1091 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
KKRainbow	5af90471bf	fix(vpn): inherit portal exit nodes for attached clients (#2726) nightly	2026-10-19 00:04:29 +08:00
KKRainbow	a144597d02	fix(core): show complete instance startup errors (#2724) ... Restore the CLI's default instance-manager diagnostics without enabling unrelated module logs. Include failed instance IDs and their saved error chains in the final exit error. Attach the listener URL to required-listener failures and render full error chains in startup logs, so bind failures expose their OS cause. Extend listener regression coverage and document the default CLI targets.	2026-10-18 22:28:41 +08:00
Luna Yao	4ff27c7ef4	fix(cli): support loose boolean values for flags (#2721) ... Allow boolean flags to accept 1/0, yes/no, on/off in addition to true/false using clap's BoolishValueParser.	2026-10-18 20:06:33 +08:00
KKRainbow	f1b910da4e	test: make secure datagram grace expiry deterministic (#2723) ... The expiry test sampled time before sync_root_key established its grace period. Scheduling delays over 3 ms could leave the asserted timestamp inside the grace window and fail the test. Use the actual grace deadline to check acceptance just before expiry and rejection at expiry. Use a fresh sequence number for the rejection check so replay detection cannot hide a broken expiry boundary.	2026-10-18 12:36:54 +08:00
KKRainbow	e25c6bdd0c	fix(web): prevent heartbeat replay and unsafe receiver takeover (#2718) ... * fix(web): stop replaying heartbeats after token validation Wake runtime reconciliation once when authentication establishes the session. Repeated successful validation, including a binding refresh, must not replay a heartbeat whose instance list predates a completed Run. Use existing notifications as wakeups and read the latest session heartbeat when reconciling, so delayed validation and config callbacks cannot replace a newer runtime observation with a cached payload. Cover one initial wakeup, 99 successful validations without replay, and a subsequent real heartbeat that still wakes runtime reconciliation. * fix(web): wait for authoritative config during receiver takeover Keep the desired webhook revision on the authenticated session. Gate runtime reconciliation, mutations and applied acknowledgements until the receiver has that exact revision, preserving running Core instances while its local configuration is missing or stale. After committed Full/Patch updates, request current validation authority without letting delayed publication callbacks or validation responses restore an older target. After the connected ACK establishes the route, wake existing validation once when configuration is still unavailable. Cover missing and obsolete state, authoritative empty sets, stale rounds, callback races, live Core handoff and an explicit 1000-connection takeover exercise with an independent mount.	2026-10-17 11:44:48 +08:00
KKRainbow	585628ecf1	test(dhcp): wait for dual-stack address and route convergence (#2719)	2026-10-17 09:17:47 +08:00
KKRainbow	8c2f67e13e	fix(windows): stop running GUI and services during installer updates (#2717) ... * fix(gui): stop Windows processes before installing updates Keep the NSIS installer in the current user context. Detect the target GUI and service before updating, and elevate a temporary helper only when stopping them requires administrator access. Stop services through SCM and wait for their processes to exit before closing the GUI. Retain the helper until installation completes so it can restore a previously running service without another UAC prompt. Restore the service on cancellation when its executable still exists. Prepare before Tauri launches an old uninstaller, and cover passive, silent, and direct uninstall paths. Add Windows service lifecycle tests with isolated executable fixtures. * fix(windows): report stopped before normal service exit Report SERVICE_STOPPED with no accepted controls before exiting after an explicit stop or successful completion. Reporting Running at exit makes SCM treat a normal stop as a failure and schedule a restart. This fixes the service lifecycle independently of installer changes. * fix(gui): prevent old services restarting during Windows updates Temporarily disable service startup before requesting a stop, then restore the original startup mode when the update finishes or exits. Released services can exit without reporting Stopped, causing SCM to queue a recovery restart even after an explicit stop request. Extend the Windows fixture to reproduce that exit behavior with failure recovery enabled and check that startup settings are restored. Record the minor directory-change and GUI-relaunch limitation from review. * docs(windows): record installer short-path matching limitation Record the 8.3 path alias mismatch found while testing the installer helper without administrator privileges. Document how to run the fixture with a full temporary-directory path and retain the issue as a minor follow-up without expanding the installer implementation.	2026-10-17 02:15:57 +08:00
KKRainbow	c7442868ab	fix(ci): exclude nightly tags and isolate shared TUN cases (#2716) ... Restrict OHOS version baselines to v-prefixed version tags so the rolling nightly tag cannot produce an invalid ohpm package version. Keep the manifest version fallback and count commits from the selected version tag. Give each parameterized shared TUN test its own network namespace, while keeping both member instances on the same TUN within that namespace. Reuse TestNetwork to own and clean up the namespaces and remove the process-local serial lock, which does not serialize nextest processes. This prevents fixed test addresses from competing for routes in the root namespace without increasing timeouts.	2026-10-16 22:14:53 +08:00
KKRainbow	3384cc1162	test: synchronize BPF veth initialization before sending (#2712)	2026-10-16 19:12:16 +08:00
KKRainbowandCodex	99db92a3ae	fix(config): preserve and patch empty manual route mode (#2709) ... * fix(config): preserve empty manual route mode in API conversion Treat present TOML routes as manual mode even when the list is empty. Both Core readback and Web normalization must distinguish routes=[] from automatic discovery; otherwise Web can skip a required overwrite and Core can report a different mode from its running configuration. Cover API/TOML round trips and receiver reconcile mode transitions. Verify default-feature tests, clippy, formatting and real system routes in three isolated Linux network namespaces. * fix(config): patch manual route mode and verify legacy readback Add an explicit manual-route mode to route patches and advertise typed readback support through GetConfig. Apply the mode and route edits in the existing route transaction without restarting the instance; keep released callers that omit the new field on their existing route semantics. Web gates route patches on the observed capability. For old clients with ambiguous empty routes, recover the actual mode from GetConfig TOML or instance-scoped ShowNodeInfo before acknowledging application. Supporting clients use typed readback directly. Keep capability evidence in the existing session cache and preserve its invalidation rules. Cover mode transitions, persistence failure, stable peer identity, legacy readback, compact clients, failed observations and cache capability gates. Document the runtime contract and compatibility boundary. * refactor(web): advertise route patch support in heartbeats Declare manual-route patch and typed readback support on the WebClient heartbeat alongside existing client capabilities. Select route updates and legacy readback from the current authenticated Session heartbeat, including when reconciliation reuses an observed configuration. Remove the unreleased GetConfig capability field and per-instance capability wrapper. Keep only observed configuration in the existing cache, and retain strict application confirmation after full Run. Cover the client declaration, legacy default and capability changes against the same cached configuration. Update the runtime contract. --------- Co-authored-by: Codex <codex@users.noreply.github.com>	2026-10-16 00:47:43 +08:00
Fa	7588062f7e	fix(wasi): initialize and control embedded runtime logging (#2655)	2026-10-15 20:37:32 +08:00
KKRainbow	da6d721b97	test(credentials): wait for deterministic two-admin election (#2705) ... The non-reusable credential test guessed an owner from three route samples and repeatedly probed reachability with fixed stability sleeps. Partial route synchronization could select a temporary owner, while the extra waits pushed otherwise healthy runs past the 60-second CI limit. Wait for both credential peers to connect, then require both admins to route only to the lower peer ID selected by the owner election. After stopping that peer, wait for both admins to route only to the survivor. Verify reachability and rejection from both admins in each phase without the redundant sampling loops. Keep the existing nextest timeout.	2026-10-15 10:02:45 +08:00
KKRainbow	ec694f7cb8	fix(web): align central network initial-node protocols (#2704)	2026-10-15 01:30:06 +08:00
KKRainbow	8839b4b2f1	fix: avoid shared IPv4 miscompilation on Rust 1.95 (#2703) ... Keep ipv4_inet out of line to prevent LLVM load combining from zeroing the address and prefix when inlined into async add_ip. This works around Windows named-NIC IPv4 setup failures on the current release toolchain. Link the upstream LLVM fix so the workaround can be removed once all build toolchains include it. Fixes #2696	2026-10-15 00:53:24 +08:00
KKRainbow	0ca2fde0fb	ci: align nightly assets with version releases (#2699) ... Publish GUI installers and Android APKs under their original names. Use the built commit version in Core, Web and Magisk ZIP names, and match the version-release archive layout while preserving executables. Generate SHA256SUMS for all downloads and validate the packaged asset manifest before publication. Cover native installers, archive layout, checksums and invalid artifacts in the CI script tests. Document versioned download URLs and remove the stable-URL claim.	2026-10-14 14:11:53 +08:00
KKRainbow	d25ccd4c17	fix(windows): reuse numbered TUN names after complete shutdown (#2694) ... * fix(windows): reuse stable TUN identities after complete shutdown Wait for NIC forwarding and packet-drain tasks to release their handles before stopping or replacing the interface. Stop the old static-IP NIC before entering its recreation path. Store typed NIC state so shutdown can await the owned tasks instead of only cancelling them on drop. Use the instance UUID for the default Windows interface name and derive a stable Wintun GUID from the device name. Keep explicit names and their existing sharing behavior, while generated names remain dedicated. Keep resolved names out of the input flags so recreation preserves that choice. Pin rust-tun to the fix that joins its reader during session drop. Remove the global NetworkList cleanup that deleted profiles based only on their names. Stable identities avoid creating a new profile for each restart without guessing which existing records are safe to delete. Add regression tests for receiver release and Windows instance restarts with another dedicated or shared-NIC member still running. Validation: formatting and workspace Clippy pass; 66 NIC, shared-NIC and TUN runtime tests pass in the privileged rust container. Fixes #2682 Related: #110 * fix(windows): allocate the first unused numbered TUN name Use et_1, et_2 and subsequent vacant slots for default Windows NICs. Reserve each name across threads and processes with a named kernel object, retaining it through firewall cleanup and releasing it on exit. Check the current device tree to skip disabled adapters without treating removed adapters in the IP interface tables as occupied slots. Keep GUIDs derived from names and preserve explicit NIC sharing. Cover concurrent allocation, case-insensitive reservations and slot reuse. * fix(windows): release idle TUN names across cached and service owners Release a shared NIC name after its dispatcher has stopped and its firewall rules have been removed, even when the registry caches the NIC. Clear the old interface name so a later cache drop cannot remove rules belonging to its replacement. Await dispatcher teardown on control failure and timeout as well as on successful shutdown. Grant only SYNCHRONIZE access to name reservations across accounts so SYSTEM services and desktop processes can skip occupied slots. Cover idle registry reuse, firewall ownership and failed-control cleanup with regression tests. * test(tun): use the renamed dispatcher task handle on Unix Update the two Unix-only teardown tests to match the task field used by explicit dispatcher shutdown. * fix(windows): report firewall cleanup failures and verify all rules Inspect all eight interface rules, including the ALL protocol pair. Treat only a missing rule as absent and propagate other lookup errors. Attempt every rule deletion and report failures with rule names instead of silently returning success after a permission or service error. Validate rule protocols, directions, profiles, interface binding and allow settings on Windows. Cover repeated add/remove, unprivileged failures, full cleanup and shared-NIC rule ownership across restarts. Pin tun-easytier to merged v2 commit 5ba6be073e5b486b68c12f80fac5cfb50601f024 and update Cargo.lock. Its tree matches the previously tested PR commit.	2026-10-14 13:43:35 +08:00
KKRainbow	15a3d43039	ci: wait for nightly builds before publishing the release (#2695) ... GITHUB_TOKEN-dispatched builds do not trigger downstream workflow_run jobs. The nightly release check ran before builds finished and then exited successfully without publishing anything. Track dispatch run IDs and wait for all missing components to succeed. Retry failed jobs once, account for delayed rerun state, and fail on terminal errors. Bound the build and wait job to three hours. Pass the built commit to publication so later main commits do not change the release target. Retain component deduplication and manual build completion handlers, and document the nightly lifecycle. Add regression coverage for pending builds, retries, terminal failures, dispatch races, and main advancing before publication. All 34 Node tests and actionlint for the three nightly workflows pass.	2026-10-14 09:57:54 +08:00
KKRainbow	76439ce562	docs: fix Ask DeepWiki badges in both READMEs (#2693)	2026-10-14 02:14:46 +08:00
KKRainbow	36b4ffcc74	ci: publish rolling nightly releases with build deduplication (#2692) ... * ci: publish rolling main nightly builds and retry failed jobs Keep one nightly prerelease with stable artifact filenames. Publish only successful Core, GUI, Mobile and Test runs from the same main commit, and prevent older runs from replacing a newer nightly. Generate dated changes against the latest published version release, including manual prereleases, in newest-first order. Link the fixed nightly download page from both READMEs. Retry failed full-build jobs once on main and develop, excluding cancelled runs and attempts after the first. Validated with 28 Node tests, actionlint, archive packaging checks, and read-only selection of real GitHub builds and release notes.	2026-10-14 01:24:00 +08:00
KKRainbow	03078b4791	feat(dhcp): support automatic IPv6 address assignment (#2688) ... Accept a boolean or an IPv6 CIDR in dhcpv6 and --dhcpv6, using fd6b:8c2d:91e4::/64 when no initial subnet is supplied. Keep IPv4 configuration serialization compatible and DHCPv6 disabled by default. Share the DHCP lifecycle and host update between both address families, with typed allocation state, peer subnet selection, conflict recovery, and bounded IPv6 probing. Preserve static addresses of the other family and prevent static config patches from replacing DHCP-owned leases. Carry IPv6 settings, leases, and events through management, web config, and mobile VPN setup. Reuse the shared NIC registry and mobile address list for IPv6-only and dual-stack operation without extra FD owners. Cover config round trips, allocation and recovery, mobile reconciliation, three-node IPv6 and dual-stack connectivity, and shared TUN member exit. Validate with workspace clippy, Docker TUN tests, frontend tests/builds, WASI and Android Rust checks, and Android VPN Kotlin compilation.	2026-10-14 00:36:47 +08:00
KKRainbow	7c8ca07812	refactor(tun): consolidate shared NIC configuration and tests (#2690) ... * refactor(tun): consolidate shared NIC configuration and tests Separate member claims from OS deltas so mobile admission updates do not compute unused diffs. Reuse effective configurations for desktop address, route, and MTU updates, and share the platform claims paths. Remove redundant runtime dispatch and test-only public accessors while preserving registration cleanup and platform device creation ordering. Move configuration and lifecycle tests into focused modules. Reuse setup and table-driven cases, and verify route replacement order, source hints, stale registrations, and failed cleanup through behavior. Validation: shared NIC unit and Docker integration tests, mobile claim selection, TUN and public IPv6 tests, full-workspace clippy, Android arm64 library check, and formatting of the changed files. * docs(tun): describe shared Ring dispatch lifecycle Document direct member Ring polling, mobile descriptor replacement, and cooperative scheduling in the shared dispatcher. The dispatcher implementation is already provided by the base branch in #2689. * test(core): remove completion race from timeout budget test Use a pending future to exercise stage-specific timeout errors. A delayed CI runner can observe the old 20 ms sleep and 1 ms timeout as ready together. Tokio polls the inner future first, returning Ok instead of the error expected by the test. Keep the timeout assertion without a competing completion timer. Production timeout behavior is unchanged.	2026-10-13 23:53:35 +08:00
KKRainbow	4d4b5ad8dc	refactor(tun): consolidate NIC setup and DHCP host logic (#2691) ... Select dedicated or shared NICs through one constructor, removing redundant construction wrappers and unreachable setup error handling. Share desktop and mobile DHCP cancellation, publication, and permit handling while retaining their platform-specific NIC setup. Build mobile VPN configuration once after member selection or attach, and use CIDR formatting that preserves host prefixes. Cover DHCP publication locking and cancelled address updates, and retain explicit IPv4 /32 and IPv6 /128 projection assertions.	2026-10-13 23:52:24 +08:00
KKRainbow	0da58e68df	refactor(tun): dispatch shared members through Ring endpoints (#2689)	2026-10-13 23:12:50 +08:00
KKRainbow	32dc7f1f40	feat: add shared virtual nic (#2352) ... * Add shared virtual NIC core with per-member routing Share a named TUN across instances while keeping unnamed devices dedicated. Track member addresses, routes, and MTU, and reject overlapping destinations except the common Magic DNS host route. Dispatch packets between the physical TUN and member tunnels. Keep IPv4 and ordinary IPv6 source translation for mobile wrong-source traffic. Update platform configuration and runtime host integration, with unit and network namespace coverage for routing and lifecycle. Use smoltcp for packet parsing and checksum updates. Keep core CI matrix jobs independent. Reserve native inbound flows before source translations allocate their wire tuples. Keep active reservations under table pressure and leave forwarded subnet traffic outside the local flow table. Complete interface claim updates on the shared runtime and retain member registrations until the transaction commits. Keep address, route, and MTU cleanup ordered after cancelled callers, including device initialization. Project mobile VPN addresses, routes, and DNS from admitted native members. Prefer unchanged attached claims and report conflicting members individually. Apply each member's complete initial claims before opening the shared fd, so conflicts leave healthy members usable. Cover inbound IPv4/IPv6 collisions, cancellation during native changes and dispatcher acknowledgments, admission priority, and atomic mobile claim rejection with regression tests. Use scoped TestNetwork fixtures for shared TUN bridge setup and cleanup. Resolve public IPv6 namespace aliases through the lab's actual names so the new tests remain isolated under parallel upstream test runs. * Configure one mobile VPN from running TUN instances Use admitted native members to configure VpnService and attach its single fd to the core shared TUN. Wait for attachment completion and record the actual attached members before refreshing VPN state. Report rejected members in the GUI and preserve the VPN for unchanged healthy members. Reconcile ordinary configuration notifications without invalidating an arbitrary member. Invalidate attachments on instance lifecycle changes, including restarts that reuse an instance ID. Forward public IPv6 changes alongside proxy route changes to refresh the platform VPN configuration. Exclude confirmed IPv4-less members from readiness gating while retaining retries for unavailable status and pending addresses. Quick Settings stops all running TUN members and restores that group on the next start, skipping removed configurations and no_tun networks. Keep the FFI set_tun_fd call scoped to one instance and report attachment errors. Cover mobile configuration, member rejection and replacement, attachment completion, collection notifications, IPv4-less members, and tile stop/start restoration in GUI regression tests. Validate with 36 mobile VPN tests, vue-tsc --noEmit, Android GUI cargo check, workspace clippy, and shared TUN network namespace tests. * fix(tun): preserve shared NIC ownership and failure invariants Keep mobile address and route claims in dispatcher tables without applying desktop interface configuration to synthetic TUN names. Limit the Magic DNS overlap exemption to route claims and remove the shared route retry that bypassed claim accounting after invalidation. Invalidate and stop dispatchers on failed mobile TUN replacement or I/O. Bound TUN writes so stalled devices release pending source updates and member cleanup instead of retaining an unusable shared dispatcher. Treat missing Darwin and Windows addresses and routes as successful deletions while preserving permission and other configuration errors. Add regressions for claim conflicts, mobile configuration, failed TUN replacement, stalled writes, and platform deletion error handling. * fix(tun): forward single-member shared NIC traffic unchanged Deliver TUN packets directly to the sole attached member without destination matching or creating source translations. Keep native flow reservations so a later member cannot collide with existing connections, and continue applying mappings created before other members leave. Reuse flow preparation with the original source address. Preserve the desktop subnet forwarding bypass, including when the flow table is full. IPv4 fragments and IPv6 extension headers remain unchanged on flows that need no translation. Cover unknown sources and destinations, first and later IP fragments, native flows established before another member joins, and retained translations after returning to one member. Document the forwarding behavior and retain rejection coverage for multiple attached members. * fix(tun): preserve wildcard UDP replies on shared member ports Mark flow reservations created by incoming traffic separately from outgoing mappings. When a wildcard UDP socket replies with another member's source address, reuse the incoming reservation after source correction and preserve its service port and inbound destination. Keep exact outgoing mappings and outgoing flow collision handling ahead of this rule. Incoming UDP sessions take priority when packet tuples cannot distinguish a reply from a new client using identical endpoints. Cover IPv4 and IPv6 replies, checksum updates, repeated inbound traffic, existing outgoing mappings, TCP collisions, and single-to-shared member transitions with regression tests. * test(tun): wait for IPv6 activation in mobile configuration test Assert that the configured IPv6 address is registered before forwarding starts, then wait up to five seconds for the kernel to make it usable. Netlink acknowledges address creation before asynchronous IPv6 activation completes, so an immediate bind can fail under CI parallelism. Disable automatic link-local address generation in the test namespace to keep startup IPv6 control traffic out of member-routing assertions. Validation: the original test failed 40 of 320 runs at 32-way parallelism. The updated test passed all 320 runs; workspace fmt and clippy also pass.	2026-10-13 21:00:03 +08:00
fanyang	99fce327d5	fix(ohos): reject unsupported services and remove interface warnings (#2676)	2026-10-13 12:09:10 +08:00
fanyangandKKRainbow	1c6992d6cb	fix(web): bind config listeners without route probes (#2660) ... Construct config-server TCP and UDP listeners on IPv4 and IPv6 wildcard addresses. A default route is not needed for listening, so remove the local-IP probes, URL-to-address wrapper, and optional listener pairs. Keep WebSocket on its existing IPv4 address. Propagate all native socket bind errors instead of ignoring IPv6 failures. Try address families independently and stop startup only when no listener could bind, so one unavailable family does not hide a working listener or create an unbound socket. Log every successful listener with its actual bound address, including the allocated port when the configured port is zero. Add regressions for occupied ports and unavailable IPv6 source addresses, failed listener registration, and valid ephemeral ports. Fixes #2611 Co-authored-by: KKRainbow <5665404+KKRainbow@users.noreply.github.com>	2026-10-13 10:04:10 +08:00
KKRainbow	9bc1a0941f	feat(dhcp): accept an IPv4 CIDR for the initial address subnet (#2686) ... * feat(dhcp): accept an IPv4 CIDR for the initial address subnet Accept booleans or an IPv4 CIDR in --dhcp, ET_DHCP, and TOML. Preserve existing boolean behavior and reject invalid subnets and /31 or /32. Carry the bootstrap subnet through management config conversions and runtime snapshots. Keep peer-advertised subnets authoritative and use 10.126.126.0/24 when no custom bootstrap subnet is supplied. Cover CLI overrides, config round trips, validation, address allocation, and subnet precedence. Update English and Chinese CLI help. * refactor(dhcp): select the bootstrap subnet during construction Read the optional DHCP CIDR once when creating the service and pass it to the existing allocator constructor. Restore reconciliation without rewriting the bootstrap subnet on every round. Initialize test configurations before constructing their DHCP services. The PatchConfig API does not expose the DHCP policy; management changes recreate the network instance.	2026-10-13 00:34:26 +08:00
KKRainbow	c01e2baafa	perf(core): cap shards in per-network and per-peer maps (#2685) ... Public relays create many mostly empty maps for each foreign network. DashMap defaults to 128 shards on a 24-CPU host, allocating about 1.26 GiB of shard arrays for 2,421 networks before peer/session state. Cap these maps at eight shards and retain the four-shard default on single-CPU hosts. Cache the shard count once and keep global indexes on their existing default. Apply the same cap to peer connection maps and route synchronization version maps. Replace nested peer/network DashSets with HashSets protected by their existing outer map or an entry mutex. Keep cross-index updates under the manager lock. Use a plain HashMap for the local route graph index. Validation: 245 peer/RPC tests and eight three-node integration tests passed, along with workspace fmt and clippy with full features.	2026-10-13 00:18:49 +08:00
KKRainbow	d31396f04c	fix(hole-punch): connect UDP when STUN mapping differs (#2680) ... * fix(hole-punch): connect UDP without reverse probe gating Start cone UDP handshakes on the same punched socket without waiting for reverse HolePunch packets. Keep outgoing probes while the existing session layer retries SYN, allowing a reachable listener to reply to the actual source when the STUN candidate uses a different mapping. Register source observers on the listener's existing receive loop for the active cone RPC. Send bounded batches to the signaled endpoint and the first matching observed source, deduplicating equal endpoints. Unregister observers on completion, cancellation, or listener shutdown. Cover missing reverse probes, dropped SYN, late observed sources, transaction isolation, and cleanup. Document socket and connectivity ownership of observation and reply policy. * fix(hole-punch): prepare source observation during listener selection Carry an optional transaction ID in SelectPunchListener and echo it only after registering the listener's existing UDP receive loop. Preserve the first source arriving before SendPunchPacketCone, then transfer cleanup ownership to that RPC without clearing the observed address. Keep prepared and active registrations in the same transaction table. Expire abandoned preparations after 30 seconds through listener cleanup; active observers still unregister on completion or cancellation. Preserve legacy requests without a transaction ID and tolerate older responses without a registration acknowledgement. Cover early packets, transaction ID zero, preparation expiry, active RPC cleanup, legacy protobuf interoperability, and SYN retries against peers with and without registration confirmation. Document the lifetime and compatibility contract in the core architecture. Validation: 820 core tests; workspace fmt and full-feature clippy passed.	2026-10-12 23:19:46 +08:00
KKRainbow	4b4f0c3cb3	fix: restore thread network namespaces and stabilize tunnel tests (#2683)	2026-10-12 20:04:01 +08:00
KKRainbow	1649ec0013	ci: parallelize Linux tests and skip HAR packaging on PRs (#2678)	2026-10-12 09:09:52 +08:00
KKRainbow	f8a45ccc20	ci: use lightweight PR checks and conditional nightly builds (#2677) ... * ci: use lightweight PR checks and conditional nightly builds Check three Core platforms, Linux GUI, and Android ARM64 on PRs and ordinary branch pushes. Keep formatting, clippy, WASI, and all Linux tests; reserve the per-feature sweep for full builds. Run complete platform matrices on releases/** pushes and manual dispatch. At 03:17 Asia/Shanghai, check existing main and develop branches and dispatch only workflows whose last successful full build used a different commit, retrying failed components on the next night. Cache compilation outputs by target and build mode. Build only the GUI frontend dependencies and reuse the dashboard artifact for Core builds. Separate full-build concurrency so ordinary pushes cannot cancel them. Keep the required result checks and propagate failures and cancellations. Validate successful full-build origins and matching Core, GUI, and Mobile commits before preparing release assets. Validation: actionlint 1.7.12, 10 Node tests, read-only GitHub nightly dry run, GUI frontend build, Linux GUI check, Android ARM64 check, and Linux musl Core/Web checks including embedded dashboard assets. * docs: describe CI behavior in English and Chinese Document PR checks, nightly dispatch, manual builds, release validation, artifacts, and independent workflows. Keep both versions aligned with current workflow definitions. * ci: decouple PR checks from Web dashboard builds Run PR dashboard builds only when frontend sources, Core configuration sources, protobuf schemas, or build configuration change. Keep embedded Web builds in full mode and let ordinary Rust checks start without frontend artifacts. Upload dashboard artifacts only for full builds. Skip frontend setup for ordinary lint runs and remove GUI/frontend setup from test archives. Update both CI documents to match the new behavior. Validation: actionlint; frontend dependency and workflow routing cases; Linux Core cargo check and workspace clippy with frontend outputs absent.	2026-10-12 00:13:12 +08:00
lightfirstandKKRainbow	7592951b80	fix(dataplane): route UDP by bound local endpoints (#2652) ... Register one UDP flow at bind so sockets can receive from new peers before their first send. Allocate and reserve ports within each instance independently of TUN and Host sockets. Release the endpoint on close. Search the ephemeral range once and preserve concurrent cursor progress. Route local UDP fragments by the first fragment's bound endpoint. Buffer earlier tails in a bounded shallow cache and forward original packets to one recipient. Preserve cached ownership across binding changes, expire idle entries, and clear state on address changes and runtime shutdown. This avoids orphan fragments exhausting smoltcp's reassembly slots while keeping original packet sizes for TUN and proxy consumers. Randomize each new stack's seed to avoid replaying IP IDs on rebuild. Document accepted residual collision-related UDP loss or downstream delivery instead of adding fragment completion tracking. Allow peer filters to return a batch, resuming each packet at the next filter without repeating earlier filters. The single-packet path does not allocate a batch queue. Keep ZCPacket and IpReassembler unchanged. Cover endpoint ownership, ephemeral allocation, out-of-order fragments, cache limits and expiry, binding changes, batch continuation, and large UDP datagrams after more than 16 complete unrelated fragmented datagrams. Exercise two recreated sending stacks with controlled seeds to verify that new fragments do not inherit an old downstream route. Co-authored-by: KKRainbow <5665404+KKRainbow@users.noreply.github.com>	2026-10-11 01:35:33 +08:00
fanyang	83baead059	fix(runtime): restore per-instance native thread configuration (#2658) ... Restore per-instance Tokio executors for standard native instances, honoring multi_thread and multi_thread_count with a two-worker minimum in multi-thread mode. Preserve external execution for compact hosts. Run construction, lifecycle operations, FFI data-plane tasks, and hot-reloaded port forwards on the selected instance executor. Keep shutdown cleanup running when its caller is cancelled, and release owned executors without blocking their workers on runtime teardown. Add runtime ownership, cancellation, cross-runtime connectivity, and hot-reload regression coverage, and document the execution model. Validation: all 45 PR checks passed, including linting, integration tests, and cross-platform builds.	2026-10-11 01:17:32 +08:00
Luna YaoandClaude Code	250c2ad8d6	refactor(config): preserve explicit flags with FlagsPatch and derive CLI arguments from schema (#2585) ... This PR refactors EasyTier's configuration flags system across protobuf definitions, TOML/API persistence, runtime reconciliation, and the CLI. It introduces a synthesized FlagsPatch protobuf message with optionize and pbjson support to track field presence reliably, replaces manual CLI flag boilerplate with dynamic schema-driven clap argument generation, and establishes Flags::resolve(patch) as the single source of truth for runtime defaults. Co-authored-by: Claude Code <noreply@anthropic.com>	2026-10-10 22:11:08 +08:00
fanyangandCopilot Autofix powered by AI	018750a785	fix: replace deprecated atomic fetch_update calls (#2665) ... * fix: replace deprecated atomic fetch_update calls Use try_update, available since the workspace's Rust 1.95 minimum, for all standard-library atomic update calls. Preserve closure behavior and memory ordering, and leave arc-swap's unrelated API unchanged. Cover smoltcp port allocation's previous-value return and wrap boundary. Fixes #2614 * Add unused_async allowance for tokio test Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-10-10 21:49:43 +08:00
fanyang	24afb4ecb4	fix(cli): warn about ignored TOML logging configuration (#2661) ... * fix(cli): warn about ignored TOML logging configuration Keep logging process-wide and direct users to CLI options or environment variables when legacy logging sections are present. Emit diagnostics for files, config directories, stdin, and config validation. Refs #984 * fix(test): use relocated core binary in nextest archives Resolve the runtime NEXTEST_BIN_EXE path before clearing the child environment, with a compile-time fallback for cargo test. This avoids using the build runner's binary path after extracting an archive on another runner.	2026-10-10 12:35:15 +08:00
fanyang	d96eaa668b	feat(cli): show direct peers using temporary credentials (#2663) ... Add credential peers with table and JSON output while preserving credential list. Match authenticated remote credential keys to stored fingerprints and virtual route addresses. Keep instance results isolated and exclude unproven relay users. Enable SHA-256 for CLI-only builds and add regression and multi-instance tests. Accept omitted protobuf default lists in the existing multi-instance test. Refs #2529	2026-10-10 12:33:47 +08:00
fanyang	bd06395573	feat: support cargo-binstall for prebuilt CLI tools (#2659) ... Map the existing release ZIP names and binary paths through package metadata, including ARM hard-float, RISC-V, Windows ARM64, and FreeBSD naming exceptions. Document repository-based installation and Windows sidecar requirements. Fixes #365	2026-10-10 10:17:08 +08:00
刚刚and225284228a-droid	db289e87bb	fix(web): default virtual subnet masks to /24 (#2646) ... Co-authored-by: 225284228a-droid <239500008+225284228a-droid@users.noreply.github.com>	2026-10-09 23:05:14 +08:00
刚刚and225284228a-droid	2583d867c3	fix(web): keep refresh buttons steady during polling (#2647) ... Co-authored-by: 225284228a-droid <239500008+225284228a-droid@users.noreply.github.com>	2026-10-09 23:04:22 +08:00
fanyang	7fdfe90291	feat(cli): support configurable local state directory (#2654) ... Add --state-dir and ET_STATE_DIR for persisted web-client machine IDs. Fixes #2340	2026-10-09 21:23:02 +08:00
KKRainbow	7af7bdc16a	build: consolidate dependencies and select rustls ring explicitly (#2648) ... * build(core): consolidate crypto dependencies and trim features Align AES-GCM, ChaCha20Poly1305, HMAC, SHA2 and HKDF with the versions already required by Snow and STUN. Align base64 with pbjson, and explain the coordinated upgrade constraints beside the manifest entries. Adapt AEAD and HMAC calls without changing packet or key formats, and pin the WireGuard client key derivation with an independent HKDF vector. Limit Snow to the Noise algorithms used by the core. Use crossbeam-utils directly, keep the futures executor in tests, and remove UUID fast-rng from the core while retaining existing features in native consumers. Enable browser entropy and certificate time for the rustls backend. Core default normal/build dependencies fall from 255 to 224 packages; duplicated package names fall from 24 to 5 against upstream 4837468d. Validation: Docker tests pass: 970 core, 33 proto (2 ignored), 5 WireGuard, and TCP/UDP three-node encrypted relays. Clippy passes with warnings denied for core, proto, native and web targets. Browser default/ChaCha20, WASI and minimal native compile checks pass. Workspace formatting passes. * fix(tls): select ring explicitly across application entry points Building easytier and easytier-web together enabled both ring and aws-lc through reqwest 0.13. HTTPS endpoint discovery used rustls automatic provider selection and could panic before sending a ClientHello. Use reqwest rustls-no-provider to share ring, and explicitly install the process default before starting CLI, GUI and web services. Initialize it for standalone webhook construction too, retaining any provider already selected by the host. Pass ring directly to HTTPS discovery and WebSocket TLS builders so library use is independent of application initialization order. Keep existing certificate verification, SNI and protocol settings. Add a duplex-stream regression that reproduces the original panic with both backends enabled, and run it in CI. Explain provider selection and feature-unification constraints next to the relevant code. Validation: the new regression fails before the fix and passes after it. Docker tests pass: 10 discovery, 13 webhook, 2 WebSocket, WSS three-node AES-GCM relay, and WSS credential connectivity. Clippy with warnings denied and fmt pass. GUI, browser, WASI, minimal native, endpoint-only and WebSocket-only compile checks pass. Linux and Windows release dependency trees contain only the ring runtime backend. Fixes #2607 * ci: remove the separate rustls backend regression step Keep the HTTPS discovery regression in the existing test archive and runner. Avoid an extra core test build solely to enable both rustls backends; that combination was verified locally before the TLS fix. * build(web): share reqwest 0.13 with the OIDC client Disable the reqwest 0.12 client bundled with openidconnect/oauth2 and use the official oauth2-reqwest adapter around the workspace reqwest 0.13 client. Pin the pre-release adapter version until its API stabilizes. Keep the existing redirect policy and 30-second timeout. Initialize the ring provider when constructing OIDC configuration, including outside the web application entry point. Exercise discovery, JWKS fetching, token success and OAuth error responses against a local mock provider. Verify redirects are not followed. Refresh Cargo.lock to remove reqwest 0.12 without unrelated upgrades. Validation: Docker OIDC tests (2) and webhook tests (13) pass. Clippy with warnings denied for native/core/proto/web all targets and full features passes, as does workspace formatting. The default core/web dependency graph has one reqwest version and 45 multi-version names instead of 46; the TLS runtime still selects ring only.	2026-10-09 10:22:32 +08:00
LighteningShadow	983afda177	fix(gui): declare pkexec dependency for deb package (#2635) ... The GUI shells out to pkexec for privilege elevation on Linux (elevate/linux.rs). Since Debian 12 / Ubuntu 24.04, pkexec is shipped as a standalone binary package split from policykit-1, so it is not guaranteed to be installed. On such systems (e.g. a minimal Debian 13 desktop) installing the official deb succeeds but launching the GUI panics with: Failed to run elevated command: No such file or directory (os error 2) Add 'pkexec | policykit-1' to the deb bundle dependencies. The alternation keeps the package installable on older releases where pkexec still lives inside policykit-1 (e.g. Ubuntu 22.04), while tauri-bundler continues to append the auto-detected webkit2gtk/gtk dependencies.	2026-10-09 00:02:37 +08:00
刚刚	4837468d43	fix(gui/web): 修复丢包率和 NAT 类型显示 (#2643)	2026-10-08 00:51:06 +08:00
Luna Yao	eb32d2a930	fix(utils): fix some bugs in BufPoolWriter/BufList (#2634) ... fix bugs introduced by feat(buf): add BufPool, BufMargins, and BufList for zero-copy packet buffering #2625 cf. perf(quic-proxy): use BufPool and BufMargins in QuicSocket #2626 (comment)	2026-10-07 21:58:46 +08:00
KKRainbow	728ba94b50	Link easytier-mini downloads and fix UDP admission test ordering (#2638)	2026-10-07 01:03:35 +08:00
KKRainbow	8b7f1f0196	fix(web): accept client handshakes concurrently (#2633) ... Move secure tunnel handshakes out of the listener accept path so an idle connection cannot delay subsequent device sessions. Bound pending handshakes to 4096 per listener and own them in a JoinSet for cancellation. Preserve each in-flight accept future while handling completed handshakes so listeners with transport upgrades do not lose accepted connections. Keep session registration, authentication and protocol timeouts unchanged. Add TCP regressions for idle-client isolation, manager shutdown, bounded admission and preserving an unfinished transport accept. The isolation test fails before the fix and passes afterward. Validation: all 249 easytier-web tests with --include-ignored pass. Raise the test process file descriptor limit to 16384 for the explicit 4097-connection capacity test. The default test run skips this stress test. Cargo fmt --all -- --check and cargo clippy -p easytier-web --all-targets -- -D warnings also pass. Domain context impact: none; this changes handshake scheduling only. Architecture impact: none; ClientManager retains connection ownership. v2.7.0	2026-10-05 16:25:29 +08:00
KKRainbow	d3a5ae684a	fix(peers): keep TCP hole-punched connections alive with 1s pings (#2632) ... Disable ping interval backoff for TCP hole-punched connections so idle connections continue to send keepalive traffic every second. Preserve the existing backoff and loss handling for other connections. Keep randomized backoff above zero and cover the one-second schedule and the existing backoff and loss retry behavior with tests. * refactor(peers): model connection origins at admission Record manual, direct, listener, TCP/UDP hole-punch, and attached origins when constructing peer connections. Derive hole-punch state from this origin instead of maintaining separate mutable flags. Choose the one-second TCP hole-punch ping limit in PeerConn and pass only a maximum interval to the pinger. Keep other origins on the existing backoff schedule without inspecting tunnel type strings. Keep origin selection internal and preserve the dedicated attached admission paths. Update public admission callers and cover origin propagation, relay restrictions, and ping interval limits.	2026-10-05 16:25:08 +08:00
Luna Yao	6abc3731ae	perf(wireguard): rename WG_MAX_PACKET_SIZE and optimize scratch buffers with FixedBufPool (#2627)	2026-10-05 11:57:40 +08:00