48 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
KKRainbow	5af90471bf	fix(vpn): inherit portal exit nodes for attached clients (#2726)	2026-10-19 00:04:29 +08:00
KKRainbow	a144597d02	fix(core): show complete instance startup errors (#2724) ... Restore the CLI's default instance-manager diagnostics without enabling unrelated module logs. Include failed instance IDs and their saved error chains in the final exit error. Attach the listener URL to required-listener failures and render full error chains in startup logs, so bind failures expose their OS cause. Extend listener regression coverage and document the default CLI targets.	2026-10-18 22:28:41 +08:00
KKRainbow	f1b910da4e	test: make secure datagram grace expiry deterministic (#2723) ... The expiry test sampled time before sync_root_key established its grace period. Scheduling delays over 3 ms could leave the asserted timestamp inside the grace window and fail the test. Use the actual grace deadline to check acceptance just before expiry and rejection at expiry. Use a fresh sequence number for the rejection check so replay detection cannot hide a broken expiry boundary.	2026-10-18 12:36:54 +08:00
KKRainbow	e25c6bdd0c	fix(web): prevent heartbeat replay and unsafe receiver takeover (#2718) ... * fix(web): stop replaying heartbeats after token validation Wake runtime reconciliation once when authentication establishes the session. Repeated successful validation, including a binding refresh, must not replay a heartbeat whose instance list predates a completed Run. Use existing notifications as wakeups and read the latest session heartbeat when reconciling, so delayed validation and config callbacks cannot replace a newer runtime observation with a cached payload. Cover one initial wakeup, 99 successful validations without replay, and a subsequent real heartbeat that still wakes runtime reconciliation. * fix(web): wait for authoritative config during receiver takeover Keep the desired webhook revision on the authenticated session. Gate runtime reconciliation, mutations and applied acknowledgements until the receiver has that exact revision, preserving running Core instances while its local configuration is missing or stale. After committed Full/Patch updates, request current validation authority without letting delayed publication callbacks or validation responses restore an older target. After the connected ACK establishes the route, wake existing validation once when configuration is still unavailable. Cover missing and obsolete state, authoritative empty sets, stale rounds, callback races, live Core handoff and an explicit 1000-connection takeover exercise with an independent mount.	2026-10-17 11:44:48 +08:00
KKRainbow	585628ecf1	test(dhcp): wait for dual-stack address and route convergence (#2719)	2026-10-17 09:17:47 +08:00
KKRainbow	8c2f67e13e	fix(windows): stop running GUI and services during installer updates (#2717) ... * fix(gui): stop Windows processes before installing updates Keep the NSIS installer in the current user context. Detect the target GUI and service before updating, and elevate a temporary helper only when stopping them requires administrator access. Stop services through SCM and wait for their processes to exit before closing the GUI. Retain the helper until installation completes so it can restore a previously running service without another UAC prompt. Restore the service on cancellation when its executable still exists. Prepare before Tauri launches an old uninstaller, and cover passive, silent, and direct uninstall paths. Add Windows service lifecycle tests with isolated executable fixtures. * fix(windows): report stopped before normal service exit Report SERVICE_STOPPED with no accepted controls before exiting after an explicit stop or successful completion. Reporting Running at exit makes SCM treat a normal stop as a failure and schedule a restart. This fixes the service lifecycle independently of installer changes. * fix(gui): prevent old services restarting during Windows updates Temporarily disable service startup before requesting a stop, then restore the original startup mode when the update finishes or exits. Released services can exit without reporting Stopped, causing SCM to queue a recovery restart even after an explicit stop request. Extend the Windows fixture to reproduce that exit behavior with failure recovery enabled and check that startup settings are restored. Record the minor directory-change and GUI-relaunch limitation from review. * docs(windows): record installer short-path matching limitation Record the 8.3 path alias mismatch found while testing the installer helper without administrator privileges. Document how to run the fixture with a full temporary-directory path and retain the issue as a minor follow-up without expanding the installer implementation.	2026-10-17 02:15:57 +08:00
KKRainbow	c7442868ab	fix(ci): exclude nightly tags and isolate shared TUN cases (#2716) ... Restrict OHOS version baselines to v-prefixed version tags so the rolling nightly tag cannot produce an invalid ohpm package version. Keep the manifest version fallback and count commits from the selected version tag. Give each parameterized shared TUN test its own network namespace, while keeping both member instances on the same TUN within that namespace. Reuse TestNetwork to own and clean up the namespaces and remove the process-local serial lock, which does not serialize nextest processes. This prevents fixed test addresses from competing for routes in the root namespace without increasing timeouts.	2026-10-16 22:14:53 +08:00
KKRainbow	3384cc1162	test: synchronize BPF veth initialization before sending (#2712)	2026-10-16 19:12:16 +08:00
KKRainbowandCodex	99db92a3ae	fix(config): preserve and patch empty manual route mode (#2709) ... * fix(config): preserve empty manual route mode in API conversion Treat present TOML routes as manual mode even when the list is empty. Both Core readback and Web normalization must distinguish routes=[] from automatic discovery; otherwise Web can skip a required overwrite and Core can report a different mode from its running configuration. Cover API/TOML round trips and receiver reconcile mode transitions. Verify default-feature tests, clippy, formatting and real system routes in three isolated Linux network namespaces. * fix(config): patch manual route mode and verify legacy readback Add an explicit manual-route mode to route patches and advertise typed readback support through GetConfig. Apply the mode and route edits in the existing route transaction without restarting the instance; keep released callers that omit the new field on their existing route semantics. Web gates route patches on the observed capability. For old clients with ambiguous empty routes, recover the actual mode from GetConfig TOML or instance-scoped ShowNodeInfo before acknowledging application. Supporting clients use typed readback directly. Keep capability evidence in the existing session cache and preserve its invalidation rules. Cover mode transitions, persistence failure, stable peer identity, legacy readback, compact clients, failed observations and cache capability gates. Document the runtime contract and compatibility boundary. * refactor(web): advertise route patch support in heartbeats Declare manual-route patch and typed readback support on the WebClient heartbeat alongside existing client capabilities. Select route updates and legacy readback from the current authenticated Session heartbeat, including when reconciliation reuses an observed configuration. Remove the unreleased GetConfig capability field and per-instance capability wrapper. Keep only observed configuration in the existing cache, and retain strict application confirmation after full Run. Cover the client declaration, legacy default and capability changes against the same cached configuration. Update the runtime contract. --------- Co-authored-by: Codex <codex@users.noreply.github.com>	2026-10-16 00:47:43 +08:00
KKRainbow	da6d721b97	test(credentials): wait for deterministic two-admin election (#2705) ... The non-reusable credential test guessed an owner from three route samples and repeatedly probed reachability with fixed stability sleeps. Partial route synchronization could select a temporary owner, while the extra waits pushed otherwise healthy runs past the 60-second CI limit. Wait for both credential peers to connect, then require both admins to route only to the lower peer ID selected by the owner election. After stopping that peer, wait for both admins to route only to the survivor. Verify reachability and rejection from both admins in each phase without the redundant sampling loops. Keep the existing nextest timeout.	2026-10-15 10:02:45 +08:00
KKRainbow	ec694f7cb8	fix(web): align central network initial-node protocols (#2704)	2026-10-15 01:30:06 +08:00
KKRainbow	8839b4b2f1	fix: avoid shared IPv4 miscompilation on Rust 1.95 (#2703) ... Keep ipv4_inet out of line to prevent LLVM load combining from zeroing the address and prefix when inlined into async add_ip. This works around Windows named-NIC IPv4 setup failures on the current release toolchain. Link the upstream LLVM fix so the workaround can be removed once all build toolchains include it. Fixes #2696	2026-10-15 00:53:24 +08:00
KKRainbow	0ca2fde0fb	ci: align nightly assets with version releases (#2699) ... Publish GUI installers and Android APKs under their original names. Use the built commit version in Core, Web and Magisk ZIP names, and match the version-release archive layout while preserving executables. Generate SHA256SUMS for all downloads and validate the packaged asset manifest before publication. Cover native installers, archive layout, checksums and invalid artifacts in the CI script tests. Document versioned download URLs and remove the stable-URL claim.	2026-10-14 14:11:53 +08:00
KKRainbow	d25ccd4c17	fix(windows): reuse numbered TUN names after complete shutdown (#2694) ... * fix(windows): reuse stable TUN identities after complete shutdown Wait for NIC forwarding and packet-drain tasks to release their handles before stopping or replacing the interface. Stop the old static-IP NIC before entering its recreation path. Store typed NIC state so shutdown can await the owned tasks instead of only cancelling them on drop. Use the instance UUID for the default Windows interface name and derive a stable Wintun GUID from the device name. Keep explicit names and their existing sharing behavior, while generated names remain dedicated. Keep resolved names out of the input flags so recreation preserves that choice. Pin rust-tun to the fix that joins its reader during session drop. Remove the global NetworkList cleanup that deleted profiles based only on their names. Stable identities avoid creating a new profile for each restart without guessing which existing records are safe to delete. Add regression tests for receiver release and Windows instance restarts with another dedicated or shared-NIC member still running. Validation: formatting and workspace Clippy pass; 66 NIC, shared-NIC and TUN runtime tests pass in the privileged rust container. Fixes #2682 Related: #110 * fix(windows): allocate the first unused numbered TUN name Use et_1, et_2 and subsequent vacant slots for default Windows NICs. Reserve each name across threads and processes with a named kernel object, retaining it through firewall cleanup and releasing it on exit. Check the current device tree to skip disabled adapters without treating removed adapters in the IP interface tables as occupied slots. Keep GUIDs derived from names and preserve explicit NIC sharing. Cover concurrent allocation, case-insensitive reservations and slot reuse. * fix(windows): release idle TUN names across cached and service owners Release a shared NIC name after its dispatcher has stopped and its firewall rules have been removed, even when the registry caches the NIC. Clear the old interface name so a later cache drop cannot remove rules belonging to its replacement. Await dispatcher teardown on control failure and timeout as well as on successful shutdown. Grant only SYNCHRONIZE access to name reservations across accounts so SYSTEM services and desktop processes can skip occupied slots. Cover idle registry reuse, firewall ownership and failed-control cleanup with regression tests. * test(tun): use the renamed dispatcher task handle on Unix Update the two Unix-only teardown tests to match the task field used by explicit dispatcher shutdown. * fix(windows): report firewall cleanup failures and verify all rules Inspect all eight interface rules, including the ALL protocol pair. Treat only a missing rule as absent and propagate other lookup errors. Attempt every rule deletion and report failures with rule names instead of silently returning success after a permission or service error. Validate rule protocols, directions, profiles, interface binding and allow settings on Windows. Cover repeated add/remove, unprivileged failures, full cleanup and shared-NIC rule ownership across restarts. Pin tun-easytier to merged v2 commit 5ba6be073e5b486b68c12f80fac5cfb50601f024 and update Cargo.lock. Its tree matches the previously tested PR commit.	2026-10-14 13:43:35 +08:00
KKRainbow	15a3d43039	ci: wait for nightly builds before publishing the release (#2695) ... GITHUB_TOKEN-dispatched builds do not trigger downstream workflow_run jobs. The nightly release check ran before builds finished and then exited successfully without publishing anything. Track dispatch run IDs and wait for all missing components to succeed. Retry failed jobs once, account for delayed rerun state, and fail on terminal errors. Bound the build and wait job to three hours. Pass the built commit to publication so later main commits do not change the release target. Retain component deduplication and manual build completion handlers, and document the nightly lifecycle. Add regression coverage for pending builds, retries, terminal failures, dispatch races, and main advancing before publication. All 34 Node tests and actionlint for the three nightly workflows pass.	2026-10-14 09:57:54 +08:00
KKRainbow	76439ce562	docs: fix Ask DeepWiki badges in both READMEs (#2693)	2026-10-14 02:14:46 +08:00
KKRainbow	36b4ffcc74	ci: publish rolling nightly releases with build deduplication (#2692) ... * ci: publish rolling main nightly builds and retry failed jobs Keep one nightly prerelease with stable artifact filenames. Publish only successful Core, GUI, Mobile and Test runs from the same main commit, and prevent older runs from replacing a newer nightly. Generate dated changes against the latest published version release, including manual prereleases, in newest-first order. Link the fixed nightly download page from both READMEs. Retry failed full-build jobs once on main and develop, excluding cancelled runs and attempts after the first. Validated with 28 Node tests, actionlint, archive packaging checks, and read-only selection of real GitHub builds and release notes.	2026-10-14 01:24:00 +08:00
KKRainbow	03078b4791	feat(dhcp): support automatic IPv6 address assignment (#2688) ... Accept a boolean or an IPv6 CIDR in dhcpv6 and --dhcpv6, using fd6b:8c2d:91e4::/64 when no initial subnet is supplied. Keep IPv4 configuration serialization compatible and DHCPv6 disabled by default. Share the DHCP lifecycle and host update between both address families, with typed allocation state, peer subnet selection, conflict recovery, and bounded IPv6 probing. Preserve static addresses of the other family and prevent static config patches from replacing DHCP-owned leases. Carry IPv6 settings, leases, and events through management, web config, and mobile VPN setup. Reuse the shared NIC registry and mobile address list for IPv6-only and dual-stack operation without extra FD owners. Cover config round trips, allocation and recovery, mobile reconciliation, three-node IPv6 and dual-stack connectivity, and shared TUN member exit. Validate with workspace clippy, Docker TUN tests, frontend tests/builds, WASI and Android Rust checks, and Android VPN Kotlin compilation.	2026-10-14 00:36:47 +08:00
KKRainbow	7c8ca07812	refactor(tun): consolidate shared NIC configuration and tests (#2690) ... * refactor(tun): consolidate shared NIC configuration and tests Separate member claims from OS deltas so mobile admission updates do not compute unused diffs. Reuse effective configurations for desktop address, route, and MTU updates, and share the platform claims paths. Remove redundant runtime dispatch and test-only public accessors while preserving registration cleanup and platform device creation ordering. Move configuration and lifecycle tests into focused modules. Reuse setup and table-driven cases, and verify route replacement order, source hints, stale registrations, and failed cleanup through behavior. Validation: shared NIC unit and Docker integration tests, mobile claim selection, TUN and public IPv6 tests, full-workspace clippy, Android arm64 library check, and formatting of the changed files. * docs(tun): describe shared Ring dispatch lifecycle Document direct member Ring polling, mobile descriptor replacement, and cooperative scheduling in the shared dispatcher. The dispatcher implementation is already provided by the base branch in #2689. * test(core): remove completion race from timeout budget test Use a pending future to exercise stage-specific timeout errors. A delayed CI runner can observe the old 20 ms sleep and 1 ms timeout as ready together. Tokio polls the inner future first, returning Ok instead of the error expected by the test. Keep the timeout assertion without a competing completion timer. Production timeout behavior is unchanged.	2026-10-13 23:53:35 +08:00
KKRainbow	4d4b5ad8dc	refactor(tun): consolidate NIC setup and DHCP host logic (#2691) ... Select dedicated or shared NICs through one constructor, removing redundant construction wrappers and unreachable setup error handling. Share desktop and mobile DHCP cancellation, publication, and permit handling while retaining their platform-specific NIC setup. Build mobile VPN configuration once after member selection or attach, and use CIDR formatting that preserves host prefixes. Cover DHCP publication locking and cancelled address updates, and retain explicit IPv4 /32 and IPv6 /128 projection assertions.	2026-10-13 23:52:24 +08:00
KKRainbow	0da58e68df	refactor(tun): dispatch shared members through Ring endpoints (#2689)	2026-10-13 23:12:50 +08:00
KKRainbow	32dc7f1f40	feat: add shared virtual nic (#2352) ... * Add shared virtual NIC core with per-member routing Share a named TUN across instances while keeping unnamed devices dedicated. Track member addresses, routes, and MTU, and reject overlapping destinations except the common Magic DNS host route. Dispatch packets between the physical TUN and member tunnels. Keep IPv4 and ordinary IPv6 source translation for mobile wrong-source traffic. Update platform configuration and runtime host integration, with unit and network namespace coverage for routing and lifecycle. Use smoltcp for packet parsing and checksum updates. Keep core CI matrix jobs independent. Reserve native inbound flows before source translations allocate their wire tuples. Keep active reservations under table pressure and leave forwarded subnet traffic outside the local flow table. Complete interface claim updates on the shared runtime and retain member registrations until the transaction commits. Keep address, route, and MTU cleanup ordered after cancelled callers, including device initialization. Project mobile VPN addresses, routes, and DNS from admitted native members. Prefer unchanged attached claims and report conflicting members individually. Apply each member's complete initial claims before opening the shared fd, so conflicts leave healthy members usable. Cover inbound IPv4/IPv6 collisions, cancellation during native changes and dispatcher acknowledgments, admission priority, and atomic mobile claim rejection with regression tests. Use scoped TestNetwork fixtures for shared TUN bridge setup and cleanup. Resolve public IPv6 namespace aliases through the lab's actual names so the new tests remain isolated under parallel upstream test runs. * Configure one mobile VPN from running TUN instances Use admitted native members to configure VpnService and attach its single fd to the core shared TUN. Wait for attachment completion and record the actual attached members before refreshing VPN state. Report rejected members in the GUI and preserve the VPN for unchanged healthy members. Reconcile ordinary configuration notifications without invalidating an arbitrary member. Invalidate attachments on instance lifecycle changes, including restarts that reuse an instance ID. Forward public IPv6 changes alongside proxy route changes to refresh the platform VPN configuration. Exclude confirmed IPv4-less members from readiness gating while retaining retries for unavailable status and pending addresses. Quick Settings stops all running TUN members and restores that group on the next start, skipping removed configurations and no_tun networks. Keep the FFI set_tun_fd call scoped to one instance and report attachment errors. Cover mobile configuration, member rejection and replacement, attachment completion, collection notifications, IPv4-less members, and tile stop/start restoration in GUI regression tests. Validate with 36 mobile VPN tests, vue-tsc --noEmit, Android GUI cargo check, workspace clippy, and shared TUN network namespace tests. * fix(tun): preserve shared NIC ownership and failure invariants Keep mobile address and route claims in dispatcher tables without applying desktop interface configuration to synthetic TUN names. Limit the Magic DNS overlap exemption to route claims and remove the shared route retry that bypassed claim accounting after invalidation. Invalidate and stop dispatchers on failed mobile TUN replacement or I/O. Bound TUN writes so stalled devices release pending source updates and member cleanup instead of retaining an unusable shared dispatcher. Treat missing Darwin and Windows addresses and routes as successful deletions while preserving permission and other configuration errors. Add regressions for claim conflicts, mobile configuration, failed TUN replacement, stalled writes, and platform deletion error handling. * fix(tun): forward single-member shared NIC traffic unchanged Deliver TUN packets directly to the sole attached member without destination matching or creating source translations. Keep native flow reservations so a later member cannot collide with existing connections, and continue applying mappings created before other members leave. Reuse flow preparation with the original source address. Preserve the desktop subnet forwarding bypass, including when the flow table is full. IPv4 fragments and IPv6 extension headers remain unchanged on flows that need no translation. Cover unknown sources and destinations, first and later IP fragments, native flows established before another member joins, and retained translations after returning to one member. Document the forwarding behavior and retain rejection coverage for multiple attached members. * fix(tun): preserve wildcard UDP replies on shared member ports Mark flow reservations created by incoming traffic separately from outgoing mappings. When a wildcard UDP socket replies with another member's source address, reuse the incoming reservation after source correction and preserve its service port and inbound destination. Keep exact outgoing mappings and outgoing flow collision handling ahead of this rule. Incoming UDP sessions take priority when packet tuples cannot distinguish a reply from a new client using identical endpoints. Cover IPv4 and IPv6 replies, checksum updates, repeated inbound traffic, existing outgoing mappings, TCP collisions, and single-to-shared member transitions with regression tests. * test(tun): wait for IPv6 activation in mobile configuration test Assert that the configured IPv6 address is registered before forwarding starts, then wait up to five seconds for the kernel to make it usable. Netlink acknowledges address creation before asynchronous IPv6 activation completes, so an immediate bind can fail under CI parallelism. Disable automatic link-local address generation in the test namespace to keep startup IPv6 control traffic out of member-routing assertions. Validation: the original test failed 40 of 320 runs at 32-way parallelism. The updated test passed all 320 runs; workspace fmt and clippy also pass.	2026-10-13 21:00:03 +08:00
KKRainbow	9bc1a0941f	feat(dhcp): accept an IPv4 CIDR for the initial address subnet (#2686) ... * feat(dhcp): accept an IPv4 CIDR for the initial address subnet Accept booleans or an IPv4 CIDR in --dhcp, ET_DHCP, and TOML. Preserve existing boolean behavior and reject invalid subnets and /31 or /32. Carry the bootstrap subnet through management config conversions and runtime snapshots. Keep peer-advertised subnets authoritative and use 10.126.126.0/24 when no custom bootstrap subnet is supplied. Cover CLI overrides, config round trips, validation, address allocation, and subnet precedence. Update English and Chinese CLI help. * refactor(dhcp): select the bootstrap subnet during construction Read the optional DHCP CIDR once when creating the service and pass it to the existing allocator constructor. Restore reconciliation without rewriting the bootstrap subnet on every round. Initialize test configurations before constructing their DHCP services. The PatchConfig API does not expose the DHCP policy; management changes recreate the network instance.	2026-10-13 00:34:26 +08:00
KKRainbow	c01e2baafa	perf(core): cap shards in per-network and per-peer maps (#2685) ... Public relays create many mostly empty maps for each foreign network. DashMap defaults to 128 shards on a 24-CPU host, allocating about 1.26 GiB of shard arrays for 2,421 networks before peer/session state. Cap these maps at eight shards and retain the four-shard default on single-CPU hosts. Cache the shard count once and keep global indexes on their existing default. Apply the same cap to peer connection maps and route synchronization version maps. Replace nested peer/network DashSets with HashSets protected by their existing outer map or an entry mutex. Keep cross-index updates under the manager lock. Use a plain HashMap for the local route graph index. Validation: 245 peer/RPC tests and eight three-node integration tests passed, along with workspace fmt and clippy with full features.	2026-10-13 00:18:49 +08:00
KKRainbow	d31396f04c	fix(hole-punch): connect UDP when STUN mapping differs (#2680) ... * fix(hole-punch): connect UDP without reverse probe gating Start cone UDP handshakes on the same punched socket without waiting for reverse HolePunch packets. Keep outgoing probes while the existing session layer retries SYN, allowing a reachable listener to reply to the actual source when the STUN candidate uses a different mapping. Register source observers on the listener's existing receive loop for the active cone RPC. Send bounded batches to the signaled endpoint and the first matching observed source, deduplicating equal endpoints. Unregister observers on completion, cancellation, or listener shutdown. Cover missing reverse probes, dropped SYN, late observed sources, transaction isolation, and cleanup. Document socket and connectivity ownership of observation and reply policy. * fix(hole-punch): prepare source observation during listener selection Carry an optional transaction ID in SelectPunchListener and echo it only after registering the listener's existing UDP receive loop. Preserve the first source arriving before SendPunchPacketCone, then transfer cleanup ownership to that RPC without clearing the observed address. Keep prepared and active registrations in the same transaction table. Expire abandoned preparations after 30 seconds through listener cleanup; active observers still unregister on completion or cancellation. Preserve legacy requests without a transaction ID and tolerate older responses without a registration acknowledgement. Cover early packets, transaction ID zero, preparation expiry, active RPC cleanup, legacy protobuf interoperability, and SYN retries against peers with and without registration confirmation. Document the lifetime and compatibility contract in the core architecture. Validation: 820 core tests; workspace fmt and full-feature clippy passed.	2026-10-12 23:19:46 +08:00
KKRainbow	4b4f0c3cb3	fix: restore thread network namespaces and stabilize tunnel tests (#2683)	2026-10-12 20:04:01 +08:00
KKRainbow	1649ec0013	ci: parallelize Linux tests and skip HAR packaging on PRs (#2678)	2026-10-12 09:09:52 +08:00
KKRainbow	f8a45ccc20	ci: use lightweight PR checks and conditional nightly builds (#2677) ... * ci: use lightweight PR checks and conditional nightly builds Check three Core platforms, Linux GUI, and Android ARM64 on PRs and ordinary branch pushes. Keep formatting, clippy, WASI, and all Linux tests; reserve the per-feature sweep for full builds. Run complete platform matrices on releases/** pushes and manual dispatch. At 03:17 Asia/Shanghai, check existing main and develop branches and dispatch only workflows whose last successful full build used a different commit, retrying failed components on the next night. Cache compilation outputs by target and build mode. Build only the GUI frontend dependencies and reuse the dashboard artifact for Core builds. Separate full-build concurrency so ordinary pushes cannot cancel them. Keep the required result checks and propagate failures and cancellations. Validate successful full-build origins and matching Core, GUI, and Mobile commits before preparing release assets. Validation: actionlint 1.7.12, 10 Node tests, read-only GitHub nightly dry run, GUI frontend build, Linux GUI check, Android ARM64 check, and Linux musl Core/Web checks including embedded dashboard assets. * docs: describe CI behavior in English and Chinese Document PR checks, nightly dispatch, manual builds, release validation, artifacts, and independent workflows. Keep both versions aligned with current workflow definitions. * ci: decouple PR checks from Web dashboard builds Run PR dashboard builds only when frontend sources, Core configuration sources, protobuf schemas, or build configuration change. Keep embedded Web builds in full mode and let ordinary Rust checks start without frontend artifacts. Upload dashboard artifacts only for full builds. Skip frontend setup for ordinary lint runs and remove GUI/frontend setup from test archives. Update both CI documents to match the new behavior. Validation: actionlint; frontend dependency and workflow routing cases; Linux Core cargo check and workspace clippy with frontend outputs absent.	2026-10-12 00:13:12 +08:00
KKRainbow	7af7bdc16a	build: consolidate dependencies and select rustls ring explicitly (#2648) ... * build(core): consolidate crypto dependencies and trim features Align AES-GCM, ChaCha20Poly1305, HMAC, SHA2 and HKDF with the versions already required by Snow and STUN. Align base64 with pbjson, and explain the coordinated upgrade constraints beside the manifest entries. Adapt AEAD and HMAC calls without changing packet or key formats, and pin the WireGuard client key derivation with an independent HKDF vector. Limit Snow to the Noise algorithms used by the core. Use crossbeam-utils directly, keep the futures executor in tests, and remove UUID fast-rng from the core while retaining existing features in native consumers. Enable browser entropy and certificate time for the rustls backend. Core default normal/build dependencies fall from 255 to 224 packages; duplicated package names fall from 24 to 5 against upstream 4837468d. Validation: Docker tests pass: 970 core, 33 proto (2 ignored), 5 WireGuard, and TCP/UDP three-node encrypted relays. Clippy passes with warnings denied for core, proto, native and web targets. Browser default/ChaCha20, WASI and minimal native compile checks pass. Workspace formatting passes. * fix(tls): select ring explicitly across application entry points Building easytier and easytier-web together enabled both ring and aws-lc through reqwest 0.13. HTTPS endpoint discovery used rustls automatic provider selection and could panic before sending a ClientHello. Use reqwest rustls-no-provider to share ring, and explicitly install the process default before starting CLI, GUI and web services. Initialize it for standalone webhook construction too, retaining any provider already selected by the host. Pass ring directly to HTTPS discovery and WebSocket TLS builders so library use is independent of application initialization order. Keep existing certificate verification, SNI and protocol settings. Add a duplex-stream regression that reproduces the original panic with both backends enabled, and run it in CI. Explain provider selection and feature-unification constraints next to the relevant code. Validation: the new regression fails before the fix and passes after it. Docker tests pass: 10 discovery, 13 webhook, 2 WebSocket, WSS three-node AES-GCM relay, and WSS credential connectivity. Clippy with warnings denied and fmt pass. GUI, browser, WASI, minimal native, endpoint-only and WebSocket-only compile checks pass. Linux and Windows release dependency trees contain only the ring runtime backend. Fixes #2607 * ci: remove the separate rustls backend regression step Keep the HTTPS discovery regression in the existing test archive and runner. Avoid an extra core test build solely to enable both rustls backends; that combination was verified locally before the TLS fix. * build(web): share reqwest 0.13 with the OIDC client Disable the reqwest 0.12 client bundled with openidconnect/oauth2 and use the official oauth2-reqwest adapter around the workspace reqwest 0.13 client. Pin the pre-release adapter version until its API stabilizes. Keep the existing redirect policy and 30-second timeout. Initialize the ring provider when constructing OIDC configuration, including outside the web application entry point. Exercise discovery, JWKS fetching, token success and OAuth error responses against a local mock provider. Verify redirects are not followed. Refresh Cargo.lock to remove reqwest 0.12 without unrelated upgrades. Validation: Docker OIDC tests (2) and webhook tests (13) pass. Clippy with warnings denied for native/core/proto/web all targets and full features passes, as does workspace formatting. The default core/web dependency graph has one reqwest version and 45 multi-version names instead of 46; the TLS runtime still selects ring only.	2026-10-09 10:22:32 +08:00
KKRainbow	728ba94b50	Link easytier-mini downloads and fix UDP admission test ordering (#2638)	2026-10-07 01:03:35 +08:00
KKRainbow	8b7f1f0196	fix(web): accept client handshakes concurrently (#2633) ... Move secure tunnel handshakes out of the listener accept path so an idle connection cannot delay subsequent device sessions. Bound pending handshakes to 4096 per listener and own them in a JoinSet for cancellation. Preserve each in-flight accept future while handling completed handshakes so listeners with transport upgrades do not lose accepted connections. Keep session registration, authentication and protocol timeouts unchanged. Add TCP regressions for idle-client isolation, manager shutdown, bounded admission and preserving an unfinished transport accept. The isolation test fails before the fix and passes afterward. Validation: all 249 easytier-web tests with --include-ignored pass. Raise the test process file descriptor limit to 16384 for the explicit 4097-connection capacity test. The default test run skips this stress test. Cargo fmt --all -- --check and cargo clippy -p easytier-web --all-targets -- -D warnings also pass. Domain context impact: none; this changes handshake scheduling only. Architecture impact: none; ClientManager retains connection ownership.	2026-10-05 16:25:29 +08:00
KKRainbow	d3a5ae684a	fix(peers): keep TCP hole-punched connections alive with 1s pings (#2632) ... Disable ping interval backoff for TCP hole-punched connections so idle connections continue to send keepalive traffic every second. Preserve the existing backoff and loss handling for other connections. Keep randomized backoff above zero and cover the one-second schedule and the existing backoff and loss retry behavior with tests. * refactor(peers): model connection origins at admission Record manual, direct, listener, TCP/UDP hole-punch, and attached origins when constructing peer connections. Derive hole-punch state from this origin instead of maintaining separate mutable flags. Choose the one-second TCP hole-punch ping limit in PeerConn and pass only a maximum interval to the pinger. Keep other origins on the existing backoff schedule without inspecting tunnel type strings. Keep origin selection internal and preserve the dedicated attached admission paths. Update public admission callers and cover origin propagation, relay restrictions, and ping interval limits.	2026-10-05 16:25:08 +08:00
KKRainbow	651a8d9e25	feat(web): add central network management console (#2622) ... Persist central network intent and compile complete per-device configs with secure credentials, ACL policy, and dedicated Gateway runtimes. Expose network, credential, device registry, and runtime observation APIs. Treat central management and external Console as alternative consumers of the upstream ClientManager. Register central devices through a local webhook handler and publish through existing runtime reconciliation. Serialize public mutations with enrollment, reject direct credential changes to managed instances, and retain REST revision invalidation. Keep Gateway lifecycle publication in the central service and remove obsolete incremental result bookkeeping. Restore persisted networks and retire orphan runtimes through the same serialized publisher. Add Core and protocol support for Gateway and WireGuard management, including GUI bindings and serialized GUI config writes. Bootstrap IPv4 for DHCP-only networks and retain assigned addresses without peer IPv4. Cover intent transactions, complete configuration publication, offline recovery, authentication, revocation, Gateway lifecycle, and DHCP. Validate central candidates before persistence using Core URL, config, and portal-client rules. Reject unsupported peer schemes, unconvertible proxy subnets, and invalid portal clients without changing live intent. Expose existing pure Core validators without changing runtime behavior. Gate API-facing credential validation on API-enabled Core builds so minimal WASM targets do not reference omitted management types. Preserve session-backed device views in external Console mode. Bound Gateway admissions without cancelling transport upgrades, and cancel pending peer handshakes before retiring runtimes. Batch registry reads and bound runtime observation concurrency. Randomize DHCP bootstrap and conflict retries, keep an advertised current subnet, and select fallback subnets deterministically. Cover concurrent startup, Gateway admission lifetime, and external Console regressions. Allow DHCP bootstrap with no remote routes. Count network members through one tenant-scoped query without write transactions. Cover zero- peer allocation and tenant/empty-network counts. Preserve direct Web configurations and disabled states in central device snapshots. Remove obsolete central rows atomically with membership changes. Stop online managed instances before deleting or blocking devices, retaining intent when shutdown or deletion fails. Persist automatic IPv4 allocations separately from manual overrides so subnet changes reallocate only automatic members. Normalize mapped proxy routes to their advertised CIDRs when granting temporary credentials. Cover publication, deletion rollback, subnet migration, and grant updates. Read central intent in deferred transactions so polling does not reserve the SQLite writer lock. Test reads with an active writer and assert the temporary-member secret constraint using a valid device fixture. Persist patched WireGuard clients from the saved Web or GUI candidate without a follow-up RPC. Preserve pending settings and ownership, and cover disconnects and failed patches. Resolve named credential and config mutations against the live Core instance before checking central ownership. Forward authorized mutations by UUID on the same session, including while network renames are pending. Cover all mutation methods and preserve direct Console behavior. * feat(web-ui): add central network console and WireGuard management Add network and device views with central membership, credentials, ACL policy, temporary peers, and per-instance runtime details. Update console navigation, styling, theme handling, and API clients. Extend shared configuration and status components for central networks. Add a WireGuard portal dialog for setup and running-device management, with matching translations and network configuration types. Use secure UUID generation on HTTP, discard stale member configuration responses, and stop node-detail polling when the component unmounts. Update frontend workspace dependencies and include component, dashboard, configuration serialization, and central console end-to-end tests. Add isolated real-Core E2E coverage for central data-plane traffic, ACL, DHCP, recovery, device lifecycle, and native WireGuard clients. Record all 59 functional checks with evidence and confirmed validation/UI defects; keep runtime artifacts and test credentials out of Git. Normalize protobuf logger levels and render translated labels correctly. Cover all six levels across setting, reload, and language changes. Add real configuration-rejection E2E checks for database and Core stability and uninterrupted traffic, and record the resolved audit findings. Gate central navigation and registry actions by console mode. Refresh WireGuard settings on mounted status views and preserve explicit portal listener endpoints. Explain the trusted permanent-member ACL boundary. Cover external Console rendering, portal refresh retries and teardown, and explicit IPv4/IPv6 listener exports. Preserve PublicServer discovery when saving its settings, including when its URL matches the Gateway. Cover renaming and endpoint edits in the browser. Display automatic member addresses without converting them to manual overrides during edits. Derive offline address prefixes from the network subnet. Add browser regression coverage and real-Core checks for direct configuration preservation, temporary proxy mappings, automatic subnet migration, and shutdown before device deletion. Build enrollment commands from the configured API hostname, including IPv6 and relative endpoints. Use the PublicServer connector in temporary credential CLI and TOML exports. Add browser regression coverage. Preserve form credentials across repeated normalization and GUI storage reloads. Keep explicit form values authoritative over backend keys and cover JSON persistence, idempotence, replacement, and clearing.	2026-10-05 11:06:47 +08:00
KKRainbow	3da349f4ee	fix(relay): preserve forwarded packets in secure relay paths (#2618) ... Forward remote packets without starting a relay session at the intermediate hop. Encrypting forwarded Noise handshake replies with that hop's session corrupts the end-to-end handshake and causes credential connectivity tests to time out. Disable automatic P2P in the admin/shared/credential test so direct connections cannot mask broken forwarding. Cover unchanged forwarding of handshake requests, replies, and encrypted data packets.	2026-09-29 22:52:10 +08:00
KKRainbow	ff3921ce68	docs: acknowledge Linfeng Cloud in sponsor sections (#2604) ... Add Linfeng Cloud to both README sponsor sections, using the partner link from the project website. Store its logo locally so it renders on GitHub without relying on the partner site.	2026-09-24 12:05:36 +08:00
KKRainbow	ebf0b947b9	fix(ospf): resync missing peer data after metadata expiry (#2599) ... Report missing peer metadata and connection rows in sync responses. Resend those records through the existing per-session pending queues without resetting the incremental cursor or rebuilding sessions. Keep requests across lost responses, distinguish missing connection rows from metadata, and avoid requesting non-relaying credential rows. Deduplicate records selected by both incremental and pending paths. Cover selective expiry, multihop recovery, retries, partial availability, and unchanged-record suppression. All 40 route module tests pass. Fixes #2597	2026-09-22 23:38:34 +08:00
KKRainbow	0f3d8e4434	fix(core): keep peer liveness responsive under receive limits (#2590)	2026-09-19 08:22:12 +08:00
KKRainbow	e313ba8efb	fix(wasi): reduce startup RSS, align ABI v4 and wire v3 (#2588) ... * feat(easytier-go): accept data plane ABI v4 The core raised DATA_PLANE_ABI_VERSION to 4 in f26c2aa1 ("feat(wasi): run EasyTier core on Cloudflare Workers and browsers") to advertise the new guest exports easytier_data_plane_tcp_shutdown_write_submit and easytier_data_plane_tcp_shutdown_write_result_take, which let a host half-close guest TCP streams. The Go host has no caller for half-close: net.Conn exposes only Close, which already tears down both directions, so the v3 behavior is preserved and no new plumbing is added. Without this bump, any artifact rebuilt from current core source is rejected at instance creation with "unsupported EasyTier data plane ABI version 4, want 3". * fix(easytier-go): decode socket options wire v3, rebuild core artifact 38e2a621 ("refactor(ohos): 拆分 OHRS 包并按 socket 精细保护 VPN 流量") raised the host socket options wire format from version 2 to 3: a need_protect byte is appended after the purpose byte in TCP connect, UDP bind, and TCP listen options, shifting bind_device one byte later. The Go hostABI decoders were never updated, so every socket operation from a HEAD-built core was rejected as "invalid options" and required listeners failed to start. Bump the accepted wire version to 3 and skip the need_protect byte in all three decoders. The byte requests VPN socket protection, which only Android-style VPN hosts can honor; on every other platform sockets are already protected, so reading and discarding it is correct. Regenerate the embedded core artifact and protobuf bindings from HEAD (599e4eac) so the shipped artifact matches the Go host again. The proto regeneration also picks up schema fields added since the last embed (e.g. prefer_peer_relay). * perf(easytier-go): release compiler garbage after host init wazero's optimizing compiler allocates ~100MB of throwaway state on the Go heap while compiling the embedded core. Go's runtime does not return that memory to the OS after the initiating GC, so the process retained the compilation peak for its entire lifetime: RSS sat at ~164MB before any instance or network activity. Call debug.FreeOSMemory() once after the module is instantiated. NewHost is a one-time initialization path outside the dataplane, so the stop-the-world pass is safe here. Measured RSS after host.New drops from ~164MB to ~64MB; no behavioral change. * chore(easytier-js): bump toolchain dependencies - vitest 2.1.9 -> 3.2.7 (all three packages) - esbuild 0.25.9 -> 0.28.2 (browser bundler) - wrangler 4.114.0 -> 4.134.0 (cloudflare + web example) - @cloudflare/workers-types 5.20260724.1 -> 5.20260917.1 - binaryen 131.0.0 -> 132.0.0 (JS bindings only; the wasm build uses the standalone wasm-opt binary fetched by the build script) Not bumped: typescript stays at 5.9.3 (latest 5.x; 7.0 is a major jump not worth taking for this workspace), vite stays at 5.4.21 (web-example only; 5->8 spans three majors). Verified with pnpm test (28 + 2 + 2 tests across runtime, browser, cloudflare) and pnpm check (tsc + wrangler deploy --dry-run). pnpm-workspace.yaml gained three minimumReleaseAgeExclude entries recorded automatically by pnpm for freshly published versions. * fix(easytier-js): align host wire format with core wire v3 The core socket options wire format moved to version 3 in 38e2a621 (need_protect byte after purpose). The JS websocket-host still required version 2 and rejected every TCP bind from a HEAD-built core, breaking browser port leases. - websocket-host.ts: accept version 3, minimum length 49. The need_protect byte sits after purpose (offset 43) and is a no-op outside Android VPN hosts, so the decoder just skips it. - websocket-host.test.ts: update the test encoder to emit v3. - binaryen stays at 131.0.0 to match script/build-wasi-core.sh, which intentionally pins binaryen 131 for the Go-side embedded core. The npm binaryen package provides the wasm-opt binary used by build-wasm.mjs, so keeping both sides on the same version avoids divergent optimization output. - pnpm-workspace.yaml: drop two stale minimumReleaseAgeExclude entries for @cloudflare/workers-types versions no longer in the lockfile. * test(easytier-go): cover socket options wire v3 decoders Direct unit tests for decodeTCPConnectOptions, decodeUDPBindOptions, and decodeTCPListenOptions with wire v3 documents. Covers combinations of socket mark, netns, bind device, and local address presence, plus rejection of wire v2. Resolves review feedback on PR #2588.	2026-09-19 00:13:47 +08:00
KKRainbow	7853ec8685	fix(windows): reliable service auto-start on boot and start-on-boot GUI entry (#2579) ... * fix(service): restart windows service indefinitely on failure The windows service was installed with only the AutoStart start type and no SCM failure actions configured. When the service failed during boot (e.g. network not yet ready, config load error), it reported SERVICE_STOPPED with a non-zero exit code and stayed stopped until started manually, which is reported as no auto-start after reboot in issue #1771. Configure failure actions on install and update when restart is not disabled: - three Restart actions (1s/5s/10s delay) with reset period Never; the SCM repeats the last action once the failure count exceeds the actions array, so restarts are retried indefinitely - set fFailureActionsOnNonCrashFailures so exits that report SERVICE_STOPPED with a non-zero exit code (the error path in win_service_event_loop) are also treated as failures; manual stops still exit with 0 and do not trigger a restart Also exit the service process with a non-zero code after reporting the error status. Without it the process stayed alive after reporting SERVICE_STOPPED and was only counted as failed after the SCM force-killed it, adding roughly 30s of dead time to every retry cycle. This matches the systemd path, which already generates Restart=always with StartLimitIntervalSec=0. The --disable-restart-on-failure option now also clears previously configured failure actions on windows. Verified on a real windows host: crash failures and reported-error failures both restart with the configured 1s/5s/10s cadence indefinitely, manual stops are not restarted, and --disable-restart-on-failure clears the actions. * feat(gui): add start-on-boot menu entry pointing to service mode Issue #1771 reports that users cannot find how to make EasyTier start on boot. Auto-start is provided by service mode, but the GUI offered no entry named after it, so the connection was hard to discover. Add a "Start on Boot" item to the settings menu. It opens the mode dialog with service mode preselected and shows an info message explaining that enabling service mode registers EasyTier as a system service that starts automatically at boot and keeps running in the background. When the dialog is opened with service mode preselected, the mode watcher in ModeSwitcher can run before the default config/log dirs have been resolved, leaving the fields empty and failing validation on save. Fill them from the resolved defaults after mount in that case. Add mode.autostart / mode.autostart_hint strings to the cn/en locales in frontend-lib. * fix(cli): stop collecting the --core-args flag into the service args InstallArgs.core_args was declared without an explicit `long`, so clap treated it as a trailing positional argument instead of a named option. Passing `service install --core-args --daemon ...` therefore collected the literal "--core-args" token into the value, and the installed service was registered with an invalid command line that failed on every start (observed on a real windows host: the binPath contained `easytier-core.exe --core-args --daemon ...`). Declare it as a real option (`long` + `num_args = 1..`) while keeping allow_hyphen_values and the trailing semantics: --core-args must be the last option of install and consumes everything after it. The bare-positional spelling (`service install --daemon`), the only correctly-working form before, now fails with a clear "unexpected argument" error; scripts written against it need to add the --core-args prefix. Add unit tests covering the flag, `=` and mixed forms.	2026-09-16 23:02:40 +08:00
KKRainbow	5477d4bca2	fix(proxy): isolate TCP flows and recover KCP control loss (#2569) ... * fix(proxy): distinguish TCP flows sharing source ports Key TCP NAT entries by source and destination so connections sharing a source port can reach different targets independently. Allocate a unique translated source port for each flow and restore the original addresses and ports on the return path. Keep connection identity during accept and cleanup so a replaced flow cannot lose its new mapping. Give each smoltcp proxy mode its own listener port and retain the original destination for mapped subnets. Include regression coverage for SYN retries, concurrent insertion, stale cleanup, translated port wraparound and exhaustion, plus the recorded cross-platform and six-mode traffic validation. * fix(proxy): preserve half-closed streams and pending KCP accepts Propagate EOF to the opposite writer while keeping reverse traffic alive until both directions finish. This allows a server to reply after reading request EOF and a client to send after reading response EOF. Pin kcp-sys to b37ee660 for retained pending accepts, receive-buffer draining before EOF, early FIN handling, atomic state cleanup, and keepalives that start only after the handshake completes. Cover both shutdown directions, empty requests and buffered transfers in gateway tests and the TCP/KCP/QUIC kernel/smoltcp integration matrix. Include the half-close validation record and its remaining loss limits. * fix(proxy): enable backward-compatible KCP control recovery Pin kcp-sys to 26853356 and update both the root and OHOS workspace lockfiles. The dependency negotiates reliable control per connection while preserving legacy behavior when either endpoint lacks support. New peers recover lost handshake and FIN control packets, acknowledge FIN without closing the reverse writer, and retain bounded close state for duplicate packets. Queue saturation cannot block reliable stateless responses. Compatibility tests retain one historical baseline. Include the protocol design and validation records for deterministic loss, real old endpoints, three platforms, the full integration matrix, and proxy traffic. Preserve mixed-version failures and the documented minor scheduling issue rather than claiming legacy loss recovery. Validate the OHOS workspace with --locked: 12 library tests and the binding test build check pass, along with formatting.	2026-09-16 12:50:08 +08:00
KKRainbow	dd013e6a2a	fix(acl): prevent bidirectional ping from bypassing inbound drop rules (#2570) ... * fix(acl): match ICMP replies in outbound allow records Only outbound echo requests with code zero create ICMP response records. Require inbound complete packets and first fragments to be echo replies with code zero before using those records, so reverse echo requests remain subject to inbound ACL rules. Recognize ICMP fragment tails without reading their payload as an ICMP header. Allow them to use existing address and protocol records without creating new records. Walk IPv6 extension headers to locate ICMPv6 and avoid inferring an unknown tail protocol from its payload. Add IPv4 and IPv6 unit coverage for message direction, code, truncation, and fragment parsing. Add a three-node regression for bidirectional requests and ordinary and fragmented replies under inbound default-drop. Fixes #2545 * fix(acl): keep IPv6 parse failures subject to rules Retain source and destination addresses when an IPv6 extension header is truncated, exceeds the payload, or repeats a fragment header. Treat these packets as unspecified protocol instead of entering the global parse-failure allow path. Apply the same handling to truncated transport headers after an extension header. Classify non-ICMPv6 fragment tails as unspecified so their data cannot be parsed as TCP/UDP ports or create temporary response records. Keep ICMPv6 tail authorization through existing response records. Exercise the ACL entry point with malformed headers and short and long fragment tails under default-drop and default-allow policies, including port allow rules that must not match tail payload bytes.	2026-09-15 10:03:15 +08:00
KKRainbow	c96b6c1961	fix(web): harden managed config sync between console and clients (#2567) ... * fix(web): fence managed config runtime reconciliation Keep runtime reconciliation tied to the currently authorized session so stale connections cannot mutate a replacement session runtime. Accumulate only contiguous dirty IDs and load their latest SQLite state. Require the applied revision to match the earliest Patch base and the persisted revision to match the latest target. Otherwise, reconcile the full desired state. Use separate runtime-state and config-cache epochs. Managed updates can reuse observed configs; direct mutations invalidate them. Update sync documentation to match. * fix(web): interrupt validation retry on state changes Track meaningful validation state changes separately from periodic dirty signals. Applied revision changes wake a failed validation immediately, while heartbeat-driven revalidation retains the retry backoff. Treat Notify as a wake-up hint and recheck the state-change epoch after every wake so stored permits and periodic heartbeats cannot cause retry storms. * fix(web): retry unconfirmed connected webhooks Retry node-connected webhook delivery on retryable errors with a short 100ms/500ms backoff and give up immediately on non-retryable errors. Re-check that the session still owns the connection before every attempt and before recording the delivery, so a replaced session can no longer record a stale connected binding. * fix(web): fence disconnects by session ownership Return whether session removal actually removed the current route owner, and emit disconnected only for that owner. Replaced sessions can no longer invalidate a newer connected route. * fix(web): hot-patch managed hostnames Include hostname changes in the hot-patch path instead of falling back to a full restart. When a full overwrite run is required and the desired config has no hostname, inherit the current runtime hostname so an unmanaged value survives until it is explicitly cleared. Read back the runtime config after an overwrite run and verify it converged instead of assuming the desired state was applied. * fix(web): retry transient runtime reconciliation failures Keep the per-session managed runtime reconciliation worker alive when a single database round fails. Retry from the next heartbeat so persisted managed revisions can still converge after restart-time contention. Reserve terminal worker shutdown for destroyed session or storage state, and cover recovery after a transient revision read failure. * fix(web): accept omitted hostname after runtime apply Release 2.6.4 omits hostname from config readback when it matches the device hostname. Trust a successful hostname mutation only when the returned field is absent, while continuing to verify every other field and rejecting explicit mismatches. * fix(web): ignore unmanaged runtime device names Windows release 2.6.4 generates a random interface name when the managed config leaves dev_name empty. Exclude that runtime-owned value from reconciliation unless the desired config explicitly sets a non-empty device name, preventing endless overwrite restarts. * feat(web): report failed network instances to console Expose stopped Core instances with startup errors in heartbeats. Merge Core failures with direct managed-run RPC failures in easytier-web. Send failed instance IDs during token validation without error text. Prune local run failures when managed configs are deleted. * fix(web): distinguish unknown runtime application state Track whether the current session has observed its applied revision separately from the optional revision value. Report this fact through validate-token so Console can preserve application state across receiver restarts while recognizing deliberate pending mutations. * feat(web): configure heartbeat timing from server Heartbeat responses now provide the interval and RPC timeout. Legacy servers use local defaults and remote values are clamped. Web configuration and session receive timeout follow the policy. * fix(web): reject inactive control sessions Route control RPCs by machine id only to sessions whose RPC manager is still running, so a session that has been stopped or replaced can no longer receive control traffic addressed to the device. * fix(core): filter network info before collection When a collect-network-info request names specific instances, collect those instances only instead of collecting every instance and filtering the result afterwards, so unrequested instances no longer run per-collection work on every request. * feat(web): enable focused runtime diagnostics Enable easytier-web info logs by default while preserving explicit log configuration. Record startup settings, session lifecycle, failed instance changes, webhook queue and request latency, and managed runtime operation timings for production diagnosis. * fix(web): preserve managed revision across reconnects Keep one runtime identifier for each Core WebClient lifetime. Reuse its managed runtime state after transport reconnects. Retain applied revisions and reconcile hints while disconnected. Preserve runtime epochs so stale work cannot mark a revision applied. Reject stale sessions from reclaiming routes after reconnect. Core or Web restarts and legacy clients still use unknown state. Immediately revalidate a restored revision after authentication. Document local management RPC drift as an accepted trade-off. This lets Console converge without waiting for periodic validation. * fix(web): satisfy clippy across managed config sync tests Scope managed runtime guards to blocks in runtime revision tests so no std MutexGuard is held across await points, return the applied revision directly instead of through a let binding, and pass WebhookValidationInput to request_heartbeat_validation instead of expanding it into eight separate arguments. * fix(core): stop reporting failed instances as running in heartbeats A stopped instance with a startup error appeared in both running_network_instances and failed_network_instances, so the server treated it as running and never re-ran its managed config. Exclude failed instance ids when building the running list so the reconciler restarts them. * fix(core): close missed-wakeup race in instance state changes wait_for_change created the Notified future before reading the generation but only registered it when awaited. A change landing in between fired notify_waiters with no registered waiter and delayed the heartbeat by a full interval. Enable the future before reading the generation so every change wakes a waiting heartbeat. * fix(web): address review findings Fence webhook validation and connection transitions against stale state, redact credentials from default-level logs, and stabilize runtime reconciliation: - Record connected bindings only while the session still owns the machine route, and skip disconnect compensation once a replacement owns the route so a stale disconnect cannot revoke it. - Discard webhook validation results when the change epoch moved during the HTTP round, so a stale rejection cannot invalidate the current session. - Drop user_token fields from info and warn logs that became visible with info-level defaults. - Restore a hostname omitted by the 2.6.4 readback into the cached runtime config after a successful mutation, so later rounds stop re-sending the same hostname patch. - Reconcile running web configs when no revision is tracked so legacy unrevisioned updates converge, and wake sessions for unrevisioned full updates instead of waiting for the next heartbeat. * chore(go): regenerate web proto bindings for heartbeat fields Add failed_network_instances, support_heartbeat_policy, and the heartbeat policy response fields to the checked-in Go bindings. Other proto packages are left as-is because their drift predates this change. * fix(web): redact user tokens from positional log arguments Three runtime reconciliation info logs and the user lookup error contexts printed user_token through format arguments, which the earlier field-syntax redaction missed. The reconcile log now fires every round for unrevisioned machines, so remove the token from these messages as well. * fix(web): fence stale validation and runtime reconcile rounds Check webhook validation epochs while holding the session write lock, so stale success and rejection responses cannot change session state. Advance the runtime epoch for unrevisioned full config updates, and exclude failed instances from heartbeat and RPC reconciliation lists so stopped instances are restarted instead of repeatedly hot-patched. Release test read guards before awaiting validation apply calls. Set up the no-pending condition before asserting that an applied revision is a no-op, and verify that its runtime epoch remains unchanged. Validation: all 137 client_manager tests passed. * test(credentials): cover P2P with active VPN portal Model an admin and temporary credential peer connected as a foreign network through a public server with data relay disabled. Verify their direct connection can be replaced after a WireGuard portal client comes online. * test(credentials): stabilize two-admins failover assertions The two-admins non-reusable credential test could fail on slow convergence: after dropping the winning peer it relied on a single route sample passing a bare AND condition, then re-asserted the same expectations through one-shot checks seconds later. A transient route flap in that window (for example a briefly resurrected winner route from stale conn info) turned a passing convergence into a hard assert failure. This matches the 48.9s CI flake of credential_non_reusable_across_two_admins_allows_only_one_peer observed on 2026-08-12. Changes: - wait for bidirectional admin connectivity (AND) with a 20s budget before issuing the credential, instead of a one-directional OR - replace the failover wait_for_condition with wait_stable_failover_visibility_on_admins, which requires three consecutive samples of loser-present and winner-absent on both admins within the same 60s budget and logs every sample - enrich the stable-single-winner timeout message with per-admin visibility flags and elapsed time for triage All existing contracts are preserved; only observation windows and diagnostics change. Validated in the rust container: three passes at normal speed (54.1s / 53.8s / 53.1s) plus one slow-convergence round (172.7s) that would have raced the old one-shot sampling; it now passes with failover samples logged. cargo fmt and clippy -D warnings clean.	2026-09-13 01:13:28 +08:00
KKRainbow	e0bdb516b6	fix(quic): bind proxy packet checksum to packet number via ETQ1 version (#2565) ... * fix(quic): bind proxy packet checksum to packet number via ETQ1 version QUIC proxy connections die with quinn PROTOCOL_VIOLATION "unsent packet acked" under bursty traffic with reordering, and the affected peer pair keeps failing for every new connection until the source node restarts. Root cause: the custom crypto checksums the packet bytes but not the packet number, while quinn decodes truncated packet numbers by proximity to the largest received (RFC 9000 Appendix A). A 1-byte encoded packet delayed beyond the +/-128 decode window is decoded as a future packet number, still passes the checksum, gets ACKed, and the peer aborts because it never sent that number. Real QUIC survives this because the AEAD nonce is derived from the packet number, so a misdecode fails authentication. Fix: negotiate a custom QUIC version ETQ1 (0x45545131) for the proxy. Connections on ETQ1 mix the packet number into the SeaHash checksum, so an out-of-window misdecode fails authentication and the packet is handled as ordinary loss. The mode is derived statelessly from the negotiated version in QuicSession and ServerConfig::initial_keys. Compatibility: the proxy endpoint accepts both ETQ1 and version 1. NatDstQuicConnector dials ETQ1 first; on ConnectionError::VersionMismatch from a legacy peer it retries with version 1 and remembers the peer in legacy_version_peers to skip the rejected version afterwards. The quic:// tunnel keeps version 1 only. Verified with 13 docker nodes under netem jitter and bursty iperf load: the previously-poisoned pair survived 16 minutes on ETQ1 with zero violations while all legacy-version pairs kept dying; mixed new-to-old and old-to-new connections work. * fix(quic): extend the ETQ1 checksum fix to the quic:// tunnel The quic:// tunnel shares CryptoKey with the proxy, so after the proxy moved to ETQ1 the tunnel still carried the unsent-packet-acked exposure. Make endpoint_config() dual-version so tunnel listeners accept both ETQ1 and legacy peers, and dial ETQ1 first in upgrade_connected with a transparent fallback to version 1 on VersionMismatch, via a shared connect_with_etq1 helper. The proxy keeps its hedged dialer with the per-peer legacy memory; tunnel connections are established once per session, so the fallback there costs a single extra round trip.	2026-09-11 23:33:46 +08:00
KKRainbow	19e5c49ba3	chore: bump version to 2.7.0 (#2566) ... * chore: bump version to 2.7.0 Update version strings across the workspace: - crate versions and internal dependency requirements for easytier, easytier-core, easytier-proto, easytier-web, easytier-gui, and easytier-mini, plus Cargo.lock - GUI package.json and tauri.conf.json - Magisk module.prop - default release/docker workflow tags (v2.7.0) * fix(ohos): sync easytier-ohrs Cargo.lock with bumped workspace versions The ohos workflow builds easytier-ohrs with --locked, so its lockfile must record the new 2.7.0 versions of the easytier, easytier-core, and easytier-proto path dependencies.	2026-09-10 22:38:24 +08:00
KKRainbow	974c3270e8	feat(magisk): add module WebUI configuration (#2563) ... * feat(magisk): add module WebUI configuration Reuse the existing config generator in KernelSU-compatible module managers. Validate and atomically persist TOML through a module helper before restarting EasyTier, and package the generated assets in CI. Closes #1915 * fix(magisk): preserve existing WebUI configuration Merge form-managed fields into the original TOML so advanced module settings remain intact. Resolve the running core by its exact executable path before restart.	2026-09-10 20:13:21 +08:00
KKRainbow	3d0c9c3ca5	chore(go): use lowercase module import path (#2560) ... * chore(go): use lowercase module import path * ci: scope checks for Go module changes	2026-09-10 15:13:55 +08:00
KKRainbow	86d942ec8c	docs: add security reporting policy (#2561) ... * docs(security): add private reporting policy Document supported versions and route vulnerability reports through GitHub's private advisory workflow. Add English and Chinese responsible-use notices to the READMEs. Closes #2544 * ci: skip unrelated pull request builds Use pull-request-aware path filtering for required Core, GUI, Mobile, and Test workflows so they still publish required check contexts without launching expensive jobs for documentation changes. Limit the optional OHOS pull request workflow to relevant paths.	2026-09-10 12:30:49 +08:00
KKRainbow	993640b1dd	fix(config): normalize [secure_mode] when loading TOML config files (#2562)	2026-09-10 08:56:57 +08:00