-
Notifications
You must be signed in to change notification settings - Fork 63
Open
Description
Currently only the Websocket side supports TLS (through the -tlscert and -tlskey options). Support should be added for TLS on the TCP side.
This could be done by adding a flag (e.g. -tcptls or -tls) which causes ws-tcp-relay to use crypto/tls to dial the connection instead of net. Additional options may need to be added for configuring the connection (see https://golang.org/pkg/crypto/tls/#Config), such as specifying the root CAs.
Care should be taken to avoid confusion between client-side (TCP) and server-side (WSS) TLS. This may mean renaming the -tlscert and -tlskey options, although the old ones should be retained for backwards-compat.
Proposed new usage:
Usage: ws-tcp-relay <tcpTargetAddress>
-b Use binary frames instead of text frames
-binary
Use binary frames instead of text frames
-p uint
The port to listen on (default 4223)
-port uint
The port to listen on (default 4223)
-wsscert string (also -tlscert)
Path to a certificate (PEM file) to use for serving WebSockets using TLS. If the certificate is signed by
a certificate authority, the file should be the concatenation of the server's certificate, any
intermediates, and the CA's certificate. Must also specify -wsskey.
-wsskey string (also -tlskey)
Path to a private key (PEM file) to use for serving WebSockets using TLS. Must also specify -wsscert.
-tcptls
Use TLS for outgoing TCP connections
-tcptlscert
Path (or multiple paths) to a certificate (PEM file) to use for outgoing TCP connections using TLS.
May be specified multiple times Only used when -tcptls is specified.
-tcptlsrootcert
TODO
Metadata
Metadata
Assignees
Labels
No labels