The minimal E2E in ci.yml was masking curl/SOCKS forwarding failures
with '|| true' and piping through 'head', so tunnel failures were
silently ignored and CI always reported success.
Changes:
- Remove '|| true' from the curl/SOCKS5 forwarding test
- Capture curl exit code and fail CI if non-zero
- Assert HTTP 200 status code from the response
- Assert response body contains expected HTTP server content
- Use cross-platform 'sed' instead of 'head -n -1' (BSD/macOS)
- Also unmask the HTTP target health check
- Preserve existing cross-platform cleanup trap and helpers
- Add EXIT trap so cleanup runs on success AND failure
- Replace Unix-only lsof with cross-platform kill_by_port that tries
lsof, netstat+taskkill, and fuser with graceful fallbacks
- Add kill_process helper for OS-aware PID termination
- Track all PIDs (connector, listener, target) for reliable cleanup
- Clean up temp credential directory on exit
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
- Fix race condition in generate test temp_dir() by using PID + atomic counter
instead of nanosecond timestamps that collide under parallel test execution
- Apply cargo fmt to tunnel.rs for consistent formatting
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Frame::deserialize consumed header bytes from the buffer via get_u8/
get_u64/get_u32 even when the payload was incomplete, causing those
bytes to be permanently lost on retry. Replaced with slice-based
reading that never consumes until the complete frame (header + payload)
is available.
Added 9 new tests covering header-only, partial payload, remaining
payload, header-split, and multi-frame chunked scenarios.
Includes async FrameReader tests with chunked reads.
Fix socks-e2e scrutiny blockers by replacing HTTP-shaped request/response
forwarding with a true persistent authenticated tunnel data path.
Key changes:
- Implement bidirectional framing with stream IDs over the authenticated
tunnel so SOCKS target TCP connections originate from the listener side
- Multiple sequential/concurrent SOCKS streams share one authenticated
session with stream isolation via frame dispatch
- Bytes stream incrementally without whole-response buffering or fixed EOF
timeouts
- CLOSE/ERROR frames propagate deterministically for clean stream teardown
- Remove /forward HTTP endpoint and TunnelSession HTTP-based forwarding
- Remove read_until_double_crlf HTTP-specific parsing from SOCKS path
- Add StreamMux for concurrent stream management on the connector side
- Add tests for slow/interleaved streams, concurrent isolation,
listener-side target origin, close frame propagation, and E2E framing
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
- Introduce TunnelSession that holds a single authenticated SendRequest
shared across all concurrent SOCKS5 streams via Arc<Mutex<>>
- Connector authenticates once on startup, then reuses the persistent
tunnel for all SOCKS5 CONNECT requests
- Listener /forward returns raw bytes (no HTTP parse/unparse overhead)
to preserve exact byte semantics for SOCKS5 TCP proxying
- Add stream counters (session-X) for logging and isolation tracking
- Add 5 new tests: sequential streams, concurrent streams with isolation,
stream counter increments, pre-auth rejection, and E2E concurrent SOCKS5
streams over a shared tunnel
- All 117 tests pass; E2E CLI validates 5 concurrent streams share one
persistent TLS connection (127.0.0.1:64216 in transcript)
Add HTTPS default tunnel endpoint and outbound connector using Rustls
with mTLS and an additional auth/session token.
- Add rustls, tokio-rustls, hyper, and related dependencies
- Implement TLS config builders (server/client) with cert validation
- Implement HTTPS tunnel listener with mTLS accept and auth handshake
- Implement HTTPS tunnel connector with server cert validation
- Add auth token loading from CLI value or file
- Add security gate state machine for tracking auth progression
- Fail closed for missing/invalid TLS config, cert mismatch, auth failures
- Port conflicts fail without fallback
- Reconnect revalidates all security gates
- 67 tests covering all validation assertions
The 'Invalid command fails' and 'Invalid port fails' smoke test steps use
bash if/then/fi syntax that fails on Windows runners (default pwsh shell).
Explicitly setting shell: bash makes these steps portable across the
Windows/Linux/macOS CI matrix.
- Make CI smoke commands Windows-aware by using OS-neutral cargo run invocations
- Replace masked negative smoke checks (|| true) with explicit non-zero assertions
- Remove Cargo.lock from .gitignore and track for binary reproducibility
- Strengthen secret redaction to eliminate stable first/last character leakage
- Remove readme field from Cargo.toml that referenced a missing README.md
