isobit / ws-tcp-relay

A simple relay between WebSocket clients and TCP servers
MIT License
245 stars 61 forks source link

Add support for TCP TLS #4

Open isobit opened 6 years ago

isobit commented 6 years ago

Currently only the Websocket side supports TLS (through the -tlscert and -tlskey options). Support should be added for TLS on the TCP side.

This could be done by adding a flag (e.g. -tcptls or -tls) which causes ws-tcp-relay to use crypto/tls to dial the connection instead of net. Additional options may need to be added for configuring the connection (see https://golang.org/pkg/crypto/tls/#Config), such as specifying the root CAs.

Care should be taken to avoid confusion between client-side (TCP) and server-side (WSS) TLS. This may mean renaming the -tlscert and -tlskey options, although the old ones should be retained for backwards-compat.

Proposed new usage:

Usage: ws-tcp-relay <tcpTargetAddress>
  -b    Use binary frames instead of text frames
  -binary
        Use binary frames instead of text frames
  -p uint
        The port to listen on (default 4223)
  -port uint
        The port to listen on (default 4223)
  -wsscert string (also -tlscert)
        Path to a certificate (PEM file) to use for serving WebSockets using TLS. If the certificate is signed by
        a certificate authority, the file should be the concatenation of the server's certificate, any
        intermediates, and the CA's certificate. Must also specify -wsskey.
  -wsskey string (also -tlskey)
        Path to a private key (PEM file) to use for serving WebSockets using TLS. Must also specify -wsscert.
  -tcptls
        Use TLS for outgoing TCP connections
  -tcptlscert
        Path (or multiple paths) to a certificate (PEM file) to use for outgoing TCP connections using TLS. 
        May be specified multiple times Only used when -tcptls is specified.
  -tcptlsrootcert
        TODO
hammzaza commented 4 years ago

Did you get it done? Need help creating a wss support through websocket-nats (Using in my angular app). relay working properly without tls. but with tls giving handshake errors. (verified my certs as well)