multi_fix: harden peer/session handling, tighten foreign-network trust, and improve web client metadata (#1999)

* machine-id should be scoped unbder same user-id
* feat: report device os metadata to console
* fix sync root key cause packet loss
* fix tun packet not invalid
* fix faketcp cause lat jitter
* fix some packet not decrypt
* fix peer info patch, improve performance of update self info
* fix foreign credential identity mismatch handling

easytier-web/src/restful/mod.rs

@@ -31,7 +31,7 @@ use users::{AuthSession, Backend};
 
 use crate::client_manager::storage::StorageToken;
 use crate::client_manager::ClientManager;
-use crate::db::Db;
+use crate::db::{Db, UserIdInDb};
 use crate::webhook::SharedWebhookConfig;
 use crate::FeatureFlags;
 
@@ -252,7 +252,7 @@ impl RestfulServer {
                     get(Self::handle_list_all_sessions_internal),
                 )
                 .route(
-                    "/api/internal/sessions/:machine-id",
+                    "/api/internal/users/:user-id/sessions/:machine-id",
                     delete(Self::handle_disconnect_session_internal),
                 )
                 .merge(NetworkApi::build_route_internal())
@@ -315,11 +315,11 @@ impl RestfulServer {
     }
 
     async fn handle_disconnect_session_internal(
-        Path(machine_id): Path<uuid::Uuid>,
+        Path((user_id, machine_id)): Path<(UserIdInDb, uuid::Uuid)>,
         State(client_mgr): AppState,
     ) -> Result<StatusCode, HttpHandleError> {
         if client_mgr
-            .disconnect_session_by_machine_id_global(&machine_id)
+            .disconnect_session_by_machine_id(user_id, &machine_id)
             .await
         {
             Ok(StatusCode::NO_CONTENT)

easytier-web/src/restful/network.rs

@@ -299,10 +299,9 @@ impl NetworkApi {
 
     async fn handle_run_network_instance_internal(
         State(client_mgr): AppState,
-        Path(machine_id): Path<uuid::Uuid>,
+        Path((user_id, machine_id)): Path<(UserIdInDb, uuid::Uuid)>,
         Json(payload): Json<RunNetworkJsonReq>,
     ) -> Result<Json<Void>, HttpHandleError> {
-        let user_id = Self::get_user_id_from_machine(&client_mgr, &machine_id)?;
         client_mgr
             .handle_run_network_instance((user_id, machine_id), payload.config, payload.save)
             .await
@@ -312,9 +311,8 @@ impl NetworkApi {
 
     async fn handle_remove_network_instance_internal(
         State(client_mgr): AppState,
-        Path((machine_id, inst_id)): Path<(uuid::Uuid, uuid::Uuid)>,
+        Path((user_id, machine_id, inst_id)): Path<(UserIdInDb, uuid::Uuid, uuid::Uuid)>,
     ) -> Result<(), HttpHandleError> {
-        let user_id = Self::get_user_id_from_machine(&client_mgr, &machine_id)?;
         client_mgr
             .handle_remove_network_instances((user_id, machine_id), vec![inst_id])
             .await
@@ -323,9 +321,8 @@ impl NetworkApi {
 
     async fn handle_list_network_instance_ids_internal(
         State(client_mgr): AppState,
-        Path(machine_id): Path<uuid::Uuid>,
+        Path((user_id, machine_id)): Path<(UserIdInDb, uuid::Uuid)>,
     ) -> Result<Json<ListNetworkInstanceIdsJsonResp>, HttpHandleError> {
-        let user_id = Self::get_user_id_from_machine(&client_mgr, &machine_id)?;
         Ok(client_mgr
             .handle_list_network_instance_ids((user_id, machine_id))
             .await
@@ -335,10 +332,9 @@ impl NetworkApi {
 
     async fn handle_collect_network_info_internal(
         State(client_mgr): AppState,
-        Path(machine_id): Path<uuid::Uuid>,
+        Path((user_id, machine_id)): Path<(UserIdInDb, uuid::Uuid)>,
         Json(payload): Json<CollectNetworkInfoJsonReq>,
     ) -> Result<Json<CollectNetworkInfoResponse>, HttpHandleError> {
-        let user_id = Self::get_user_id_from_machine(&client_mgr, &machine_id)?;
         Ok(client_mgr
             .handle_collect_network_info((user_id, machine_id), payload.inst_ids)
             .await
@@ -346,32 +342,19 @@ impl NetworkApi {
             .into())
     }
 
-    /// Look up user_id from a machine's active session token.
-    fn get_user_id_from_machine(
-        client_mgr: &AppStateInner,
-        machine_id: &uuid::Uuid,
-    ) -> Result<UserIdInDb, HttpHandleError> {
-        client_mgr
-            .get_user_id_by_machine_id_global(machine_id)
-            .ok_or((
-                StatusCode::NOT_FOUND,
-                other_error("Machine not found").into(),
-            ))
-    }
-
     pub fn build_route_internal() -> Router<AppStateInner> {
         Router::new()
             .route(
-                "/api/internal/machines/:machine-id/networks",
+                "/api/internal/users/:user-id/machines/:machine-id/networks",
                 post(Self::handle_run_network_instance_internal)
                     .get(Self::handle_list_network_instance_ids_internal),
             )
             .route(
-                "/api/internal/machines/:machine-id/networks/:inst-id",
+                "/api/internal/users/:user-id/machines/:machine-id/networks/:inst-id",
                 delete(Self::handle_remove_network_instance_internal),
             )
             .route(
-                "/api/internal/machines/:machine-id/networks/info",
+                "/api/internal/users/:user-id/machines/:machine-id/networks/info",
                 get(Self::handle_collect_network_info_internal),
             )
     }

easytier-web/src/restful/rpc.rs

@@ -7,6 +7,8 @@ use axum::{
 use axum_login::AuthUser as _;
 use easytier::proto::rpc_types::controller::BaseController;
 
+use crate::db::UserIdInDb;
+
 use super::{other_error, AppState, HttpHandleError};
 
 #[derive(Debug, serde::Deserialize)]
@@ -162,11 +164,11 @@ pub fn router() -> Router<super::AppStateInner> {
 /// Internal proxy-rpc handler: no AuthSession, resolves the active session by machine_id.
 pub async fn handle_proxy_rpc_internal(
     State(client_mgr): AppState,
-    Path(machine_id): Path<uuid::Uuid>,
+    Path((user_id, machine_id)): Path<(UserIdInDb, uuid::Uuid)>,
     Json(req): Json<ProxyRpcRequest>,
 ) -> Result<Json<serde_json::Value>, HttpHandleError> {
     let session = client_mgr
-        .get_session_by_machine_id_global(&machine_id)
+        .get_session_by_machine_id(user_id, &machine_id)
         .ok_or((
             StatusCode::NOT_FOUND,
             other_error("Session not found").into(),
@@ -176,7 +178,7 @@ pub async fn handle_proxy_rpc_internal(
 
 pub fn router_internal() -> Router<super::AppStateInner> {
     Router::new().route(
-        "/api/internal/machines/:machine-id/proxy-rpc",
+        "/api/internal/users/:user-id/machines/:machine-id/proxy-rpc",
         post(handle_proxy_rpc_internal),
     )
 }