Skip to content

v0.6.2

Choose a tag to compare

View all tags
@Gouryella Gouryella released this 12 Jan 03:54
· 55 commits to main since this release
v0.6.2
0d1b72d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Overview

This release introduces IP-based access control functionality for HTTP, HTTPS, and TCP tunnels, allowing users to restrict access based on client IP addresses using whitelist and blacklist rules.

New Features

IP Access Control

  • Whitelist/Blacklist Support: Configure allowed and denied IP addresses for tunnel access
  • CIDR Range Support: Both --allow-ip and --deny-ip flags support CIDR notation (e.g., 192.168.0.0/16, 10.0.0.0/8)
  • Single IP Support: Individual IP addresses are also supported (automatically converted to /32 for IPv4, /128 for IPv6)
  • Multi-tunnel Support: IP access control works across HTTP, HTTPS, and TCP tunnels

Usage Examples:

# Allow only specific IP ranges
drip http --allow-ip 192.168.1.0/24,10.0.0.0/8

# Deny specific IPs or ranges
drip tcp --deny-ip 1.2.3.4,192.168.0.0/16

# Combine allow and deny rules
drip https --allow-ip 10.0.0.0/8 --deny-ip 10.0.1.0/24

Access Control Rules:

  1. If IP is in deny list → reject
  2. If whitelist is configured and IP is not in whitelist → reject
  3. Otherwise → allow

Improvements

Server Configuration Validation

  • Added Validate method to ServerConfig for validating port ranges, domain format, and TCP port ranges
  • Configuration is now validated before server startup to catch errors early
  • More detailed error messages help users correctly configure server addresses

Security Enhancements

  • Trusted Proxy Headers: X-Forwarded-For and X-Real-IP headers are now only trusted when requests originate from private/loopback networks
  • Private Network Definitions: Added RFC 1918 and other private network range definitions for proxy header validation

Connection Handling Optimizations

  • Improved channel naming in TCP connections for better code readability
  • Enhanced data copying mechanism with context cancellation support to prevent resource leaks
  • Added JSON serialization error handling in TCP connections to prevent data loss

Bug Fixes

  • Fixed CIDR parsing in deny list - previously CIDR ranges like 192.168.0.0/16 were silently ignored
  • Fixed context handling logic in pipe callbacks
  • Optimized error handling mechanism for data connection responses

What's Changed

Full Changelog: v0.6.1...v0.6.2

What's Changed

Full Changelog: v0.6.1...v0.6.2

Contributors

Gouryella
Assets 9
Loading