10.4.2

files/wstunnel-client

@@ -52,6 +52,7 @@ TLS_CERTIFICATE=""
 TLS_PRIVATE_KEY=""
 DNS_RESOLVER=()
 DNS_RESOLVER_PREFER_IPV4=""
+TLS_ECH_ENABLE=""
 REVERSE_TUNNEL_CONNECTION_RETRY_MAX_BACKOFF=""
 
 # Function to trim whitespace
@@ -179,6 +180,9 @@ while IFS='=' read -r key value; do
         dns_resolver_prefer_ipv4)
             DNS_RESOLVER_PREFER_IPV4="$value"
             ;;
+        tls_ech_enable)
+            TLS_ECH_ENABLE="$value"
+            ;;
         reverse_tunnel_connection_retry_max_backoff)
             REVERSE_TUNNEL_CONNECTION_RETRY_MAX_BACKOFF="$value"
             ;;
@@ -228,6 +232,7 @@ for resolver in "${DNS_RESOLVER[@]}"; do
     CMD+=("--dns-resolver" "$resolver")
 done
 [ "$DNS_RESOLVER_PREFER_IPV4" = "true" ] && CMD+=("--dns-resolver-prefer-ipv4")
+[ "$TLS_ECH_ENABLE" = "true" ] && CMD+=("--tls-ech-enable")
 
 # Set environment variable for nb_worker_threads if specified
 if [ -n "$NB_WORKER_THREADS" ]; then

files/wstunnel.conf

@@ -163,3 +163,7 @@ websocket_ping_frequency = 30s
 ; The client follows an exponential backoff strategy until it reaches this maximum delay
 ; By default, the client tries to reconnect every 1 second
 ; reverse_tunnel_connection_retry_max_backoff = 1s
+
+; Enable ECH (encrypted sni) during TLS handshake to wstunnel server.
+; Warning: Ech DNS config is not refreshed over time. It is retrieved only once at startup of the program 
+; tls_ech_enable = flase