chisel - A fast TCP tunnel over HTTP

docker run --rm -it jpillora/chisel --help

$ go get -v github.com/jpillora/chisel

• Easy to use
• Performant *
• Encrypted connections using crypto/ssh
• Authenticated connections ; authenticated client connections with a users config file, authenticated server connections with fingerprint matching.
• Client auto-reconnects with exponential backoff
• Client can create multiple tunnel endpoints over one TCP connection
• Server optionally doubles as a reverse proxy

$ chisel server --port $PORT --proxy http://example.com
# listens on $PORT, proxy web requests to 'http://example.com'

$ chisel client https://chisel-demo.herokuapp.com 3000
# connects to 'https://chisel-demo.herokuapp.com',
# tunnels your localhost:3000 to the server's localhost:3000

    Usage: chisel [command] [--help]

    Version: 0.0.0-src

    Commands:
      server - runs chisel in server mode
      client - runs chisel in client mode

    Read more:
      https://github.com/jpillora/chisel

    Usage: chisel server [options]

    Options:

      --host, Defines the HTTP listening host – the network interface
      (defaults to 0.0.0.0).

      --port, Defines the HTTP listening port (defaults to 8080).

      --key, An optional string to seed the generation of a ECDSA public
      and private key pair. All communications will be secured using this
      key pair. Share this fingerprint with clients to enable detection
      of man-in-the-middle attacks.

      --authfile, An optional path to a users.json file. This file should
      be an object with users defined like:
        "<user:pass>": ["<addr-regex>","<addr-regex>"]
        when <user> connects, their <pass> will be verified and then
        each of the remote addresses will be compared against the list
        of address regular expressions for a match. Addresses will
        always come in the form "<host/ip>:<port>".

      --proxy, Specifies the default proxy target to use when chisel
      receives a normal HTTP request.

      -v, Enable verbose logging

      --help, This help text

    Read more:
      https://github.com/jpillora/chisel

    Usage: chisel client [options] <server> <remote> [remote] [remote] ...

    server is the URL to the chisel server.

    remotes are remote connections tunnelled through the server, each of
    which come in the form:

<local-host>:<local-port>:<remote-host>:<remote-port>

        * remote-port is required.
        * local-port defaults to remote-port.
        * local-host defaults to 0.0.0.0 (all interfaces).
        * remote-host defaults to 0.0.0.0 (server localhost).

        example remotes

            3000
            example.com:3000
            3000:google.com:80
            192.168.0.5:3000:google.com:80

    Options:

      --fingerprint, An optional fingerprint (server authentication)
      string to compare against the server's public key. You may provide
      just a prefix of the key or the entire string. Fingerprint 
      mismatches will close the connection.

      --auth, An optional username and password (client authentication)
      in the form: "<user>:<pass>". These credentials are compared to
      the credentials inside the server's --authfile.

      --keepalive, An optional keepalive interval. Since the underlying
      transport is HTTP, in many instances we'll be traversing through
      proxies, often these proxies will close idle connections. You must
      specify a time with a unit, for example '30s' or '2m'. Defaults
      to '0s' (disabled).

      -v, Enable verbose logging

      --help, This help text

    Read more:
      https://github.com/jpillora/chisel

                    (direct)
        .--------------->----------------.
       /    chisel         chisel         \
request--->client:2001--->server:2002---->fileserver:3000
       \                                  /
        '--> crowbar:4001--->crowbar:4002'
             client           server

:3000 => 1 bytes in 1.440608ms
:3000 => 10 bytes in 658.833µs
:3000 => 100 bytes in 669.6µs
:3000 => 1000 bytes in 570.242µs
:3000 => 10000 bytes in 655.795µs
:3000 => 100000 bytes in 693.761µs
:3000 => 1000000 bytes in 2.156777ms
:3000 => 10000000 bytes in 18.562896ms
:3000 => 100000000 bytes in 146.355886ms

:2001 => 1 bytes in 1.393731ms
:2001 => 10 bytes in 1.002992ms
:2001 => 100 bytes in 1.082757ms
:2001 => 1000 bytes in 1.096081ms
:2001 => 10000 bytes in 1.215036ms
:2001 => 100000 bytes in 2.09334ms
:2001 => 1000000 bytes in 9.136138ms
:2001 => 10000000 bytes in 84.170904ms
:2001 => 100000000 bytes in 796.713039ms

:4001 => 1 bytes in 3.335797ms
:4001 => 10 bytes in 1.453007ms
:4001 => 100 bytes in 1.811727ms
:4001 => 1000 bytes in 1.621525ms
:4001 => 10000 bytes in 5.20729ms
:4001 => 100000 bytes in 38.461926ms
:4001 => 1000000 bytes in 358.784864ms
:4001 => 10000000 bytes in 3.603206487s
:4001 => 100000000 bytes in 36.332395213s

• WebSockets support is required
  • IaaS providers all will support WebSockets
    • Unless an unsupporting HTTP proxy has been forced in front of you, in which case I'd argue that you've been downgraded to PaaS.
  • PaaS providers vary in their support for WebSockets
    • Heroku has full support
    • Openshift has full support though connections are only accepted on ports 8443 and 8080
    • Google App Engine has no support

• http://golang.org/doc/code.html
• http://golang.org/doc/effective_go.html
• github.com/jpillora/chisel/share contains the shared package
• github.com/jpillora/chisel/server contains the server package
• github.com/jpillora/chisel/client contains the client package

• 1.0.0 - Init
• 1.1.0 - Swapped out simple symmetric encryption for ECDSA SSH

• Better, faster tests
• Expose a stats page for proxy throughput
• Treat client stdin/stdout as a socket
• Allow clients to act as an indirect tunnel endpoint for other clients
• Keep local connections open and buffer between remote retries