Passthrough implementation

[namay26]

Resolves #172 :
Adds a passthrough handler, which acts like a proxy and sets up two go routines to listen to and log the information passed between the client and the destination.

[Copilot]

Pull Request Overview

This PR introduces a new “passthrough” rule type that proxies TCP connections between clients and real targets, logging bidirectional traffic.

• Adds Passthrough to the rule enum and exposes RuleType
• Implements HandlePassThrough in protocols/tcp/passthrough.go with two goroutines for source→target and target→source streaming
• Registers the new handler in protocols/protocols.go and adds a sample rule in config/rules.yaml

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
rules/rules.go	Export RuleType, add Passthrough constant and init case
protocols/tcp/passthrough.go	New handler to proxy TCP streams and log data
protocols/protocols.go	Register "passthrough" handler
config/rules.yaml	Add sample passthrough rule

Comments suppressed due to low confidence (2)

protocols/tcp/passthrough.go:26

• [nitpick] The comment is unclear and contains informal shorthand ('w/o', 'w it'). Consider rephrasing to explain the function’s purpose clearly, e.g., “HandlePassThrough opens a TCP connection to the real target and proxies traffic bidirectionally without modifying payloads.”

// Dial to the source ip, acting as a proxy between the client and real source by piping the data back and forth w/o interfering w it.

protocols/tcp/passthrough.go:1

• The new passthrough handler doesn’t have any associated unit or integration tests. Adding tests would help ensure correct proxy behavior under various scenarios and catch regressions.

package tcp

[Copilot]

parsedPassThrough and passThroughServer are added but never used. Consider removing these types or implementing their intended functionality to avoid dead code.

Suggested change

	type parsedPassThrough struct {
	Direction string `json:"direction,omitempty"`
	Payload []byte `json:"payload,omitempty"`
	PayloadHash string `json:"payload_hash,omitempty"`
	}
	type passThroughServer struct {
	events []parsedPassThrough
	target string
	}
	// Removed unused types: parsedPassThrough and passThroughServer

[namay26]

Here, do we need to append the events into a Server, like we do for other protocols?

[glaslos]

I think it could be interesting to capture the traffic as well. Maybe we make it optional through configuration?

[namay26]

Made traffic capture configurable via config.yaml. You can now enable or disable payload capturing by toggling the capture_traffic boolean.
Also extended rules.yaml support for host:port targets. These are now automatically routed to the passthrough handler, similar to how Freki handles them.
@glaslos