TUN-6380: Enforce connect and keep-alive timeouts for TCP connections in both WARP routing and websocket based TCP proxy.

ipostelnik · ipostelnik · commit f2339a72445e · 2022-06-14T21:36:40.000Z
For WARP routing the defaults for these new settings are 5 seconds for connect timeout and 30 seconds for keep-alive timeout. These values can be configured either remotely or locally. Local config lives under "warp-routing" section in config.yaml.

For websocket-based proxy, the defaults come from originConfig settings (either global or per-service) and use the same defaults as HTTP proxying.
diff --git a/cmd/cloudflared/tunnel/configuration.go b/cmd/cloudflared/tunnel/configuration.go
@@ -358,7 +358,7 @@ func prepareTunnelConfig(
 	}
 	orchestratorConfig := &orchestration.Config{
 		Ingress:            &ingressRules,
-		WarpRoutingEnabled: warpRoutingEnabled,
+		WarpRouting:        ingress.NewWarpRoutingConfig(&cfg.WarpRouting),
 		ConfigurationFlags: parseConfigFlags(c),
 	}
 	return tunnelConfig, orchestratorConfig, nil
diff --git a/config/configuration.go b/config/configuration.go
@@ -244,7 +244,9 @@ type Configuration struct {
 }
 
 type WarpRoutingConfig struct {
-	Enabled bool `yaml:"enabled" json:"enabled"`
+	Enabled        bool            `yaml:"enabled" json:"enabled"`
+	ConnectTimeout *CustomDuration `yaml:"connectTimeout" json:"connectTimeout,omitempty"`
+	TCPKeepAlive   *CustomDuration `yaml:"tcpKeepAlive" json:"tcpKeepAlive,omitempty"`
 }
 
 type configFileSettings struct {
diff --git a/config/configuration_test.go b/config/configuration_test.go
@@ -23,7 +23,9 @@ func TestConfigFileSettings(t *testing.T) {
 			Service:  "https://localhost:8001",
 		}
 		warpRouting = WarpRoutingConfig{
-			Enabled: true,
+			Enabled:        true,
+			ConnectTimeout: &CustomDuration{Duration: 2 * time.Second},
+			TCPKeepAlive:   &CustomDuration{Duration: 10 * time.Second},
 		}
 	)
 	rawYAML := `
@@ -48,6 +50,9 @@ ingress:
    service: https://localhost:8001
 warp-routing: 
   enabled: true
+  connectTimeout: 2s
+  tcpKeepAlive: 10s
+
 retries: 5
 grace-period: 30s
 percentage: 3.14
diff --git a/ingress/config.go b/ingress/config.go
@@ -12,10 +12,11 @@ import (
 )
 
 var (
-	defaultConnectTimeout   = config.CustomDuration{Duration: 30 * time.Second}
-	defaultTLSTimeout       = config.CustomDuration{Duration: 10 * time.Second}
-	defaultTCPKeepAlive     = config.CustomDuration{Duration: 30 * time.Second}
-	defaultKeepAliveTimeout = config.CustomDuration{Duration: 90 * time.Second}
+	defaultHTTPConnectTimeout        = config.CustomDuration{Duration: 30 * time.Second}
+	defaultWarpRoutingConnectTimeout = config.CustomDuration{Duration: 5 * time.Second}
+	defaultTLSTimeout                = config.CustomDuration{Duration: 10 * time.Second}
+	defaultTCPKeepAlive              = config.CustomDuration{Duration: 30 * time.Second}
+	defaultKeepAliveTimeout          = config.CustomDuration{Duration: 90 * time.Second}
 )
 
 const (
@@ -41,10 +42,44 @@ const (
 	socksProxy = "socks"
 )
 
+type WarpRoutingConfig struct {
+	Enabled        bool                  `yaml:"enabled" json:"enabled"`
+	ConnectTimeout config.CustomDuration `yaml:"connectTimeout" json:"connectTimeout,omitempty"`
+	TCPKeepAlive   config.CustomDuration `yaml:"tcpKeepAlive" json:"tcpKeepAlive,omitempty"`
+}
+
+func NewWarpRoutingConfig(raw *config.WarpRoutingConfig) WarpRoutingConfig {
+	cfg := WarpRoutingConfig{
+		Enabled:        raw.Enabled,
+		ConnectTimeout: defaultWarpRoutingConnectTimeout,
+		TCPKeepAlive:   defaultTCPKeepAlive,
+	}
+	if raw.ConnectTimeout != nil {
+		cfg.ConnectTimeout = *raw.ConnectTimeout
+	}
+	if raw.TCPKeepAlive != nil {
+		cfg.TCPKeepAlive = *raw.TCPKeepAlive
+	}
+	return cfg
+}
+
+func (c *WarpRoutingConfig) RawConfig() config.WarpRoutingConfig {
+	raw := config.WarpRoutingConfig{
+		Enabled: c.Enabled,
+	}
+	if c.ConnectTimeout.Duration != defaultWarpRoutingConnectTimeout.Duration {
+		raw.ConnectTimeout = &c.ConnectTimeout
+	}
+	if c.TCPKeepAlive.Duration != defaultTCPKeepAlive.Duration {
+		raw.TCPKeepAlive = &c.TCPKeepAlive
+	}
+	return raw
+}
+
 // RemoteConfig models ingress settings that can be managed remotely, for example through the dashboard.
 type RemoteConfig struct {
 	Ingress     Ingress
-	WarpRouting config.WarpRoutingConfig
+	WarpRouting WarpRoutingConfig
 }
 
 type RemoteConfigJSON struct {
@@ -72,18 +107,18 @@ func (rc *RemoteConfig) UnmarshalJSON(b []byte) error {
 	}
 
 	rc.Ingress = ingress
-	rc.WarpRouting = rawConfig.WarpRouting
+	rc.WarpRouting = NewWarpRoutingConfig(&rawConfig.WarpRouting)
 
 	return nil
 }
 
 func originRequestFromSingeRule(c *cli.Context) OriginRequestConfig {
-	var connectTimeout config.CustomDuration = defaultConnectTimeout
-	var tlsTimeout config.CustomDuration = defaultTLSTimeout
-	var tcpKeepAlive config.CustomDuration = defaultTCPKeepAlive
+	var connectTimeout = defaultHTTPConnectTimeout
+	var tlsTimeout = defaultTLSTimeout
+	var tcpKeepAlive = defaultTCPKeepAlive
 	var noHappyEyeballs bool
-	var keepAliveConnections int = defaultKeepAliveConnections
-	var keepAliveTimeout config.CustomDuration = defaultKeepAliveTimeout
+	var keepAliveConnections = defaultKeepAliveConnections
+	var keepAliveTimeout = defaultKeepAliveTimeout
 	var httpHostHeader string
 	var originServerName string
 	var caPool string
@@ -160,7 +195,7 @@ func originRequestFromSingeRule(c *cli.Context) OriginRequestConfig {
 
 func originRequestFromConfig(c config.OriginRequestConfig) OriginRequestConfig {
 	out := OriginRequestConfig{
-		ConnectTimeout:       defaultConnectTimeout,
+		ConnectTimeout:       defaultHTTPConnectTimeout,
 		TLSTimeout:           defaultTLSTimeout,
 		TCPKeepAlive:         defaultTCPKeepAlive,
 		KeepAliveConnections: defaultKeepAliveConnections,
@@ -404,7 +439,7 @@ func ConvertToRawOriginConfig(c OriginRequestConfig) config.OriginRequestConfig
 	var keepAliveTimeout *config.CustomDuration
 	var proxyAddress *string
 
-	if c.ConnectTimeout != defaultConnectTimeout {
+	if c.ConnectTimeout != defaultHTTPConnectTimeout {
 		connectTimeout = &c.ConnectTimeout
 	}
 	if c.TLSTimeout != defaultTLSTimeout {
diff --git a/ingress/config_test.go b/ingress/config_test.go
@@ -274,7 +274,7 @@ func TestOriginRequestConfigDefaults(t *testing.T) {
 		// Rule 0 didn't override anything, so it inherits the cloudflared defaults
 		actual0 := ing.Rules[0].Config
 		expected0 := OriginRequestConfig{
-			ConnectTimeout:       defaultConnectTimeout,
+			ConnectTimeout:       defaultHTTPConnectTimeout,
 			TLSTimeout:           defaultTLSTimeout,
 			TCPKeepAlive:         defaultTCPKeepAlive,
 			KeepAliveConnections: defaultKeepAliveConnections,
@@ -404,7 +404,7 @@ func TestDefaultConfigFromCLI(t *testing.T) {
 	c := cli.NewContext(nil, set, nil)
 
 	expected := OriginRequestConfig{
-		ConnectTimeout:       defaultConnectTimeout,
+		ConnectTimeout:       defaultHTTPConnectTimeout,
 		TLSTimeout:           defaultTLSTimeout,
 		TCPKeepAlive:         defaultTCPKeepAlive,
 		KeepAliveConnections: defaultKeepAliveConnections,
diff --git a/ingress/ingress.go b/ingress/ingress.go
@@ -97,8 +97,16 @@ type WarpRoutingService struct {
 	Proxy StreamBasedOriginProxy
 }
 
-func NewWarpRoutingService() *WarpRoutingService {
-	return &WarpRoutingService{Proxy: &rawTCPService{name: ServiceWarpRouting}}
+func NewWarpRoutingService(config WarpRoutingConfig) *WarpRoutingService {
+	svc := &rawTCPService{
+		name: ServiceWarpRouting,
+		dialer: net.Dialer{
+			Timeout:   config.ConnectTimeout.Duration,
+			KeepAlive: config.TCPKeepAlive.Duration,
+		},
+	}
+
+	return &WarpRoutingService{Proxy: svc}
 }
 
 // Get a single origin service from the CLI/config.
diff --git a/ingress/origin_proxy.go b/ingress/origin_proxy.go
@@ -1,26 +1,20 @@
 package ingress
 
 import (
+	"context"
 	"fmt"
-	"net"
 	"net/http"
-
-	"github.com/pkg/errors"
-)
-
-var (
-	errUnsupportedConnectionType = errors.New("internal error: unsupported connection type")
 )
 
 // HTTPOriginProxy can be implemented by origin services that want to proxy http requests.
 type HTTPOriginProxy interface {
-	// RoundTrip is how cloudflared proxies eyeball requests to the actual origin services
+	// RoundTripper is how cloudflared proxies eyeball requests to the actual origin services
 	http.RoundTripper
 }
 
 // StreamBasedOriginProxy can be implemented by origin services that want to proxy ws/TCP.
 type StreamBasedOriginProxy interface {
-	EstablishConnection(dest string) (OriginConnection, error)
+	EstablishConnection(ctx context.Context, dest string) (OriginConnection, error)
 }
 
 func (o *unixSocketPath) RoundTrip(req *http.Request) (*http.Response, error) {
@@ -59,8 +53,8 @@ func (o *statusCode) RoundTrip(_ *http.Request) (*http.Response, error) {
 	return resp, nil
 }
 
-func (o *rawTCPService) EstablishConnection(dest string) (OriginConnection, error) {
-	conn, err := net.Dial("tcp", dest)
+func (o *rawTCPService) EstablishConnection(ctx context.Context, dest string) (OriginConnection, error) {
+	conn, err := o.dialer.DialContext(ctx, "tcp", dest)
 	if err != nil {
 		return nil, err
 	}
@@ -71,13 +65,13 @@ func (o *rawTCPService) EstablishConnection(dest string) (OriginConnection, erro
 	return originConn, nil
 }
 
-func (o *tcpOverWSService) EstablishConnection(dest string) (OriginConnection, error) {
+func (o *tcpOverWSService) EstablishConnection(ctx context.Context, dest string) (OriginConnection, error) {
 	var err error
 	if !o.isBastion {
 		dest = o.dest
 	}
 
-	conn, err := net.Dial("tcp", dest)
+	conn, err := o.dialer.DialContext(ctx, "tcp", dest)
 	if err != nil {
 		return nil, err
 	}
@@ -89,6 +83,6 @@ func (o *tcpOverWSService) EstablishConnection(dest string) (OriginConnection, e
 
 }
 
-func (o *socksProxyOverWSService) EstablishConnection(dest string) (OriginConnection, error) {
+func (o *socksProxyOverWSService) EstablishConnection(_ctx context.Context, _dest string) (OriginConnection, error) {
 	return o.conn, nil
 }
diff --git a/ingress/origin_proxy_test.go b/ingress/origin_proxy_test.go
@@ -36,7 +36,7 @@ func TestRawTCPServiceEstablishConnection(t *testing.T) {
 	require.NoError(t, err)
 
 	// Origin not listening for new connection, should return an error
-	_, err = rawTCPService.EstablishConnection(req.URL.String())
+	_, err = rawTCPService.EstablishConnection(context.Background(), req.URL.String())
 	require.Error(t, err)
 }
 
@@ -87,7 +87,7 @@ func TestTCPOverWSServiceEstablishConnection(t *testing.T) {
 		t.Run(test.testCase, func(t *testing.T) {
 			if test.expectErr {
 				bastionHost, _ := carrier.ResolveBastionDest(test.req)
-				_, err := test.service.EstablishConnection(bastionHost)
+				_, err := test.service.EstablishConnection(context.Background(), bastionHost)
 				assert.Error(t, err)
 			}
 		})
@@ -99,7 +99,7 @@ func TestTCPOverWSServiceEstablishConnection(t *testing.T) {
 	for _, service := range []*tcpOverWSService{newTCPOverWSService(originURL), newBastionService()} {
 		// Origin not listening for new connection, should return an error
 		bastionHost, _ := carrier.ResolveBastionDest(bastionReq)
-		_, err := service.EstablishConnection(bastionHost)
+		_, err := service.EstablishConnection(context.Background(), bastionHost)
 		assert.Error(t, err)
 	}
 }
diff --git a/ingress/origin_service.go b/ingress/origin_service.go
@@ -91,7 +91,8 @@ func (o httpService) MarshalJSON() ([]byte, error) {
 // rawTCPService dials TCP to the destination specified by the client
 // It's used by warp routing
 type rawTCPService struct {
-	name string
+	name   string
+	dialer net.Dialer
 }
 
 func (o *rawTCPService) String() string {
@@ -113,6 +114,7 @@ type tcpOverWSService struct {
 	dest          string
 	isBastion     bool
 	streamHandler streamHandlerFunc
+	dialer        net.Dialer
 }
 
 type socksProxyOverWSService struct {
@@ -176,6 +178,8 @@ func (o *tcpOverWSService) start(log *zerolog.Logger, _ <-chan struct{}, cfg Ori
 	} else {
 		o.streamHandler = DefaultStreamHandler
 	}
+	o.dialer.Timeout = cfg.ConnectTimeout.Duration
+	o.dialer.KeepAlive = cfg.TCPKeepAlive.Duration
 	return nil
 }
 
diff --git a/orchestration/config.go b/orchestration/config.go
@@ -19,8 +19,8 @@ type newLocalConfig struct {
 
 // Config is the original config as read and parsed by cloudflared.
 type Config struct {
-	Ingress            *ingress.Ingress
-	WarpRoutingEnabled bool
+	Ingress     *ingress.Ingress
+	WarpRouting ingress.WarpRoutingConfig
 
 	// Extra settings used to configure this instance but that are not eligible for remotely management
 	// ie. (--protocol, --loglevel, ...)
@@ -37,7 +37,7 @@ func (rc *newLocalConfig) MarshalJSON() ([]byte, error) {
 			// UI doesn't support top level configs, so we reconcile to individual ingress configs.
 			GlobalOriginRequest: nil,
 			IngressRules:        convertToUnvalidatedIngressRules(rc.RemoteConfig.Ingress),
-			WarpRouting:         rc.RemoteConfig.WarpRouting,
+			WarpRouting:         rc.RemoteConfig.WarpRouting.RawConfig(),
 		},
 	}
 
diff --git a/orchestration/config_test.go b/orchestration/config_test.go
@@ -3,16 +3,17 @@ package orchestration
 import (
 	"encoding/json"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/cloudflare/cloudflared/config"
 	"github.com/cloudflare/cloudflared/ingress"
 )
 
 // TestNewLocalConfig_MarshalJSON tests that we are able to converte a compiled and validated config back
 // into an "unvalidated" format which is compatible with Remote Managed configurations.
 func TestNewLocalConfig_MarshalJSON(t *testing.T) {
-
 	rawConfig := []byte(`
 	{
 		"originRequest": {
@@ -57,7 +58,11 @@ func TestNewLocalConfig_MarshalJSON(t *testing.T) {
 					]
 				}
 			}
-		]
+		],
+        "warp-routing": {
+			"enabled": true,
+			"connectTimeout": 1
+        }
 	}
 	`)
 
@@ -73,10 +78,18 @@ func TestNewLocalConfig_MarshalJSON(t *testing.T) {
 	jsonSerde, err := json.Marshal(c)
 	require.NoError(t, err)
 
-	var config ingress.RemoteConfig
-	err = json.Unmarshal(jsonSerde, &config)
+	var remoteConfig ingress.RemoteConfig
+	err = json.Unmarshal(jsonSerde, &remoteConfig)
 	require.NoError(t, err)
 
-	require.Equal(t, config.WarpRouting.Enabled, false)
-	require.Equal(t, config.Ingress.Rules, expectedConfig.Ingress.Rules)
+	require.Equal(t, remoteConfig.WarpRouting, ingress.WarpRoutingConfig{
+		Enabled: true,
+		ConnectTimeout: config.CustomDuration{
+			Duration: time.Second,
+		},
+		TCPKeepAlive: config.CustomDuration{
+			Duration: 30 * time.Second, // default value is 30 seconds
+		},
+	})
+	require.Equal(t, remoteConfig.Ingress.Rules, expectedConfig.Ingress.Rules)
 }
diff --git a/orchestration/orchestrator.go b/orchestration/orchestrator.go
diff --git a/orchestration/orchestrator_test.go b/orchestration/orchestrator_test.go
diff --git a/proxy/proxy.go b/proxy/proxy.go
diff --git a/proxy/proxy_test.go b/proxy/proxy_test.go

Original file line number	Diff line number	Diff line change
`@@ -358,7 +358,7 @@ func prepareTunnelConfig(`
`358`	`358`	`}`
`359`	`359`	`orchestratorConfig := &orchestration.Config{`
`360`	`360`	`Ingress: &ingressRules,`
`361`		`- WarpRoutingEnabled: warpRoutingEnabled,`
	`361`	`+ WarpRouting: ingress.NewWarpRoutingConfig(&cfg.WarpRouting),`
`362`	`362`	`ConfigurationFlags: parseConfigFlags(c),`
`363`	`363`	`}`
`364`	`364`	`return tunnelConfig, orchestratorConfig, nil`
Original file line number	Diff line number	Diff line change
`@@ -244,7 +244,9 @@ type Configuration struct {`
`244`	`244`	`}`
`245`	`245`
`246`	`246`	`type WarpRoutingConfig struct {`
`247`		- Enabled bool `yaml:"enabled" json:"enabled"`
	`247`	+ Enabled bool `yaml:"enabled" json:"enabled"`
	`248`	+ ConnectTimeout *CustomDuration `yaml:"connectTimeout" json:"connectTimeout,omitempty"`
	`249`	+ TCPKeepAlive *CustomDuration `yaml:"tcpKeepAlive" json:"tcpKeepAlive,omitempty"`
`248`	`250`	`}`
`249`	`251`
`250`	`252`	`type configFileSettings struct {`
Original file line number	Diff line number	Diff line change
`@@ -1,26 +1,20 @@`
`1`	`1`	`package ingress`
`2`	`2`
`3`	`3`	`import (`
	`4`	`+ "context"`
`4`	`5`	`"fmt"`
`5`		`- "net"`
`6`	`6`	`"net/http"`
`7`		`-`
`8`		`- "github.com/pkg/errors"`
`9`		`-)`
`10`		`-`
`11`		`-var (`
`12`		`- errUnsupportedConnectionType = errors.New("internal error: unsupported connection type")`
`13`	`7`	`)`
`14`	`8`
`15`	`9`	`// HTTPOriginProxy can be implemented by origin services that want to proxy http requests.`
`16`	`10`	`type HTTPOriginProxy interface {`
`17`		`- // RoundTrip is how cloudflared proxies eyeball requests to the actual origin services`
	`11`	`+ // RoundTripper is how cloudflared proxies eyeball requests to the actual origin services`
`18`	`12`	`http.RoundTripper`
`19`	`13`	`}`
`20`	`14`
`21`	`15`	`// StreamBasedOriginProxy can be implemented by origin services that want to proxy ws/TCP.`
`22`	`16`	`type StreamBasedOriginProxy interface {`
`23`		`- EstablishConnection(dest string) (OriginConnection, error)`
	`17`	`+ EstablishConnection(ctx context.Context, dest string) (OriginConnection, error)`
`24`	`18`	`}`
`25`	`19`
`26`	`20`	`func (o unixSocketPath) RoundTrip(req http.Request) (*http.Response, error) {`
`@@ -59,8 +53,8 @@ func (o statusCode) RoundTrip(_ http.Request) (*http.Response, error) {`
`59`	`53`	`return resp, nil`
`60`	`54`	`}`
`61`	`55`
`62`		`-func (o *rawTCPService) EstablishConnection(dest string) (OriginConnection, error) {`
`63`		`- conn, err := net.Dial("tcp", dest)`
	`56`	`+func (o *rawTCPService) EstablishConnection(ctx context.Context, dest string) (OriginConnection, error) {`
	`57`	`+ conn, err := o.dialer.DialContext(ctx, "tcp", dest)`
`64`	`58`	`if err != nil {`
`65`	`59`	`return nil, err`
`66`	`60`	`}`
`@@ -71,13 +65,13 @@ func (o *rawTCPService) EstablishConnection(dest string) (OriginConnection, erro`
`71`	`65`	`return originConn, nil`
`72`	`66`	`}`
`73`	`67`
`74`		`-func (o *tcpOverWSService) EstablishConnection(dest string) (OriginConnection, error) {`
	`68`	`+func (o *tcpOverWSService) EstablishConnection(ctx context.Context, dest string) (OriginConnection, error) {`
`75`	`69`	`var err error`
`76`	`70`	`if !o.isBastion {`
`77`	`71`	`dest = o.dest`
`78`	`72`	`}`
`79`	`73`
`80`		`- conn, err := net.Dial("tcp", dest)`
	`74`	`+ conn, err := o.dialer.DialContext(ctx, "tcp", dest)`
`81`	`75`	`if err != nil {`
`82`	`76`	`return nil, err`
`83`	`77`	`}`
`@@ -89,6 +83,6 @@ func (o *tcpOverWSService) EstablishConnection(dest string) (OriginConnection, e`
`89`	`83`
`90`	`84`	`}`
`91`	`85`
`92`		`-func (o *socksProxyOverWSService) EstablishConnection(dest string) (OriginConnection, error) {`
	`86`	`+func (o *socksProxyOverWSService) EstablishConnection(_ctx context.Context, _dest string) (OriginConnection, error) {`
`93`	`87`	`return o.conn, nil`
`94`	`88`	`}`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ func TestRawTCPServiceEstablishConnection(t *testing.T) {`
`36`	`36`	`require.NoError(t, err)`
`37`	`37`
`38`	`38`	`// Origin not listening for new connection, should return an error`
`39`		`- _, err = rawTCPService.EstablishConnection(req.URL.String())`
	`39`	`+ _, err = rawTCPService.EstablishConnection(context.Background(), req.URL.String())`
`40`	`40`	`require.Error(t, err)`
`41`	`41`	`}`
`42`	`42`
`@@ -87,7 +87,7 @@ func TestTCPOverWSServiceEstablishConnection(t *testing.T) {`
`87`	`87`	`t.Run(test.testCase, func(t *testing.T) {`
`88`	`88`	`if test.expectErr {`
`89`	`89`	`bastionHost, _ := carrier.ResolveBastionDest(test.req)`
`90`		`- _, err := test.service.EstablishConnection(bastionHost)`
	`90`	`+ _, err := test.service.EstablishConnection(context.Background(), bastionHost)`
`91`	`91`	`assert.Error(t, err)`
`92`	`92`	`}`
`93`	`93`	`})`
`@@ -99,7 +99,7 @@ func TestTCPOverWSServiceEstablishConnection(t *testing.T) {`
`99`	`99`	`for _, service := range []*tcpOverWSService{newTCPOverWSService(originURL), newBastionService()} {`
`100`	`100`	`// Origin not listening for new connection, should return an error`
`101`	`101`	`bastionHost, _ := carrier.ResolveBastionDest(bastionReq)`
`102`		`- _, err := service.EstablishConnection(bastionHost)`
	`102`	`+ _, err := service.EstablishConnection(context.Background(), bastionHost)`
`103`	`103`	`assert.Error(t, err)`
`104`	`104`	`}`
`105`	`105`	`}`
Original file line number	Diff line number	Diff line change
`@@ -91,7 +91,8 @@ func (o httpService) MarshalJSON() ([]byte, error) {`
`91`	`91`	`// rawTCPService dials TCP to the destination specified by the client`
`92`	`92`	`// It's used by warp routing`
`93`	`93`	`type rawTCPService struct {`
`94`		`- name string`
	`94`	`+ name string`
	`95`	`+ dialer net.Dialer`
`95`	`96`	`}`
`96`	`97`
`97`	`98`	`func (o *rawTCPService) String() string {`
`@@ -113,6 +114,7 @@ type tcpOverWSService struct {`
`113`	`114`	`dest string`
`114`	`115`	`isBastion bool`
`115`	`116`	`streamHandler streamHandlerFunc`
	`117`	`+ dialer net.Dialer`
`116`	`118`	`}`
`117`	`119`
`118`	`120`	`type socksProxyOverWSService struct {`
`@@ -176,6 +178,8 @@ func (o tcpOverWSService) start(log zerolog.Logger, _ <-chan struct{}, cfg Ori`
`176`	`178`	`} else {`
`177`	`179`	`o.streamHandler = DefaultStreamHandler`
`178`	`180`	`}`
	`181`	`+ o.dialer.Timeout = cfg.ConnectTimeout.Duration`
	`182`	`+ o.dialer.KeepAlive = cfg.TCPKeepAlive.Duration`
`179`	`183`	`return nil`
`180`	`184`	`}`
`181`	`185`