Skip to content

Add support for TCP TLS #4

@isobit

Description

@isobit

Currently only the Websocket side supports TLS (through the -tlscert and -tlskey options). Support should be added for TLS on the TCP side.

This could be done by adding a flag (e.g. -tcptls or -tls) which causes ws-tcp-relay to use crypto/tls to dial the connection instead of net. Additional options may need to be added for configuring the connection (see https://golang.org/pkg/crypto/tls/#Config), such as specifying the root CAs.

Care should be taken to avoid confusion between client-side (TCP) and server-side (WSS) TLS. This may mean renaming the -tlscert and -tlskey options, although the old ones should be retained for backwards-compat.

Proposed new usage:

Usage: ws-tcp-relay <tcpTargetAddress>
  -b	Use binary frames instead of text frames
  -binary
    	Use binary frames instead of text frames
  -p uint
    	The port to listen on (default 4223)
  -port uint
    	The port to listen on (default 4223)
  -wsscert string (also -tlscert)
    	Path to a certificate (PEM file) to use for serving WebSockets using TLS. If the certificate is signed by
        a certificate authority, the file should be the concatenation of the server's certificate, any
        intermediates, and the CA's certificate. Must also specify -wsskey.
  -wsskey string (also -tlskey)
    	Path to a private key (PEM file) to use for serving WebSockets using TLS. Must also specify -wsscert.
  -tcptls
        Use TLS for outgoing TCP connections
  -tcptlscert
        Path (or multiple paths) to a certificate (PEM file) to use for outgoing TCP connections using TLS. 
        May be specified multiple times Only used when -tcptls is specified.
  -tcptlsrootcert
        TODO

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions