Add browser gateway

Former-commit-id: 67b81c1f40
2026-08-31 11:11:28 +02:00 · 2026-05-11 18:03:40 -07:00
parent c9ac8fc28f
commit 832b06d8d5
6 changed files with 731 additions and 0 deletions
--- a/browsergateway/main.go
+++ b/browsergateway/main.go
@@ -0,0 +1,305 @@
+package browsergateway
+
+import (
+	"context"
+	"crypto/subtle"
+	"crypto/tls"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// Forwarding buffer size. RDP graphics traffic is bursty and TLS records cap
+// at ~16 KiB, so 64 KiB lets a couple of records pile up per syscall/frame
+// without wasting memory per session.
+const forwardBufSize = 64 * 1024
+
+// Config holds the configuration for a Gateway.
+type Config struct {
+	// AuthToken is the shared secret required by RDP clients in the RDCleanPath
+	// ProxyAuth field, and by SSH clients as the authToken query parameter.
+	AuthToken string
+	// NativeSSH, when non-nil, configures a local PTY/shell SSH mode instead
+	// of proxying to an external SSH server.
+	NativeSSH *NativeSSHConfig
+}
+
+// Gateway is a browser-based RDP/SSH WebSocket proxy.
+// Create one with New and mount it via RegisterHandlers or the individual
+// HandleRDP / HandleSSH http.HandlerFunc methods.
+type Gateway struct {
+	authToken string
+	nativeSSH *NativeSSHConfig
+}
+
+// New creates a new Gateway from the provided Config.
+func New(cfg Config) *Gateway {
+	return &Gateway{
+		authToken: cfg.AuthToken,
+		nativeSSH: cfg.NativeSSH,
+	}
+}
+
+// RegisterHandlers registers the /jet/rdp and /jet/ssh routes on mux.
+func (g *Gateway) RegisterHandlers(mux *http.ServeMux) {
+	mux.HandleFunc("/rdp", g.HandleRDP)
+	mux.HandleFunc("/ssh", g.HandleSSH)
+}
+
+// HandleRDP is an http.HandlerFunc for RDP-over-WebSocket connections.
+func (g *Gateway) HandleRDP(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	ws, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		InsecureSkipVerify: true, // any-origin: minimal dev proxy with no auth
+		Subprotocols:       []string{"binary"},
+	})
+	if err != nil {
+		log.Printf("websocket upgrade failed: %v", err)
+		return
+	}
+	// Disable per-message read size cap (default is 32 KiB which would break
+	// large RDP graphics messages).
+	ws.SetReadLimit(-1)
+	defer ws.CloseNow() //nolint:errcheck
+
+	if err := g.serveSession(ctx, ws); err != nil {
+		log.Printf("session error: %v", err)
+	}
+}
+
+func (g *Gateway) serveSession(ctx context.Context, ws *websocket.Conn) error {
+	// Expose the WebSocket as a streaming net.Conn. Binary messages are
+	// concatenated into a byte stream and writes become single binary frames.
+	// This is a thin wrapper with no per-message goroutine, unlike Gorilla.
+	stream := websocket.NetConn(ctx, ws, websocket.MessageBinary)
+	defer stream.Close() //nolint:errcheck
+
+	// -- Read the initial RDCleanPath request from the client --
+	pdu, err := readCleanPath(stream)
+	if err != nil {
+		return fmt.Errorf("read RDCleanPath: %w", err)
+	}
+
+	if pdu.Destination == "" {
+		return errors.New("RDCleanPath missing destination")
+	}
+	if len(pdu.X224) == 0 {
+		return errors.New("RDCleanPath missing X224 connection PDU")
+	}
+
+	// Constant-time comparison to avoid leaking the expected token via timing.
+	if subtle.ConstantTimeCompare([]byte(pdu.ProxyAuth), []byte(g.authToken)) != 1 {
+		return errors.New("RDCleanPath ProxyAuth token mismatch")
+	}
+
+	target := pdu.Destination
+	// Default port for RDP if not specified.
+	if _, _, splitErr := net.SplitHostPort(target); splitErr != nil {
+		target = net.JoinHostPort(target, "3389")
+	}
+
+	log.Printf("Connecting to RDP server %s", target)
+
+	// -- Open TCP connection to the destination RDP server --
+	serverTCP, err := net.DialTimeout("tcp", target, 15*time.Second)
+	if err != nil {
+		return fmt.Errorf("dial %s: %w", target, err)
+	}
+	defer serverTCP.Close()
+	if tcp, ok := serverTCP.(*net.TCPConn); ok {
+		// NoDelay is Go's default; set explicitly. RDP wants low latency for
+		// input echo, and the bulk path is naturally chunked by TLS records.
+		_ = tcp.SetNoDelay(true)
+		_ = tcp.SetKeepAlive(true)
+		_ = tcp.SetKeepAlivePeriod(30 * time.Second)
+		_ = tcp.SetReadBuffer(forwardBufSize)
+		_ = tcp.SetWriteBuffer(forwardBufSize)
+	}
+	serverAddr := serverTCP.RemoteAddr().String()
+
+	// Forward the optional pre-connection blob, then the X.224 connection request.
+	if pdu.PreconnectionBlob != "" {
+		if _, err := serverTCP.Write([]byte(pdu.PreconnectionBlob)); err != nil {
+			return fmt.Errorf("send PCB: %w", err)
+		}
+	}
+	if _, err := serverTCP.Write(pdu.X224); err != nil {
+		return fmt.Errorf("send X224: %w", err)
+	}
+
+	// -- Read the X.224 connection confirm from the server --
+	x224Rsp, err := readX224(serverTCP)
+	if err != nil {
+		return fmt.Errorf("read X224 response: %w", err)
+	}
+	logX224Negotiation(x224Rsp)
+
+	// -- Upgrade the server connection to TLS (skip verification) --
+	//
+	// Windows RDP hosts are picky: only set SNI when the target is a hostname
+	// (Go would skip SNI for IP literals anyway, but be explicit), and accept
+	// the full range of TLS versions / ciphers since some servers only
+	// negotiate TLS 1.0 or legacy suites.
+	host, _, _ := net.SplitHostPort(target)
+	tlsCfg := &tls.Config{
+		InsecureSkipVerify: true, //nolint:gosec // proxy intentionally skips verification
+		MinVersion:         tls.VersionTLS10,
+		// Cap at TLS 1.2: Windows RDP servers commonly send a TLS "internal_error"
+		// alert when CredSSP/NLA is layered on top of a TLS 1.3 session.
+		MaxVersion: tls.VersionTLS12,
+	}
+	if net.ParseIP(host) == nil {
+		tlsCfg.ServerName = host
+	}
+	tlsConn := tls.Client(serverTCP, tlsCfg)
+	if err := tlsConn.Handshake(); err != nil {
+		return fmt.Errorf("TLS handshake with server: %w", err)
+	}
+	log.Printf("Server TLS handshake OK (version=0x%04x cipher=0x%04x)",
+		tlsConn.ConnectionState().Version, tlsConn.ConnectionState().CipherSuite)
+
+	// Collect the raw DER server certificate chain to return to the client.
+	state := tlsConn.ConnectionState()
+	if len(state.PeerCertificates) == 0 {
+		return errors.New("server did not present any certificates")
+	}
+	chain := make([][]byte, 0, len(state.PeerCertificates))
+	for _, c := range state.PeerCertificates {
+		chain = append(chain, c.Raw)
+	}
+
+	// -- Send the RDCleanPath response back to the client --
+	rsp, err := encodeRDCleanPathResponse(serverAddr, x224Rsp, chain)
+	if err != nil {
+		return fmt.Errorf("encode RDCleanPath response: %w", err)
+	}
+	if _, err := stream.Write(rsp); err != nil {
+		return fmt.Errorf("write RDCleanPath response: %w", err)
+	}
+
+	log.Printf("RDCleanPath handshake complete, forwarding traffic to %s", serverAddr)
+
+	// -- Two-way blind forwarding of the (now TLS-encrypted) RDP stream --
+	return forward(stream, tlsConn)
+}
+
+// readCleanPath buffers bytes from the stream until a full RDCleanPath PDU has
+// been received, then decodes it.
+func readCleanPath(r io.Reader) (*rdCleanPathPdu, error) {
+	buf := make([]byte, 0, 1024)
+	tmp := make([]byte, 1024)
+	for {
+		total := detectRDCleanPathLength(buf)
+		switch {
+		case total == -2:
+			return nil, errors.New("invalid RDCleanPath PDU")
+		case total > 0 && len(buf) >= total:
+			return decodeRDCleanPathRequest(buf[:total])
+		}
+		n, err := r.Read(tmp)
+		if n > 0 {
+			buf = append(buf, tmp[:n]...)
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+}
+
+// readX224 reads exactly one TPKT-framed X.224 PDU from the server.
+//
+// The TPKT header is 4 bytes: version (0x03), reserved (0x00), and a u16
+// big-endian total length that includes the header itself.
+func readX224(r io.Reader) ([]byte, error) {
+	hdr := make([]byte, 4)
+	if _, err := io.ReadFull(r, hdr); err != nil {
+		return nil, err
+	}
+	if hdr[0] != 0x03 {
+		return nil, fmt.Errorf("unexpected TPKT version 0x%02x", hdr[0])
+	}
+	total := int(binary.BigEndian.Uint16(hdr[2:4]))
+	if total < 4 || total > 4096 {
+		return nil, fmt.Errorf("unreasonable TPKT length %d", total)
+	}
+	out := make([]byte, total)
+	copy(out, hdr)
+	if _, err := io.ReadFull(r, out[4:]); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// logX224Negotiation prints which RDP security protocol the server selected
+// (or the failure code), to help diagnose handshake issues such as the server
+// requiring NLA/CredSSP.
+//
+// X.224 Connection Confirm layout (RFC 1006 / [MS-RDPBCGR]):
+//
+//	bytes 0..3   TPKT header (03 00 LL LL)
+//	byte  4      X.224 length indicator
+//	byte  5      X.224 code (0xD0 = CC)
+//	bytes 6..10  DST-REF, SRC-REF, class
+//	byte  11     optional RDP Negotiation type (0x02 = response, 0x03 = failure)
+//	byte  12     flags
+//	bytes 13..14 length (little-endian, =8)
+//	bytes 15..18 selected protocol / failure code (u32 little-endian)
+func logX224Negotiation(pdu []byte) {
+	if len(pdu) < 19 {
+		log.Printf("X.224 response too short (%d bytes) to contain RDP negotiation", len(pdu))
+		return
+	}
+	switch pdu[11] {
+	case 0x02:
+		proto := uint32(pdu[15]) | uint32(pdu[16])<<8 | uint32(pdu[17])<<16 | uint32(pdu[18])<<24
+		name := "unknown"
+		switch proto {
+		case 0:
+			name = "RDP (standard)"
+		case 1:
+			name = "SSL/TLS"
+		case 2:
+			name = "HYBRID (CredSSP/NLA)"
+		case 8:
+			name = "HYBRID_EX"
+		}
+		log.Printf("Server selected RDP protocol 0x%x (%s)", proto, name)
+	case 0x03:
+		code := uint32(pdu[15]) | uint32(pdu[16])<<8 | uint32(pdu[17])<<16 | uint32(pdu[18])<<24
+		log.Printf("Server returned RDP negotiation failure code 0x%x", code)
+	default:
+		log.Printf("X.224 response has no RDP negotiation block (type=0x%02x)", pdu[11])
+	}
+}
+
+// forward shuttles bytes between the two streams until either side closes.
+func forward(a, b io.ReadWriteCloser) error {
+	errc := make(chan error, 2)
+	go func() {
+		buf := make([]byte, forwardBufSize)
+		_, err := io.CopyBuffer(a, b, buf)
+		_ = a.Close()
+		_ = b.Close()
+		errc <- err
+	}()
+	go func() {
+		buf := make([]byte, forwardBufSize)
+		_, err := io.CopyBuffer(b, a, buf)
+		_ = a.Close()
+		_ = b.Close()
+		errc <- err
+	}()
+	// Wait for one side to finish, then return.
+	err := <-errc
+	if errors.Is(err, io.EOF) || err == nil {
+		return nil
+	}
+	return err
+}
--- a/browsergateway/rdcleanpath.go
+++ b/browsergateway/rdcleanpath.go
@@ -0,0 +1,88 @@
+package browsergateway
+
+import (
+	"encoding/asn1"
+	"fmt"
+)
+
+// RDCleanPath PDU version (BASE_VERSION + 1 = 3389 + 1).
+const rdCleanPathVersion = int64(3390)
+
+// rdCleanPathPdu is a Go translation of the ASN.1 SEQUENCE defined in the
+// ironrdp-rdcleanpath crate. All optional fields use EXPLICIT context-specific
+// tagging, matching the Rust `der::Sequence` derivation with
+// `tag_mode = "EXPLICIT"`.
+//
+// We only need a subset of fields for the basic proxy flow, but the struct
+// declares every tag we may encounter so that decoding does not fail on an
+// unexpected element.
+type rdCleanPathPdu struct {
+	Version           int64    `asn1:"explicit,tag:0"`
+	Destination       string   `asn1:"explicit,tag:2,optional,utf8"`
+	ProxyAuth         string   `asn1:"explicit,tag:3,optional,utf8"`
+	ServerAuth        string   `asn1:"explicit,tag:4,optional,utf8"`
+	PreconnectionBlob string   `asn1:"explicit,tag:5,optional,utf8"`
+	X224              []byte   `asn1:"explicit,tag:6,optional"`
+	ServerCertChain   [][]byte `asn1:"explicit,tag:7,optional"`
+	ServerAddr        string   `asn1:"explicit,tag:9,optional,utf8"`
+}
+
+// decodeRDCleanPathRequest parses a client-to-proxy RDCleanPath PDU.
+func decodeRDCleanPathRequest(buf []byte) (*rdCleanPathPdu, error) {
+	var pdu rdCleanPathPdu
+	rest, err := asn1.Unmarshal(buf, &pdu)
+	if err != nil {
+		return nil, fmt.Errorf("asn1 unmarshal: %w", err)
+	}
+	if len(rest) != 0 {
+		return nil, fmt.Errorf("trailing data after RDCleanPath PDU: %d bytes", len(rest))
+	}
+	if pdu.Version != rdCleanPathVersion {
+		return nil, fmt.Errorf("unexpected RDCleanPath version: %d", pdu.Version)
+	}
+	return &pdu, nil
+}
+
+// encodeRDCleanPathResponse builds a proxy-to-client RDCleanPath response PDU
+// containing the server address, X.224 connection confirm and server TLS chain.
+func encodeRDCleanPathResponse(serverAddr string, x224Rsp []byte, certChain [][]byte) ([]byte, error) {
+	pdu := rdCleanPathPdu{
+		Version:         rdCleanPathVersion,
+		X224:            x224Rsp,
+		ServerCertChain: certChain,
+		ServerAddr:      serverAddr,
+	}
+	return asn1.Marshal(pdu)
+}
+
+// detectRDCleanPathLength returns the total DER length of an RDCleanPath PDU
+// if enough bytes are available, otherwise -1.
+//
+// The PDU is a DER SEQUENCE, which begins with the universal SEQUENCE tag
+// (0x30) followed by a length octet/octets. We parse just enough to know the
+// total length so we can buffer accordingly.
+func detectRDCleanPathLength(buf []byte) int {
+	if len(buf) < 2 {
+		return -1
+	}
+	if buf[0] != 0x30 {
+		// Not a SEQUENCE: cannot be RDCleanPath.
+		return -2
+	}
+	l := buf[1]
+	if l < 0x80 {
+		return 2 + int(l)
+	}
+	n := int(l & 0x7f)
+	if n == 0 || n > 4 {
+		return -2
+	}
+	if len(buf) < 2+n {
+		return -1
+	}
+	total := 0
+	for i := 0; i < n; i++ {
+		total = (total << 8) | int(buf[2+i])
+	}
+	return 2 + n + total
+}
--- a/browsergateway/ssh.go
+++ b/browsergateway/ssh.go
@@ -0,0 +1,225 @@
+package browsergateway
+
+import (
+	"context"
+	"crypto/subtle"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net"
+	"net/http"
+	"time"
+
+	"github.com/coder/websocket"
+	"golang.org/x/crypto/ssh"
+)
+
+// sshClientMsg is a JSON message sent from the browser to the proxy.
+type sshClientMsg struct {
+	// type: "auth" | "data" | "resize"
+	Type     string `json:"type"`
+	Password string `json:"password,omitempty"` // used when type="auth"
+	Data     string `json:"data,omitempty"`     // used when type="data"
+	Cols     uint32 `json:"cols,omitempty"`     // used when type="resize"
+	Rows     uint32 `json:"rows,omitempty"`     // used when type="resize"
+}
+
+// sshServerMsg is a JSON message sent from the proxy back to the browser.
+type sshServerMsg struct {
+	// type: "data" | "error"
+	Type  string `json:"type"`
+	Data  string `json:"data,omitempty"`
+	Error string `json:"error,omitempty"`
+}
+
+// HandleSSH is an http.HandlerFunc for SSH-over-WebSocket connections.
+func (g *Gateway) HandleSSH(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	// -- Validate auth token from query parameter before upgrading --
+	token := r.URL.Query().Get("authToken")
+	if subtle.ConstantTimeCompare([]byte(token), []byte(g.authToken)) != 1 {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	// In proxy mode we also need host + username from query params.
+	var target, username string
+	if g.nativeSSH == nil {
+		host := r.URL.Query().Get("host")
+		port := r.URL.Query().Get("port")
+		username = r.URL.Query().Get("username")
+		if host == "" || username == "" {
+			http.Error(w, "missing host or username", http.StatusBadRequest)
+			return
+		}
+		if port == "" {
+			port = "22"
+		}
+		target = net.JoinHostPort(host, port)
+	}
+
+	ws, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		InsecureSkipVerify: true,
+		Subprotocols:       []string{"ssh"},
+	})
+	if err != nil {
+		log.Printf("SSH websocket upgrade failed: %v", err)
+		return
+	}
+	ws.SetReadLimit(-1)
+	defer ws.CloseNow() //nolint:errcheck
+
+	if g.nativeSSH != nil {
+		if err := serveNativeSSHSession(ctx, ws, *g.nativeSSH); err != nil {
+			log.Printf("SSH native session error: %v", err)
+		}
+	} else {
+		if err := serveSSHSession(ctx, ws, target, username, g.authToken); err != nil {
+			log.Printf("SSH session error: %v", err)
+		}
+	}
+}
+
+func serveSSHSession(ctx context.Context, ws *websocket.Conn, target, username, _ string) error {
+	// -- Wait for the auth message from the client to get the password --
+	_, authBytes, err := ws.Read(ctx)
+	if err != nil {
+		return fmt.Errorf("read auth message: %w", err)
+	}
+	var authMsg sshClientMsg
+	if err := json.Unmarshal(authBytes, &authMsg); err != nil || authMsg.Type != "auth" {
+		return fmt.Errorf("expected auth message, got: %s", authBytes)
+	}
+	password := authMsg.Password
+
+	// -- Dial the SSH server --
+	log.Printf("SSH: connecting to %s as %s", target, username)
+	sshCfg := &ssh.ClientConfig{
+		User: username,
+		Auth: []ssh.AuthMethod{
+			ssh.Password(password),
+		},
+		// HostKeyCallback is intentionally InsecureIgnoreHostKey for this dev
+		// proxy. In production, verify against a known-hosts store.
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), //nolint:gosec
+		Timeout:         15 * time.Second,
+	}
+
+	sshClient, err := ssh.Dial("tcp", target, sshCfg)
+	if err != nil {
+		sendSSHError(ctx, ws, fmt.Sprintf("SSH dial failed: %v", err))
+		return fmt.Errorf("ssh dial %s: %w", target, err)
+	}
+	defer sshClient.Close()
+
+	// -- Open an interactive session --
+	sess, err := sshClient.NewSession()
+	if err != nil {
+		sendSSHError(ctx, ws, fmt.Sprintf("Failed to open SSH session: %v", err))
+		return fmt.Errorf("ssh new session: %w", err)
+	}
+	defer sess.Close()
+
+	// Request a PTY.
+	if err := sess.RequestPty("xterm-256color", 24, 80, ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 38400,
+		ssh.TTY_OP_OSPEED: 38400,
+	}); err != nil {
+		sendSSHError(ctx, ws, fmt.Sprintf("Failed to request PTY: %v", err))
+		return fmt.Errorf("ssh request pty: %w", err)
+	}
+
+	stdinPipe, err := sess.StdinPipe()
+	if err != nil {
+		return fmt.Errorf("ssh stdin pipe: %w", err)
+	}
+	stdoutPipe, err := sess.StdoutPipe()
+	if err != nil {
+		return fmt.Errorf("ssh stdout pipe: %w", err)
+	}
+	stderrPipe, err := sess.StderrPipe()
+	if err != nil {
+		return fmt.Errorf("ssh stderr pipe: %w", err)
+	}
+
+	if err := sess.Shell(); err != nil {
+		sendSSHError(ctx, ws, fmt.Sprintf("Failed to start shell: %v", err))
+		return fmt.Errorf("ssh shell: %w", err)
+	}
+
+	log.Printf("SSH: session established with %s", target)
+
+	// -- Pump SSH stdout/stderr → WebSocket --
+	sessCtx, cancelSess := context.WithCancel(ctx)
+	defer cancelSess()
+
+	go func() {
+		buf := make([]byte, 4096)
+		for {
+			n, readErr := stdoutPipe.Read(buf)
+			if n > 0 {
+				msg := sshServerMsg{Type: "data", Data: string(buf[:n])}
+				b, _ := json.Marshal(msg)
+				if writeErr := ws.Write(sessCtx, websocket.MessageText, b); writeErr != nil {
+					return
+				}
+			}
+			if readErr != nil {
+				cancelSess()
+				return
+			}
+		}
+	}()
+
+	go func() {
+		buf := make([]byte, 4096)
+		for {
+			n, readErr := stderrPipe.Read(buf)
+			if n > 0 {
+				msg := sshServerMsg{Type: "data", Data: string(buf[:n])}
+				b, _ := json.Marshal(msg)
+				if writeErr := ws.Write(sessCtx, websocket.MessageText, b); writeErr != nil {
+					return
+				}
+			}
+			if readErr != nil {
+				return
+			}
+		}
+	}()
+
+	// -- Pump WebSocket input → SSH stdin / resize --
+	for {
+		_, msgBytes, readErr := ws.Read(sessCtx)
+		if readErr != nil {
+			break
+		}
+
+		var msg sshClientMsg
+		if err := json.Unmarshal(msgBytes, &msg); err != nil {
+			continue
+		}
+
+		switch msg.Type {
+		case "data":
+			if _, err := stdinPipe.Write([]byte(msg.Data)); err != nil {
+				return fmt.Errorf("write ssh stdin: %w", err)
+			}
+		case "resize":
+			if msg.Cols > 0 && msg.Rows > 0 {
+				_ = sess.WindowChange(int(msg.Rows), int(msg.Cols))
+			}
+		}
+	}
+
+	return nil
+}
+
+// sendSSHError sends an error message to the browser and logs it.
+func sendSSHError(ctx context.Context, ws *websocket.Conn, msg string) {
+	log.Printf("SSH error: %s", msg)
+	b, _ := json.Marshal(sshServerMsg{Type: "error", Error: msg})
+	_ = ws.Write(ctx, websocket.MessageText, b)
+}
--- a/browsergateway/ssh_native.go
+++ b/browsergateway/ssh_native.go
@@ -0,0 +1,107 @@
+package browsergateway
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+	"os/exec"
+
+	"github.com/coder/websocket"
+	"github.com/creack/pty"
+)
+
+// NativeSSHConfig holds configuration for the native PTY/shell mode.
+type NativeSSHConfig struct {
+	// Shell is the executable to spawn (e.g. /bin/bash). Defaults to /bin/sh.
+	Shell string
+}
+
+// serveNativeSSHSession handles a WebSocket SSH session by spawning a local
+// PTY+shell instead of proxying to an external SSH server. The auth token has
+// already been validated at the WebSocket upgrade level, so this function only
+// reads (and discards) the initial "auth" frame for protocol compatibility with
+// the browser client before starting the shell.
+func serveNativeSSHSession(ctx context.Context, ws *websocket.Conn, cfg NativeSSHConfig) error {
+	// Read and discard the auth frame (token already validated at HTTP layer).
+	_, authBytes, err := ws.Read(ctx)
+	if err != nil {
+		return fmt.Errorf("read auth message: %w", err)
+	}
+	var authMsg sshClientMsg
+	if err := json.Unmarshal(authBytes, &authMsg); err != nil || authMsg.Type != "auth" {
+		return fmt.Errorf("expected auth message, got: %s", authBytes)
+	}
+
+	shell := cfg.Shell
+	if shell == "" {
+		shell = "/bin/sh"
+	}
+
+	log.Printf("SSH native: spawning %s", shell)
+
+	cmd := exec.CommandContext(ctx, shell)
+	cmd.Env = append(os.Environ(), "TERM=xterm-256color")
+
+	// Start the command with a PTY attached.
+	ptmx, err := pty.Start(cmd)
+	if err != nil {
+		sendSSHError(ctx, ws, fmt.Sprintf("Failed to spawn shell: %v", err))
+		return fmt.Errorf("pty start: %w", err)
+	}
+	defer func() {
+		_ = ptmx.Close()
+		_ = cmd.Wait()
+	}()
+
+	// Cancel context to unblock the WebSocket read loop when the shell exits.
+	sessCtx, cancelSess := context.WithCancel(ctx)
+	defer cancelSess()
+
+	// Pump PTY output → WebSocket.
+	go func() {
+		defer cancelSess()
+		buf := make([]byte, 4096)
+		for {
+			n, readErr := ptmx.Read(buf)
+			if n > 0 {
+				msg := sshServerMsg{Type: "data", Data: string(buf[:n])}
+				b, _ := json.Marshal(msg)
+				if writeErr := ws.Write(sessCtx, websocket.MessageText, b); writeErr != nil {
+					return
+				}
+			}
+			if readErr != nil {
+				return
+			}
+		}
+	}()
+
+	// Pump WebSocket input → PTY stdin / resize.
+	for {
+		_, msgBytes, readErr := ws.Read(sessCtx)
+		if readErr != nil {
+			break
+		}
+		var msg sshClientMsg
+		if err := json.Unmarshal(msgBytes, &msg); err != nil {
+			continue
+		}
+		switch msg.Type {
+		case "data":
+			if _, writeErr := ptmx.Write([]byte(msg.Data)); writeErr != nil {
+				return fmt.Errorf("write pty: %w", writeErr)
+			}
+		case "resize":
+			if msg.Cols > 0 && msg.Rows > 0 {
+				_ = pty.Setsize(ptmx, &pty.Winsize{
+					Cols: uint16(msg.Cols),
+					Rows: uint16(msg.Rows),
+				})
+			}
+		}
+	}
+
+	return nil
+}
--- a/go.mod
+++ b/go.mod
@@ -35,8 +35,10 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/coder/websocket v1.8.14 // indirect
 	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/creack/pty v1.1.24 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.4.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -8,12 +8,16 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
 github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=