- Fix race condition in generate test temp_dir() by using PID + atomic counter
instead of nanosecond timestamps that collide under parallel test execution
- Apply cargo fmt to tunnel.rs for consistent formatting
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Fix socks-e2e scrutiny blockers by replacing HTTP-shaped request/response
forwarding with a true persistent authenticated tunnel data path.
Key changes:
- Implement bidirectional framing with stream IDs over the authenticated
tunnel so SOCKS target TCP connections originate from the listener side
- Multiple sequential/concurrent SOCKS streams share one authenticated
session with stream isolation via frame dispatch
- Bytes stream incrementally without whole-response buffering or fixed EOF
timeouts
- CLOSE/ERROR frames propagate deterministically for clean stream teardown
- Remove /forward HTTP endpoint and TunnelSession HTTP-based forwarding
- Remove read_until_double_crlf HTTP-specific parsing from SOCKS path
- Add StreamMux for concurrent stream management on the connector side
- Add tests for slow/interleaved streams, concurrent isolation,
listener-side target origin, close frame propagation, and E2E framing
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
- Introduce TunnelSession that holds a single authenticated SendRequest
shared across all concurrent SOCKS5 streams via Arc<Mutex<>>
- Connector authenticates once on startup, then reuses the persistent
tunnel for all SOCKS5 CONNECT requests
- Listener /forward returns raw bytes (no HTTP parse/unparse overhead)
to preserve exact byte semantics for SOCKS5 TCP proxying
- Add stream counters (session-X) for logging and isolation tracking
- Add 5 new tests: sequential streams, concurrent streams with isolation,
stream counter increments, pre-auth rejection, and E2E concurrent SOCKS5
streams over a shared tunnel
- All 117 tests pass; E2E CLI validates 5 concurrent streams share one
persistent TLS connection (127.0.0.1:64216 in transcript)
Add HTTPS default tunnel endpoint and outbound connector using Rustls
with mTLS and an additional auth/session token.
- Add rustls, tokio-rustls, hyper, and related dependencies
- Implement TLS config builders (server/client) with cert validation
- Implement HTTPS tunnel listener with mTLS accept and auth handshake
- Implement HTTPS tunnel connector with server cert validation
- Add auth token loading from CLI value or file
- Add security gate state machine for tracking auth progression
- Fail closed for missing/invalid TLS config, cert mismatch, auth failures
- Port conflicts fail without fallback
- Reconnect revalidates all security gates
- 67 tests covering all validation assertions
