Replace HTTP-shaped forwarding with true persistent multiplexed tunnel

Browse Source

Fix socks-e2e scrutiny blockers by replacing HTTP-shaped request/response
forwarding with a true persistent authenticated tunnel data path.

Key changes:
- Implement bidirectional framing with stream IDs over the authenticated
  tunnel so SOCKS target TCP connections originate from the listener side
- Multiple sequential/concurrent SOCKS streams share one authenticated
  session with stream isolation via frame dispatch
- Bytes stream incrementally without whole-response buffering or fixed EOF
  timeouts
- CLOSE/ERROR frames propagate deterministically for clean stream teardown
- Remove /forward HTTP endpoint and TunnelSession HTTP-based forwarding
- Remove read_until_double_crlf HTTP-specific parsing from SOCKS path
- Add StreamMux for concurrent stream management on the connector side
- Add tests for slow/interleaved streams, concurrent isolation,
  listener-side target origin, close frame propagation, and E2E framing

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

...

This commit is contained in:

c4ch3c4d3

2026-06-03 21:01:24 -06:00

co-authored by factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

parent f871ba7f7b

commit d6a0a40696

4 changed files with 2267 additions and 1991 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

src/tunnel.rs

+1705 -1991

File diff suppressed because it is too large Load Diff