bzuccaro
2bf8da739b
CI / cargo fmt (push) Canceled after 0s
CI / cargo clippy (macos-latest) (push) Canceled after 0s
CI / cargo clippy (ubuntu-latest) (push) Canceled after 0s
CI / cargo clippy (windows-latest) (push) Canceled after 0s
CI / cargo test (macos-latest) (push) Canceled after 0s
CI / cargo test (ubuntu-latest) (push) Canceled after 0s
CI / cargo test (windows-latest) (push) Canceled after 0s
CI / cargo build (macos-latest) (push) Canceled after 0s
CI / cargo build (ubuntu-latest) (push) Canceled after 0s
CI / cargo build (windows-latest) (push) Canceled after 0s
CI / cargo build --release (macos-latest) (push) Canceled after 0s
CI / cargo build --release (ubuntu-latest) (push) Canceled after 0s
CI / cargo build --release (windows-latest) (push) Canceled after 0s
CI / CLI smoke (macos-latest) (push) Canceled after 0s
CI / CLI smoke (ubuntu-latest) (push) Canceled after 0s
CI / CLI smoke (windows-latest) (push) Canceled after 0s
CI / Minimal E2E (macos-latest) (push) Canceled after 0s
CI / Minimal E2E (ubuntu-latest) (push) Canceled after 0s
CI / Minimal E2E (windows-latest) (push) Canceled after 0s
Connection keys are now a ~49-char seed (rtun3.) instead of a bundled ~1740-char certificate blob. Both endpoints deterministically derive an identical Ed25519 CA from the seed and mint ephemeral server/client leaves at startup (keyderive.rs); the app-layer auth token is derived from the seed. Target is passed separately on connect (resocks-style). - connkey.rs: rtun3 seed parse/format - keyderive.rs: CA/server/client/token derivation - keygen takes no args; connect requires --target - remove miniz_oxide; TLS layer unchanged - add determinism + key-based e2e + wrong-seed-rejected tests - update wiki, README, design spec, CI smoke
60 lines
2.4 KiB
Markdown
60 lines
2.4 KiB
Markdown
# rustunnel CLI
|
|
|
|
The rustunnel binary exposes five subcommands defined in `src/cli.rs` and dispatched in `src/main.rs`.
|
|
|
|
## Commands
|
|
|
|
### `listen`
|
|
|
|
Start the HTTPS tunnel listener. Binds an HTTPS server that accepts mTLS connections from connectors.
|
|
|
|
Key arguments:
|
|
- `--listen` — bind address (default `0.0.0.0:4180`)
|
|
- `--advertise` — public host added to the derived server cert and used in the printed connect hint
|
|
- `--connection-key` — reusable key generated by `keygen` or a previous `listen` run
|
|
- `--socks` — optional server-side SOCKS5 proxy address for connector-side network access
|
|
- `--cert`, `--key`, `--ca-cert` — TLS material paths (required unless using a connection key)
|
|
- `--auth-token`, `--auth-token-file` — application auth token
|
|
- `--insecure-skip-tls-verify` — skip client certificate verification (lab only)
|
|
|
|
When run without explicit certificate paths and without a connection key, `listen` auto-generates a new connection key and prints it.
|
|
|
|
### `connect`
|
|
|
|
Connect to the listener and expose a local SOCKS5 proxy.
|
|
|
|
Key arguments:
|
|
- `CONNECTION_KEY` — positional connection key (optional)
|
|
- `--target` — listener address (required; not stored in the key)
|
|
- `--connection-key` — connection key via flag or env `RUSTUNNEL_KEY`
|
|
- `--socks` — local SOCKS5 proxy address (default `127.0.0.1:1180`)
|
|
- `--cert`, `--key`, `--ca-cert` — TLS material paths (required unless using a connection key)
|
|
- `--insecure-skip-tls-verify` — skip server certificate verification (lab only)
|
|
|
|
### `generate`
|
|
|
|
Generate local certificate and auth material into an output directory.
|
|
|
|
Creates: `ca.pem`, `ca.key`, `server.crt`, `server.key`, `client.crt`, `client.key`, `token.txt`, `config.json`.
|
|
|
|
### `keygen`
|
|
|
|
Print a fresh ~49-char connection key (prefix `rtun3.`). The key is a random 32-byte
|
|
seed from which both endpoints derive identical TLS material; no certificates are
|
|
shipped. Pass the target address separately on `connect`.
|
|
|
|
### `version`
|
|
|
|
Print version, edition, platform, and architecture.
|
|
|
|
## Entry point
|
|
|
|
`src/main.rs` installs the ring crypto provider, initializes tracing with an env-filter defaulting to `info`, parses the CLI, and dispatches to the appropriate runner function.
|
|
|
|
## Key source files
|
|
|
|
| File | Purpose |
|
|
| ---- | ------- |
|
|
| `src/cli.rs` | clap `Parser` and `Subcommand` definitions |
|
|
| `src/main.rs` | Entry point, command dispatch, host:port parsing helpers |
|