fix: harden tunnel performance under load

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Cargo.lock

@@ -1293,6 +1293,7 @@ dependencies = [
  "http-body-util",
  "hyper",
  "hyper-util",
+ "libc",
  "rand",
  "rcgen",
  "rustls",

Cargo.toml

@@ -33,6 +33,7 @@ sha2 = "0.10"
 bytes = "1"
 futures = "0.3"
 url = "2"
+libc = "0.2"
 
 [dev-dependencies]
 tempfile = "3"

src/cli.rs

@@ -55,6 +55,34 @@ pub enum Commands {
         /// Skip TLS certificate verification (insecure — for DPI/intercepted environments only)
         #[arg(long, default_value = "false")]
         insecure_skip_tls_verify: bool,
+
+        /// Target process file descriptor limit to request on Unix
+        #[arg(long, default_value_t = 1_048_576)]
+        max_open_files: u64,
+
+        /// Maximum concurrent authenticated HTTPS tunnel sessions
+        #[arg(long, default_value_t = 4096)]
+        max_tunnel_sessions: usize,
+
+        /// Maximum concurrent SOCKS5 client connections
+        #[arg(long, default_value_t = 65_536)]
+        max_socks_connections: usize,
+
+        /// Maximum concurrent streams per tunnel
+        #[arg(long, default_value_t = 65_536)]
+        max_streams_per_tunnel: usize,
+
+        /// TLS/HTTP/SOCKS handshake timeout in milliseconds
+        #[arg(long, default_value_t = 10_000)]
+        handshake_timeout_ms: u64,
+
+        /// DNS/target connect timeout in milliseconds
+        #[arg(long, default_value_t = 10_000)]
+        connect_timeout_ms: u64,
+
+        /// Timeout waiting for tunneled CONNECT replies in milliseconds
+        #[arg(long, default_value_t = 15_000)]
+        stream_open_timeout_ms: u64,
     },
 
     /// Connect to the HTTPS tunnel listener
@@ -102,6 +130,30 @@ pub enum Commands {
         /// Skip TLS certificate verification (insecure — for DPI/intercepted environments only)
         #[arg(long, default_value = "false")]
         insecure_skip_tls_verify: bool,
+
+        /// Target process file descriptor limit to request on Unix
+        #[arg(long, default_value_t = 1_048_576)]
+        max_open_files: u64,
+
+        /// Maximum concurrent SOCKS5 client connections
+        #[arg(long, default_value_t = 65_536)]
+        max_socks_connections: usize,
+
+        /// Maximum concurrent streams per tunnel
+        #[arg(long, default_value_t = 65_536)]
+        max_streams_per_tunnel: usize,
+
+        /// TLS/HTTP/SOCKS handshake timeout in milliseconds
+        #[arg(long, default_value_t = 10_000)]
+        handshake_timeout_ms: u64,
+
+        /// DNS/target connect timeout in milliseconds
+        #[arg(long, default_value_t = 10_000)]
+        connect_timeout_ms: u64,
+
+        /// Timeout waiting for tunneled CONNECT replies in milliseconds
+        #[arg(long, default_value_t = 15_000)]
+        stream_open_timeout_ms: u64,
     },
 
     /// Generate local certificate and auth material

src/framing.rs

@@ -268,7 +268,6 @@ impl FrameWriter {
     ) -> Result<(), FrameError> {
         let bytes = frame.serialize();
         writer.write_all(&bytes).await?;
-        writer.flush().await?;
         Ok(())
     }
 }

src/main.rs

@@ -13,12 +13,15 @@ mod tunnel;
 use std::path::Path;
 use std::process;
 use std::sync::Arc;
+use std::time::Duration;
 
 use clap::Parser;
 
 use crate::cli::Cli;
 use crate::connkey::ConnectionKey;
-use crate::tunnel::{ClientTlsMaterial, ConnectorConfig, ListenerConfig, ServerTlsMaterial};
+use crate::tunnel::{
+    ClientTlsMaterial, ConnectorConfig, ListenerConfig, PerformanceConfig, ServerTlsMaterial,
+};
 
 fn main() {
     // Install the default crypto provider (ring) for rustls
@@ -47,6 +50,13 @@ fn main() {
             auth_token,
             auth_token_file,
             insecure_skip_tls_verify,
+            max_open_files,
+            max_tunnel_sessions,
+            max_socks_connections,
+            max_streams_per_tunnel,
+            handshake_timeout_ms,
+            connect_timeout_ms,
+            stream_open_timeout_ms,
         } => run_listen(
             listen,
             advertise,
@@ -58,6 +68,13 @@ fn main() {
             auth_token,
             auth_token_file,
             insecure_skip_tls_verify,
+            max_open_files,
+            max_tunnel_sessions,
+            max_socks_connections,
+            max_streams_per_tunnel,
+            handshake_timeout_ms,
+            connect_timeout_ms,
+            stream_open_timeout_ms,
         ),
         crate::cli::Commands::Connect {
             connection_key_arg,
@@ -70,6 +87,12 @@ fn main() {
             auth_token,
             auth_token_file,
             insecure_skip_tls_verify,
+            max_open_files,
+            max_socks_connections,
+            max_streams_per_tunnel,
+            handshake_timeout_ms,
+            connect_timeout_ms,
+            stream_open_timeout_ms,
         } => run_connect(
             connection_key_arg,
             target,
@@ -81,6 +104,12 @@ fn main() {
             auth_token,
             auth_token_file,
             insecure_skip_tls_verify,
+            max_open_files,
+            max_socks_connections,
+            max_streams_per_tunnel,
+            handshake_timeout_ms,
+            connect_timeout_ms,
+            stream_open_timeout_ms,
         ),
         crate::cli::Commands::Generate {
             out,
@@ -112,7 +141,24 @@ fn run_listen(
     auth_token: String,
     auth_token_file: Option<String>,
     insecure_skip_tls_verify: bool,
+    max_open_files: u64,
+    max_tunnel_sessions: usize,
+    max_socks_connections: usize,
+    max_streams_per_tunnel: usize,
+    handshake_timeout_ms: u64,
+    connect_timeout_ms: u64,
+    stream_open_timeout_ms: u64,
 ) -> i32 {
+    configure_performance(
+        max_open_files,
+        max_tunnel_sessions,
+        max_socks_connections,
+        max_streams_per_tunnel,
+        handshake_timeout_ms,
+        connect_timeout_ms,
+        stream_open_timeout_ms,
+    );
+
     let (host, port) = match cli::parse_host_port(&listen) {
         Ok(v) => v,
         Err(e) => {
@@ -310,7 +356,23 @@ fn run_connect(
     auth_token: String,
     auth_token_file: Option<String>,
     insecure_skip_tls_verify: bool,
+    max_open_files: u64,
+    max_socks_connections: usize,
+    max_streams_per_tunnel: usize,
+    handshake_timeout_ms: u64,
+    connect_timeout_ms: u64,
+    stream_open_timeout_ms: u64,
 ) -> i32 {
+    configure_performance(
+        max_open_files,
+        1,
+        max_socks_connections,
+        max_streams_per_tunnel,
+        handshake_timeout_ms,
+        connect_timeout_ms,
+        stream_open_timeout_ms,
+    );
+
     let raw_connection_key = connection_key_arg.or(connection_key);
     let decoded_key = if let Some(raw) = raw_connection_key {
         match ConnectionKey::decode(&raw) {
@@ -465,6 +527,26 @@ fn run_connect(
     0
 }
 
+fn configure_performance(
+    max_open_files: u64,
+    max_tunnel_sessions: usize,
+    max_socks_connections: usize,
+    max_streams_per_tunnel: usize,
+    handshake_timeout_ms: u64,
+    connect_timeout_ms: u64,
+    stream_open_timeout_ms: u64,
+) {
+    tunnel::set_performance_config(PerformanceConfig {
+        max_open_files,
+        max_tunnel_sessions,
+        max_socks_connections,
+        max_streams_per_tunnel,
+        handshake_timeout: Duration::from_millis(handshake_timeout_ms),
+        connect_timeout: Duration::from_millis(connect_timeout_ms),
+        stream_open_timeout: Duration::from_millis(stream_open_timeout_ms),
+    });
+}
+
 fn select_connect_target<'a>(
     target: Option<&'a str>,
     decoded_key: Option<&'a ConnectionKey>,