Fix socks-e2e scrutiny blockers by replacing HTTP-shaped request/response
forwarding with a true persistent authenticated tunnel data path.
Key changes:
- Implement bidirectional framing with stream IDs over the authenticated
tunnel so SOCKS target TCP connections originate from the listener side
- Multiple sequential/concurrent SOCKS streams share one authenticated
session with stream isolation via frame dispatch
- Bytes stream incrementally without whole-response buffering or fixed EOF
timeouts
- CLOSE/ERROR frames propagate deterministically for clean stream teardown
- Remove /forward HTTP endpoint and TunnelSession HTTP-based forwarding
- Remove read_until_double_crlf HTTP-specific parsing from SOCKS path
- Add StreamMux for concurrent stream management on the connector side
- Add tests for slow/interleaved streams, concurrent isolation,
listener-side target origin, close frame propagation, and E2E framing
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
Add HTTPS default tunnel endpoint and outbound connector using Rustls
with mTLS and an additional auth/session token.
- Add rustls, tokio-rustls, hyper, and related dependencies
- Implement TLS config builders (server/client) with cert validation
- Implement HTTPS tunnel listener with mTLS accept and auth handshake
- Implement HTTPS tunnel connector with server cert validation
- Add auth token loading from CLI value or file
- Add security gate state machine for tracking auth progression
- Fail closed for missing/invalid TLS config, cert mismatch, auth failures
- Port conflicts fail without fallback
- Reconnect revalidates all security gates
- 67 tests covering all validation assertions
bzuccaro