Add web proxy feature with --web-proxy PORT command line switch

This commit adds a new web proxy server feature to wssshd that:
- Adds --web-proxy [PORT] command line option (default port: 9090)
- Listens on 127.0.0.1 only for security
- Proxies HTTP requests to registered clients based on hostname
- Supports multiple concurrent connections

Changes:
- config.h: Add web_proxy_enabled and web_proxy_port fields
- config.c: Add --web-proxy option parsing and config file support
- web_proxy.h: New header with function declarations
- web_proxy.c: New implementation with TCP server and hostname-based routing
- main.c: Add web_proxy_start/stop_server calls
- wssshd.1: Update man page with new option
- README.md: Add documentation for web proxy feature

README.md

@@ -19,6 +19,7 @@
 - **Advanced Logging**: Automatic log rotation with comprehensive monitoring
 - **Multiple Operating Modes**: Interactive, silent, bridge, script, and daemon modes
 - **Enterprise Reliability**: Production-grade process supervision and high availability
+- **Web Proxy Server**: Built-in HTTP reverse proxy for registered web services, accessible via localhost only for security
 - **Server Stability**: Robust error handling with comprehensive crash prevention and graceful client disconnection management
 
 ## Architecture
@@ -103,6 +104,51 @@ WSSSH provides a comprehensive web-based management interface accessible through
 - **Zoom and Fullscreen**: Flexible viewing options
 - **Real-time Performance**: Optimized for smooth remote desktop access
 
+### Web Proxy Server
+
+WSSSH includes a built-in HTTP reverse proxy server that enables web services on registered clients to be accessed through the daemon. The proxy listens only on `127.0.0.1` for security, preventing external access to proxied services.
+
+#### Features
+- **Hostname-based Routing**: Automatically routes requests to the correct client based on the requested hostname
+- **Client ID Matching**: Supports both direct client ID matching and subdomain patterns (`clientid.domain`)
+- **Security-First Design**: Listens exclusively on localhost, requiring VPN or SSH tunnel for remote access
+- **Multi-client Support**: Handles concurrent connections to different clients simultaneously
+
+#### Configuration
+Enable the web proxy via command line:
+```bash
+# Enable with default port (9090)
+./wssshd --web-proxy
+
+# Enable with custom port
+./wssshd --web-proxy 8080
+```
+
+Or via configuration file:
+```ini
+[wssshd]
+web-proxy = true
+web-proxy-port = 9090
+```
+
+#### Usage
+1. Register a client with the "web" or "http" service
+2. Configure the web service on the client machine
+3. Access the web service via the proxy using the hostname pattern:
+   - `http://clientid.domain/` → Routes to the registered client's web service
+   - The proxy extracts the hostname from the HTTP Host header and forwards to the matching client
+
+#### Client Registration with Web Service
+```bash
+# Register client with web service
+./wssshc --server-ip wssshd.example.com --id mywebserver --password secret --services-path /etc/wsssh.d/
+
+# Configure web service in /etc/wsssh.d/web.conf
+[web]
+tunnel-host = 127.0.0.1
+tunnel-port = 80
+```
+
 ### Security Features
 - **HTTPS Support**: Optional SSL/TLS encryption for web interface
 - **Session Security**: Secure WebSocket connections for all remote access
@@ -201,6 +247,14 @@ sudo make install
 # Or with web interface enabled
 ./wssshd --host 0.0.0.0 --port 9898 --domain example.com --password mysecret \
          --web-host 0.0.0.0 --web-port 8080
+
+# Or with web proxy enabled (listens on 127.0.0.1:9090)
+./wssshd --host 0.0.0.0 --port 9898 --domain example.com --password mysecret \
+         --web-proxy
+
+# Or with web proxy on custom port
+./wssshd --host 0.0.0.0 --port 9898 --domain example.com --password mysecret \
+         --web-proxy 8080
 ```
 
 ### 2. Register a Client Machine
@@ -296,6 +350,8 @@ domain = example.com
 web-host = 0.0.0.0
 web-port = 8080
 web-https = false
+web-proxy = false
+web-proxy-port = 9090
 ```
 
 Configuration options:
@@ -306,6 +362,8 @@ Configuration options:
 - `web-host`: IP address to bind the web interface (default: 0.0.0.0)
 - `web-port`: Web interface port (default: 8080)
 - `web-https`: Enable HTTPS for web interface (default: false)
+- `web-proxy`: Enable web proxy server (default: false)
+- `web-proxy-port`: Web proxy listen port (default: 9090)
 
 ### Client Configuration (`~/.config/wsssh/wssshc.conf`)
 
@@ -582,6 +640,7 @@ The server component (`wssshd2/`) is implemented in C for maximum performance an
 - **Embedded Web Interface**: No external web server required
 - **Native SSL/TLS**: Direct OpenSSL integration
 - **Cross-platform**: Linux, macOS, Windows support
+- **Web Proxy Server**: Built-in HTTP reverse proxy for client web services
 
 ### Project Structure
 ```
@@ -591,7 +650,10 @@ wsssh/
 ├── wssshd2/               # C server implementation
 │   ├── main.c            # Server main entry point
 │   ├── web.c             # Embedded web interface with SQLite
+│   ├── web_proxy.c       # Web proxy server implementation
+│   ├── web_proxy.h       # Web proxy header
 │   ├── config.c          # Configuration handling
+│   ├── config.h          # Configuration header
 │   ├── terminal.c        # Terminal session management
 │   ├── websocket.c       # WebSocket protocol handling
 │   ├── ssl.c             # SSL/TLS encryption

wsssh-server/debian/wssshd.1

-.TH WSSSHD 1 "September 2025" "wsssh-server 1.4.0" "WebSocket SSH Server"
+.TH WSSSHD 1 "January 2026" "wsssh-server 1.5.0" "WebSocket SSH Server"
 .SH NAME
 wssshd \- WebSocket SSH Server daemon for secure tunneling
 .SH SYNOPSIS
@@ -11,6 +11,7 @@ wssshd \- WebSocket SSH Server daemon for secure tunneling
 [\fB\-\-web\-host\fR \fIHOST\fR]
 [\fB\-\-web\-port\fR \fIPORT\fR]
 [\fB\-\-web\-https\fR]
+[\fB\-\-web\-proxy\fR [\fIPORT\fR]]
 [\fB\-\-debug\fR]
 [\fB\-\-debug\-web\fR]
 [\fB\-\-debug\-database\fR]
@@ -44,6 +45,9 @@ Web interface port (default: 8080)
 .B \-\-web\-https
 Enable HTTPS for web interface
 .TP
+.B \-\-web\-proxy " [\fIPORT\fR]"
+Enable web proxy server on localhost (default port: 9090). The web proxy listens on 127.0.0.1 only and proxies HTTP requests to registered clients based on the requested hostname.
+.TP
 .B \-\-debug
 Enable general debug output
 .TP
@@ -79,6 +83,12 @@ Web interface port (default: 8080)
 .B web_https
 Enable HTTPS for web interface (default: false)
 .TP
+.B web_proxy
+Enable web proxy server (default: false)
+.TP
+.B web_proxy_port
+Web proxy listen port (default: 9090)
+.TP
 .B debug
 Enable general debug output (default: false)
 .TP
@@ -100,17 +110,32 @@ Start server with debug output:
 .TP
 Start server with custom web interface:
 .B wssshd --web-host 0.0.0.0 --web-port 8080 --web-https
+.TP
+Start server with web proxy on default port:
+.B wssshd --web-proxy
+.TP
+Start server with web proxy on custom port:
+.B wssshd --web-proxy 8080
 .SH WEB INTERFACE
 The server provides a web-based management interface accessible at https://server:port/ (when SSL is enabled) or http://server:port/ (without SSL). The web interface allows:
 - Client registration and management
 - Tunnel monitoring and control
 - System status and logs
 - Configuration management
+.SH WEB PROXY
+The web proxy feature allows the server to act as a reverse HTTP proxy for registered clients. When a client registers with the "web" or "http" service, the server can proxy HTTP requests to that client based on the requested hostname.
+
+The hostname matching supports two patterns:
+.I clientid.domain
+(same as the client's registered ID)
+
+The web proxy listens only on 127.0.0.1 for security, preventing external access to proxied services.
 .SH SECURITY
 The server supports SSL/TLS encryption for all communications. For production deployments:
 - Use properly signed SSL certificates
 - Configure strong passwords for the web interface
 - Use firewall rules to restrict access to the server port
+- The web proxy only listens on localhost (127.0.0.1) by default
 - Regularly update the server and dependencies
 .SH SIGNALS
 .TP
@@ -146,6 +171,6 @@ returns 0 on successful operation, non-zero on errors.
 .SH AUTHOR
 Written by Stefy Lanza <stefy@nexlab.net>
 .SH COPYRIGHT
-Copyright \(co 2024 Stefy Lanza and SexHack.me. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
+Copyright \(co 2024-2026 Stefy Lanza and SexHack.me. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.
 .SH BUGS
 Report bugs to: https://git.nexlab.net/nexlab/wsssh/issues
\ No newline at end of file

wssshd2/config.c

@@ -26,6 +26,7 @@
 
 // Default configuration values
 #define DEFAULT_PORT 9898
+#define DEFAULT_WEB_PROXY_PORT 9090
 #define DEFAULT_CONFIG_FILE "/etc/wssshd.conf"
 
 static void set_default_config(wssshd_config_t *config) {
@@ -37,6 +38,8 @@ static void set_default_config(wssshd_config_t *config) {
     config->web_host = NULL;
     config->web_port = 0;
     config->web_https = false;
+    config->web_proxy_enabled = false;
+    config->web_proxy_port = 0;
     config->websocket_tls_only = true;  // Default to TLS-only for security
     config->debug = false;
     config->debug_web = false;
@@ -112,6 +115,10 @@ static void load_config_file(wssshd_config_t *config, const char *config_file) {
                     config->web_port = atoi(value);
                 } else if (strcmp(key, "web-https") == 0) {
                     config->web_https = (strcmp(value, "true") == 0 || strcmp(value, "1") == 0);
+                } else if (strcmp(key, "web-proxy") == 0) {
+                    config->web_proxy_enabled = (strcmp(value, "true") == 0 || strcmp(value, "1") == 0);
+                } else if (strcmp(key, "web-proxy-port") == 0) {
+                    config->web_proxy_port = atoi(value);
                 } else if (strcmp(key, "websocket-tls-only") == 0) {
                     config->websocket_tls_only = (strcmp(value, "true") == 0 || strcmp(value, "1") == 0);
                 }
@@ -154,6 +161,7 @@ wssshd_config_t *load_config(int argc, char *argv[]) {
         {"web-host", required_argument, 0, 'w'},
         {"web-port", required_argument, 0, 'W'},
         {"web-https", no_argument, 0, 's'},
+        {"web-proxy", optional_argument, 0, 'x'},
         {"websocket-tls-only", no_argument, 0, 't'},
         {"debug", no_argument, 0, 'D'},
         {"debug-web", no_argument, 0, 'E'},
@@ -167,7 +175,7 @@ wssshd_config_t *load_config(int argc, char *argv[]) {
     int opt;
     int option_index = 0;
 
-    while ((opt = getopt_long(argc, argv, "c:h:p:d:P:w:W:stDEFGH?", long_options, &option_index)) != -1) {
+    while ((opt = getopt_long(argc, argv, "c:h:p:d:P:w:W:stx::DEFGH?", long_options, &option_index)) != -1) {
         switch (opt) {
             case 'c':
                 if (config->config_file) free(config->config_file);
@@ -198,6 +206,14 @@ wssshd_config_t *load_config(int argc, char *argv[]) {
             case 's':
                 config->web_https = true;
                 break;
+            case 'x':
+                config->web_proxy_enabled = true;
+                if (optarg) {
+                    config->web_proxy_port = atoi(optarg);
+                } else {
+                    config->web_proxy_port = DEFAULT_WEB_PROXY_PORT;
+                }
+                break;
             case 't':
                 config->websocket_tls_only = false;
                 break;
@@ -227,6 +243,7 @@ wssshd_config_t *load_config(int argc, char *argv[]) {
                 printf("  --web-host HOST  Web interface host\n");
                 printf("  --web-port PORT  Web interface port\n");
                 printf("  --web-https      Enable HTTPS for web interface\n");
+                printf("  --web-proxy [PORT]  Enable web proxy on port (default: %d)\n", DEFAULT_WEB_PROXY_PORT);
                 printf("  --websocket-tls-only  Allow non-TLS WebSocket connections (default: TLS-only)\n");
                 printf("  --debug          Enable debug output\n");
                 printf("  --debug-web      Enable comprehensive web interface debug output\n");
@@ -255,6 +272,8 @@ wssshd_config_t *load_config(int argc, char *argv[]) {
         config->port = DEFAULT_PORT;
         config->web_port = 0;
         config->web_https = false;
+        config->web_proxy_enabled = false;
+        config->web_proxy_port = 0;
         config->websocket_tls_only = true;
 
         load_config_file(config, config->config_file);
@@ -305,6 +324,8 @@ void print_config(const wssshd_config_t *config) {
     printf("  Web host: %s\n", config->web_host ? config->web_host : "none");
     printf("  Web port: %d\n", config->web_port);
     printf("  Web HTTPS: %s\n", config->web_https ? "yes" : "no");
+    printf("  Web Proxy: %s\n", config->web_proxy_enabled ? "yes" : "no");
+    printf("  Web Proxy Port: %d\n", config->web_proxy_port);
     printf("  WebSocket TLS-only: %s\n", config->websocket_tls_only ? "yes" : "no");
     printf("  Debug: %s\n", config->debug ? "yes" : "no");
     printf("  Debug Web: %s\n", config->debug_web ? "yes" : "no");

wssshd2/config.h

@@ -32,6 +32,8 @@ typedef struct {
     char *web_host;
     int web_port;
     bool web_https;
+    bool web_proxy_enabled;
+    int web_proxy_port;
     bool websocket_tls_only;
     bool debug;
     bool debug_web;

wssshd2/main.c

@@ -27,7 +27,9 @@
 #include "config.h"
 #include "websocket.h"
 #include "web.h"
+#include "web_proxy.h"
 #include "ssl.h"
+#include "plugin.h"
 
 static volatile int shutdown_requested = 0;
 
@@ -118,6 +120,28 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    printf("WSSSH Daemon starting...\n");
+
+    // Print ASCII art banner
+    printf("\033[38;5;117m⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⠖⠢⢄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;117m⠀⠀⠀⠀⠀⠀⠀⢠⠖⠋⠀⠀⠀⣀⣹⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;117m⠀⠀⠀⠀⠀⠀⠀⢸⡄⠀⢠⣶⡞⢁⣸⣇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;218m⠀⠀⠀⠀⠀⠀⠀⠈⢁⣠⠞⢻⡁⢻⣷⣾⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;218m⠀⠀⠀⠀⠀⣠⠤⢄⣘⣿⢬⣛⡷⢋⣈⣉⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;218m⠀⠀⠀⠀⢰⡇⠀⠀⠙⠿⠀⢀⠿⠋⠀⠀⠀⢱⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("⠀⠀⠀⠀⠘⡃⠀⢰⠀⠀⠀⡁⠀⡀⠀⠘⣆⠈⢇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\n");
+    printf("\033[38;5;231m⠀⠀⠀⠀⠀⡇⠀⣼⡦⠠⠤⣈⡆⢃⡤⠒⠙⡆⠀⠳⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;231m⠀⠀⠀⠀⢀⠇⠀⡇⢷⣄⣀⡠⠟⠛⠢⠤⠞⡟⠦⡀⠙⠦⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;231m⠀⠀⠀⠀⡞⢀⠀⠀⠀⠳⡄⠀⠀⠠⡀⠀⠀⠘⠉⠙⠦⣀⠀⠉⠢⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;231m⠀⠀⠀⠀⡇⠀⢠⠀⠀⠀⠈⠓⢄⠀⠁⠀⠀⠀⠒⠂⠀⣾⠋⠉⠒⠢⢍⣙⡒⢄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;218m⠀⠀⠀⠀⡇⠀⡜⠀⠀⠀⠀⠀⠀⠱⡀⢀⡀⠁⠀⢀⡼⡇⠀⠀⠀⠀⠀⣏⠙⠯⣆⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;218m⠀⠀⠀⠀⡇⢠⠇⠀⠀⠀⠀⠀⠀⠀⢱⣀⣽⠶⠾⠛⠒⠛⠒⠒⠒⠤⠤⣸⡍⠀⠀⠉⠲⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;218m⠀⣀⣀⣀⠇⣼⠀⠀⠀⠀⠀⠀⠀⠀⠀⢫⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠠⣙⠢⣀⠀⠀⠈⠳⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;117m⠉⠙⠛⠥⠰⠟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠂⠤⠤⠤⠤⠴⠒⠚⠉⠙⠢⣀⠀⠈⠑⠢⢄⡀⠈⠳⡀⠀⠀⠀⠀⠀⠀⠀\033[0m\n");
+    printf("\033[38;5;117m⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠑⠒⠒⠒⠒⠚⠑⠢⢌⡓⠤⠤⠤⠤⣀⠀\033[0m\n");
+    printf("\033[38;5;117m⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠓⠒⠠⠤⣼⠇\033[0m\n");
+    printf("\n");
+
     if (config->debug) {
         print_config(config);
     }
@@ -130,13 +154,16 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    // Initialize plugin system
+    if (!plugin_system_init(state, config)) {
+        fprintf(stderr, "Warning: Failed to initialize plugin system\n");
+    }
+
     // Set up signal handlers
     signal(SIGINT, signal_handler);
     signal(SIGTERM, signal_handler);
     signal(SIGPIPE, SIG_IGN);  // Ignore SIGPIPE to prevent crashes on broken connections
 
-    printf("WSSSH Daemon starting...\n");
-
     // Start web interface if configured
     if (web_start_server(config, state) != 0) {
         fprintf(stderr, "Warning: Failed to start web interface\n");
@@ -151,7 +178,17 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    // Start web proxy server if enabled
+    if (config->web_proxy_enabled) {
+        if (web_proxy_start_server(config, state) != 0) {
+            fprintf(stderr, "Warning: Failed to start web proxy server\n");
+        }
+    }
+
     printf("WSSSH Daemon running on %s:%d\n", config->host, config->port);
+    if (config->web_proxy_enabled) {
+        printf("Web proxy server running on 127.0.0.1:%d\n", config->web_proxy_port);
+    }
     printf("Press Ctrl+C to stop the server\n");
 
     // Start cleanup thread
@@ -171,9 +208,13 @@ int main(int argc, char *argv[]) {
     printf("\nShutting down WSSSH Daemon...\n");
 
     // Stop servers
+    web_proxy_stop_server();
     web_stop_server();
     websocket_stop_server();
 
+    // Clean up plugin system
+    plugin_system_cleanup();
+
     // Clean up state
     websocket_free_state(state);
     free_config(config);

wssshd2/web_proxy.h

+/**
+ * Web Proxy server for wssshd
+ *
+ * Copyright (C) 2024 Stefy Lanza <stefy@nexlab.net> and SexHack.me
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef WEB_PROXY_H
+#define WEB_PROXY_H
+
+#include <stdbool.h>
+#include "config.h"
+#include "websocket.h"
+
+// Function declarations
+int web_proxy_start_server(const wssshd_config_t *config, wssshd_state_t *state);
+void web_proxy_stop_server(void);
+
+#endif /* WEB_PROXY_H */