it seems to me that the connection has no identification, authentization or authorization whatsoever (as these are the parts that Mosh offloaded to SSH, by design): if you know the port, you're in.
What am I missing?
Edit: ok, I see, you need to also input the MOSH_MALLET_HMAC_KEY and MOSH_MALLET_CCRYPT_KEY into the client. That...helps. Are they static, though?
Authentication is by preshared keys and the client prompts for them or you can set environment variables. The preshared keys are static, yes.
This sure looks useful, nice!
From what I can tell, the packet is {32 bytes of MAC}:{timestamp}, and MAC = HMACSHA256(timestamp + secret_key), and the 'used' timestamp-nonces are not stored anywhere. This means that this packet is reusable by any host, even one knocking from another IP (eg. an attacker on your LAN or on the public Internet).
EDIT: Ah, no, the response is encrypted with a symmetric cipher (MOSH_MALLET_CCRYPT_KEY). So that particular attack won't work. Leaving this post in case someone also makes a similar assumption to this when reading the code.
UDP hole punching is pretty straight forward.
This does it securely using SSH.
