tlswrapper-tcp(1)

💖 tlswrapper-tcp 💖

okay bestie, welcome to the tlswrapper-tcp manual page — it lives in section 1 of the General Commands Manual, and it's basically the little client-side goblin that makes TLS-wrapping your weird non-TLS services possible. sit down, grab a strawberry, we're doing this 💅

---

✨ NAME ✨

tlswrapper-tcp — TLS encryption wrapper, tcp client. that's the whole vibe, she's a client, she wraps things, slay 🎀

---

🌸 SYNOPSIS 🌸

tlswrapper-tcp [ options ] host port

---

🦋 DESCRIPTION 🦋

so tlswrapper-tcp is a TCP client, periodt. it connects to host:port and then it's the ultimate relay bestie: it takes data from standard input and sends it off to the host, and it takes data coming back from the host and drops it onto standard output. 🔁

she's not a solo main character though — she's literally designed to run together with tlswrapper, and tlswrapper is the one who executes her. together they let you protect a non-TLS TCP service with TLS, kinda the same energy as stunnel(8). iconic behavior honestly.

here's how the little pipeline of besties works: systemd.socket/inetd/tcpserver/whatever creates the server connection, then tlswrapper encrypts/decrypts the data stream, and then tlswrapper-tcp creates the client connection and sends/receives the unencrypted data to/from host:port. like this:

Internet <--> systemd.socket/inetd/tcpserver/... <--> tlswrapper <-->
tlswrapper-tcp <-> host:port

it's giving relay race but everyone's holding hands 🫶

---

💅 OPTIONS 💅

• -q — quiet mode. no error messages, we're keeping it chill and silent. 🤫
• -v — enable verbose mode. stack multiple -v options to increase the verbosity — but the maximum is 3, so don't get greedy. 📢
• -t seconds — set the network timeout to seconds seconds. default is 3600.
• -T seconds — set the connect timeout to seconds seconds. default is 10.
• -p version — enable incoming proxy-protocol version version string.
• -P version — enable outgoing proxy-protocol version version string.
• -J jaildir — chroot the network-process into a specified jaildir. default: /var/lib/tlswrapper/empty.
• -j jailuser — run the network-process and dnsresolver-process under a specified jailuser's uid and gid. the account must resolve to a non-zero uid and a non-zero gid — accounts with uid 0 or gid 0 are rejected, no exceptions, don't even try it. if unset, the network-process and dnsresolver-process run under a random uid and gid. 🎲
• host — host or IP.
• port — TCP port.

---

🔒 SECURITY 🔒

🧚 Separate process for network connection and separate process for DNS resolving

bestie, listen. to protect against secret-information leaks to the network connection (heartbleed energy, we do not want that 😭), tlswrapper-tcp runs two independent processes. one process resolves the hostname, and the second one creates a connection to host:port. two little guys, separate jobs, no shared secrets slipping out. 💪

👑 JAIL — Privilege separation, filesystem isolation, limits

tlswrapper-tcp, just like tlswrapper processes, runs under a dedicated non-zero uid to prohibit kill, ptrace, etc. — nobody's touching her. she's chrooted into an empty, unwritable directory to prohibit filesystem access. she sets ulimits to prohibit new files, sockets, etc. and she sets ulimits to prohibit forks. locked down, unbothered, thriving. 🔐

---

🌈 EXAMPLES 🌈

want to run tlswrapper using tcpserver/busybox/inetd on port 443 and connect to the non-TLS service at ip 127.0.0.1 and port 80? say less:

tcpserver -HRDl0 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
busybox tcpsvd 0 443 tlswrapper [ options ] tlswrapper-tcp 127.0.0.1 80
inetd.conf line: https stream tcp nowait root /usr/bin/tlswrapper tlswrapper [ options ] /usr/bin/tlswrapper-tcp 127.0.0.1 80

three whole ways to do the exact same thing and honestly? pick your fighter. ⭐

---

👀 SEE ALSO 👀

• tlswrapper(1)

---

and that's the whole page, bestie 💜 this was the tlswrapper-tcp(1) page from the General Commands Manual, and yeah — the footer is just tlswrapper-tcp(1) again, because she's self-referential like that. no cap, she ate and left no crumbs. now go wrap something in TLS 🎀✨