Drip ทุกเวอร์ชันและเวอร์ชันเก่า

Overview
Drip v0.6.3 introduces HTTP Proxy Authentication and enhanced IP Access Control, providing more granular security controls for your tunnels.
What's New
Proxy Authentication
Secure your HTTP tunnels with password protection. When enabled, visitors must authenticate before accessing your tunneled service.
- Password-protected tunnels - Add --auth <password> flag to require authentication
- Cookie-based sessions - Authenticated users stay logged in via secure cookies
- Clean login page - Built-in login UI for seamless user experience
- XSS protection - HTML escaping implemented to prevent cross-site scripting attacks
Usage:
drip http 8080 --auth mysecretpassword
Enhanced IP Access Control
Extended IP filtering capabilities with CIDR range support.
- CIDR range blocking - Block entire IP ranges instead of individual IPs
- Flexible blacklisting - Support for both single IPs and CIDR notation (e.g., 192.168.1.0/24)
Usage:
drip http 8080 --blacklist 10.0.0.0/8,192.168.0.0/16
Server Improvements
- Configuration validation - Server now validates configuration on startup
- Optimized connection handling - Improved connection lifecycle management
Changelog
- feat(proxy): Implement HTML escaping in login pages to prevent XSS attacks
- feat(cli): Add proxy authentication support with --auth flag
- feat(netutil): Extend IP access checker blacklist from single IP to CIDR ranges
- feat(server): Add server configuration validation and optimize connection handling
Upgrade Guide
This release is backward compatible. Simply update to the latest version:
go install github.com/Gouryella/drip@latest
What's Changed
- feat(cli): add proxy authentication support by @Gouryella in https://github.com/Gouryella/drip/pull/15
Full Changelog: https://github.com/Gouryella/drip/compare/v0.6.2...v0.6.3
What's Changed
- feat(cli): add proxy authentication support by @Gouryella in https://github.com/Gouryella/drip/pull/15
Full Changelog: https://github.com/Gouryella/drip/compare/v0.6.2...v0.6.3

Overview
This release introduces IP-based access control functionality for HTTP, HTTPS, and TCP tunnels, allowing users to restrict access based on client IP addresses using whitelist and blacklist rules.
New Features
IP Access Control
- Whitelist/Blacklist Support: Configure allowed and denied IP addresses for tunnel access
- CIDR Range Support: Both --allow-ip and --deny-ip flags support CIDR notation (e.g., 192.168.0.0/16, 10.0.0.0/8)
- Single IP Support: Individual IP addresses are also supported (automatically converted to /32 for IPv4, /128 for IPv6)
- Multi-tunnel Support: IP access control works across HTTP, HTTPS, and TCP tunnels
Usage Examples:
# Allow only specific IP ranges
drip http --allow-ip 192.168.1.0/24,10.0.0.0/8

# Deny specific IPs or ranges
drip tcp --deny-ip 1.2.3.4,192.168.0.0/16

# Combine allow and deny rules
drip https --allow-ip 10.0.0.0/8 --deny-ip 10.0.1.0/24
Access Control Rules:
1. If IP is in deny list → reject
2. If whitelist is configured and IP is not in whitelist → reject
3. Otherwise → allow
Improvements
Server Configuration Validation
- Added Validate method to ServerConfig for validating port ranges, domain format, and TCP port ranges
- Configuration is now validated before server startup to catch errors early
- More detailed error messages help users correctly configure server addresses
Security Enhancements
- Trusted Proxy Headers: X-Forwarded-For and X-Real-IP headers are now only trusted when requests originate from private/loopback networks
- Private Network Definitions: Added RFC 1918 and other private network range definitions for proxy header validation
Connection Handling Optimizations
- Improved channel naming in TCP connections for better code readability
- Enhanced data copying mechanism with context cancellation support to prevent resource leaks
- Added JSON serialization error handling in TCP connections to prevent data loss
Bug Fixes
- Fixed CIDR parsing in deny list - previously CIDR ranges like 192.168.0.0/16 were silently ignored
- Fixed context handling logic in pipe callbacks
- Optimized error handling mechanism for data connection responses
What's Changed
- feat/ip access control by @Gouryella in https://github.com/Gouryella/drip/pull/14
Full Changelog: https://github.com/Gouryella/drip/compare/v0.6.1...v0.6.2
What's Changed
- feat/ip access control by @Gouryella in https://github.com/Gouryella/drip/pull/14
Full Changelog: https://github.com/Gouryella/drip/compare/v0.6.1...v0.6.2

✨ New Features
Prometheus Metrics Monitoring
- Added Prometheus metrics support with /metrics endpoint
- Detailed metric collection for tunnels, connections, and traffic
- New metrics-token configuration option for monitoring access control
- Tunnel IP metrics statistics tracking
Server Configuration Management
- New server config command to display server configuration
- Support --full flag to display full token
- Refactored token mask logic with configurable display options
Homepage Improvements
- Refactored proxy processor homepage with modern CSS styles
- Responsive design support
- Added code copy functionality
- Added link to metrics endpoint
🔧 Changes
Breaking Changes
- Removed session selection-related methods in TCP connection groups
- Removed large buffer feature from buffer pool
📦 Dependencies
- Updated github.com/spf13/cobra from v1.10.1 to v1.10.2
- Updated golang.org/x/crypto from v0.45.0 to v0.46.0
- Updated golang.org/x/net from v0.47.0 to v0.48.0
- Updated golang.org/x/sys from v0.38.0 to v0.39.0
- Added prometheus/client_golang for metrics collection
📝 Documentation
- Updated README: removed v0.5.0 update content
- Added acknowledgments section
What's Changed
- Feat/prometheus monitoring by @Gouryella in https://github.com/Gouryella/drip/pull/13
Full Changelog: https://github.com/Gouryella/drip/compare/v0.6.0...v0.6.1

Highlights
This release focuses on performance optimization and concurrency safety improvements, significantly enhancing throughput and stability under high-load scenarios.
⚠️ Breaking Changes
- Removed manual GC tuning configuration in main.go, replaced with automatic tuning mode
✨ New Features
Connection Pool Optimization
- Implemented connection pool preheating to eliminate cold start delay
- Optimized pool scaling logic with burst load batch expansion support
- Concurrent data session creation to accelerate scaling
- Added ping loop keep-alive mechanism for each session
- Introduced GetSessionStats method for detailed session statistics
Tunnel Management & Security
- Implemented IP-based tunnel count and registration rate limits
- Added rate limiter to prevent malicious registration behavior
- Client IP address tracking for access control
Concurrency Safety Enhancement
- CAS loop implementation for atomic operations on global tunnel counter
- Added rollback mechanism to ensure proper resource release on registration failure
- Combined atomic operations with locks for thread-safe IP rate limiting
⚡ Performance Improvements
Core Performance
- Optimized session selection using min-heap, reducing time complexity from O(n) to O(log n)
- Added bufio.Reader pool and buffer pool to reduce memory allocation
- Implemented sharded lock manager for improved high-concurrency performance
- Updated yamux with unified optimized configuration for better throughput
- Added patterned GC tuning
HTTP Server
- Used sync.Pool to reuse bufio.Writer, reducing GC pressure
- Enabled TCP_NODELAY for improved response speed
- Adjusted HTTP server timeout configuration to balance performance and security
Resource Management
- Optimized stream open timeout control using context to prevent goroutine leaks
- Improved shutdown process to ensure proper cleanup coroutine exit
- Reduced maximum frame size from 10MB to 1MB to mitigate DoS risk
- Used stack arrays instead of heap allocation for frame header reading
🔧 Other Changes
- ID generator now exclusively uses crypto/rand, removed timestamp fallback
- Added TryGenerateID for non-panic error handling
- Upgraded test scripts from Python to Go implementation
- Added nginx WebSocket proxy header configuration documentation
Upgrade Guide
This release primarily contains performance optimizations. When upgrading:
1. Remove any custom GC configuration code if present
2. Thoroughly test in high-load environments before production deployment
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.3...v0.6.0
What's Changed
- Perf/pool scaling and latency fix by @Gouryella in https://github.com/Gouryella/drip/pull/12
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.3...v0.6.0

🔧 Bug Fixes
- TCP reconnect stability fix: Fixed an issue where subdomain and TCP port would change on client reconnect
- Persist the assigned subdomain after first connect so reconnects reuse it
- Allow reserving a specific TCP port when the subdomain is tcp-<port> to prevent port drift
⬆️ Upgrade Notes
This release is fully backward compatible. After upgrading, TCP tunnels will maintain stable access addresses during reconnections caused by network fluctuations.
What's Changed
- feat(tcp): Fix reconnect behavior to keep stable subdomain and TCP port by @Gouryella in https://github.com/Gouryella/drip/pull/11
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.2...v0.5.3
What's Changed
- feat(tcp): Fix reconnect behavior to keep stable subdomain and TCP port by @Gouryella in https://github.com/Gouryella/drip/pull/11
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.2...v0.5.3

Bug Fixes
- Fixed WebSocket connections being terminated immediately after handshake
The WebSocket proxy was experiencing premature disconnections due to two issues:
1. Server-side context cancellation: The HTTP request context (r.Context()) was being used for the WebSocket pipe goroutine. When the HTTP handler returned after hijacking the connection, Go's HTTP server cancelled the request context, causing the WebSocket pipe to terminate immediately. Changed to use context.Background() for long-lived WebSocket connections.
2. Server-side buffered data handling: The bufio.ReadWriter returned by Hijack() was being discarded, which could cause loss of any buffered data from the client. Now properly handles buffered data using bufferedReadWriteCloser.
- Fixed WebSocket Host header not being forwarded correctly
When proxying WebSocket upgrade requests, only req.URL.Host was being updated but not req.Host. Since http.Request.Write() uses req.Host for the Host header, the original proxy hostname was being sent to the backend instead of the local target address. Now correctly sets req.Host to the target address and preserves the original host in X-Forwarded-Host.
What's Changed
- fix(tcp): Fixed a connection reading issue during WebSocket upgrade by @Gouryella in https://github.com/Gouryella/drip/pull/10
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.1...v0.5.2
What's Changed
- fix(tcp): Fixed a connection reading issue during WebSocket upgrade by @Gouryella in https://github.com/Gouryella/drip/pull/10
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.1...v0.5.2

🔧 Patch Release - Connection Handling Optimization
Highlights
This release focuses on connection handling optimization and codebase simplification, refining the yamux-based architecture introduced in v0.5.0 with improved session management and cleaner proxy logic.
✨ New Features
HTTP Connection Listener
- New connQueueListener for seamless HTTP connection handoff to standard http.Server
- Better integration with HTTP/2 configuration support
🔧 Improvements
TCP Tunnel Optimization
- Refactored data connection processing logic for improved efficiency
- Session selection now prioritizes non-primary sessions for data transmission
- Falls back to main session only when no data session is available
- Send successful response earlier before upgrading to yamux session
Connection Lifecycle Management
- Optimized Connection struct fields and lifecycle logic
- Improved connection closing mechanism to prevent resource leaks
- Enhanced HTTP request parsing stability
- Better error logging methods
Dependency Updates
- Upgraded golang.org/x/net to latest version
🗑️ Removed
HTTP CONNECT Method
- Removed support for HTTP CONNECT tunneling
- CONNECT requests now return 405 Method Not Allowed
- Simplified proxy handler by removing HTTPS tunnel logic
Deprecated Code Cleanup
- Removed redundant DataConnection structures and related management methods
- Removed connection_group_manager.go (~22 lines)
- Streamlined response writing logic
📊 Stats
- 9 files changed
- +262 lines / -413 lines
- Net reduction of ~150 lines through code simplification
⚠️ Compatibility
- Fully compatible with v0.5.0 protocol
- No breaking changes from v0.5.0
What's Changed
- refactor(tcp): Optimizes the TCP tunnel data connection processing logic by @Gouryella
- feat(server): Supports HTTP connection listener and connection pooling improvements by @Gouryella
- feat(proxy): Removes support for the HTTP CONNECT method by @Gouryella
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.0...v0.5.1
What's Changed
- Fix/http proxy by @Gouryella in https://github.com/Gouryella/drip/pull/9
Full Changelog: https://github.com/Gouryella/drip/compare/v0.5.0...v0.5.1

Flow Control & Reliability Improvements 🎯
Features
- Flow Control Protocol: New FlowControl frame type for backpressure
control between client and server
- SafeFrame: Automatic frame resource management ensures data is correctly
returned to memory pool after use
- Queue Pressure Monitoring: Client monitors dataFrameQueue length and
automatically sends flow control commands when threshold exceeded
- Server Backpressure: Added handleFlowControl and sendWithBackpressure
methods for server-side flow control
- Panic Recovery: New recovery package with Recoverer and PanicMetrics for
goroutine panic capture and stack trace logging
Performance
- Faster Heartbeat: Reduced heartbeat interval from 5s to 2s, timeout from
15s to 6s
- Quicker Shutdown: Reduced forced shutdown wait time from 5s/3s to 2s for
faster resource reclamation
- Homepage Response: Converted HTML to byte slices with Content-Length
header for improved response performance
Stability
- SafeFrame Lifecycle: Unified frame lifecycle management with defer
sf.Close(), preventing memory leaks on abnormal paths
- Delay Precision: Fixed delay formatting to correctly handle
microsecond-level delays
What's Changed
- perf: Add flow control, panic recovery and performance tuning by @Gouryella in https://github.com/Gouryella/drip/pull/7
Full Changelog: https://github.com/Gouryella/drip/compare/v0.4.0...v0.4.1
What's Changed
- perf: Add flow control, panic recovery and performance tuning by @Gouryella in https://github.com/Gouryella/drip/pull/7
Full Changelog: https://github.com/Gouryella/drip/compare/v0.4.0...v0.4.1

Performance Improvements 🚀
- Buffer Pooling: Adaptive buffer pool reduces memory allocations by ~40-50%
- Worker Pool: Multi-worker architecture for concurrent data frame processing (1.5× CPU cores, min 4)
- Response Optimization: Pre-marshaled JSON for /health and /stats endpoints
Stability
- Context Management: Request lifecycle control with proper cancellation support across proxy handlers, TCP connections, and frame handlers
- Connection Cleanup: Extended channel timeout to 3 seconds for graceful shutdown
- Error Handling: Improved data integrity during edge cases
Security
- TLS Protection: Safeguards against slow handshake attacks
- Header Filtering: Unified hop-by-hop header filtering in responses
Features
- CLI: HTTPS tunnel support in drip stop command
- Display: Optimized token and buffer configuration formatting
- Tooling: Performance profiling script at scripts/test/profile-test.sh
What's Changed
- perf: Improve performance and stability with buffer pooling, context management, and security enhancements by @Gouryella in https://github.com/Gouryella/drip/pull/6
Full Changelog: https://github.com/Gouryella/drip/compare/v0.3.2...v0.4.0

What's Changed
- Fix/windows daemon by @Gouryella in #4
Full Changelog: https://github.com/Gouryella/drip/compare/v0.3.0...v0.3.1