feat(tlsbridge): make intercepted TLS ports configurable (default 443,8443)

Adds tls_bridge.ports to TLSBridgeConfig (empty => {443,8443}), threads it
into Decision via main.go, and unifies the transparent listener's sniff gate
with the bridge's port set: shouldSniff() keeps its host-recovery heuristic
{80,443,8080,8443}, but the transparent path now ALSO sniffs whatever ports
the bridge intercepts (Decision.HandlesPort), so a configured non-standard
port (e.g. 9443) gets the peekable conn the bridge needs — no drift between
the two lists. Validation rejects out-of-range ports. New
TestTransparentBridge_CustomPort proves the bridge engages on a random
ephemeral port (outside shouldSniff's set) when configured.

Keep ports HTTP(S)-only: the bridge serves the decrypted stream as HTTP/1.1
or h2, so non-HTTP TLS (LDAPS/SMTPS/DB-over-TLS) must NOT be added here.

Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/config/config.go

@@ -55,6 +55,11 @@ type TLSBridgeConfig struct {
 	CAKeyPath        string   `yaml:"ca_key_path" json:"ca_key_path"`
 	UpstreamCABundle string   `yaml:"upstream_ca_bundle" json:"upstream_ca_bundle"`
 	SkipHosts        []string `yaml:"skip_hosts" json:"skip_hosts"`
+	// Ports is the set of TCP ports to intercept as TLS. Empty => {443, 8443}.
+	// Only HTTP(S)-bearing ports belong here: the bridge serves the decrypted
+	// stream as HTTP/1.1 or h2, so terminating a non-HTTP TLS protocol (LDAPS,
+	// SMTPS, DB-over-TLS, …) would break it.
+	Ports []int `yaml:"ports" json:"ports"`
 }
 
 // Validate is called from the loader when TLSBridge != nil.
@@ -73,6 +78,11 @@ func (b *TLSBridgeConfig) Validate() error {
 			return fmt.Errorf("tls_bridge.internal_cidrs: %q is not a valid CIDR: %w", c, err)
 		}
 	}
+	for _, p := range b.Ports {
+		if p < 1 || p > 65535 {
+			return fmt.Errorf("tls_bridge.ports: %d is out of range 1-65535", p)
+		}
+	}
 	return nil
 }
 

authbridge/authlib/config/config_test.go

@@ -764,6 +764,10 @@ func TestTLSBridgeConfig_Validate(t *testing.T) {
 		{"file ca with paths", TLSBridgeConfig{CASource: "file", CACertPath: "/c", CAKeyPath: "/k"}, false},
 		{"bad cidr typo", TLSBridgeConfig{InternalCIDRs: []string{"10.0.0.0/8", "10.0.0.0./8"}}, true},
 		{"bad cidr missing mask", TLSBridgeConfig{InternalCIDRs: []string{"10.0.0.0"}}, true},
+		{"valid ports", TLSBridgeConfig{Ports: []int{443, 8443, 9443}}, false},
+		{"port zero", TLSBridgeConfig{Ports: []int{0}}, true},
+		{"port too high", TLSBridgeConfig{Ports: []int{70000}}, true},
+		{"port negative", TLSBridgeConfig{Ports: []int{-1}}, true},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {

authbridge/authlib/listener/forwardproxy/tlsbridge_integration_test.go

@@ -135,7 +135,7 @@ func TestTransparentBridge(t *testing.T) {
 	//    side believes it captured a connection whose SO_ORIGINAL_DST is the
 	//    origin's host:port.
 	clientSide, serverSide := net.Pipe()
-	defer clientSide.Close()
+	defer func() { _ = clientSide.Close() }()
 
 	done := make(chan struct{})
 	go func() {
@@ -223,6 +223,119 @@ func TestTransparentBridge(t *testing.T) {
 	}
 }
 
+// TestTransparentBridge_CustomPort proves the configurable-ports path: the
+// origin runs on a RANDOM ephemeral port (NOT in shouldSniff's hardcoded
+// {80,443,8080,8443} set), and the bridge is configured (Decision.Ports) to
+// intercept exactly that port. Before the shouldSniff↔Decision.Ports unification
+// the transparent path would not sniff this port, so the bridge could never peek
+// and the call would tunnel (agent handshake would fail against the origin's real
+// cert). With the unification, HandlesPort(port) widens the sniff and the bridge
+// engages. Asserting decryption here is the regression test for that wiring.
+func TestTransparentBridge_CustomPort(t *testing.T) {
+	var gotOriginPath string
+	origin := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotOriginPath = r.URL.Path
+		if r.URL.Path == "/secret" {
+			_, _ = w.Write([]byte("OK-SECRET"))
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer origin.Close()
+
+	originCAPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: origin.Certificate().Raw})
+	originURL, err := url.Parse(origin.URL)
+	if err != nil {
+		t.Fatalf("parse origin URL: %v", err)
+	}
+	originHostPort := originURL.Host // 127.0.0.1:<random ephemeral port>
+	customPort := portOf(originHostPort)
+	if customPort == 443 || customPort == 8443 || customPort == 80 || customPort == 8080 {
+		t.Skipf("random origin port %d collided with a default sniff port; rerun", customPort)
+	}
+
+	src, err := tlsbridge.NewEphemeralSource()
+	if err != nil {
+		t.Fatalf("NewEphemeralSource: %v", err)
+	}
+	minter := tlsbridge.NewMinter(src, tlsbridge.MinterOpts{})
+	up, err := tlsbridge.NewUpstreamClient(originCAPEM)
+	if err != nil {
+		t.Fatalf("NewUpstreamClient: %v", err)
+	}
+	engine := &tlsbridge.Engine{
+		// Only the custom port is configured — proves both that it IS bridged
+		// (despite shouldSniff not knowing it) and that the default set is replaced.
+		Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
+			Scope: tlsbridge.ScopeAll,
+			Ports: map[int]bool{customPort: true},
+		}),
+		Term:     tlsbridge.NewTerminator(minter),
+		Skip:     tlsbridge.NewSkipSet(),
+		Upstream: up,
+		CAPEM:    src.CACertPEM(),
+	}
+
+	probe := &bridgeProbePlugin{}
+	p, err := plugintesting.BuildPipeline([]pipeline.Plugin{probe})
+	if err != nil {
+		t.Fatalf("BuildPipeline: %v", err)
+	}
+	srv := &Server{OutboundPipeline: pipeline.NewHolder(p), Client: http.DefaultClient, TLSBridge: engine}
+
+	clientSide, serverSide := net.Pipe()
+	defer func() { _ = clientSide.Close() }()
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		srv.HandleTransparentConn(serverSide, originHostPort)
+	}()
+
+	pool := x509.NewCertPool()
+	if !pool.AppendCertsFromPEM(engine.CAPEM) {
+		t.Fatalf("append bridge CA")
+	}
+	host := hostOnly(originHostPort)
+	tconn := tls.Client(clientSide, &tls.Config{ServerName: host, RootCAs: pool, NextProtos: []string{"http/1.1"}})
+	_ = tconn.SetDeadline(time.Now().Add(10 * time.Second))
+	if err := tconn.Handshake(); err != nil {
+		t.Fatalf("agent handshake through bridge on custom port failed: %v", err)
+	}
+	req, err := http.NewRequest(http.MethodGet, "https://"+host+"/secret", nil)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+	writeErr := make(chan error, 1)
+	go func() { writeErr <- req.Write(tconn) }()
+	resp, err := http.ReadResponse(bufio.NewReader(tconn), req)
+	if err != nil {
+		t.Fatalf("read response on custom-port bridge: %v", err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if werr := <-writeErr; werr != nil {
+		t.Fatalf("write request: %v", werr)
+	}
+
+	if probe.gotPath != "/secret" {
+		t.Errorf("probe path = %q, want /secret (bridge did not engage on custom port)", probe.gotPath)
+	}
+	if gotOriginPath != "/secret" {
+		t.Errorf("origin path = %q, want /secret", gotOriginPath)
+	}
+	if got := strings.TrimSpace(string(body)); got != "OK-SECRET" {
+		t.Errorf("body = %q, want OK-SECRET", got)
+	}
+
+	_ = clientSide.Close()
+	_ = serverSide.Close()
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatalf("HandleTransparentConn did not return")
+	}
+}
+
 // TestConnectBridge drives the full CONNECT → 200 → agent-TLS → decrypt →
 // pipeline → re-originate loop through the PUBLIC forward-proxy HTTP handler
 // (so the real net/http Hijack path runs). An httptest TLS origin stands in

authbridge/authlib/listener/forwardproxy/transparent.go

@@ -66,7 +66,12 @@ func (s *Server) HandleTransparentConn(clientConn net.Conn, dst string) {
 	// HTTP/TLS ports so non-HTTP protocols are not delayed by the peek. The dial
 	// target stays dst (the IP); only pctx.Host gets the recovered name.
 	host := dst
-	if shouldSniff(dst) {
+	// Sniff on the standard HTTP/TLS ports, OR on whatever ports the TLS bridge
+	// is configured to intercept — so a configured non-standard bridge port
+	// (e.g. 9443) still gets the peekable conn the bridge branch needs. The
+	// bridge's own port set is the single source of truth (no drift with
+	// shouldSniff's heuristic list).
+	if shouldSniff(dst) || (s.TLSBridge != nil && s.TLSBridge.Decision.HandlesPort(portOf(dst))) {
 		name, wrapped := sniffHost(clientConn)
 		clientConn = wrapped
 		if name != "" {

authbridge/authlib/tlsbridge/decision.go

@@ -49,6 +49,12 @@ func NewDecision(o DecisionOpts) *Decision {
 	return d
 }
 
+// HandlesPort reports whether port is in the bridge's interception set. It is
+// the single source of truth for "which ports the bridge cares about" — the
+// transparent listener consults it so it sniffs (and thus can bridge) exactly
+// the configured ports, never drifting from Classify's port gate.
+func (d *Decision) HandlesPort(port int) bool { return d.ports[port] }
+
 // Classify decides whether to bridge. first is the peeked client bytes.
 func (d *Decision) Classify(host, ip string, port int, first []byte) (Verdict, string) {
 	if !d.ports[port] {

authbridge/authlib/tlsbridge/decision_test.go

@@ -78,3 +78,22 @@ func TestSkipSet_AutoSkip(t *testing.T) {
 		t.Error("Add then Contains failed")
 	}
 }
+
+func TestDecision_HandlesPort(t *testing.T) {
+	// Default set when Ports is nil.
+	d := NewDecision(DecisionOpts{})
+	if !d.HandlesPort(443) || !d.HandlesPort(8443) {
+		t.Error("default set must handle 443 and 8443")
+	}
+	if d.HandlesPort(9443) {
+		t.Error("default set must not handle 9443")
+	}
+	// Custom set replaces the default.
+	c := NewDecision(DecisionOpts{Ports: map[int]bool{9443: true}})
+	if !c.HandlesPort(9443) {
+		t.Error("custom set must handle 9443")
+	}
+	if c.HandlesPort(443) {
+		t.Error("custom set must not handle 443 (it replaces, not augments, the default)")
+	}
+}

authbridge/cmd/authbridge-proxy/main.go

@@ -278,9 +278,16 @@ func main() {
 		if cfg.TLSBridge.Scope == "all" {
 			scope = tlsbridge.ScopeAll
 		}
+		var ports map[int]bool // nil => NewDecision defaults to {443, 8443}
+		if len(cfg.TLSBridge.Ports) > 0 {
+			ports = make(map[int]bool, len(cfg.TLSBridge.Ports))
+			for _, p := range cfg.TLSBridge.Ports {
+				ports[p] = true
+			}
+		}
 		bridge = &tlsbridge.Engine{
 			Decision: tlsbridge.NewDecision(tlsbridge.DecisionOpts{
-				Scope: scope, InternalCIDRs: cfg.TLSBridge.InternalCIDRs, SkipHosts: cfg.TLSBridge.SkipHosts,
+				Scope: scope, Ports: ports, InternalCIDRs: cfg.TLSBridge.InternalCIDRs, SkipHosts: cfg.TLSBridge.SkipHosts,
 			}),
 			Term:     tlsbridge.NewTerminator(minter),
 			Skip:     tlsbridge.NewSkipSet(),