Skip to content

Commit bee76be

Browse files
VHSgunzoVHSgunzo
committed
Remove TLS
1 parent 3de1774 commit bee76be

32 files changed

+128
-803
lines changed

‎Makefile

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ BUILD=$(shell git rev-parse HEAD)
33
DIRBASE=./build
44
DIR=${DIRBASE}/${VERSION}/${BUILD}/bin
55

6-
LDFLAGS=-ldflags "-s -w ${XBUILD} -buildid=${BUILD} -X github.com/jpillora/chisel/share.BuildVersion=${VERSION}"
6+
LDFLAGS=-ldflags "-s -w ${XBUILD} -buildid= -X github.com/jpillora/chisel/share.BuildVersion=${VERSION}"
77

88
GOFILES=`go list ./...`
99
GOFILESNOTEST=`go list ./... | grep -v test`
@@ -18,7 +18,7 @@ freebsd: lint
1818
env CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-freebsd_amd64 .
1919

2020
linux: lint
21-
env CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-linux_amd64 .
21+
env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-linux_amd64 .
2222

2323
windows: lint
2424
env CGO_ENABLED=1 GOOS=windows GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-windows_amd64 .
@@ -51,4 +51,4 @@ release: lint test
5151
clean:
5252
rm -rf ${DIRBASE}/*
5353

54-
.PHONY: all freebsd linux windows docker dep lint test release clean
54+
.PHONY: all freebsd linux windows docker dep lint test release clean

‎README.md

Lines changed: 4 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ and then visit [localhost:3000](http://localhost:3000/), we should see a directo
8787
with $ md-tmpl -w README.md -->
8888

8989
<!--tmpl,code=plain:echo "$ chisel --help" && go run main.go --help | sed 's#0.0.0-src (go1\..*)#X.Y.Z#' -->
90-
``` plain
90+
``` plain
9191
$ chisel --help
9292
9393
Usage: chisel [command] [--help]
@@ -106,7 +106,7 @@ $ chisel --help
106106

107107

108108
<!--tmpl,code=plain:echo "$ chisel server --help" && go run main.go server --help | cat | sed 's#0.0.0-src (go1\..*)#X.Y.Z#' -->
109-
``` plain
109+
``` plain
110110
$ chisel server --help
111111
112112
Usage: chisel server [options]
@@ -169,27 +169,6 @@ $ chisel server --help
169169
--reverse, Allow clients to specify reverse port forwarding remotes
170170
in addition to normal remotes.
171171
172-
--tls-key, Enables TLS and provides optional path to a PEM-encoded
173-
TLS private key. When this flag is set, you must also set --tls-cert,
174-
and you cannot set --tls-domain.
175-
176-
--tls-cert, Enables TLS and provides optional path to a PEM-encoded
177-
TLS certificate. When this flag is set, you must also set --tls-key,
178-
and you cannot set --tls-domain.
179-
180-
--tls-domain, Enables TLS and automatically acquires a TLS key and
181-
certificate using LetsEncrypt. Setting --tls-domain requires port 443.
182-
You may specify multiple --tls-domain flags to serve multiple domains.
183-
The resulting files are cached in the "$HOME/.cache/chisel" directory.
184-
You can modify this path by setting the CHISEL_LE_CACHE variable,
185-
or disable caching by setting this variable to "-". You can optionally
186-
provide a certificate notification email by setting CHISEL_LE_EMAIL.
187-
188-
--tls-ca, a path to a PEM encoded CA certificate bundle or a directory
189-
holding multiple PEM encode CA certificate bundle files, which is used to
190-
validate client connections. The provided CA certificates will be used
191-
instead of the system roots. This is commonly used to implement mutual-TLS.
192-
193172
--pid Generate pid file in current working directory
194173
195174
-v, Enable verbose logging
@@ -212,7 +191,7 @@ $ chisel server --help
212191

213192

214193
<!--tmpl,code=plain:echo "$ chisel client --help" && go run main.go client --help | sed 's#0.0.0-src (go1\..*)#X.Y.Z#' -->
215-
``` plain
194+
``` plain
216195
$ chisel client --help
217196
218197
Usage: chisel client [options] <server> <remote> [remote] [remote] ...
@@ -267,7 +246,7 @@ $ chisel client --help
267246
client's internal SOCKS5 proxy.
268247
269248
When stdio is used as local-host, the tunnel will connect standard
270-
input/output of this program with the remote. This is useful when
249+
input/output of this program with the remote. This is useful when
271250
combined with ssh ProxyCommand. You can use
272251
ssh -o ProxyCommand='chisel client chiselserver stdio:%h:%p' \
273252
[email protected]
@@ -311,28 +290,6 @@ $ chisel client --help
311290
--hostname, Optionally set the 'Host' header (defaults to the host
312291
found in the server url).
313292
314-
--sni, Override the ServerName when using TLS (defaults to the
315-
hostname).
316-
317-
--tls-ca, An optional root certificate bundle used to verify the
318-
chisel server. Only valid when connecting to the server with
319-
"https" or "wss". By default, the operating system CAs will be used.
320-
321-
--tls-skip-verify, Skip server TLS certificate verification of
322-
chain and host name (if TLS is used for transport connections to
323-
server). If set, client accepts any TLS certificate presented by
324-
the server and any host name in that certificate. This only affects
325-
transport https (wss) connection. Chisel server's public key
326-
may be still verified (see --fingerprint) after inner connection
327-
is established.
328-
329-
--tls-key, a path to a PEM encoded private key used for client
330-
authentication (mutual-TLS).
331-
332-
--tls-cert, a path to a PEM encoded certificate matching the provided
333-
private key. The certificate must have client authentication
334-
enabled (mutual-TLS).
335-
336293
--pid Generate pid file in current working directory
337294
338295
-v, Enable verbose logging

‎client/client.go

Lines changed: 6 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,12 @@ package chclient
33
import (
44
"context"
55
"crypto/md5"
6-
"crypto/tls"
7-
"crypto/x509"
86
"encoding/base64"
97
"errors"
108
"fmt"
119
"net"
1210
"net/http"
1311
"net/url"
14-
"os"
1512
"regexp"
1613
"strings"
1714
"time"
@@ -40,27 +37,16 @@ type Config struct {
4037
Proxy string
4138
Remotes []string
4239
Headers http.Header
43-
TLS TLSConfig
4440
DialContext func(ctx context.Context, network, addr string) (net.Conn, error)
4541
Verbose bool
4642
}
4743

48-
// TLSConfig for a Client
49-
type TLSConfig struct {
50-
SkipVerify bool
51-
CA string
52-
Cert string
53-
Key string
54-
ServerName string
55-
}
56-
5744
// Client represents a client instance
5845
type Client struct {
5946
*cio.Logger
6047
config *Config
6148
computed settings.Config
6249
sshConfig *ssh.ClientConfig
63-
tlsConfig *tls.Config
6450
proxyURL *url.URL
6551
server string
6652
connCount cnet.ConnCount
@@ -72,7 +58,8 @@ type Client struct {
7258
// NewClient creates a new client instance
7359
func NewClient(c *Config) (*Client, error) {
7460
//apply default scheme
75-
if !strings.HasPrefix(c.Server, "http") {
61+
if !strings.HasPrefix(c.Server, "http") &&
62+
!strings.HasPrefix(c.Server, "ws") {
7663
c.Server = "http://" + c.Server
7764
}
7865
if c.MaxRetryInterval < time.Second {
@@ -83,14 +70,12 @@ func NewClient(c *Config) (*Client, error) {
8370
return nil, err
8471
}
8572
//swap to websockets scheme
73+
// if !strings.HasPrefix(c.Server, "ws") {
8674
u.Scheme = strings.Replace(u.Scheme, "http", "ws", 1)
75+
// }
8776
//apply default port
8877
if !regexp.MustCompile(`:\d+$`).MatchString(u.Host) {
89-
if u.Scheme == "wss" {
90-
u.Host = u.Host + ":443"
91-
} else {
92-
u.Host = u.Host + ":80"
93-
}
78+
u.Host = u.Host + ":2871"
9479
}
9580
hasReverse := false
9681
hasSocks := false
@@ -101,44 +86,10 @@ func NewClient(c *Config) (*Client, error) {
10186
computed: settings.Config{
10287
Version: chshare.BuildVersion,
10388
},
104-
server: u.String(),
105-
tlsConfig: nil,
89+
server: u.String(),
10690
}
10791
//set default log level
10892
client.Logger.Info = true
109-
//configure tls
110-
if u.Scheme == "wss" {
111-
tc := &tls.Config{}
112-
if c.TLS.ServerName != "" {
113-
tc.ServerName = c.TLS.ServerName
114-
}
115-
//certificate verification config
116-
if c.TLS.SkipVerify {
117-
client.Infof("TLS verification disabled")
118-
tc.InsecureSkipVerify = true
119-
} else if c.TLS.CA != "" {
120-
rootCAs := x509.NewCertPool()
121-
if b, err := os.ReadFile(c.TLS.CA); err != nil {
122-
return nil, fmt.Errorf("Failed to load file: %s", c.TLS.CA)
123-
} else if ok := rootCAs.AppendCertsFromPEM(b); !ok {
124-
return nil, fmt.Errorf("Failed to decode PEM: %s", c.TLS.CA)
125-
} else {
126-
client.Infof("TLS verification using CA %s", c.TLS.CA)
127-
tc.RootCAs = rootCAs
128-
}
129-
}
130-
//provide client cert and key pair for mtls
131-
if c.TLS.Cert != "" && c.TLS.Key != "" {
132-
c, err := tls.LoadX509KeyPair(c.TLS.Cert, c.TLS.Key)
133-
if err != nil {
134-
return nil, fmt.Errorf("Error loading client cert and key pair: %v", err)
135-
}
136-
tc.Certificates = []tls.Certificate{c}
137-
} else if c.TLS.Cert != "" || c.TLS.Key != "" {
138-
return nil, fmt.Errorf("Please specify client BOTH cert and key")
139-
}
140-
client.tlsConfig = tc
141-
}
14293
//validate remotes
14394
for _, s := range c.Remotes {
14495
r, err := settings.DecodeRemote(s)

‎client/client_connect.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,6 @@ func (c *Client) connectionOnce(ctx context.Context) (connected bool, err error)
7979
d := websocket.Dialer{
8080
HandshakeTimeout: settings.EnvDuration("WS_TIMEOUT", 45*time.Second),
8181
Subprotocols: []string{chshare.ProtocolVersion},
82-
TLSClientConfig: c.tlsConfig,
8382
ReadBufferSize: settings.EnvInt("WS_BUFF_SIZE", 0),
8483
WriteBufferSize: settings.EnvInt("WS_BUFF_SIZE", 0),
8584
NetDialContext: c.config.DialContext,

‎go.mod

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,22 @@
11
module github.com/jpillora/chisel
22

3-
go 1.21
3+
go 1.22.3
44

55
require (
66
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
7-
github.com/fsnotify/fsnotify v1.6.0
8-
github.com/gorilla/websocket v1.5.0
7+
github.com/fsnotify/fsnotify v1.7.0
8+
github.com/gorilla/websocket v1.5.3
99
github.com/jpillora/backoff v1.0.0
1010
github.com/jpillora/requestlog v1.0.0
1111
github.com/jpillora/sizestr v1.0.0
12-
golang.org/x/crypto v0.16.0
13-
golang.org/x/net v0.14.0
14-
golang.org/x/sync v0.5.0
12+
golang.org/x/crypto v0.24.0
13+
golang.org/x/net v0.26.0
14+
golang.org/x/sync v0.7.0
1515
)
1616

1717
require (
1818
github.com/andrew-d/go-termutil v0.0.0-20150726205930-009166a695a2 // indirect
1919
github.com/jpillora/ansi v1.0.3 // indirect
2020
github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce // indirect
21-
golang.org/x/sys v0.15.0 // indirect
22-
golang.org/x/text v0.14.0 // indirect
21+
golang.org/x/sys v0.21.0 // indirect
2322
)

‎go.sum

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ github.com/andrew-d/go-termutil v0.0.0-20150726205930-009166a695a2 h1:axBiC50cNZ
22
github.com/andrew-d/go-termutil v0.0.0-20150726205930-009166a695a2/go.mod h1:jnzFpU88PccN/tPPhCpnNU8mZphvKxYM9lLNkd8e+os=
33
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
44
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
5-
github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
6-
github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
7-
github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
8-
github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
5+
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
6+
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
7+
github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
8+
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
99
github.com/jpillora/ansi v1.0.3 h1:nn4Jzti0EmRfDxm7JtEs5LzCbNwd5sv+0aE+LdS9/ZQ=
1010
github.com/jpillora/ansi v1.0.3/go.mod h1:D2tT+6uzJvN1nBVQILYWkIdq7zG+b5gcFN5WI/VyjMY=
1111
github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
@@ -16,16 +16,13 @@ github.com/jpillora/sizestr v1.0.0 h1:4tr0FLxs1Mtq3TnsLDV+GYUWG7Q26a6s+tV5Zfw2yg
1616
github.com/jpillora/sizestr v1.0.0/go.mod h1:bUhLv4ctkknatr6gR42qPxirmd5+ds1u7mzD+MZ33f0=
1717
github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce h1:fb190+cK2Xz/dvi9Hv8eCYJYvIGUTN2/KLq1pT6CjEc=
1818
github.com/tomasen/realip v0.0.0-20180522021738-f0c99a92ddce/go.mod h1:o8v6yHRoik09Xen7gje4m9ERNah1d1PPsVq1VEx9vE4=
19-
golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
20-
golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
21-
golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
22-
golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
23-
golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
24-
golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
25-
golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
26-
golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
27-
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
28-
golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
29-
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
30-
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
31-
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
19+
golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
20+
golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
21+
golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
22+
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
23+
golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
24+
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
25+
golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
26+
golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
27+
golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
28+
golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=

0 commit comments

Comments
 (0)