Add --allow-socks server flag and --proxy socks5 client support (v0.6.0)

[guyte149]

Summary

Two new flags from the README roadmap, both gated behind explicit opt-in for safety:

• --allow-socks (server) — default-deny gate for reverse-SOCKS5 (R:socks / R:port:socks). Without it the server now refuses reverse-SOCKS at the control-plane handshake instead of silently exposing its network. Mirrors --allow-reverse semantics. Forward socks decomposes into per-target dynamic TCP/UDP on the wire and is intentionally not gated by this flag — see the new "Security & access control" roadmap section in the README for the full ACL story.

• --proxy socks5://[user:pass@]host:port (client) — routes the QUIC connection through a SOCKS5 proxy via UDP ASSOCIATE (RFC 1928 §4). New rusnel::common::proxy module with:

  • ProxyConfig URL parser (socks5://, socks:// alias, bare host:port, optional user:pass@ per RFC 1929).
  • SOCKS5 control-plane handshake (no-auth + user/pass).
  • Socks5UdpSocket adapter implementing quinn::AsyncUdpSocket, wrapping every outbound QUIC datagram in RSV/FRAG/ATYP/DST.ADDR/DST.PORT framing and unwrapping every inbound one. The TCP control connection is held open inside the socket for the lifetime of the relay (RFC 1928 §6).
  • Client-side: bypasses Happy Eyeballs and the cross-attempt endpoint pool when proxied (the proxy owns routing); each reconnect opens a fresh UDP association.

HTTP CONNECT is intentionally not supported in this release — it cannot carry UDP/QUIC. The path that would unlock HTTP/SOCKS-CONNECT proxies is the WebSocket-fallback transport tracked separately in the README roadmap.

Test plan

• 12 new unit tests in src/common/proxy.rs (URL parser corner cases, SOCKS5 UDP wrap/unwrap roundtrips, fragment/ATYP rejection paths).
• New tests/proxy.rs integration test stands up an in-process SOCKS5 UDP relay and asserts a real Rusnel client + server pair completes the QUIC handshake through it and round-trips bytes over a tunneled TCP echo.
• All existing test suites still pass (cargo test --all).
• cargo fmt --all -- --check clean.
• cargo clippy --all -- -D warnings clean.
• Version bumped to 0.6.0; CHANGELOG updated.
• README CLI help blocks updated; --proxy README TODO bullet checked.

Notes for downstream embedders

• ServerConfig gains pub allow_socks: bool (default-deny — set to true if you previously relied on reverse-SOCKS without the flag).
• ClientConfig gains pub proxy: Option<ProxyConfig> (None = direct connect, existing behaviour).
• server_receive_remote_request gains an allow_socks: bool parameter alongside allow_reverse. Wire format unchanged.

Made with Cursor