175 Commits

Include renames

Author	SHA1	Message	Date
KKRainbow	ec694f7cb8	fix(web): align central network initial-node protocols (#2704)	2026-10-15 01:30:06 +08:00
KKRainbow	03078b4791	feat(dhcp): support automatic IPv6 address assignment (#2688) ... Accept a boolean or an IPv6 CIDR in dhcpv6 and --dhcpv6, using fd6b:8c2d:91e4::/64 when no initial subnet is supplied. Keep IPv4 configuration serialization compatible and DHCPv6 disabled by default. Share the DHCP lifecycle and host update between both address families, with typed allocation state, peer subnet selection, conflict recovery, and bounded IPv6 probing. Preserve static addresses of the other family and prevent static config patches from replacing DHCP-owned leases. Carry IPv6 settings, leases, and events through management, web config, and mobile VPN setup. Reuse the shared NIC registry and mobile address list for IPv6-only and dual-stack operation without extra FD owners. Cover config round trips, allocation and recovery, mobile reconciliation, three-node IPv6 and dual-stack connectivity, and shared TUN member exit. Validate with workspace clippy, Docker TUN tests, frontend tests/builds, WASI and Android Rust checks, and Android VPN Kotlin compilation.	2026-10-14 00:36:47 +08:00
fanyangandKKRainbow	1c6992d6cb	fix(web): bind config listeners without route probes (#2660) ... Construct config-server TCP and UDP listeners on IPv4 and IPv6 wildcard addresses. A default route is not needed for listening, so remove the local-IP probes, URL-to-address wrapper, and optional listener pairs. Keep WebSocket on its existing IPv4 address. Propagate all native socket bind errors instead of ignoring IPv6 failures. Try address families independently and stop startup only when no listener could bind, so one unavailable family does not hide a working listener or create an unbound socket. Log every successful listener with its actual bound address, including the allocated port when the configured port is zero. Add regressions for occupied ports and unavailable IPv6 source addresses, failed listener registration, and valid ephemeral ports. Fixes #2611 Co-authored-by: KKRainbow <5665404+KKRainbow@users.noreply.github.com>	2026-10-13 10:04:10 +08:00
KKRainbow	9bc1a0941f	feat(dhcp): accept an IPv4 CIDR for the initial address subnet (#2686) ... * feat(dhcp): accept an IPv4 CIDR for the initial address subnet Accept booleans or an IPv4 CIDR in --dhcp, ET_DHCP, and TOML. Preserve existing boolean behavior and reject invalid subnets and /31 or /32. Carry the bootstrap subnet through management config conversions and runtime snapshots. Keep peer-advertised subnets authoritative and use 10.126.126.0/24 when no custom bootstrap subnet is supplied. Cover CLI overrides, config round trips, validation, address allocation, and subnet precedence. Update English and Chinese CLI help. * refactor(dhcp): select the bootstrap subnet during construction Read the optional DHCP CIDR once when creating the service and pass it to the existing allocator constructor. Restore reconciliation without rewriting the bootstrap subnet on every round. Initialize test configurations before constructing their DHCP services. The PatchConfig API does not expose the DHCP policy; management changes recreate the network instance.	2026-10-13 00:34:26 +08:00
Luna YaoandClaude Code	250c2ad8d6	refactor(config): preserve explicit flags with FlagsPatch and derive CLI arguments from schema (#2585) ... This PR refactors EasyTier's configuration flags system across protobuf definitions, TOML/API persistence, runtime reconciliation, and the CLI. It introduces a synthesized FlagsPatch protobuf message with optionize and pbjson support to track field presence reliably, replaces manual CLI flag boilerplate with dynamic schema-driven clap argument generation, and establishes Flags::resolve(patch) as the single source of truth for runtime defaults. Co-authored-by: Claude Code <noreply@anthropic.com>	2026-10-10 22:11:08 +08:00
刚刚and225284228a-droid	db289e87bb	fix(web): default virtual subnet masks to /24 (#2646) ... Co-authored-by: 225284228a-droid <239500008+225284228a-droid@users.noreply.github.com>	2026-10-09 23:05:14 +08:00
刚刚and225284228a-droid	2583d867c3	fix(web): keep refresh buttons steady during polling (#2647) ... Co-authored-by: 225284228a-droid <239500008+225284228a-droid@users.noreply.github.com>	2026-10-09 23:04:22 +08:00
KKRainbow	7af7bdc16a	build: consolidate dependencies and select rustls ring explicitly (#2648) ... * build(core): consolidate crypto dependencies and trim features Align AES-GCM, ChaCha20Poly1305, HMAC, SHA2 and HKDF with the versions already required by Snow and STUN. Align base64 with pbjson, and explain the coordinated upgrade constraints beside the manifest entries. Adapt AEAD and HMAC calls without changing packet or key formats, and pin the WireGuard client key derivation with an independent HKDF vector. Limit Snow to the Noise algorithms used by the core. Use crossbeam-utils directly, keep the futures executor in tests, and remove UUID fast-rng from the core while retaining existing features in native consumers. Enable browser entropy and certificate time for the rustls backend. Core default normal/build dependencies fall from 255 to 224 packages; duplicated package names fall from 24 to 5 against upstream 4837468d. Validation: Docker tests pass: 970 core, 33 proto (2 ignored), 5 WireGuard, and TCP/UDP three-node encrypted relays. Clippy passes with warnings denied for core, proto, native and web targets. Browser default/ChaCha20, WASI and minimal native compile checks pass. Workspace formatting passes. * fix(tls): select ring explicitly across application entry points Building easytier and easytier-web together enabled both ring and aws-lc through reqwest 0.13. HTTPS endpoint discovery used rustls automatic provider selection and could panic before sending a ClientHello. Use reqwest rustls-no-provider to share ring, and explicitly install the process default before starting CLI, GUI and web services. Initialize it for standalone webhook construction too, retaining any provider already selected by the host. Pass ring directly to HTTPS discovery and WebSocket TLS builders so library use is independent of application initialization order. Keep existing certificate verification, SNI and protocol settings. Add a duplex-stream regression that reproduces the original panic with both backends enabled, and run it in CI. Explain provider selection and feature-unification constraints next to the relevant code. Validation: the new regression fails before the fix and passes after it. Docker tests pass: 10 discovery, 13 webhook, 2 WebSocket, WSS three-node AES-GCM relay, and WSS credential connectivity. Clippy with warnings denied and fmt pass. GUI, browser, WASI, minimal native, endpoint-only and WebSocket-only compile checks pass. Linux and Windows release dependency trees contain only the ring runtime backend. Fixes #2607 * ci: remove the separate rustls backend regression step Keep the HTTPS discovery regression in the existing test archive and runner. Avoid an extra core test build solely to enable both rustls backends; that combination was verified locally before the TLS fix. * build(web): share reqwest 0.13 with the OIDC client Disable the reqwest 0.12 client bundled with openidconnect/oauth2 and use the official oauth2-reqwest adapter around the workspace reqwest 0.13 client. Pin the pre-release adapter version until its API stabilizes. Keep the existing redirect policy and 30-second timeout. Initialize the ring provider when constructing OIDC configuration, including outside the web application entry point. Exercise discovery, JWKS fetching, token success and OAuth error responses against a local mock provider. Verify redirects are not followed. Refresh Cargo.lock to remove reqwest 0.12 without unrelated upgrades. Validation: Docker OIDC tests (2) and webhook tests (13) pass. Clippy with warnings denied for native/core/proto/web all targets and full features passes, as does workspace formatting. The default core/web dependency graph has one reqwest version and 45 multi-version names instead of 46; the TLS runtime still selects ring only.	2026-10-09 10:22:32 +08:00
刚刚	4837468d43	fix(gui/web): 修复丢包率和 NAT 类型显示 (#2643)	2026-10-08 00:51:06 +08:00
KKRainbow	8b7f1f0196	fix(web): accept client handshakes concurrently (#2633) ... Move secure tunnel handshakes out of the listener accept path so an idle connection cannot delay subsequent device sessions. Bound pending handshakes to 4096 per listener and own them in a JoinSet for cancellation. Preserve each in-flight accept future while handling completed handshakes so listeners with transport upgrades do not lose accepted connections. Keep session registration, authentication and protocol timeouts unchanged. Add TCP regressions for idle-client isolation, manager shutdown, bounded admission and preserving an unfinished transport accept. The isolation test fails before the fix and passes afterward. Validation: all 249 easytier-web tests with --include-ignored pass. Raise the test process file descriptor limit to 16384 for the explicit 4097-connection capacity test. The default test run skips this stress test. Cargo fmt --all -- --check and cargo clippy -p easytier-web --all-targets -- -D warnings also pass. Domain context impact: none; this changes handshake scheduling only. Architecture impact: none; ClientManager retains connection ownership.	2026-10-05 16:25:29 +08:00
KKRainbow	d3a5ae684a	fix(peers): keep TCP hole-punched connections alive with 1s pings (#2632) ... Disable ping interval backoff for TCP hole-punched connections so idle connections continue to send keepalive traffic every second. Preserve the existing backoff and loss handling for other connections. Keep randomized backoff above zero and cover the one-second schedule and the existing backoff and loss retry behavior with tests. * refactor(peers): model connection origins at admission Record manual, direct, listener, TCP/UDP hole-punch, and attached origins when constructing peer connections. Derive hole-punch state from this origin instead of maintaining separate mutable flags. Choose the one-second TCP hole-punch ping limit in PeerConn and pass only a maximum interval to the pinger. Keep other origins on the existing backoff schedule without inspecting tunnel type strings. Keep origin selection internal and preserve the dedicated attached admission paths. Update public admission callers and cover origin propagation, relay restrictions, and ping interval limits.	2026-10-05 16:25:08 +08:00
3 people	92eecf1e73	fix(web): retire superseded live client sessions (#2609) ... Co-authored-by: 225284228a-droid <239500008+225284228a-droid@users.noreply.github.com> Co-authored-by: KKRainbow <5665404+KKRainbow@users.noreply.github.com>	2026-10-05 11:19:52 +08:00
KKRainbow	651a8d9e25	feat(web): add central network management console (#2622) ... Persist central network intent and compile complete per-device configs with secure credentials, ACL policy, and dedicated Gateway runtimes. Expose network, credential, device registry, and runtime observation APIs. Treat central management and external Console as alternative consumers of the upstream ClientManager. Register central devices through a local webhook handler and publish through existing runtime reconciliation. Serialize public mutations with enrollment, reject direct credential changes to managed instances, and retain REST revision invalidation. Keep Gateway lifecycle publication in the central service and remove obsolete incremental result bookkeeping. Restore persisted networks and retire orphan runtimes through the same serialized publisher. Add Core and protocol support for Gateway and WireGuard management, including GUI bindings and serialized GUI config writes. Bootstrap IPv4 for DHCP-only networks and retain assigned addresses without peer IPv4. Cover intent transactions, complete configuration publication, offline recovery, authentication, revocation, Gateway lifecycle, and DHCP. Validate central candidates before persistence using Core URL, config, and portal-client rules. Reject unsupported peer schemes, unconvertible proxy subnets, and invalid portal clients without changing live intent. Expose existing pure Core validators without changing runtime behavior. Gate API-facing credential validation on API-enabled Core builds so minimal WASM targets do not reference omitted management types. Preserve session-backed device views in external Console mode. Bound Gateway admissions without cancelling transport upgrades, and cancel pending peer handshakes before retiring runtimes. Batch registry reads and bound runtime observation concurrency. Randomize DHCP bootstrap and conflict retries, keep an advertised current subnet, and select fallback subnets deterministically. Cover concurrent startup, Gateway admission lifetime, and external Console regressions. Allow DHCP bootstrap with no remote routes. Count network members through one tenant-scoped query without write transactions. Cover zero- peer allocation and tenant/empty-network counts. Preserve direct Web configurations and disabled states in central device snapshots. Remove obsolete central rows atomically with membership changes. Stop online managed instances before deleting or blocking devices, retaining intent when shutdown or deletion fails. Persist automatic IPv4 allocations separately from manual overrides so subnet changes reallocate only automatic members. Normalize mapped proxy routes to their advertised CIDRs when granting temporary credentials. Cover publication, deletion rollback, subnet migration, and grant updates. Read central intent in deferred transactions so polling does not reserve the SQLite writer lock. Test reads with an active writer and assert the temporary-member secret constraint using a valid device fixture. Persist patched WireGuard clients from the saved Web or GUI candidate without a follow-up RPC. Preserve pending settings and ownership, and cover disconnects and failed patches. Resolve named credential and config mutations against the live Core instance before checking central ownership. Forward authorized mutations by UUID on the same session, including while network renames are pending. Cover all mutation methods and preserve direct Console behavior. * feat(web-ui): add central network console and WireGuard management Add network and device views with central membership, credentials, ACL policy, temporary peers, and per-instance runtime details. Update console navigation, styling, theme handling, and API clients. Extend shared configuration and status components for central networks. Add a WireGuard portal dialog for setup and running-device management, with matching translations and network configuration types. Use secure UUID generation on HTTP, discard stale member configuration responses, and stop node-detail polling when the component unmounts. Update frontend workspace dependencies and include component, dashboard, configuration serialization, and central console end-to-end tests. Add isolated real-Core E2E coverage for central data-plane traffic, ACL, DHCP, recovery, device lifecycle, and native WireGuard clients. Record all 59 functional checks with evidence and confirmed validation/UI defects; keep runtime artifacts and test credentials out of Git. Normalize protobuf logger levels and render translated labels correctly. Cover all six levels across setting, reload, and language changes. Add real configuration-rejection E2E checks for database and Core stability and uninterrupted traffic, and record the resolved audit findings. Gate central navigation and registry actions by console mode. Refresh WireGuard settings on mounted status views and preserve explicit portal listener endpoints. Explain the trusted permanent-member ACL boundary. Cover external Console rendering, portal refresh retries and teardown, and explicit IPv4/IPv6 listener exports. Preserve PublicServer discovery when saving its settings, including when its URL matches the Gateway. Cover renaming and endpoint edits in the browser. Display automatic member addresses without converting them to manual overrides during edits. Derive offline address prefixes from the network subnet. Add browser regression coverage and real-Core checks for direct configuration preservation, temporary proxy mappings, automatic subnet migration, and shutdown before device deletion. Build enrollment commands from the configured API hostname, including IPv6 and relative endpoints. Use the PublicServer connector in temporary credential CLI and TOML exports. Add browser regression coverage. Preserve form credentials across repeated normalization and GUI storage reloads. Keep explicit form values authoritative over backend keys and cover JSON persistence, idempotence, replacement, and clearing.	2026-10-05 11:06:47 +08:00
Luna Yao	eafd46b91b	chore: add ohrs as workspace member; clean Cargo.toml (#2601)	2026-09-24 12:03:13 +08:00
KKRainbow	7853ec8685	fix(windows): reliable service auto-start on boot and start-on-boot GUI entry (#2579) ... * fix(service): restart windows service indefinitely on failure The windows service was installed with only the AutoStart start type and no SCM failure actions configured. When the service failed during boot (e.g. network not yet ready, config load error), it reported SERVICE_STOPPED with a non-zero exit code and stayed stopped until started manually, which is reported as no auto-start after reboot in issue #1771. Configure failure actions on install and update when restart is not disabled: - three Restart actions (1s/5s/10s delay) with reset period Never; the SCM repeats the last action once the failure count exceeds the actions array, so restarts are retried indefinitely - set fFailureActionsOnNonCrashFailures so exits that report SERVICE_STOPPED with a non-zero exit code (the error path in win_service_event_loop) are also treated as failures; manual stops still exit with 0 and do not trigger a restart Also exit the service process with a non-zero code after reporting the error status. Without it the process stayed alive after reporting SERVICE_STOPPED and was only counted as failed after the SCM force-killed it, adding roughly 30s of dead time to every retry cycle. This matches the systemd path, which already generates Restart=always with StartLimitIntervalSec=0. The --disable-restart-on-failure option now also clears previously configured failure actions on windows. Verified on a real windows host: crash failures and reported-error failures both restart with the configured 1s/5s/10s cadence indefinitely, manual stops are not restarted, and --disable-restart-on-failure clears the actions. * feat(gui): add start-on-boot menu entry pointing to service mode Issue #1771 reports that users cannot find how to make EasyTier start on boot. Auto-start is provided by service mode, but the GUI offered no entry named after it, so the connection was hard to discover. Add a "Start on Boot" item to the settings menu. It opens the mode dialog with service mode preselected and shows an info message explaining that enabling service mode registers EasyTier as a system service that starts automatically at boot and keeps running in the background. When the dialog is opened with service mode preselected, the mode watcher in ModeSwitcher can run before the default config/log dirs have been resolved, leaving the fields empty and failing validation on save. Fill them from the resolved defaults after mount in that case. Add mode.autostart / mode.autostart_hint strings to the cn/en locales in frontend-lib. * fix(cli): stop collecting the --core-args flag into the service args InstallArgs.core_args was declared without an explicit `long`, so clap treated it as a trailing positional argument instead of a named option. Passing `service install --core-args --daemon ...` therefore collected the literal "--core-args" token into the value, and the installed service was registered with an invalid command line that failed on every start (observed on a real windows host: the binPath contained `easytier-core.exe --core-args --daemon ...`). Declare it as a real option (`long` + `num_args = 1..`) while keeping allow_hyphen_values and the trailing semantics: --core-args must be the last option of install and consumes everything after it. The bare-positional spelling (`service install --daemon`), the only correctly-working form before, now fails with a clear "unexpected argument" error; scripts written against it need to add the --core-args prefix. Add unit tests covering the flag, `=` and mixed forms.	2026-09-16 23:02:40 +08:00
Luna Yao	7223677264	cargo: upgrade (#2116) ... update dependencies	2026-09-16 20:50:43 +08:00
KKRainbow	c96b6c1961	fix(web): harden managed config sync between console and clients (#2567) ... * fix(web): fence managed config runtime reconciliation Keep runtime reconciliation tied to the currently authorized session so stale connections cannot mutate a replacement session runtime. Accumulate only contiguous dirty IDs and load their latest SQLite state. Require the applied revision to match the earliest Patch base and the persisted revision to match the latest target. Otherwise, reconcile the full desired state. Use separate runtime-state and config-cache epochs. Managed updates can reuse observed configs; direct mutations invalidate them. Update sync documentation to match. * fix(web): interrupt validation retry on state changes Track meaningful validation state changes separately from periodic dirty signals. Applied revision changes wake a failed validation immediately, while heartbeat-driven revalidation retains the retry backoff. Treat Notify as a wake-up hint and recheck the state-change epoch after every wake so stored permits and periodic heartbeats cannot cause retry storms. * fix(web): retry unconfirmed connected webhooks Retry node-connected webhook delivery on retryable errors with a short 100ms/500ms backoff and give up immediately on non-retryable errors. Re-check that the session still owns the connection before every attempt and before recording the delivery, so a replaced session can no longer record a stale connected binding. * fix(web): fence disconnects by session ownership Return whether session removal actually removed the current route owner, and emit disconnected only for that owner. Replaced sessions can no longer invalidate a newer connected route. * fix(web): hot-patch managed hostnames Include hostname changes in the hot-patch path instead of falling back to a full restart. When a full overwrite run is required and the desired config has no hostname, inherit the current runtime hostname so an unmanaged value survives until it is explicitly cleared. Read back the runtime config after an overwrite run and verify it converged instead of assuming the desired state was applied. * fix(web): retry transient runtime reconciliation failures Keep the per-session managed runtime reconciliation worker alive when a single database round fails. Retry from the next heartbeat so persisted managed revisions can still converge after restart-time contention. Reserve terminal worker shutdown for destroyed session or storage state, and cover recovery after a transient revision read failure. * fix(web): accept omitted hostname after runtime apply Release 2.6.4 omits hostname from config readback when it matches the device hostname. Trust a successful hostname mutation only when the returned field is absent, while continuing to verify every other field and rejecting explicit mismatches. * fix(web): ignore unmanaged runtime device names Windows release 2.6.4 generates a random interface name when the managed config leaves dev_name empty. Exclude that runtime-owned value from reconciliation unless the desired config explicitly sets a non-empty device name, preventing endless overwrite restarts. * feat(web): report failed network instances to console Expose stopped Core instances with startup errors in heartbeats. Merge Core failures with direct managed-run RPC failures in easytier-web. Send failed instance IDs during token validation without error text. Prune local run failures when managed configs are deleted. * fix(web): distinguish unknown runtime application state Track whether the current session has observed its applied revision separately from the optional revision value. Report this fact through validate-token so Console can preserve application state across receiver restarts while recognizing deliberate pending mutations. * feat(web): configure heartbeat timing from server Heartbeat responses now provide the interval and RPC timeout. Legacy servers use local defaults and remote values are clamped. Web configuration and session receive timeout follow the policy. * fix(web): reject inactive control sessions Route control RPCs by machine id only to sessions whose RPC manager is still running, so a session that has been stopped or replaced can no longer receive control traffic addressed to the device. * fix(core): filter network info before collection When a collect-network-info request names specific instances, collect those instances only instead of collecting every instance and filtering the result afterwards, so unrequested instances no longer run per-collection work on every request. * feat(web): enable focused runtime diagnostics Enable easytier-web info logs by default while preserving explicit log configuration. Record startup settings, session lifecycle, failed instance changes, webhook queue and request latency, and managed runtime operation timings for production diagnosis. * fix(web): preserve managed revision across reconnects Keep one runtime identifier for each Core WebClient lifetime. Reuse its managed runtime state after transport reconnects. Retain applied revisions and reconcile hints while disconnected. Preserve runtime epochs so stale work cannot mark a revision applied. Reject stale sessions from reclaiming routes after reconnect. Core or Web restarts and legacy clients still use unknown state. Immediately revalidate a restored revision after authentication. Document local management RPC drift as an accepted trade-off. This lets Console converge without waiting for periodic validation. * fix(web): satisfy clippy across managed config sync tests Scope managed runtime guards to blocks in runtime revision tests so no std MutexGuard is held across await points, return the applied revision directly instead of through a let binding, and pass WebhookValidationInput to request_heartbeat_validation instead of expanding it into eight separate arguments. * fix(core): stop reporting failed instances as running in heartbeats A stopped instance with a startup error appeared in both running_network_instances and failed_network_instances, so the server treated it as running and never re-ran its managed config. Exclude failed instance ids when building the running list so the reconciler restarts them. * fix(core): close missed-wakeup race in instance state changes wait_for_change created the Notified future before reading the generation but only registered it when awaited. A change landing in between fired notify_waiters with no registered waiter and delayed the heartbeat by a full interval. Enable the future before reading the generation so every change wakes a waiting heartbeat. * fix(web): address review findings Fence webhook validation and connection transitions against stale state, redact credentials from default-level logs, and stabilize runtime reconciliation: - Record connected bindings only while the session still owns the machine route, and skip disconnect compensation once a replacement owns the route so a stale disconnect cannot revoke it. - Discard webhook validation results when the change epoch moved during the HTTP round, so a stale rejection cannot invalidate the current session. - Drop user_token fields from info and warn logs that became visible with info-level defaults. - Restore a hostname omitted by the 2.6.4 readback into the cached runtime config after a successful mutation, so later rounds stop re-sending the same hostname patch. - Reconcile running web configs when no revision is tracked so legacy unrevisioned updates converge, and wake sessions for unrevisioned full updates instead of waiting for the next heartbeat. * chore(go): regenerate web proto bindings for heartbeat fields Add failed_network_instances, support_heartbeat_policy, and the heartbeat policy response fields to the checked-in Go bindings. Other proto packages are left as-is because their drift predates this change. * fix(web): redact user tokens from positional log arguments Three runtime reconciliation info logs and the user lookup error contexts printed user_token through format arguments, which the earlier field-syntax redaction missed. The reconcile log now fires every round for unrevisioned machines, so remove the token from these messages as well. * fix(web): fence stale validation and runtime reconcile rounds Check webhook validation epochs while holding the session write lock, so stale success and rejection responses cannot change session state. Advance the runtime epoch for unrevisioned full config updates, and exclude failed instances from heartbeat and RPC reconciliation lists so stopped instances are restarted instead of repeatedly hot-patched. Release test read guards before awaiting validation apply calls. Set up the no-pending condition before asserting that an applied revision is a no-op, and verify that its runtime epoch remains unchanged. Validation: all 137 client_manager tests passed. * test(credentials): cover P2P with active VPN portal Model an admin and temporary credential peer connected as a foreign network through a public server with data relay disabled. Verify their direct connection can be replaced after a WireGuard portal client comes online. * test(credentials): stabilize two-admins failover assertions The two-admins non-reusable credential test could fail on slow convergence: after dropping the winning peer it relied on a single route sample passing a bare AND condition, then re-asserted the same expectations through one-shot checks seconds later. A transient route flap in that window (for example a briefly resurrected winner route from stale conn info) turned a passing convergence into a hard assert failure. This matches the 48.9s CI flake of credential_non_reusable_across_two_admins_allows_only_one_peer observed on 2026-08-12. Changes: - wait for bidirectional admin connectivity (AND) with a 20s budget before issuing the credential, instead of a one-directional OR - replace the failover wait_for_condition with wait_stable_failover_visibility_on_admins, which requires three consecutive samples of loser-present and winner-absent on both admins within the same 60s budget and logs every sample - enrich the stable-single-winner timeout message with per-admin visibility flags and elapsed time for triage All existing contracts are preserved; only observation windows and diagnostics change. Validated in the rust container: three passes at normal speed (54.1s / 53.8s / 53.1s) plus one slow-convergence round (172.7s) that would have raced the old one-shot sampling; it now passes with failover samples logged. cargo fmt and clippy -D warnings clean.	2026-09-13 01:13:28 +08:00
KKRainbow	19e5c49ba3	chore: bump version to 2.7.0 (#2566) ... * chore: bump version to 2.7.0 Update version strings across the workspace: - crate versions and internal dependency requirements for easytier, easytier-core, easytier-proto, easytier-web, easytier-gui, and easytier-mini, plus Cargo.lock - GUI package.json and tauri.conf.json - Magisk module.prop - default release/docker workflow tags (v2.7.0) * fix(ohos): sync easytier-ohrs Cargo.lock with bumped workspace versions The ohos workflow builds easytier-ohrs with --locked, so its lockfile must record the new 2.7.0 versions of the easytier, easytier-core, and easytier-proto path dependencies.	2026-09-10 22:38:24 +08:00
KKRainbow	974c3270e8	feat(magisk): add module WebUI configuration (#2563) ... * feat(magisk): add module WebUI configuration Reuse the existing config generator in KernelSU-compatible module managers. Validate and atomically persist TOML through a module helper before restarting EasyTier, and package the generated assets in CI. Closes #1915 * fix(magisk): preserve existing WebUI configuration Merge form-managed fields into the original TOML so advanced module settings remain intact. Resolve the running core by its exact executable path before restart.	2026-09-10 20:13:21 +08:00
Mg Pig	0fba5769a3	feat(web): add URL path support for listener addresses (#1967)	2026-09-09 22:55:44 +08:00
Zhengqi Zhang	f19bcfb400	feat(android): add VPN quick settings tile (#2511) ... add an Android Quick Settings tile for starting and stopping EasyTier VPN networks persist tile actions until the Tauri frontend is ready, so cold-start clicks are not lost add the standard Quick Settings preferences activity alias so long-pressing the tile opens EasyTier keep network and VPN lifecycle ownership in the existing frontend reconciliation flow	2026-09-05 18:08:20 +08:00
KKRainbow	25f6e2dc5e	feat: stabilize mobile runtime and VPN portal (#2536)	2026-08-29 13:40:56 +08:00
KKRainbow	4a10d1c2b9	feat(mobile): add embedded runtime and managed network updates (#2532) ... * feat(mobile): add embedded iOS runtime API Add a thin panic-safe C ABI crate for embedding no-TUN instances on iOS. Expose lifecycle, status, JSON-RPC, string ownership, and error handling. Build device and simulator XCFramework static libraries on macOS. Add exact named-instance deletion to the iOS and Android wrappers. Cover wrapper lifecycle and the port-forward patch flow on host targets. * fix(gateway): recover TCP port-forward listeners Release an unusable TCP port-forward listener after an accept failure. Retry binding until the forward is cancelled. Keep the old listener released while rebinding so mobile sockets can recover. Expose opt-in iOS diagnostics for listener and connection events. Trace configuration removal and adapter shutdown. Add tests for recovery, release-before-rebind, and cancellation. * feat(web): persist incremental managed config patches Add a revision-CAS PATCH contract for managed configs while keeping the existing Full PUT path for compatibility and recovery. Apply Full and Patch mutations with their revision in one SQLite transaction. Reject ownership conflicts and invalidate revisions on alternate web-owned writes. Document limits, failure semantics, rollout order, and verification. Cover delta updates, conflicts, idempotency, and transaction rollback. * feat(web): apply managed config patches to live sessions Carry Patch fences and touched instance IDs into live sessions. Reconcile only those instances when the applied revision matches the Patch base. Fall back to Full reconciliation for gaps and restarts. Invalidate the applied revision around every direct runtime mutation. Fence revision advancement with the runtime cache epoch so stale reconcile rounds cannot overwrite a newer invalidation. Require deletion responses to confirm each requested instance before advancing the revision. Raise the managed PUT and PATCH body limit to 32 MiB and return typed conflicts for publisher recovery. * fix(core): retry transient accepted TCP errors Keep TCP tunnel listeners alive when an accepted socket fails during upgrade with a retryable connection-state error. Share the retryable I/O classifier with the socket listener. Cover a rejected connection followed by success and propagation of permanent errors. * feat(core): add internal Peer Relay edge projection Derive the local advertised OSPF row from physical adjacency and transport-authenticated credential relay coverage. Keep full local adjacency only in the temporary SPF snapshot so direct destinations retain a fallback route. Leave Peer Relay disabled at the public configuration seam. A follow-up change can expose the preference without coupling route projection to credential reauthorization. feat(config): expose Peer Relay routing preference Add prefer_peer_relay to public protobuf, TOML, management patch, and hosted runtime surfaces. Read the preference from live peer context so runtime config updates take effect. Refresh authenticated peer metadata when the option is enabled. Cover dynamic enable and disable in a five-node, dual-admin credential topology, including forwarded relay coverage and local fallback.	2026-08-28 00:43:26 +08:00
KKRainbow	81487c363a	fix(web): fence routes to the current session (#2522) ... * fix(web): publish routable sessions before connect events * fix(web): fence routes to the current session	2026-08-24 09:49:27 +08:00
KKRainbow	3fe427bc99	feat(credentials): manage declarative credentials through TOML (#2515) ... * feat(credentials): manage declarative credentials through TOML Make managed credentials part of the canonical TOML configuration and load them before peers can authenticate. Reuse ConfigRpc hot patches to durably replace the configured credential set without restarting the instance. Serialize credential mutations so base, managed, and ephemeral keys cannot race into conflicts. Remove the managed overlay file format, digest protocol, capability negotiation, force reconciliation, and database CAS machinery. Redact credential secrets from debug output and management events. Write credential-bearing files atomically with private permissions. * fix(core): release JoinSet reapers with their owners Pass weak task-set references into background reapers so they cannot retain the JoinSet they are meant to collect. This lets stale smoltcp bridge tasks terminate when an IPv4 generation is replaced. Add ownership and TCP generation-replacement regressions covering the production port-forward failure.	2026-08-22 16:30:51 +08:00
KKRainbow	8794e12a26	feat(vpn): hot add/remove WireGuard portal clients without restart (#2514) ... * feat(vpn): hot add/remove WireGuard portal clients without restart WireGuard portal clients were frozen at instance construction: the engine slot maps, host key table, and PortalModule state were all immutable after startup, so any client change required recreating the whole instance and dropping every established session. Wire dynamic client management through the existing config-patch channel (ConfigRpc.patch_config -> apply_config_patch), following the same pattern as connectors, port forwards, and proxy networks: - proto: InstanceConfigPatch gains repeated VpnPortalClientPatch (Add/Remove/Clear by client name) - engine: slot maps move under an RwLock with a free-index allocator; add_client/remove_client recycle indices, mark removed slots retired, and expire active sessions so Core tears down the attached peer via the regular channel-close path (credential revocation and disconnect events included); untouched clients keep their sessions intact. The retired flag is re-checked under the session lock so a datagram that races with removal cannot resurrect a session - host: WireGuardPortalHost derives keys deterministically per name (HKDF), keeps a mutable client table for render_client_config, and forwards updates to the live engine; changed clients are re-added so they re-handshake into a fresh generation with the new virtual IP or groups - PortalModule: client set, statuses, and session locks become shared mutable state; run_session resolves clients from the shared map at accept time; update_clients() validates against a caller-supplied runtime snapshot. An empty client set is legal in every lifecycle stage, so clearing all clients never produces a configuration that fails instance recreation - config_patch: apply_vpn_portal_client_patches mutates the candidate TOML; the sub-patch runs last and is deep-validated and hot-applied before the candidate commits, so a rejected client set leaves neither the shared model nor the live portal changed, and validation sees the fully patched state including routes and node IPv4 from the same request. Rejects patches when no portal is configured or a removed client does not exist - cli: vpn-portal add-client/remove-client/clear-clients subcommands Tests: engine index recycling, module update validation/state/host notification, TOML patch application, and a three-node integration test that adds a second WireGuard client live, removes the first while the second stays online, and asserts rejected patches leave the shared model unchanged. * feat(web): reconcile WireGuard portal client edits as hot patches The web console reconciles desired network config against the running instance and patches it in place when possible. VPN portal changes were not part of that: any client edit made the base configs differ, so every save recreated the instance and dropped all established sessions. Exclude vpn_portal_config from the base comparison and diff its clients by name instead. Client add/remove/change now produces VpnPortalClientPatch entries (removals first, changed clients as remove+add) applied through the existing PatchConfig channel. Listener identity changes (address or private key) and enabling or disabling the portal still fall back to a full instance recreate, since those change the listener lifecycle. * feat(web/gui): map portal client patches to frontend RPC backends Extend the RemoteClient seam with add/remove/clear VPN portal client operations so frontend hosts can drive the same PatchConfig channel as the CLI. There is deliberately no dedicated editing UI: the config form stays the single editing surface (aligned with port forwards), and these methods exist for programmatic and future use. - web console: JSON proxy-rpc to ConfigRpcService.patch_config with VpnPortalClientPatch entries (pbjson string enum actions) - desktop GUI: patch_vpn_portal_clients tauri command forwarding the same patch through the typed ConfigRpc client	2026-08-22 01:18:42 +08:00
KKRainbow	62e4fd15e9	feat(vpn): multi-client WireGuard portal with attached peers (#2502) ... * feat(peer): support protocol-agnostic attached peers Add locally attached peers backed by independent, peer-level portable managers and authenticated in-process ring connections. Carry trusted connection provenance through packet admission so attached relay privileges cannot be forged through packet headers. Let every peer manager own ACL loading, sanitized policy updates, route refresh, and runtime cleanup. In Secure Mode, grant attached identities ephemeral credentials instead of sharing administrator and group secrets. * feat(vpn): add reusable attached-peer portal runtime Add a protocol-neutral portal runtime that converts authenticated client sessions into attached EasyTier peers. Own per-client generations, status, packet forwarding, address translation, and peer cleanup without knowing the transport protocol. Add transactional IPv4 source and destination rewriting with correct IPv4, TCP, UDP, ICMP, and quoted-packet checksum updates. Keep the old production portal path temporarily active until the WireGuard adapter is migrated in the next change. * feat(wireguard): attach named clients through peer portal Replace the monolithic WireGuard portal with a native adapter that owns key derivation, UDP demultiplexing, reauthentication, roaming, and bounded per-client packet queues. Hand authenticated sessions to the generic portal runtime for peer lifecycle and IPv4 translation. Move portal configuration into the core instance model, require a dedicated server key, and preserve existing listener, CLI, and runtime configuration behavior. Reject runtime address conflicts before publishing shared configuration. * feat(vpn): expose per-client portal status Project configured clients and their runtime state through the portal RPC, including generated client configuration, listener, peer identity, endpoint, tunnel address, ACL groups, and errors. Keep private client configuration out of the broad instance-info response and expose the explicit RPC through the CLI and Tauri bridge. * feat(vpn): add portal configuration to web clients Expose WireGuard portal listener, key, client, ACL group, and runtime status fields in the shared frontend library, Web dashboard, and Tauri client. Preserve UUID and uint64 values across protobuf JSON boundaries, keep dynamic client editor rows stable, and document the portal workflow. * test(vpn): cover multi-client and roaming WireGuard portals Add two three-node integration tests for the WireGuard VPN portal. The multi-client test connects two kernel WireGuard clients from separate network namespaces, verifies per-client connectivity to mesh nodes, and exercises cross-client traffic that runs the IPv4 source and destination translation in both directions. A TCP echo exchange through the portal additionally covers the TCP pseudo-header checksum rewrite path that ICMP-only ping tests miss, and portal status snapshots must report both clients online with distinct peer ids and correctly learned tunnel addresses. The roaming test swaps the client namespace address (delete the old address, then add the new one) so the kernel WireGuard source cache is invalidated and the client keeps sending under the same session from the new source, exactly like a real network change. The portal must update the client endpoint on the same peer id via the data path (same generation, no re-handshake, no detach/reconnect) while connectivity to mesh nodes is preserved. Supporting changes: run_wireguard_client now takes an interface name, and the shared namespace topology gains net_f (10.1.2.5) on the portal bridge for the second client.	2026-08-21 10:59:05 +08:00
KKRainbow	d375d7e455	feat(mini): add compact native EasyTier client (#2479) ... Add a native EasyTier proof-of-concept binary with TCP and UDP transports, TUN, UDP hole punching, AES-GCM, and a read-only RPC portal. Introduce a release-derived mini profile and musl linker policy so x86_64, big-endian MIPS, and little-endian MIPS stay below the strict 5,000,000-byte target without UPX.	2026-08-09 19:43:30 +08:00
KKRainbow	e31bde1836	feat(web): add standalone WASM config generator (#2480) ... Add a small Vite workspace that builds and publishes independently of the dashboard. Reuse frontend-lib for the form and expose the existing NetworkConfig conversions through wasm-bindgen. Initialize the Aura theme in the standalone entry, detect the browser language, and provide a persistent selector in the form header. Present Generate Config and Copy Config as the page actions. Keep the shared network secret field fluid so both form columns align. Bundle the generator under dist/config-generator in the dashboard artifact while preserving its standalone build output. Build the optimized WASM module with the project and remove the API-backed generator route from the dashboard.	2026-08-07 16:25:33 +08:00
KKRainbow	021f523431	refactor(core): separate portable core from native runtime (#2451) ... Create easytier-core as the portable owner of configuration, connectivity, tunnels, peer and routing state, gateways, management, the data plane, and instance lifecycle. Keep operating-system integration, native protocol engines, process startup, and presentation in easytier behind explicit Host capability adapters. Create easytier-proto to own schemas, generated RPC types, descriptors, and feature-scoped protocol slices. Remove runtime protobuf reflection from core while preserving unknown route-peer fields across forwarding. Normalize instance construction through CoreInstance, CoreHostAdapters, CoreProcessRuntime, and InstanceManager. Make the runtime config store the only authoritative mutable configuration after startup. Move the portable TCP/UDP data plane into core and extract a generic OperationBroker for completion, cancellation, disposal, and capacity accounting. Expose the session-based FFI v2 completion API and keep the WASI guest ABI, wire schemas, and adapters with core. Migrate CLI, GUI, web, FFI, Android JNI, OHOS, uptime, and mobile consumers to the shared manager and core state. Add explicit user/web config ownership and revision-aware web reconciliation. Preserve configuration, wire, and management behavior while fixing regressions discovered by the full platform and integration matrix: - inherit advertised relay capabilities in foreign networks; - refresh OSPF peer state immediately after runtime config changes; - restore CLI GlobalCtx event output without forcing GUI logging; - retain legacy encryption names and standalone RPC tunnel metadata; - restore ICMP host composition and fragmented UDP handling; - use portable 64-bit atomics on 32-bit MIPS targets; and - retain discarded operations until late cancellation completes. Validate the refactor across 45 GitHub checks, including Linux, macOS, Windows, FreeBSD, web, GUI, Android, OHOS, feature profiles, and three-node and subnet-proxy integration tests. BREAKING CHANGE: internal Rust module paths are not preserved. Legacy native data-plane APIs are replaced by the session-based FFI v2 API. The dedicated Android data-plane wrapper is removed.	2026-07-26 15:41:55 +08:00
Moder Steven	346f32d3d0	fix(web): scope GET /api/v1/sessions to the authenticated user (#2445) ... handle_list_all_sessions returned client_mgr.list_sessions(), which iterates user_clients_map across ALL users and returns every session's StorageToken (token, client_url, machine_id, user_id). The handler is mounted under login_required! but performed no per-user authorization: it fetched get_group_permissions() only to println! the result, then returned the full cross-user list. Any authenticated user could read every other user's device token and public client_url. Scope the result to the caller by adding Storage::list_user_client_tokens(user_id) / ClientManager::list_sessions_by_user_id(user_id), mirroring the existing per-user pattern in handle_get_summary (list_machine_by_user_id). Also drop the leftover debug println! and the unwrap() on the current user (return 401 instead).	2026-07-20 13:47:15 +08:00
KKRainbow	4e61612944	fix(web): preserve managed config and status compatibility (#2389) ... Fix web/frontend compat bugs in managed config & runtime status - Preserve [[peer]].peer_public_key when TOML configs round-trip through the web/managed NetworkConfig path - Keep old peer_urls clients working while adding structured peer metadata for new clients - Make frontend protobuf JSON normalization preserve omitted-field semantics instead of turning missing data into misleading defaults - Harden runtime status rendering against omitted or string-encoded backend fields - Expose peer-route feature flags in the web status UI	2026-06-29 12:40:04 +08:00
KKRainbow	9cb3833216	perf(easytier-web): improve easytier-web webhook performance (#2383) ... * feat(web): reconcile managed config revisions * feat(web): cache managed runtime configs per session * test: cover managed web config delivery	2026-06-28 13:14:40 +08:00
KKRainbow	f0d00d6161	refactor(web): use generated proto network types (#2373) ... * refactor(web): use generated proto network types * fix(core): preserve dumped config flags * test(web): cover config flag save paths * fix(ci): use system protoc before frontend codegen * fix(ci): serialize frontend-lib builds	2026-06-27 13:09:28 +08:00
KKRainbow	e38b1354b3	Fix credential ospf logic, fix udp subnet proxy loop protection (#2315)	2026-06-07 12:40:09 +08:00
fanyang	73bea01f40	fix: support env vars for easytier-web (#2280) ... * fix: support env vars for easytier-web * fix: hide sensitive web env values	2026-05-22 23:59:16 +08:00
KKRainbow	8e1d079142	feat: add Windows UDP broadcast relay (#2222) ... This may helps games to find rooms in virtual network. - add opt-in Windows UDP broadcast relay config flag and CLI/env plumbing - capture local UDP broadcasts with Windows raw sockets, normalize packets, and inject them via PeerManager	2026-05-09 09:56:31 +08:00
KKRainbow	74fc8b300d	chore: bump version to 2.6.4 (#2219)	2026-05-07 13:48:51 +08:00
KKRainbow	baeee40b79	fix machine uid and easytier-web panic (#2215) ... 1. fix(web-client): persist and migrate machine id 2. fix panic when easytier-web session receive malformat packet	2026-05-07 00:57:42 +08:00
KKRainbow	852d1c9e14	feat(gui): add UPnP and public IPv6 advanced options (#2194) ... Expose disable-upnp and ipv6_public_addr_auto in the shared web/GUI config editor bump release metadata to 2.6.3.	2026-05-01 13:45:19 +08:00
Mg Pig	d1c6dcf754	fix: prevent URL input layout flicker with container queries (#2186)	2026-04-30 19:45:01 +08:00
Luna Yao	5a1668c753	refactor: remove ScopedTask (#2125) ... * replace ScopedTask with AbortOnDropHandle	2026-04-25 15:20:25 +08:00
KKRainbow	2fb41ccbba	bump version 262 (#2158)	2026-04-25 10:22:24 +08:00
james.zhang	ac112440c3	fix(UrlInput): update parseUrl and buildUrlValue to handle null ports correctly (#2146)	2026-04-23 13:45:09 +08:00
KKRainbow	958b246f05	improve webclient (#2151)	2026-04-23 13:44:18 +08:00
KKRainbow	efc043abbb	bump version to v2.6.1 (#2129)	2026-04-19 16:49:45 +08:00
KKRainbow	2db655bd6d	fix: refresh ACL groups and enable TCP_NODELAY for WebSocket (#2118) ... * fix: refresh ACL groups and enable TCP_NODELAY for WebSocket * add remove_peers to remove list of peer id in ospf route * fix secure tunnel for unreliable udp tunnel * fix(web-client): timeout secure tunnel handshake * fix(web-server): tolerate delayed secure hello * fix quic endpoint panic * fix replay check	2026-04-19 10:37:39 +08:00
Mg Pig	c49c56612b	feat(ui): add ACL graphical configuration interface (#1815)	2026-04-18 20:23:53 +08:00
Luna Yao	bcb2e512d4	utils: move code to a dedicated mod; add AsyncRuntime (#2072)	2026-04-16 23:32:07 +08:00
KKRainbow	5b35c51da9	fix packet split on udp tunnel and avoid tcp proxy access rpc portal (#2107) ... * distinct control / data when forward packets * fix rpc split for udp tunnel * feat(easytier-web): pass public ip in validate token webhook * protect rpc port from subnet proxy	2026-04-13 11:03:09 +08:00