THE CYBER TOOLCHAIN
A fast TCP/UDP tunnel over HTTP
Chisel 1.12 tightens SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. and authentication security with several breaking changes, while adding configurable retry backoff, socks5:// client proxying, graceful shutdown, and multi-arch container images.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
With --socks5 and --authfile, users who need SOCKS5 access must now have an authfile entry matching socks; previously SOCKS5 bypassed the ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. list entirely. The wildcard "" continues to match everything including socks.
{
"foo:bar": ["^10\.0\.0\.1:80$", "socks"]
}
Adds --min-retry-interval and --max-retry-interval flags to tune client exponential-backoff retry timing, letting operators slow reconnect attempts on unstable links.
--max-retry-count.$ chisel client --min-retry-interval 5s --max-retry-interval 60s --max-retry-count 10 https://chisel.example.com 3000:localhost:3000
Requires --fingerprint to supply the full SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. fingerprint or the full 16-octet MD5 colon form; truncated MD5 prefixes are now rejected.
Requires --auth values to use <user>:<pass> format with a colon; values without a colon now fail at startup instead of silently disabling authentication.
Ships ko-built, scratch-based images with CA roots for six architectures, published to Docker Hub (jpillora/chisel) and GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository. (ghcr.io/jpillora/chisel).
Authfile reloads now work reliably across editor rename-on-save and Kubernetes ConfigMap swaps; ACL changes apply to new tunnels without interrupting established ones.
A client that exhausts --max-retry-count now exits with a non-zero status code, making retry exhaustion detectable in scripts and CI.
Adds graceful SIGTERM shutdown with in-flight HTTP request draining so active tunnels complete cleanly before the process exits.
Adds socks5:// scheme support for client proxy URLs, enabling chisel clients to egress through a SOCKS5 proxy.
Caps pre-authentication WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. messages while preserving every valid SSH packet, hardening the unauthenticated attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
Reports accurate version strings for go install builds and adds info-level logs for session establishment, authentication events, and ACL denials.
Release CI now integrity-tests every .gz and .zip archive before any asset or image is published.
Migrates CLI parsing and help output to opts with terminal-aware formatting and reliable wrapping at narrow widths.
- !With
--socks5and--authfile, users who need SOCKS5 access must have an authfile entry matchingsocks; SOCKS5 previously bypassed the ACL list entirely. - !
--fingerprintnow rejects truncated MD5 prefixes; only the full SHA256 fingerprint or the full deprecated 16-octet MD5 colon form is accepted. - !
--authvalues without a colon now cause startup failure instead of silently disabling authentication. - !A client that exhausts
--max-retry-countexits non-zero; previously the exit code did not reliably signal retry exhaustion.