bzuccaro/rustunnel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: compress connection keys (rtun2) for easier copy/paste

Browse Source
This commit is contained in:
bzuccaro
2026-08-02 12:07:54 -06:00
parent ab1f74214a
commit 6bc3c00b64
13 changed files with 97 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
droid-wiki/features/connection-keys.md
+19 -8
View File
@@ -8,11 +8,19 @@ Simplify distribution of tunnel credentials between machines. Instead of transfe
## Format
Connection keys start with the prefix `rtun1.` followed by base64url-encoded (no padding) JSON:
Connection keys start with the prefix `rtun2.` followed by base64url-encoded (no
padding) **DEFLATE-compressed** JSON:
```
rtun2.<base64url(deflate(json))>
```
The JSON payload is compressed with DEFLATE (`miniz_oxide`) before base64url-encoding
to keep the key short enough to copy and paste comfortably. Example payload:
```json
{
"version": 1,
"version": 2,
"target": "198.51.100.10:4180",
"ca_cert_pem": "-----BEGIN CERTIFICATE-----...",
"server_cert_pem": "-----BEGIN CERTIFICATE-----...",
@@ -28,20 +36,23 @@ Connection keys start with the prefix `rtun1.` followed by base64url-encoded (no
| Type | File | Description |
| ---- | ---- | ----------- |
| `ConnectionKey` | `src/connkey.rs` | Struct with all fields, version check, validation |
| `ConnectionKey::encode` | `src/connkey.rs` | Serialize to JSON, base64url-encode, prepend prefix |
| `ConnectionKey::decode` | `src/connkey.rs` | Strip prefix, base64url-decode, deserialize, validate |
| `looks_like_connection_key` | `src/connkey.rs` | Quick check if a string starts with `rtun1.` |
| `ConnectionKey::encode` | `src/connkey.rs` | Serialize to JSON, DEFLATE-compress, base64url-encode, prepend prefix |
| `ConnectionKey::decode` | `src/connkey.rs` | Strip prefix, base64url-decode, DEFLATE-decompress, deserialize, validate |
| `looks_like_connection_key` | `src/connkey.rs` | Quick check if a string starts with `rtun2.` |
## Validation
`decode` validates:
- Prefix must be `rtun1.`
- Prefix must be `rtun2.`
- Base64 decoding must succeed
- DEFLATE decompression must succeed
- JSON deserialization must succeed
- Version must be exactly `1`
- Version must be exactly `2`
- All string fields must be non-empty after trimming
Legacy `rtun1.` keys are **not** accepted.
## Integration
`src/main.rs` uses `ConnectionKey::decode` when the `--connection-key` flag or positional argument is provided. The decoded material is passed to `ServerTlsMaterial::Pem` or `ClientTlsMaterial::Pem` variants, which bypass file loading and use the embedded PEM strings directly.
@@ -49,7 +60,7 @@ Connection keys start with the prefix `rtun1.` followed by base64url-encoded (no
## Entry points for modification
- To change the key format or add versioning: modify `src/connkey.rs`.
- To add compression or encryption: consider extending the encode/decode pipeline in `ConnectionKey`.
- To add encryption: consider extending the encode/decode pipeline in `ConnectionKey`.
## Key source files