PHPackages                             hypothesisphp/tunnels - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. hypothesisphp/tunnels

ActiveLibrary[Security](/categories/security)

hypothesisphp/tunnels
=====================

PHP socket transport library — AES-256-GCM encryption, ephemeral key exchange with forward secrecy, non-blocking I/O via PHP Fibers, session key rotation, heartbeat keep-alive, replay attack protection, and extensible middleware pipeline.

v1.0.0(1mo ago)10MITPHP >=8.2

Since Jul 17Compare

[ Source](https://github.com/HypothesisPHP/Tunnels)[ Packagist](https://packagist.org/packages/hypothesisphp/tunnels)[ RSS](/packages/hypothesisphp-tunnels/feed)WikiDiscussions Synced 1mo ago

READMEChangelogDependencies (2)Versions (3)Used By (0)

Tunnels
=======

[](#tunnels)

**PHP socket transport library** — secure, non-blocking, and extensible.

Built on native `stream_socket` with PHP 8.2 Fibers, AES-256-GCM encryption, ephemeral key exchange with forward secrecy, replay-attack-resistant handshake, session key rotation, heartbeat keep-alive, and a fluent API designed for long-running CLI processes.

---

Features
--------

[](#features)

- **Non-blocking I/O** via PHP 8.2 Fibers — no event loop dependency required
- **AES-256-GCM** encryption on every frame — authenticated, tamper-proof
- **Ephemeral key exchange** — fresh random contributions per session → forward secrecy
- **Secure handshake** with HMAC-SHA256, timestamp window ±30s, and nonce tracking (replay protection)
- **Persistent nonce store** — `InMemoryNonceStore`, `FileNonceStore`, or custom `NonceStoreInterface`
- **Session key rotation** — time-based, volume-based, or composite policies
- **Heartbeat / keep-alive** — automatic PING/PONG, idle detection, manual `ping()` with RTT measurement
- **Receive-side frame guard** — 16 MB hard limit on incoming frames
- **Middleware pipeline** — `CompressionMiddleware`, `PayloadSizeMiddleware`, `LoggingMiddleware`, `RateLimitMiddleware` (token bucket), `HeartbeatMiddleware`
- **Observer/Event system** — lifecycle events including `KEY_ROTATED`
- **Fluent builder API** — zero boilerplate for common cases
- **TLS transport** — configurable cert/key/CA via `->withTls()`
- **Zero mandatory dependencies** — pure PHP 8.2, no external packages required
- **Extensible by design** — swap encryption, handshake, logger, nonce store, or middleware via interfaces
- **Resilient connections** — automatic reconnect with exponential backoff
- **Connection pool** — multi-peer server management with broadcast support
- **Session statistics** — bytes/messages sent/received, uptime, last ping

---

Requirements
------------

[](#requirements)

- PHP **8.2** or higher
- `openssl` extension (enabled by default in most PHP distributions)
- `zlib` extension (only if using `CompressionMiddleware`)

---

Installation
------------

[](#installation)

```
composer require hypothesisphp/tunnels
```

---

Quick Start
-----------

[](#quick-start)

### Server

[](#server)

```