fix: address secure-tunnel scrutiny findings

src/main.rs

@@ -6,7 +6,6 @@ mod redact;
 mod tls;
 mod tunnel;
 
-use std::net::SocketAddr;
 use std::path::Path;
 use std::process;
 use std::sync::Arc;
@@ -17,6 +16,9 @@ use crate::cli::Cli;
 use crate::tunnel::{ConnectorConfig, ListenerConfig};
 
 fn main() {
+    // Install the default crypto provider (ring) for rustls
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     // Initialize tracing/logger — secrets are never printed by design
     tracing_subscriber::fmt()
         .with_env_filter(
@@ -96,6 +98,18 @@ fn run_listen(
         }
     };
 
+    // Resolve hostname to SocketAddr — no panic on failure
+    let bind_addr = match tokio::runtime::Runtime::new()
+        .unwrap()
+        .block_on(tunnel::resolve_host(&host, port))
+    {
+        Ok(addrs) => addrs[0],
+        Err(e) => {
+            eprintln!("Error: failed to resolve '{}': {}", host, e);
+            return 1;
+        }
+    };
+
     // Verify files exist before opening sockets
     if !std::path::Path::new(&cert).exists() {
         eprintln!("Error: server certificate not found: {}", cert);
@@ -126,7 +140,7 @@ fn run_listen(
     };
 
     tracing::info!(
-        "Starting HTTPS tunnel listener on {}:{} (HTTPS default transport)",
+        "Starting HTTPS tunnel listener on {}:{} (HTTPS default transport, endpoint: /tunnel)",
         host,
         port
     );
@@ -138,7 +152,6 @@ fn run_listen(
         redact::Redacted::new(&auth_token)
     );
 
-    let bind_addr: SocketAddr = format!("{}:{}", host, port).parse().unwrap();
     let config = ListenerConfig {
         bind_addr,
         server_cert_path: Arc::from(Path::new(&cert)),
@@ -232,7 +245,11 @@ fn run_connect(
         target_host,
         target_port
     );
-    tracing::info!("SOCKS5 proxy will listen on {}:{} ", socks_host, socks_port);
+    tracing::info!(
+        "SOCKS5 proxy at {}:{} is not yet implemented (scheduled for SOCKS milestone)",
+        socks_host,
+        socks_port
+    );
     tracing::info!("Using client certificate: {}", redact::Redacted::new(&cert));
     tracing::info!("Using client key: {}", redact::Redacted::new(&key));
     tracing::info!("Using CA certificate: {}", redact::Redacted::new(&ca_cert));
@@ -241,9 +258,9 @@ fn run_connect(
         redact::Redacted::new(&auth_token)
     );
 
-    let target_addr: SocketAddr = format!("{}:{}", target_host, target_port).parse().unwrap();
     let config = ConnectorConfig {
-        target_addr,
+        target_host,
+        target_port,
         client_cert_path: Arc::from(Path::new(&cert)),
         client_key_path: Arc::from(Path::new(&key)),
         ca_cert_path: Arc::from(Path::new(&ca_cert)),
@@ -282,7 +299,7 @@ fn run_generate(out: &str, ca_name: &str, server_name: &str, client_name: &str)
 
 fn run_version() -> i32 {
     println!("rustunnel {}", env!("CARGO_PKG_VERSION"));
-    println!("Edition: {}", env!("CARGO_PKG_VERSION"));
+    println!("Edition: 2024");
     println!("Platform: {}", std::env::consts::OS);
     println!("Arch: {}", std::env::consts::ARCH);
     0