erebe / wstunnel

Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available
Other
3.16k stars 287 forks source link

Runtime management of HTTP upgrade restriction paths #261

Closed leonixyz closed 6 days ago

leonixyz commented 2 weeks ago

Is your feature request related to a problem? Please describe. I would like to use the --restrict-http-upgrade-path-prefix as an authentication method for my clients, as described in the documentation. Currently, the only way to define a list of prefixes, is by passing them to command line (or env, but there is no documentation about how to specify multiple paths: is this a CSV string?). In either case, this results in the need to restart the process in order to add new paths. Whenever the process is restarted, all existing connections are obviously dropped. It would be extremely useful to be able to add a prefix without the need to restart the process.

Describe the solution you'd like DBUS API to manage path prefixes (maybe could be extended in the future to be able to kill connections, etc.)

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

Additional questions I would also know whether the authors have thought about the possibility to scale up the server process to handle dozens, hundreds, or even thousands of sockets, and which are constrains (roughly) they guess the software is currently limited to, in terms of concurrent connections.

erebe commented 1 week ago

Hello,

Having a config file to restrict tunnels server side is the next feature in line. It should be release in a month i think. I am still defining the config format at the moment.

Regarding the scaling potential, I am not worried about wstunnel scaling to thousands of connections. Beside the tradionnal cpu/ram/bandiwth limitation, I don't see any particular one. Every is multhithreaded and should use all your core already, so you should be fine.

erebe commented 1 week ago

Hello,

You may want to check this pre-release https://github.com/erebe/wstunnel/releases/tag/v9.4.0 I have added a new flag --restrict-config to allow to restrict based on a config file. You can take a examples of the config there https://github.com/erebe/wstunnel/blob/main/restrictions.yaml

Let me know if you have feedbacks

erebe commented 6 days ago

It has been released in 9.4.0