bzuccaro
2bf8da739b
Connection keys are now a ~49-char seed (rtun3.) instead of a bundled ~1740-char certificate blob. Both endpoints deterministically derive an identical Ed25519 CA from the seed and mint ephemeral server/client leaves at startup (keyderive.rs); the app-layer auth token is derived from the seed. Target is passed separately on connect (resocks-style). - connkey.rs: rtun3 seed parse/format - keyderive.rs: CA/server/client/token derivation - keygen takes no args; connect requires --target - remove miniz_oxide; TLS layer unchanged - add determinism + key-based e2e + wrong-seed-rejected tests - update wiki, README, design spec, CI smoke
2.4 KiB
rustunnel CLI
The rustunnel binary exposes five subcommands defined in src/cli.rs and dispatched in src/main.rs.
Commands
listen
Start the HTTPS tunnel listener. Binds an HTTPS server that accepts mTLS connections from connectors.
Key arguments:
--listen— bind address (default0.0.0.0:4180)--advertise— public host added to the derived server cert and used in the printed connect hint--connection-key— reusable key generated bykeygenor a previouslistenrun--socks— optional server-side SOCKS5 proxy address for connector-side network access--cert,--key,--ca-cert— TLS material paths (required unless using a connection key)--auth-token,--auth-token-file— application auth token--insecure-skip-tls-verify— skip client certificate verification (lab only)
When run without explicit certificate paths and without a connection key, listen auto-generates a new connection key and prints it.
connect
Connect to the listener and expose a local SOCKS5 proxy.
Key arguments:
CONNECTION_KEY— positional connection key (optional)--target— listener address (required; not stored in the key)--connection-key— connection key via flag or envRUSTUNNEL_KEY--socks— local SOCKS5 proxy address (default127.0.0.1:1180)--cert,--key,--ca-cert— TLS material paths (required unless using a connection key)--insecure-skip-tls-verify— skip server certificate verification (lab only)
generate
Generate local certificate and auth material into an output directory.
Creates: ca.pem, ca.key, server.crt, server.key, client.crt, client.key, token.txt, config.json.
keygen
Print a fresh ~49-char connection key (prefix rtun3.). The key is a random 32-byte
seed from which both endpoints derive identical TLS material; no certificates are
shipped. Pass the target address separately on connect.
version
Print version, edition, platform, and architecture.
Entry point
src/main.rs installs the ring crypto provider, initializes tracing with an env-filter defaulting to info, parses the CLI, and dispatches to the appropriate runner function.
Key source files
| File | Purpose |
|---|---|
src/cli.rs |
clap Parser and Subcommand definitions |
src/main.rs |
Entry point, command dispatch, host:port parsing helpers |