socket.on("data", (chunk) => br.push(chunk));

  // 1. グリーティング: バージョン + 認証メソッド一覧
  const greet = await br.read(2);       // [ver=5, nmethods]
  await br.read(greet[1]);              // メソッドリスト（消費するだけ）
  socket.write(Buffer.from([5, 0]));    // "認証不要" を返答

  // 2. CONNECTリクエスト: 宛先アドレス解析
  const hdr = await br.read(4);         // [ver, cmd, rsv, atyp]
  if (hdr[1] !== 1) { socket.destroy(); return; }  // CONNECT以外は非対応

  let host, port;
  const atyp = hdr[3];
  if (atyp === 1) {          // IPv4
    const b = await br.read(6);
    host = `${b[0]}.${b[1]}.${b[2]}.${b[3]}`;
    port = (b[4] << 8) | b[5];
  } else if (atyp === 3) {   // ドメイン名
    const [len] = await br.read(1);
    const b = await br.read(len + 2);
    host = b.slice(0, len).toString();
    port = (b[len] << 8) | b[len + 1];
  } else if (atyp === 4) {   // IPv6
    const b = await br.read(18);
    const parts = [];
    for (let i = 0; i < 16; i += 2)
      parts.push(((b[i] << 8) | b[i + 1]).toString(16));
    host = parts.join(":");
    port = (b[16] << 8) | b[17];
  }
  // ...
}

outer.forwardOut("127.0.0.1", LOCAL_SOCKS_PORT, "127.0.0.1", BASTION_SOCKS_PORT, async (err, ch) => {
  const ur = new Reader();
  ch.on("data", (chunk) => ur.push(chunk));

  // 上流SOCKS5グリーティング
  ch.write(Buffer.from([5, 1, 0]));       // ver=5, 1 method, no-auth
  const gr = await ur.read(2);
  if (gr[0] !== 5 || gr[1] !== 0) throw new Error("upstream rejected auth");

  // 上流にCONNECTリクエスト送信
  const hb = Buffer.from(host);
  const req = Buffer.allocUnsafe(7 + hb.length);
  req[0] = 5; req[1] = 1; req[2] = 0; req[3] = 3;  // ver, CONNECT, rsv, domain
  req[4] = hb.length; hb.copy(req, 5);
  req[5 + hb.length] = (port >> 8) & 0xff;
  req[6 + hb.length] = port & 0xff;
  ch.write(req);

  // 上流のCONNECTレスポンスを読む
  const resp = await ur.read(4);
  if (resp[1] !== 0) throw new Error("upstream CONNECT failed");
  // BND.ADDR をスキップ（atyp別にサイズが異なる）
  // ...

// ブラウザに「接続成功」を返答
socket.write(Buffer.from([5, 0, 0, 1, 0, 0, 0, 0, 0, 0]));

// ハンドシェイク中にバッファに溜まった余分なデータを転送
socket.removeListener("data", onBrData);
ch.removeListener("data", onUpData);
const leftBr = br.flush();
const leftUp = ur.flush();
if (leftBr.length) ch.write(leftBr);
if (leftUp.length) socket.write(leftUp);

// 生データの双方向パイプ
socket.pipe(ch);
ch.pipe(socket);
ch.on("close", () => socket.destroy());
socket.on("close", () => ch.destroy());

pnpm socks5

[1/3] Connecting to bastion...
[2/3] SOCKS5 proxy up on bastion:9092 (exits via target)

[3/3] SOCKS5 proxy ready — localhost:1080
Opening Chrome with isolated profile...
Ctrl+C to close.

execFile("open", ["-n", "-a", "Google Chrome", "--args",
  "--proxy-server=socks5://localhost:" + LOCAL_SOCKS_PORT,
  "--user-data-dir=/tmp/socks5-proxy-chrome",
  TARGET_URL,
]);

BASTION_HOST=10.xxx.x.xxx
BASTION_USER=your_user@bastion.local
DEPLOY_USER=your_user
DEPLOY_HOST=10.xxx.x.xx

{
  "scripts": {
    "proxy": "node --env-file=.env scripts/proxy.mjs",
    "nginx": "node --env-file=.env scripts/test-nginx.mjs",
    "socks5": "node --env-file=.env scripts/socks5-proxy.mjs"
  }
}