From 55f786d4228d150c1c30fc7edb33ea628213f648 Mon Sep 17 00:00:00 2001 From: Eric Rodrigues Pires Date: Sun, 29 Mar 2026 14:43:17 -0300 Subject: [PATCH] Remove SUMMARY.md and log error on unexpected HTTP proxy conditions --- CONTRIBUTING.md | 4 +- book/src/SUMMARY.md | 1 - book/src/features.md | 128 ------------------------------------------- justfile | 2 +- nix/packages.nix | 18 +++--- src/http/mod.rs | 9 ++- 6 files changed, 21 insertions(+), 141 deletions(-) delete mode 100644 book/src/features.md diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1dc8de5..364e0e0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -16,6 +16,6 @@ If you wish to contribute changes to Sandhole, please [fork the repository](http If possible, make sure that your changes pass all tests and linting/formatting checks before creating a pull request by running `just test` and `just clippy`, respectively. This should ensure that your PR will pass the CI pipeline. -Please add a short description of any user-facing changes to the top of [CHANGELOG.md](./CHANGELOG.md), under the "Unreleased" section (or create one if it does not exist). The changelog should adhere to [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and it must emphasize any breaking changes. Also, update the [features.md page](./book/src/features.md) of the book accordingly. +Please add a short description of any user-facing changes to the top of [CHANGELOG.md](./CHANGELOG.md), under the "Unreleased" section (or create one if it does not exist). The changelog must adhere to [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and it must emphasize any breaking changes. -If you're adding or modifying a command line option, run `just cli`, manually format the contents output to `cli.html` (i.e. by wrapping long lines and removing trailing whitespace), and update the [cli.md page](./book/src/cli.md) of the book accordingly. +If you're adding or modifying a command line option, run `just cli` to update the book. This requires you to have `nix` installed. diff --git a/book/src/SUMMARY.md b/book/src/SUMMARY.md index 5a37fa4..c4d9b3e 100644 --- a/book/src/SUMMARY.md +++ b/book/src/SUMMARY.md @@ -21,7 +21,6 @@ # Reference - [Frequently asked questions](./faq.md) -- [Features](./features.md) - [CLI](./cli.md) - [NixOS module options](./nixos_options.md) - [Benchmarks](./benchmarks.md) diff --git a/book/src/features.md b/book/src/features.md deleted file mode 100644 index ab3788b..0000000 --- a/book/src/features.md +++ /dev/null @@ -1,128 +0,0 @@ -# Features - -This is a comprehensive list of all features offered by Sandhole. - -## Tunneling (remote forwarding) - -Features related to Sandhole's remote forwarding and reverse proxy capabilities. - -### HTTP/HTTPS - -- HTTP tunneling via SSH remote forwarding. - - Option to force HTTP redirects to HTTPS. (SSH exec: `force-https`; CLI: `--force-https`) -- HTTPS tunneling via SSH remote forwarding, with automatic TLS certificates. - - Option to connect SSH clients via the HTTPS port. (CLI: `--connect-ssh-on-https-port`) - - Support for Server Name Indication (SNI) proxying. (SSH exec: `sni-proxy`) - - Support for HTTP/2 proxying. (SSH exec: `http2`) -- Support for automatic `X-Forwarded` headers. -- Random subdomain generation by default. - - Option to set the seed for random subdomain generation. (CLI: `--random-subdomain-seed`, `--random-subdomain-value`) - - Option to set the length for random subdomains. (CLI: `--random-subdomain-length`) - - Option to skip subdomains containing profanities. (CLI: `--random-subdomain-filter-profanities`) -- Option to allow requested subdomains instead of random generation by default. (CLI: `--allow-requested-subdomains`) - -### TCP - -- TCP tunneling via SSH remote forwarding, with random port selection. - - Option to allow requested ports instead of random selection by default. (CLI: `--allow-requested-ports`) - -### Aliasing (local forwarding) - -- TCP/HTTP/SNI aliasing via SSH remote forwarding. - - Alias-only forwardings. (SSH exec: `tcp-alias`) -- ProxyJump SSH hosts via SSH remote forwarding. -- Generic aliases via SSH remote forwarding. -- Option to restrict fingerprints for local aliasing forwardings. (SSH exec: `allowed-fingerprints`) - -### Authentication - -- SSH public key-based authentication for users and admins. - - SSH public key-restricted connection for local forwarding users. -- Option for password-based authentication for users. (CLI: `--password-authentication-url`) - - Configurable authentication request timeout. (CLI: `--authentication-request-timeout`) - -### Authorization - -- Control over how external hostnames are allowed to be bound. (CLI: `--bind-hostnames`) -- Control over the prefix for TXT external hostname authorization for binding. (CLI: `--txt-record-prefix`) -- Option to disable custom domains containing profanities from binding. (CLI: `--requested-domain-filter-profanities`) -- Option to disable subdomains containing profanities from binding. (CLI: `--requested-subdomain-filter-profanities`) - -### Reverse proxy - -- Access logs for HTTP, TCP, and aliases. -- Control over if and how services are load-balanced. (CLI: `--load-balancing`, `--load-balancing-algorithm`) -- Control over allowed incoming connections by IP address CIDRs. (SSH exec: `ip-allowlist`, CLI: `--ip-allowlist`) -- Control over blocked incoming connections by IP address CIDRs. (SSH exec: `ip-blocklist`, CLI: `--ip-blocklist`) -- Option to restrict maximum services exposed by users. (CLI: `--quota-per-user`) -- Option to restrict maximum transfer rate by the users' services. (CLI: `--rate-limit-per-user`) - -### ACME - -- Option to use Let's Encrypt's ACME server for dynamic certificates. (CLI: `--acme-contact-email`) -- Option for using Let's Encrypt's staging server for ACME debug mode. (CLI: `--acme-use-staging`) - -## Admin access - -Features related to the admin permissioning system. - -### Admin interface - -- Terminal-based interface accessible via admin key authentication. -- Real-time system metrics (CPU, memory, network usage). -- View all active connections (SSH, HTTP, SNI, TCP, and alias). - - Real-time connection statistics (requests/connections per minute, current connection count) -- View user details for connections. - - Display key algorithm and comments. - - Remove user connections and keys. - -### Admin-only aliases - -- Access to special aliases that can only be local forwarded to by users with admin credentials. - - Endpoint for exposing Prometheus metrics. (Alias: `prometheus.sandhole:10`) - -## Configuration - -Features related to system-wide configuration options. - -### Networking - -- Option to configure address for network interfaces. (CLI: `--listen-address`) -- Option to change SSH port from the default 2222. (CLI: `--ssh-port`) -- Option to change HTTP port from the default 80. (CLI: `--http-port`) -- Option to change HTTPS port from the default 443. (CLI: `--https-port`) -- Option to configure the redirect page for the root domain. (CLI: `--domain-redirect`) - -### Resources - -- Configurable buffer size for bidirectional proxying. (CLI: `--buffer-size`) -- Automatic cleanup of unresponsive SSH connections. (CLI: `--ssh-keepalive-interval`, `--ssh-keepalive-max`) -- Automatic cleanup of idle connections via timeout. (CLI: `--idle-connection-timeout`) -- Automatic cleanup of unproxied connections via timeout. (CLI: `--unproxied-connection-timeout`) -- Option to configure a timeout for HTTP/HTTPS requests. (CLI: `--http-request-timeout`) -- Option to configure a timeout for TCP/WebSocket/aliasing connections. (CLI: `--tcp-connection-timeout`) - -### File system - -- Directory-based configuration. - - Configuration of directory for SSH user keys. (CLI: `--user-keys-directory`) - - Configuration of directory for SSH admin keys. (CLI: `--admin-keys-directory`) - - Configuration of directory for TLS certificates chains and private keys. (CLI: `--certificates-directory`) - - Configuration of directory for ACME cache. (CLI: `--acme-cache-directory`) - - Configuration of file for server private key. (CLI: `--private-key-file`) -- Disabling automatic directory creation for missing paths. (CLI: `--disable-directory-creation`) - -### Logs - -- [`tracing`-based log filtering](https://docs.rs/tracing-subscriber/latest/tracing_subscriber/filter/struct.EnvFilter.html). -- Option to disable HTTP access logs. (CLI: `--disable-http-logs`) -- Option to disable TCP access logs. (CLI: `--disable-tcp-logs`) - -### Modules - -- Disabling HTTP, along with HTTPS and SNI proxying. (CLI: `--disable-http`) -- Disabling HTTPS, along with SNI proxying. (CLI: `--disable-https`) -- Disabling SNI proxying. (CLI: `--disable-sni`) -- Disabling TCP port binding. (CLI: `--disable-tcp`) -- Disabling generic aliases, along with SSH ProxyJump. (CLI: `--disable-aliasing`) - - Disabling Prometheus metrics collection and admin-only alias. (CLI: `--disable-prometheus`) diff --git a/justfile b/justfile index ca5f7ce..97c7b4a 100644 --- a/justfile +++ b/justfile @@ -1,4 +1,4 @@ -default: +list: just --list test $RUST_LOG="sandhole=debug": diff --git a/nix/packages.nix b/nix/packages.nix index 8253ce8..865149d 100644 --- a/nix/packages.nix +++ b/nix/packages.nix @@ -33,13 +33,17 @@ in options = removeAttrs evalOptions.options [ "_module" ]; }).optionsCommonMark; - _cli = pkgs.stdenv.mkDerivation { - name = "sandhole-cli.html"; - nativeBuildInputs = [ pkgs.to-html ]; - buildCommand = '' - to-html --no-prompt "${lib.getExe sandhole} --help" > $out - ''; - }; + _cli = + pkgs.runCommand "sandhole-cli.html" + { + nativeBuildInputs = [ + pkgs.to-html + sandhole + ]; + } + '' + to-html --no-prompt "sandhole --help" > $out + ''; _book = pkgs.stdenv.mkDerivation { name = "sandhole-book"; diff --git a/src/http/mod.rs b/src/http/mod.rs index c27359b..5ce7a68 100644 --- a/src/http/mod.rs +++ b/src/http/mod.rs @@ -312,8 +312,13 @@ impl From for HttpError { impl IntoResponse for HttpError { fn into_response(self) -> axum::response::Response { - #[cfg(not(coverage_nightly))] - tracing::debug!(error = %self, "HTTP proxy error."); + if matches!(self, HttpError::HyperError(_) | HttpError::InternalError(_)) { + #[cfg(not(coverage_nightly))] + tracing::error!(error = %self, "HTTP proxy error."); + } else { + #[cfg(not(coverage_nightly))] + tracing::debug!(error = %self, "HTTP proxy error."); + } match self { HttpError::HeaderToStrError(_) | HttpError::MissingUriHost -- 2.51.2