Address review comments

Stop sharing PeerCenterServer state through a process-global map so local and foreign-network services cannot mix peer-center data when peer ids overlap.

.cargo/config.toml

@@ -1,29 +1,40 @@
-[target.x86_64-unknown-linux-musl]
+# region Native
-linker = "rust-lld"
+
-rustflags = ["-C", "linker-flavor=ld.lld"]
+[target.x86_64-unknown-linux-gnu]
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 
 [target.aarch64-unknown-linux-gnu]
-linker = "aarch64-linux-gnu-gcc"
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
 
-[target.aarch64-unknown-linux-ohos]
+[target.'cfg(all(windows, target_env = "msvc"))']
-ar = "/usr/local/ohos-sdk/linux/native/llvm/bin/llvm-ar"
+rustflags = ["-C", "target-feature=+crt-static"]
-linker = "/home/runner/sdk/native/llvm/aarch64-unknown-linux-ohos-clang.sh"
 
-[target.aarch64-unknown-linux-ohos.env]
+# region
-PKG_CONFIG_PATH = "/usr/local/ohos-sdk/linux/native/sysroot/usr/lib/pkgconfig:/usr/local/ohos-sdk/linux/native/sysroot/usr/local/lib/pkgconfig"
+
-PKG_CONFIG_LIBDIR = "/usr/local/ohos-sdk/linux/native/sysroot/usr/lib:/usr/local/ohos-sdk/linux/native/sysroot/usr/local/lib"
+# region CI
-PKG_CONFIG_SYSROOT_DIR = "/usr/local/ohos-sdk/linux/native/sysroot"
+
-SYSROOT = "/usr/local/ohos-sdk/linux/native/sysroot"
+[target.x86_64-unknown-linux-musl]
+rustflags = ["-C", "target-feature=+crt-static"]
 
 [target.aarch64-unknown-linux-musl]
-linker = "aarch64-unknown-linux-musl-gcc"
 rustflags = ["-C", "target-feature=+crt-static"]
 
 [target.riscv64gc-unknown-linux-musl]
-linker = "riscv64-unknown-linux-musl-gcc"
 rustflags = ["-C", "target-feature=+crt-static"]
 
-[target.'cfg(all(windows, target_env = "msvc"))']
+[target.armv7-unknown-linux-musleabihf]
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.armv7-unknown-linux-musleabi]
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.arm-unknown-linux-musleabihf]
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.arm-unknown-linux-musleabi]
+rustflags = ["-C", "target-feature=+crt-static"]
+
+[target.loongarch64-unknown-linux-musl]
 rustflags = ["-C", "target-feature=+crt-static"]
 
 [target.mipsel-unknown-linux-musl]
@@ -64,44 +75,14 @@ rustflags = [
     "gcc",
 ]
 
-[target.armv7-unknown-linux-musleabihf]
+[target.aarch64-unknown-linux-ohos]
-linker = "armv7-unknown-linux-musleabihf-gcc"
+ar = "/usr/local/ohos-sdk/linux/native/llvm/bin/llvm-ar"
-rustflags = ["-C", "target-feature=+crt-static"]
+linker = "/home/runner/sdk/native/llvm/aarch64-unknown-linux-ohos-clang.sh"
 
-[target.armv7-unknown-linux-musleabi]
+[target.aarch64-unknown-linux-ohos.env]
-linker = "armv7-unknown-linux-musleabi-gcc"
+PKG_CONFIG_PATH = "/usr/local/ohos-sdk/linux/native/sysroot/usr/lib/pkgconfig:/usr/local/ohos-sdk/linux/native/sysroot/usr/local/lib/pkgconfig"
-rustflags = ["-C", "target-feature=+crt-static"]
+PKG_CONFIG_LIBDIR = "/usr/local/ohos-sdk/linux/native/sysroot/usr/lib:/usr/local/ohos-sdk/linux/native/sysroot/usr/local/lib"
+PKG_CONFIG_SYSROOT_DIR = "/usr/local/ohos-sdk/linux/native/sysroot"
+SYSROOT = "/usr/local/ohos-sdk/linux/native/sysroot"
 
-[target.loongarch64-unknown-linux-musl]
+# endregion
-linker = "loongarch64-unknown-linux-musl-gcc"
-rustflags = ["-C", "target-feature=+crt-static"]
-
-[target.arm-unknown-linux-musleabihf]
-linker = "arm-unknown-linux-musleabihf-gcc"
-rustflags = [
-    "-C",
-    "target-feature=+crt-static",
-    "-L",
-    "./musl_gcc/arm-unknown-linux-musleabihf/arm-unknown-linux-musleabihf/lib",
-    "-L",
-    "./musl_gcc/arm-unknown-linux-musleabihf/lib/gcc/arm-unknown-linux-musleabihf/15.1.0",
-    "-l",
-    "atomic",
-    "-l",
-    "gcc",
-]
-
-[target.arm-unknown-linux-musleabi]
-linker = "arm-unknown-linux-musleabi-gcc"
-rustflags = [
-    "-C",
-    "target-feature=+crt-static",
-    "-L",
-    "./musl_gcc/arm-unknown-linux-musleabi/arm-unknown-linux-musleabi/lib",
-    "-L",
-    "./musl_gcc/arm-unknown-linux-musleabi/lib/gcc/arm-unknown-linux-musleabi/15.1.0",
-    "-l",
-    "atomic",
-    "-l",
-    "gcc",
-]

.github/actions/prepare-build/action.yml

@@ -2,10 +2,17 @@ name: prepare-build
 author: Luna
 description: Prepare build environment
 inputs:
-  web:
+  target:
-    description: 'Whether to prepare the web build environment'
+    description: 'The target to build for'
+    required: false
+  pnpm:
+    description: 'Whether to run pnpm build'
     required: true
     default: 'true'
+  pnpm-build-filter:
+    description: 'The filter argument for pnpm build (e.g. ./easytier-web/*)'
+    required: false
+    default: './easytier-web/*'
   gui:
     description: 'Whether to prepare the GUI build environment'
     required: true
@@ -19,21 +26,61 @@ runs:
     - run: mkdir -p easytier-gui/dist
       shell: bash
 
-    - name: Setup Frontend Environment
+    - name: Install dependencies
-      if: ${{ inputs.web == 'true' }}
+      if: ${{ runner.os == 'Linux' }}
-      uses: ./.github/actions/prepare-pnpm
-      with:
-        build_filter: './easytier-web/*'
-
-    - name: Install GUI dependencies (Used by clippy)
-      if: ${{ inputs.gui == 'true' }}
       run: |
-        bash ./.github/workflows/install_gui_dep.sh
+        sudo apt-get update
+        sudo apt-get install -qqy build-essential mold musl-tools
       shell: bash
 
-    - name: Install Rust
+    - name: Setup Frontend Environment
+      if: ${{ inputs.pnpm == 'true' }}
+      uses: ./.github/actions/prepare-pnpm
+      with:
+        build-filter: ${{ inputs.pnpm-build-filter }}
+
+    - name: Install GUI dependencies (Linux)
+      if: ${{ inputs.gui == 'true' && runner.os == 'Linux' }}
       run: |
-        bash ./.github/workflows/install_rust.sh
+        sudo apt-get install -qq xdg-utils \
+        libappindicator3-dev \
+        libgtk-3-dev \
+        librsvg2-dev \
+        libwebkit2gtk-4.1-dev \
+        libxdo-dev
+      shell: bash
+
+    - uses: actions-rust-lang/setup-rust-toolchain@v1
+      with:
+        toolchain: 1.95
+        target: ${{ !contains(inputs.target, 'mips') && inputs.target || '' }}
+        components: ${{ contains(inputs.target, 'mips') && 'rust-src' || '' }}
+        cache: false
+        rustflags: ''
+
+    - name: Install Rust (MIPS)
+      if: ${{ contains(inputs.target, 'mips') }}
+      run: |
+        MUSL_TARGET=${{ inputs.target }}sf
+        mkdir -p ./musl_gcc
+        wget --inet4-only -c https://github.com/cross-tools/musl-cross/releases/download/20250520/${MUSL_TARGET}.tar.xz -P ./musl_gcc/
+        tar xf ./musl_gcc/${MUSL_TARGET}.tar.xz -C ./musl_gcc/
+        sudo ln -sf $(pwd)/musl_gcc/${MUSL_TARGET}/bin/*gcc /usr/bin/
+        sudo ln -sf $(pwd)/musl_gcc/${MUSL_TARGET}/include/ /usr/include/musl-cross
+        sudo ln -sf $(pwd)/musl_gcc/${MUSL_TARGET}/${MUSL_TARGET}/sysroot/ ./musl_gcc/sysroot
+        sudo chmod -R a+rwx ./musl_gcc
+
+        if [[ -d "./musl_gcc/sysroot" ]]; then
+          echo "BINDGEN_EXTRA_CLANG_ARGS=--sysroot=$(readlink -f ./musl_gcc/sysroot)" >> $GITHUB_ENV
+        fi
+
+        cd "$PWD/musl_gcc/${MUSL_TARGET}/lib/gcc/${MUSL_TARGET}/15.1.0" || exit 255
+        # for panic-abort
+        cp libgcc_eh.a libunwind.a
+        
+        # for mimalloc
+        ar x libgcc.a _ctzsi2.o _clz.o _bswapsi2.o
+        ar rcs libctz.a _ctzsi2.o _clz.o _bswapsi2.o
       shell: bash
 
     - name: Setup protoc

.github/actions/prepare-pnpm/action.yml

@@ -3,20 +3,21 @@ author: Luna
 description: 'Setup Node.js, pnpm, and install dependencies'
 
 inputs:
-  build_filter:
+  build-filter:
     description: 'The filter argument for pnpm build (e.g. ./easytier-web/*)'
-    required: true
+    required: false
+    default: ''
 
 runs:
   using: "composite"
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: 22
 
     - name: Install pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@v5
       with:
         version: 10
         run_install: false
@@ -27,7 +28,7 @@ runs:
         echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
     - name: Setup pnpm cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ${{ env.STORE_PATH }}
         key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
@@ -38,5 +39,10 @@ runs:
       shell: bash
       run: |
         pnpm -r install
-        echo "Building with filter: ${{ inputs.build_filter }}"
+        if [ -n "${{ inputs.build-filter }}" ]; then
-        pnpm -r --filter "${{ inputs.build_filter }}" build
+          echo "Building with filter: ${{ inputs.build-filter }}"
+          pnpm -r --filter "${{ inputs.build-filter }}" build
+        else
+          echo "No build filter provided, building all packages"
+          pnpm -r build
+        fi

.github/workflows/core.yml

@@ -2,9 +2,14 @@ name: EasyTier Core
 
 on:
   push:
-    branches: ["develop", "main", "releases/**"]
+    branches: [ "develop", "main", "releases/**" ]
   pull_request:
-    branches: ["develop", "main"]
+    branches: [ "develop", "main" ]
+    types: [ opened, synchronize, reopened, ready_for_review ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
@@ -18,6 +23,7 @@ jobs:
   pre_job:
     # continue-on-error: true # Uncomment once integration is finished
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     # Map a step output to a job output
     outputs:
       # do not skip push on branch starts with releases/
@@ -30,85 +36,69 @@ jobs:
           concurrent_skipping: 'same_content_newer'
           skip_after_successful_duplicate: 'true'
           cancel_others: 'true'
-          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", ".github/workflows/core.yml", ".github/workflows/install_rust.sh", "easytier-web/**"]'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", ".github/workflows/core.yml", ".github/actions/**", "easytier-web/**"]'
   build_web:
     runs-on: ubuntu-latest
     needs: pre_job
     if: needs.pre_job.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - name: Setup Frontend Environment
+        uses: ./.github/actions/prepare-pnpm
         with:
-          node-version: 22
+          build-filter: './easytier-web/*'
-
-      - name: Install pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-          run_install: false
-
-      - name: Get pnpm store directory
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v4
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Install frontend dependencies
-        run: |
-          pnpm -r install
-          pnpm -r --filter "./easytier-web/*"  build
 
       - name: Archive artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: easytier-web-dashboard
           path: |
             easytier-web/frontend/dist/*
   build:
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
-          - TARGET: aarch64-unknown-linux-musl
-            OS: ubuntu-22.04
-            ARTIFACT_NAME: linux-aarch64
           - TARGET: x86_64-unknown-linux-musl
-            OS: ubuntu-22.04
+            OS: ubuntu-24.04
             ARTIFACT_NAME: linux-x86_64
-          - TARGET: riscv64gc-unknown-linux-musl
+          - TARGET: aarch64-unknown-linux-musl
-            OS: ubuntu-22.04
+            OS: ubuntu-24.04-arm
-            ARTIFACT_NAME: linux-riscv64
+            ARTIFACT_NAME: linux-aarch64
-          - TARGET: mips-unknown-linux-musl
-            OS: ubuntu-22.04
-            ARTIFACT_NAME: linux-mips
-          - TARGET: mipsel-unknown-linux-musl
-            OS: ubuntu-22.04
-            ARTIFACT_NAME: linux-mipsel
-          - TARGET: armv7-unknown-linux-musleabihf # raspberry pi 2-3-4, not tested
-            OS: ubuntu-22.04
-            ARTIFACT_NAME: linux-armv7hf
-          - TARGET: armv7-unknown-linux-musleabi # raspberry pi 2-3-4, not tested
-            OS: ubuntu-22.04
-            ARTIFACT_NAME: linux-armv7
-          - TARGET: arm-unknown-linux-musleabihf # raspberry pi 0-1, not tested
-            OS: ubuntu-22.04
-            ARTIFACT_NAME: linux-armhf
-          - TARGET: arm-unknown-linux-musleabi # raspberry pi 0-1, not tested
-            OS: ubuntu-22.04
-            ARTIFACT_NAME: linux-arm
 
+          - TARGET: riscv64gc-unknown-linux-musl
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: linux-riscv64
           - TARGET: loongarch64-unknown-linux-musl
             OS: ubuntu-24.04
             ARTIFACT_NAME: linux-loongarch64
 
+          - TARGET: armv7-unknown-linux-musleabihf # raspberry pi 2-3-4, not tested
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: linux-armv7hf
+          - TARGET: armv7-unknown-linux-musleabi # raspberry pi 2-3-4, not tested
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: linux-armv7
+          - TARGET: arm-unknown-linux-musleabihf # raspberry pi 0-1, not tested
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: linux-armhf
+          - TARGET: arm-unknown-linux-musleabi # raspberry pi 0-1, not tested
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: linux-arm
+
+          - TARGET: mips-unknown-linux-musl
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: linux-mips
+          - TARGET: mipsel-unknown-linux-musl
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: linux-mipsel
+
+          - TARGET: x86_64-unknown-freebsd
+            OS: ubuntu-24.04
+            ARTIFACT_NAME: freebsd-13.2-x86_64
+            BSD_VERSION: 13.2
+
           - TARGET: x86_64-apple-darwin
             OS: macos-latest
             ARTIFACT_NAME: macos-x86_64
@@ -119,17 +109,12 @@ jobs:
           - TARGET: x86_64-pc-windows-msvc
             OS: windows-latest
             ARTIFACT_NAME: windows-x86_64
-          - TARGET: aarch64-pc-windows-msvc
-            OS: windows-latest
-            ARTIFACT_NAME: windows-arm64
           - TARGET: i686-pc-windows-msvc
             OS: windows-latest
             ARTIFACT_NAME: windows-i686
-
+          - TARGET: aarch64-pc-windows-msvc
-          - TARGET: x86_64-unknown-freebsd
+            OS: windows-11-arm
-            OS: ubuntu-22.04
+            ARTIFACT_NAME: windows-arm64
-            ARTIFACT_NAME: freebsd-13.2-x86_64
-            BSD_VERSION: 13.2
 
     runs-on: ${{ matrix.OS }}
     env:
@@ -142,7 +127,7 @@ jobs:
       - build_web
     if: needs.pre_job.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       - name: Set current ref as env variable
         run: |
@@ -154,8 +139,15 @@ jobs:
           name: easytier-web-dashboard
           path: easytier-web/frontend/dist/
 
+      - name: Prepare build environment
+        uses: ./.github/actions/prepare-build
+        with:
+          target: ${{ matrix.TARGET }}
+          gui: true
+          pnpm: true
+          token: ${{ secrets.GITHUB_TOKEN }}
+
       - uses: Swatinem/rust-cache@v2
-        if: ${{ ! endsWith(matrix.TARGET, 'freebsd') }}
         with:
           # The prefix cache key, this can be changed to start a new cache manually.
           # default: "v0-rust"
@@ -163,96 +155,51 @@ jobs:
           shared-key: "core-registry"
           cache-targets: "false"
 
-      - name: Setup protoc
+      - uses: mlugg/setup-zig@v2
-        uses: arduino/setup-protoc@v3
+        if: ${{ contains(matrix.OS, 'ubuntu') }}
+
+      - uses: taiki-e/install-action@v2
+        if: ${{ contains(matrix.OS, 'ubuntu') }}
         with:
-          # GitHub repo token to use to avoid rate limiter
+          tool: cargo-zigbuild
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build Core & Cli
+      - name: Build
-        if: ${{ ! endsWith(matrix.TARGET, 'freebsd') }}
+        if: ${{ !contains(matrix.TARGET, 'mips') }}
-        run: |
+        run: |          
-          bash ./.github/workflows/install_rust.sh
+          if [[ "$TARGET" == *windows* ]]; then
-
+            SUFFIX=.exe
-          # loongarch need llvm-18
-          if [[ $TARGET =~ ^loongarch.*$ ]]; then
-            sudo apt-get install -qq llvm-18 clang-18
-            export LLVM_CONFIG_PATH=/usr/lib/llvm-18/bin/llvm-config
-          fi
-          # we set the sysroot when sysroot is a dir
-          # this dir is a soft link generated by install_rust.sh
-          # kcp-sys need this to gen ffi bindings. without this clang may fail to find some libc headers such as bits/libc-header-start.h
-          if [[ -d "./musl_gcc/sysroot" ]]; then
-            export BINDGEN_EXTRA_CLANG_ARGS=--sysroot=$(readlink -f ./musl_gcc/sysroot)
-          fi
-
-          if [[ $OS =~ ^ubuntu.*$ && $TARGET =~ ^mips.*$ ]]; then
-            cargo +nightly-2026-02-02 build -r --target $TARGET -Z build-std=std,panic_abort --package=easytier --features=jemalloc
           else
-            if [[ $OS =~ ^windows.*$ ]]; then
+            SUFFIX=""
-              SUFFIX=.exe
-              CORE_FEATURES="--features=mimalloc"
-            elif [[ $TARGET =~ ^riscv64.*$ || $TARGET =~ ^loongarch64.*$ || $TARGET =~ ^aarch64.*$ ]]; then
-              CORE_FEATURES="--features=mimalloc"
-            else
-              CORE_FEATURES="--features=jemalloc"
-            fi
-            cargo build --release --target $TARGET --package=easytier-web --features=embed
-            mv ./target/$TARGET/release/easytier-web"$SUFFIX" ./target/$TARGET/release/easytier-web-embed"$SUFFIX"
-            cargo build --release --target $TARGET $CORE_FEATURES
           fi
 
-      # Copied and slightly modified from @lmq8267 (https://github.com/lmq8267)
+          if [[ "$TARGET" =~ (x86_64-unknown-linux-musl|aarch64-unknown-linux-musl|windows|darwin) ]]; then
-      - name: Build Core & Cli (X86_64 FreeBSD)
+            BUILD=build
-        uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27
+          else
-        if: ${{ endsWith(matrix.TARGET, 'freebsd') }}
+            BUILD=zigbuild
+          fi
+
+          if [[ "$TARGET" =~ ^(riscv64|loongarch64|aarch64).*$ || "$TARGET" =~ (freebsd|windows) ]]; then
+            FEATURES="mimalloc"
+          else
+            FEATURES="jemalloc"
+          fi
+          
+          cargo $BUILD --release --target $TARGET --package=easytier-web --features=embed
+          mv ./target/$TARGET/release/easytier-web"$SUFFIX" ./target/$TARGET/release/easytier-web-embed"$SUFFIX"
+          
+          cargo $BUILD --release --target $TARGET --features=$FEATURES
+
+      - name: Build (MIPS)
+        if: ${{ contains(matrix.TARGET, 'mips') }}
         env:
-          TARGET: ${{ matrix.TARGET }}
+          RUSTC_BOOTSTRAP: 1
-        with:
+        run: |
-          envs: TARGET
+          cargo build -r --target $TARGET -Z build-std=std,panic_abort --package=easytier --features=jemalloc
-          release: ${{ matrix.BSD_VERSION }}
-          arch: x86_64
-          usesh: true
-          mem: 6144
-          cpu: 4
-          run: |
-            uname -a
-            echo $SHELL
-            pwd
-            ls -lah
-            whoami
-            env | sort
-
-            pkg install -y git protobuf llvm-devel sudo curl
-            curl --proto 'https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-            . $HOME/.cargo/env
-
-            rustup set auto-self-update disable
-
-            rustup install 1.93
-            rustup default 1.93
-
-            export CC=clang
-            export CXX=clang++
-            export CARGO_TERM_COLOR=always
-
-            cargo build --release --verbose --target $TARGET --package=easytier-web --features=embed
-            mv ./target/$TARGET/release/easytier-web ./target/$TARGET/release/easytier-web-embed
-            cargo build --release --verbose --target $TARGET --features=mimalloc
-
-            mkdir -p built-bins/$TARGET/release/
-            mv ./target/$TARGET/release/easytier-web-embed ./built-bins/$TARGET/release/easytier-web-embed
-            mv ./target/$TARGET/release/easytier-web ./built-bins/$TARGET/release/easytier-web
-            mv ./target/$TARGET/release/easytier-core ./built-bins/$TARGET/release/easytier-core
-            mv ./target/$TARGET/release/easytier-cli ./built-bins/$TARGET/release/easytier-cli
-
-            # remove dirs to avoid copy many files back
-            rm -rf ./target ~/.cargo
-            mv ./built-bins ./target
 
       - name: Compress
         run: |
           mkdir -p ./artifacts/objects/
+
           # windows is the only OS using a different convention for executable file name
           if [[ $OS =~ ^windows.*$ ]]; then
               SUFFIX=.exe
@@ -265,59 +212,55 @@ jobs:
                   find "easytier/third_party/${ARCH_DIR}" -maxdepth 1 -type f \( -name "*.dll" -o -name "*.sys" \) -exec cp {} ./artifacts/objects/ \;
               fi
           fi
+
           if [[ $GITHUB_REF_TYPE =~ ^tag$ ]]; then
             TAG=$GITHUB_REF_NAME
           else
             TAG=$GITHUB_SHA
           fi
+          
+          if [[ $OS =~ ^ubuntu.*$ && ! $TARGET =~ (loongarch|freebsd) ]]; then
+            HOST_ARCH=$(uname -m)
+            case $HOST_ARCH in
+              x86_64)  UPX_ARCH="amd64" ;;
+              aarch64) UPX_ARCH="arm64" ;;
+              *)       UPX_ARCH="amd64" ;;
+            esac
 
-          if [[ $OS =~ ^ubuntu.*$ && ! $TARGET =~ ^.*freebsd$ && ! $TARGET =~ ^loongarch.*$ && ! $TARGET =~ ^riscv64.*$ ]]; then
+            UPX_VERSION=5.1.1
-            UPX_VERSION=4.2.4
+            UPX_PKG="upx-${UPX_VERSION}-${UPX_ARCH}_linux"
-            curl -L https://github.com/upx/upx/releases/download/v${UPX_VERSION}/upx-${UPX_VERSION}-amd64_linux.tar.xz -s | tar xJvf -
+            curl -L "https://github.com/upx/upx/releases/download/v${UPX_VERSION}/${UPX_PKG}.tar.xz" -s | tar xJvf -
-            cp upx-${UPX_VERSION}-amd64_linux/upx .
+            cp "${UPX_PKG}/upx" .
-            ./upx --lzma --best ./target/$TARGET/release/easytier-core"$SUFFIX"
+            UPX_BIN=./upx
-            ./upx --lzma --best ./target/$TARGET/release/easytier-cli"$SUFFIX"
           fi
 
-          mv ./target/$TARGET/release/easytier-core"$SUFFIX" ./artifacts/objects/
+          for BIN in ./target/$TARGET/release/easytier-{core,cli,web,web-embed}"$SUFFIX"; do
-          mv ./target/$TARGET/release/easytier-cli"$SUFFIX" ./artifacts/objects/
+            if [[ -f "$BIN" ]]; then
-          if [[ ! $TARGET =~ ^mips.*$ ]]; then
+              if [[ -n "$UPX_BIN" ]]; then
-            mv ./target/$TARGET/release/easytier-web"$SUFFIX" ./artifacts/objects/
+                $UPX_BIN --lzma --best "$BIN" || true
-            mv ./target/$TARGET/release/easytier-web-embed"$SUFFIX" ./artifacts/objects/
+              fi
-          fi
+
+              mv "$BIN" ./artifacts/objects/
+            fi
+          done
 
           mv ./artifacts/objects/* ./artifacts/
           rm -rf ./artifacts/objects/
 
       - name: Archive artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: easytier-${{ matrix.ARTIFACT_NAME }}
           path: |
             ./artifacts/*
 
-  core-result:
+  build_magisk:
-    if: needs.pre_job.outputs.should_skip != 'true' && always()
-    runs-on: ubuntu-latest
-    needs:
-      - pre_job
-      - build_web
-      - build
-    steps:
-      - name: Mark result as failed
-        if: needs.build.result != 'success'
-        run: exit 1
-
-  magisk_build:
-    needs: 
-      - pre_job
-      - build_web
-      - build
-    if: needs.pre_job.outputs.should_skip != 'true' && always()
     runs-on: ubuntu-latest
+    needs: [ pre_job, build_web, build ]
+    if: needs.pre_job.result == 'success' && needs.pre_job.outputs.should_skip != 'true' && !cancelled()
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4  # 必须先检出代码才能获取模块配置
+        uses: actions/checkout@v5  # 必须先检出代码才能获取模块配置
 
       # 下载二进制文件到独立目录
       - name: Download Linux aarch64 binaries
@@ -334,10 +277,9 @@ jobs:
           cp ./downloaded-binaries/easytier-cli ./easytier-contrib/easytier-magisk/
           cp ./downloaded-binaries/easytier-web ./easytier-contrib/easytier-magisk/
 
-
       # 上传生成的模块
       - name: Upload Magisk Module
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: Easytier-Magisk
           path: |
@@ -345,3 +287,12 @@ jobs:
             !./easytier-contrib/easytier-magisk/build.sh
             !./easytier-contrib/easytier-magisk/magisk_update.json
           if-no-files-found: error
+
+  core-result:
+    runs-on: ubuntu-latest
+    needs: [ pre_job, build_web, build, build_magisk ]
+    if: needs.pre_job.result == 'success' && needs.pre_job.outputs.should_skip != 'true' && !cancelled()
+    steps:
+      - name: Mark result as failed
+        if: contains(needs.*.result, 'failure')
+        run: exit 1

.github/workflows/docker.yml

@@ -11,7 +11,7 @@ on:
       image_tag:
         description: 'Tag for this image build'
         type: string
-        default: 'v2.5.0'
+        default: 'v2.6.3'
         required: true
       mark_latest:
         description: 'Mark this image as latest'
@@ -31,7 +31,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       -
         name: Validate inputs
         run: |

.github/workflows/gui.yml

@@ -5,7 +5,12 @@ on:
     branches: ["develop", "main", "releases/**"]
   pull_request:
     branches: ["develop", "main"]
-      
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -18,6 +23,7 @@ jobs:
   pre_job:
     # continue-on-error: true # Uncomment once integration is finished
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     # Map a step output to a job output
     outputs:
       should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }}
@@ -29,20 +35,20 @@ jobs:
           concurrent_skipping: 'same_content_newer'
           skip_after_successful_duplicate: 'true'
           cancel_others: 'true'
-          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-gui/**", ".github/workflows/gui.yml", ".github/workflows/install_rust.sh", ".github/workflows/install_gui_dep.sh", "easytier-web/frontend-lib/**"]'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-gui/**", ".github/workflows/gui.yml", ".github/actions/**", "easytier-web/frontend-lib/**"]'
   build-gui:
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
-          - TARGET: aarch64-unknown-linux-musl
-            OS: ubuntu-22.04
-            GUI_TARGET: aarch64-unknown-linux-gnu
-            ARTIFACT_NAME: linux-aarch64
           - TARGET: x86_64-unknown-linux-musl
-            OS: ubuntu-22.04
+            OS: ubuntu-24.04
             GUI_TARGET: x86_64-unknown-linux-gnu
             ARTIFACT_NAME: linux-x86_64
+          - TARGET: aarch64-unknown-linux-musl
+            OS: ubuntu-24.04-arm
+            GUI_TARGET: aarch64-unknown-linux-gnu
+            ARTIFACT_NAME: linux-aarch64
 
           - TARGET: x86_64-apple-darwin
             OS: macos-latest
@@ -57,16 +63,14 @@ jobs:
             OS: windows-latest
             GUI_TARGET: x86_64-pc-windows-msvc
             ARTIFACT_NAME: windows-x86_64
-
-          - TARGET: aarch64-pc-windows-msvc
-            OS: windows-latest
-            GUI_TARGET: aarch64-pc-windows-msvc
-            ARTIFACT_NAME: windows-arm64
-
           - TARGET: i686-pc-windows-msvc
             OS: windows-latest
             GUI_TARGET: i686-pc-windows-msvc
             ARTIFACT_NAME: windows-i686
+          - TARGET: aarch64-pc-windows-msvc
+            OS: windows-11-arm
+            GUI_TARGET: aarch64-pc-windows-msvc
+            ARTIFACT_NAME: windows-arm64
 
     runs-on: ${{ matrix.OS }}
     env:
@@ -78,96 +82,31 @@ jobs:
     needs: pre_job
     if: needs.pre_job.outputs.should_skip != 'true'    
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
-
-      - name: Install GUI dependencies (x86 only)
-        if: ${{ matrix.TARGET == 'x86_64-unknown-linux-musl' }}
-        run: bash ./.github/workflows/install_gui_dep.sh
-
-      - name: Install GUI cross compile (aarch64 only)
-        if: ${{ matrix.TARGET == 'aarch64-unknown-linux-musl' }}
-        run: |
-          # see https://tauri.app/v1/guides/building/linux/
-          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy main restricted" | sudo tee /etc/apt/sources.list
-          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-updates main restricted" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy universe" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-updates universe" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy multiverse" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-updates multiverse" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ jammy-backports main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu/ jammy-security main restricted" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu/ jammy-security universe" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=amd64] http://security.ubuntu.com/ubuntu/ jammy-security multiverse" | sudo tee -a /etc/apt/sources.list
-
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy main restricted" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates main restricted" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy universe" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates universe" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy multiverse" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-updates multiverse" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-backports main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security main restricted" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security universe" | sudo tee -a /etc/apt/sources.list
-          echo "deb [arch=armhf,arm64] http://ports.ubuntu.com/ubuntu-ports jammy-security multiverse" | sudo tee -a /etc/apt/sources.list
-
-          sudo dpkg --add-architecture arm64
-          sudo apt update
-          sudo apt install aptitude
-          sudo aptitude install -y libgstreamer1.0-0:arm64 gstreamer1.0-plugins-base:arm64 gstreamer1.0-plugins-good:arm64 \
-            libgstreamer-gl1.0-0:arm64 libgstreamer-plugins-base1.0-0:arm64 libgstreamer-plugins-good1.0-0:arm64 libwebkit2gtk-4.1-0:arm64 \
-            libwebkit2gtk-4.1-dev:arm64 libssl-dev:arm64 gcc-aarch64-linux-gnu libsoup-3.0-dev:arm64 libjavascriptcoregtk-4.1-dev:arm64
-          echo "PKG_CONFIG_SYSROOT_DIR=/usr/aarch64-linux-gnu/" >> "$GITHUB_ENV"
-          echo "PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig/" >> "$GITHUB_ENV"
 
       - name: Set current ref as env variable
         run: |
           echo "GIT_DESC=$(git log -1 --format=%cd.%h --date=format:%Y-%m-%d_%H:%M:%S)" >> $GITHUB_ENV
 
-      - uses: actions/setup-node@v4
+      - name: Prepare build environment
+        uses: ./.github/actions/prepare-build
         with:
-          node-version: 22
+          target: ${{ matrix.TARGET }}
-
+          gui: true
-      - name: Install pnpm
+          pnpm: true
-        uses: pnpm/action-setup@v4
+          pnpm-build-filter: ''
-        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
-          version: 10
-          run_install: false
-
-      - name: Get pnpm store directory
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v4
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Install frontend dependencies
-        run: |
-          pnpm -r install
-          pnpm -r build
 
       - uses: Swatinem/rust-cache@v2
         with:
           # The prefix cache key, this can be changed to start a new cache manually.
           # default: "v0-rust"
           prefix-key: ""
-
+          shared-key: "gui-registry"
-      - name: Install rust target
+          cache-targets: "false"
-        run: bash ./.github/workflows/install_rust.sh
-
-      - name: Setup protoc
-        uses: arduino/setup-protoc@v3
-        with:
-          # GitHub repo token to use to avoid rate limiter
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: copy correct DLLs
-        if: ${{ matrix.OS == 'windows-latest' }}
+        if: ${{ contains(matrix.GUI_TARGET, 'windows') }}
         run: |
           case $TARGET in
               x86_64*)  ARCH_DIR=x86_64 ;;
@@ -183,10 +122,9 @@ jobs:
         uses: tauri-apps/tauri-action@v0
         with:
           projectPath: ./easytier-gui
-          # https://tauri.app/v1/guides/building/linux/#cross-compiling-tauri-applications-for-arm-based-devices
+          args: --verbose --target ${{ matrix.GUI_TARGET }}
-          args: --verbose --target ${{ matrix.GUI_TARGET }} ${{ matrix.OS == 'ubuntu-22.04' && contains(matrix.TARGET, 'aarch64') && '--bundles deb' || ''  }}
 
-      - name: Compress
+      - name: Collect artifact
         run: |
           mkdir -p ./artifacts/objects/
           
@@ -195,36 +133,33 @@ jobs:
           else
             TAG=$GITHUB_SHA
           fi
+
           # copy gui bundle, gui is built without specific target
-          if [[ $OS =~ ^windows.*$ ]]; then
+          if [[ $GUI_TARGET =~ windows ]]; then
               mv ./target/$GUI_TARGET/release/bundle/nsis/*.exe ./artifacts/objects/
-          elif [[ $OS =~ ^macos.*$ ]]; then
+          elif [[ $GUI_TARGET =~ darwin ]]; then
               mv ./target/$GUI_TARGET/release/bundle/dmg/*.dmg ./artifacts/objects/
-          elif [[ $OS =~ ^ubuntu.*$ && ! $TARGET =~ ^mips.*$ ]]; then
+          elif [[ $GUI_TARGET =~ linux ]]; then
               mv ./target/$GUI_TARGET/release/bundle/deb/*.deb ./artifacts/objects/
-              if [[ $GUI_TARGET =~ ^x86_64.*$ ]]; then
+              mv ./target/$GUI_TARGET/release/bundle/rpm/*.rpm ./artifacts/objects/
-                # currently only x86 appimage is supported
+              mv ./target/$GUI_TARGET/release/bundle/appimage/*.AppImage ./artifacts/objects/
-                mv ./target/$GUI_TARGET/release/bundle/appimage/*.AppImage ./artifacts/objects/
-              fi
           fi
 
           mv ./artifacts/objects/* ./artifacts/
           rm -rf ./artifacts/objects/
 
       - name: Archive artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: easytier-gui-${{ matrix.ARTIFACT_NAME }}
           path: |
             ./artifacts/*
 
   gui-result:
-    if: needs.pre_job.outputs.should_skip != 'true' && always()
     runs-on: ubuntu-latest
-    needs:
+    needs: [ pre_job, build-gui ]
-      - pre_job
+    if: needs.pre_job.result == 'success' && needs.pre_job.outputs.should_skip != 'true' && !cancelled()
-      - build-gui
     steps:
       - name: Mark result as failed
-        if: needs.build-gui.result != 'success'
+        if: contains(needs.*.result, 'failure')
         run: exit 1

.github/workflows/install_gui_dep.sh

@@ -1,11 +0,0 @@
-sudo apt update
-sudo apt install -qq libwebkit2gtk-4.1-dev \
-    build-essential \
-    curl \
-    wget \
-    file \
-    libgtk-3-dev \
-    librsvg2-dev \
-    libxdo-dev \
-    libssl-dev \
-    patchelf

.github/workflows/install_rust.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-
-# env needed:
-# - TARGET
-# - GUI_TARGET
-# - OS
-
-# dependencies are only needed on ubuntu as that's the only place where
-# we make cross-compilation
-if [[ $OS =~ ^ubuntu.*$ ]]; then
-    sudo apt-get update && sudo apt-get install -qq musl-tools libappindicator3-dev llvm clang
-    # https://github.com/cross-tools/musl-cross/releases
-    # if "musl" is a substring of TARGET, we assume that we are using musl
-    MUSL_TARGET=$TARGET
-    # if target is mips or mipsel, we should use soft-float version of musl
-    if [[ $TARGET =~ ^mips.*$ || $TARGET =~ ^mipsel.*$ ]]; then
-        MUSL_TARGET=${TARGET}sf
-    elif [[ $TARGET =~ ^riscv64gc-.*$ ]]; then
-        MUSL_TARGET=${TARGET/#riscv64gc-/riscv64-}
-    fi
-    if [[ $MUSL_TARGET =~ musl ]]; then
-        mkdir -p ./musl_gcc
-        wget --inet4-only -c https://github.com/cross-tools/musl-cross/releases/download/20250520/${MUSL_TARGET}.tar.xz -P ./musl_gcc/
-        tar xf ./musl_gcc/${MUSL_TARGET}.tar.xz -C ./musl_gcc/
-        sudo ln -sf $(pwd)/musl_gcc/${MUSL_TARGET}/bin/*gcc /usr/bin/
-        sudo ln -sf $(pwd)/musl_gcc/${MUSL_TARGET}/include/ /usr/include/musl-cross
-        sudo ln -sf $(pwd)/musl_gcc/${MUSL_TARGET}/${MUSL_TARGET}/sysroot/ ./musl_gcc/sysroot
-        sudo chmod -R a+rwx ./musl_gcc
-    fi
-fi
-
-# see https://github.com/rust-lang/rustup/issues/3709
-rustup set auto-self-update disable
-rustup install 1.93
-rustup default 1.93
-
-# mips/mipsel cannot add target from rustup, need compile by ourselves
-if [[ $OS =~ ^ubuntu.*$ && $TARGET =~ ^mips.*$ ]]; then
-    cd "$PWD/musl_gcc/${MUSL_TARGET}/lib/gcc/${MUSL_TARGET}/15.1.0" || exit 255
-    # for panic-abort
-    cp libgcc_eh.a libunwind.a
-
-    # for mimalloc
-    ar x libgcc.a _ctzsi2.o _clz.o _bswapsi2.o
-    ar rcs libctz.a _ctzsi2.o _clz.o _bswapsi2.o
-
-    rustup toolchain install nightly-2026-02-02-x86_64-unknown-linux-gnu
-    rustup component add rust-src --toolchain nightly-2026-02-02-x86_64-unknown-linux-gnu
-
-    # https://github.com/rust-lang/rust/issues/128808
-    # remove it after Cargo or rustc fix this.
-    RUST_LIB_SRC=$HOME/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/
-    if [[ -f $RUST_LIB_SRC/library/Cargo.lock && ! -f $RUST_LIB_SRC/Cargo.lock ]]; then 
-        cp -f $RUST_LIB_SRC/library/Cargo.lock $RUST_LIB_SRC/Cargo.lock
-    fi
-else
-    rustup target add $TARGET
-    if [[ $GUI_TARGET != '' ]]; then
-        rustup target add $GUI_TARGET
-    fi
-fi

.github/workflows/mobile.yml

@@ -5,7 +5,12 @@ on:
     branches: ["develop", "main", "releases/**"]
   pull_request:
     branches: ["develop", "main"]
-      
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -18,6 +23,7 @@ jobs:
   pre_job:
     # continue-on-error: true # Uncomment once integration is finished
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     # Map a step output to a job output
     outputs:
       should_skip: ${{ steps.skip_check.outputs.should_skip == 'true' && !startsWith(github.ref_name, 'releases/') }}
@@ -29,25 +35,30 @@ jobs:
           concurrent_skipping: 'same_content_newer'
           skip_after_successful_duplicate: 'true'
           cancel_others: 'true'
-          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-gui/**", "tauri-plugin-vpnservice/**", ".github/workflows/mobile.yml", ".github/workflows/install_rust.sh"]'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-gui/**", "tauri-plugin-vpnservice/**", ".github/workflows/mobile.yml", ".github/actions/**"]'
   build-mobile:
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         include:
-          - TARGET: android
+          - TARGET: aarch64-linux-android
-            OS: ubuntu-22.04
+            ARCH: aarch64
-            ARTIFACT_NAME: android
+          - TARGET: armv7-linux-androideabi
-    runs-on: ${{ matrix.OS }}
+            ARCH: armv7
+          - TARGET: i686-linux-android
+            ARCH: i686
+          - TARGET: x86_64-linux-android
+            ARCH: x86_64
+    runs-on: ubuntu-latest
     env:
       NAME: easytier
       TARGET: ${{ matrix.TARGET }}
-      OS: ${{ matrix.OS }}
+      ARCH: ${{ matrix.ARCH }}
       OSS_BUCKET: ${{ secrets.ALIYUN_OSS_BUCKET }}
     needs: pre_job
     if: needs.pre_job.outputs.should_skip != 'true'    
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       - name: Set current ref as env variable
         run: |
@@ -61,72 +72,41 @@ jobs:
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
         with:
-          cmdline-tools-version: 11076708
+          cmdline-tools-version: 12.0
-          packages: 'build-tools;34.0.0 ndk;26.0.10792818 tools platform-tools platforms;android-34 '
+          packages: 'build-tools;34.0.0 ndk;26.0.10792818 platform-tools platforms;android-34 '
 
       - name: Setup Android Environment
         run: |
           echo "$ANDROID_HOME/platform-tools" >> $GITHUB_PATH
           echo "$ANDROID_HOME/ndk/26.0.10792818/toolchains/llvm/prebuilt/linux-x86_64/bin" >> $GITHUB_PATH
-          echo "NDK_HOME=$ANDROID_HOME/ndk/26.0.10792818/" > $GITHUB_ENV
+          echo "NDK_HOME=$ANDROID_HOME/ndk/26.0.10792818/" >> $GITHUB_ENV
 
-      - uses: actions/setup-node@v4
+      - name: Prepare build environment
+        uses: ./.github/actions/prepare-build
         with:
-          node-version: 22
+          target: ${{ matrix.TARGET }}
-
+          gui: false
-      - name: Install pnpm
+          pnpm: true
-        uses: pnpm/action-setup@v4
+          pnpm-build-filter: ''
-        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
-          version: 10
-          run_install: false
-
-      - name: Get pnpm store directory
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
-
-      - name: Setup pnpm cache
-        uses: actions/cache@v4
-        with:
-          path: ${{ env.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: Install frontend dependencies
-        run: |
-          pnpm -r install
-          pnpm -r build
 
       - uses: Swatinem/rust-cache@v2
         with:
           # The prefix cache key, this can be changed to start a new cache manually.
           # default: "v0-rust"
           prefix-key: ""
+          shared-key: "gui-registry"
+          cache-targets: "false"
 
-      - name: Install rust target
+      - name: Build
-        run: |
-          bash ./.github/workflows/install_rust.sh
-          rustup target add aarch64-linux-android
-          rustup target add armv7-linux-androideabi
-          rustup target add i686-linux-android
-          rustup target add x86_64-linux-android
-
-      - name: Setup protoc
-        uses: arduino/setup-protoc@v3
-        with:
-          # GitHub repo token to use to avoid rate limiter
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build Android
         run: |
           cd easytier-gui
-          pnpm tauri android build
+          pnpm tauri android build --apk --target "$ARCH" --split-per-abi
 
-      - name: Compress
+      - name: Collect artifact
         run: |
           mkdir -p ./artifacts/objects/
-          mv easytier-gui/src-tauri/gen/android/app/build/outputs/apk/universal/release/app-universal-release.apk ./artifacts/objects/
+          mv easytier-gui/src-tauri/gen/android/app/build/outputs/apk/*/release/*.apk ./artifacts/objects/
           
           if [[ $GITHUB_REF_TYPE =~ ^tag$ ]]; then
             TAG=$GITHUB_REF_NAME
@@ -134,23 +114,21 @@ jobs:
             TAG=$GITHUB_SHA
           fi
 
-          mv ./artifacts/objects/* ./artifacts
+          mv ./artifacts/objects/* ./artifacts/
           rm -rf ./artifacts/objects/
 
       - name: Archive artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
-          name: easytier-gui-${{ matrix.ARTIFACT_NAME }}
+          name: easytier-mobile-android-${{ matrix.ARCH }}
           path: |
             ./artifacts/*
 
   mobile-result:
-    if: needs.pre_job.outputs.should_skip != 'true' && always()
     runs-on: ubuntu-latest
-    needs:
+    needs: [ pre_job, build-mobile ]
-      - pre_job
+    if: needs.pre_job.result == 'success' && needs.pre_job.outputs.should_skip != 'true' && !cancelled()
-      - build-mobile
     steps:
       - name: Mark result as failed
-        if: needs.build-mobile.result != 'success'
+        if: contains(needs.*.result, 'failure')
         run: exit 1

.github/workflows/nix.yml

@@ -6,17 +6,25 @@ on:
     paths:
       - "**/*.nix"
       - "flake.lock"
+      - "rust-toolchain.toml"
   pull_request:
     branches: ["main", "develop"]
+    types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - "**/*.nix"
       - "flake.lock"
+      - "rust-toolchain.toml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   check-full-shell:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Nix
         uses: cachix/install-nix-action@v27
@@ -26,5 +34,11 @@ jobs:
       - name: Magic Nix Cache
         uses: DeterminateSystems/magic-nix-cache-action@v6
 
-      - name: Check full devShell
+      - name: Warm up full devShell
         run: nix develop .#full --command true
+
+      - name: Cargo check in flake environment
+        run: nix develop .#full --command cargo check
+
+      - name: Cargo build in flake environment
+        run: nix develop .#full --command cargo build

.github/workflows/ohos.yml

@@ -8,8 +8,13 @@ on:
       - '!*-pre'
   pull_request:
     branches: ["develop", "main"]
+    types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 
@@ -20,18 +25,29 @@ defaults:
 
 jobs:
   cargo_fmt_check:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
-      - name: fmt check
+
+      - name: Prepare build environment
+        uses: ./.github/actions/prepare-build
+        with:
+          gui: false
+          pnpm: false
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          components: rustfmt
+
+      - name: Check formatting
         working-directory: ./easytier-contrib/easytier-ohrs
-        run: |
+        run: cargo fmt --all -- --check
-          bash ../../.github/workflows/install_rust.sh
+
-          rustup component add rustfmt
-          cargo fmt --all -- --check
   pre_job:
     # continue-on-error: true # Uncomment once integration is finished
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     # Map a step output to a job output
     outputs:
       # do not skip push on branch starts with releases/
@@ -44,7 +60,8 @@ jobs:
           concurrent_skipping: "same_content_newer"
           skip_after_successful_duplicate: "true"
           cancel_others: "true"
-          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-contrib/easytier-ohrs/**", ".github/workflows/ohos.yml", ".github/workflows/install_rust.sh"]'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", "easytier-contrib/easytier-ohrs/**", ".github/workflows/ohos.yml", ".github/actions/**"]'
+
   build-ohos:
     runs-on: ubuntu-latest
     needs: pre_job
@@ -52,17 +69,16 @@ jobs:
       OHPM_PUBLISH_CODE: ${{ secrets.OHPM_PUBLISH_CODE }}
     if: needs.pre_job.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Install dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y \
+          sudo apt-get install -qq \
             build-essential \
             wget \
             unzip \
             git \
             pkg-config curl libgl1-mesa-dev expect
-          sudo apt-get clean
 
       - name: Resolve easytier version
         run: |
@@ -134,6 +150,15 @@ jobs:
         run: |
           echo "TARGET_ARCH=aarch64-linux-ohos" >> $GITHUB_ENV
 
+          rustup install stable
+          rustup default stable
+
+          rustup target add aarch64-unknown-linux-ohos
+
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: ohrs
+
       - name: Create clang wrapper script
         run: |
           sudo mkdir -p $OHOS_NDK_HOME/native/llvm
@@ -152,11 +177,7 @@ jobs:
         run: |
           sudo apt-get install -y llvm clang lldb lld
           sudo apt-get install -y protobuf-compiler
-          bash ../../.github/workflows/install_rust.sh
           source env.sh
-          cargo install ohrs
-          rustup target add aarch64-unknown-linux-ohos
-          cargo update easytier
           ohrs doctor
           ohrs build --release --arch aarch
           ohrs artifact
@@ -174,11 +195,14 @@ jobs:
           jq --arg v "$TAG_VERSION" '.name = "easytier-release" | .version = $v' oh-package.json5 > oh-package.tmp.json5 && mv oh-package.tmp.json5 oh-package.json5
           cd ..
           ohrs build --release --arch aarch
+          cd dist/arm64-v8a
+          mv libeasytier_ohrs.so libeasytier_release.so
+          cd ../..
           ohrs artifact
           mv package.har easytier-release.har
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: easytier-ohos
           path: |

.github/workflows/release.yml

@@ -18,7 +18,7 @@ on:
       version:
         description: 'Version for this release'
         type: string
-        default: 'v2.5.0'
+        default: 'v2.6.3'
         required: true
       make_latest:
         description: 'Mark this release as latest'
@@ -35,7 +35,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Download Core Artifact
         uses: dawidd6/action-download-artifact@v11
@@ -92,4 +92,4 @@ jobs:
           files: |
             ./zipped_assets/*
           token: ${{ secrets.GITHUB_TOKEN }}
-          tag_name: ${{ inputs.version }}
+          tag_name: ${{ inputs.version }}

.github/workflows/test.yml

@@ -6,6 +6,10 @@ on:
   pull_request:
     branches: [ "develop", "main" ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 env:
   CARGO_TERM_COLOR: always
 #  RUSTC_WRAPPER: "sccache"
@@ -30,7 +34,7 @@ jobs:
           # All of these options are optional, so you can remove them if you are happy with the defaults
           concurrent_skipping: 'never'
           skip_after_successful_duplicate: 'true'
-          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", ".github/workflows/test.yml", ".github/workflows/install_gui_dep.sh", ".github/workflows/install_rust.sh"]'
+          paths: '["Cargo.toml", "Cargo.lock", "easytier/**", ".github/workflows/test.yml", ".github/actions/**"]'
 
   check:
     name: Run linters & check
@@ -38,47 +42,55 @@ jobs:
     needs: pre_job
     if: needs.pre_job.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       - name: Prepare build environment
         uses: ./.github/actions/prepare-build
         with:
           gui: true
-          web: true
+          pnpm: true
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
-
+        with:
-      - name: Install rustfmt and clippy
+          components: rustfmt,clippy
-        run: |
+          rustflags: ''
-          rustup component add rustfmt
-          rustup component add clippy
 
       - uses: taiki-e/install-action@cargo-hack
 
       - name: Check formatting
+        if: ${{ !cancelled() }}
         run: cargo fmt --all -- --check
 
       - name: Check Clippy
+        if: ${{ !cancelled() }}
         run: cargo clippy --all-targets --features full --all -- -D warnings
 
       - name: Check features
         if: ${{ !cancelled() }}
         run: cargo hack check --package easytier --each-feature --exclude-features macos-ne --verbose
 
+      - name: Check Cargo.lock is up to date
+        if: ${{ !cancelled() }}
+        run: |
+          if ! cargo metadata --format-version 1 --locked > /dev/null; then
+            echo "::error::Cargo.lock is out of date. Run cargo generate-lockfile or cargo build locally, then commit Cargo.lock."
+            exit 1
+          fi
+
   pre-test:
     name: Build test
     runs-on: ubuntu-latest
     needs: pre_job
     if: needs.pre_job.outputs.should_skip != 'true'
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       - name: Prepare build environment
         uses: ./.github/actions/prepare-build
         with:
           gui: true
-          web: true
+          pnpm: true
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - uses: Swatinem/rust-cache@v2
@@ -88,7 +100,7 @@ jobs:
       - name: Archive test
         run: cargo nextest archive --archive-file tests.tar.zst --package easytier --features full
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v5
         with:
           name: tests
           path: tests.tar.zst
@@ -112,10 +124,14 @@ jobs:
           - name: "three_node::subnet_proxy_three_node_test"
             opts: "-E 'test(subnet_proxy_three_node_test)' --test-threads 1 --no-fail-fast"
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       - name: Setup tools for test
         run: sudo apt install bridge-utils
+      - name: Setup upnpd for test
+        run: |
+          sudo apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y miniupnpd miniupnpd-iptables iptables
 
       - name: Setup system for test
         run: |
@@ -139,9 +155,9 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
-    needs: [ pre_job, test_matrix ]
+    needs: [ pre_job, check, test_matrix ]
-    if: needs.pre_job.outputs.should_skip != 'true' && always()
+    if: needs.pre_job.result == 'success' && needs.pre_job.outputs.should_skip != 'true' && !cancelled()
     steps:
       - name: Mark result as failed
-        if: needs.test_matrix.result != 'success'
+        if: contains(needs.*.result, 'failure')
-        run: exit 1
+        run: exit 1

CONTRIBUTING.md

@@ -26,7 +26,7 @@ Thank you for your interest in contributing to EasyTier! This document provides
 #### Required Tools
 - Node.js v21 or higher
 - pnpm v9 or higher
-- Rust toolchain (version 1.93)
+- Rust toolchain (version 1.95)
 - LLVM and Clang
 - Protoc (Protocol Buffers compiler)
 
@@ -79,8 +79,8 @@ sudo apt install -y bridge-utils
 2. Install dependencies:
    ```bash
    # Install Rust toolchain
-   rustup install 1.93
+   rustup install 1.95
-   rustup default 1.93
+   rustup default 1.95
 
    # Install project dependencies
    pnpm -r install

CONTRIBUTING_zh.md

@@ -34,7 +34,7 @@
 #### 必需工具
 - Node.js v21 或更高版本
 - pnpm v9 或更高版本
-- Rust 工具链（版本 1.93）
+- Rust 工具链（版本 1.95）
 - LLVM 和 Clang
 - Protoc（Protocol Buffers 编译器）
 
@@ -87,8 +87,8 @@ sudo apt install -y bridge-utils
 2. 安装依赖：
    ```bash
    # 安装 Rust 工具链
-   rustup install 1.93
+   rustup install 1.95
-   rustup default 1.93
+   rustup default 1.95
 
    # 安装项目依赖
    pnpm -r install

Cargo.toml

@@ -14,6 +14,10 @@ exclude = [
     "easytier-contrib/easytier-ohrs", # it needs ohrs sdk
 ]
 
+[workspace.package]
+edition = "2024"
+rust-version = "1.95"
+
 [profile.dev]
 panic = "unwind"
 debug = 2

README.md

@@ -11,88 +11,286 @@
 
 [简体中文](/README_CN.md) | [English](/README.md)
 
-> ✨ A simple, secure, decentralized SD-WAN solution powered by Rust and Tokio
+> ✨ A simple, secure, decentralized virtual private network solution powered by Rust and Tokio
 
-🌐 **[Official Website](https://easytier.rs)** | 📚 **[Documentation](https://easytier.rs/en/)** | 🚀 **[Get Started](https://easytier.rs/en/guide/introduction.html)** | 📝 **[Download Releases](https://github.com/EasyTier/EasyTier/releases)** | 🇨🇳 **[China Site](https://easytier.cn)** | ❤️ **[Sponsor](#sponsor)**
+<p align="center">
+<img src="assets/config-page.png" width="300" alt="config page">
+<img src="assets/running-page.png" width="300" alt="running page">
+</p>
 
-## Get Started
+📚 **[Full Documentation](https://easytier.cn/en/)** | 🖥️ **[Web Console](https://easytier.cn/web)** | 📝 **[Download Releases](https://github.com/EasyTier/EasyTier/releases)** | 🧩 **[Third Party Tools](https://easytier.cn/en/guide/installation_gui.html#third-party-graphical-interfaces)** | ❤️ **[Sponsor](#sponsor)**
 
-### Install
+## Features
 
-Linux:
+### Core Features
 
+- 🔒 **Decentralized**: Nodes are equal and independent, no centralized services required  
+- 🚀 **Easy to Use**: Multiple operation methods via web, client, and command line  
+- 🌍 **Cross-Platform**: Supports Win/MacOS/Linux/FreeBSD/Android and X86/ARM/MIPS architectures  
+- 🔐 **Secure**: AES-GCM or WireGuard encryption, prevents man-in-the-middle attacks  
+
+### Advanced Capabilities
+
+- 🔌 **Efficient NAT Traversal**: Supports UDP and IPv6 traversal, works with NAT4-NAT4 networks  
+- 🌐 **Subnet Proxy**: Nodes can share subnets for other nodes to access  
+- 🔄 **Intelligent Routing**: Latency priority and automatic route selection for best network experience  
+- ⚡ **High Performance**: Zero-copy throughout the entire link, supports TCP/UDP/WSS/WG protocols  
+
+### Network Optimization
+
+- 📊 **UDP Loss Resistance**: KCP/QUIC proxy optimizes latency and bandwidth in high packet loss environments  
+- 🔧 **Web Management**: Easy configuration and monitoring through web interface  
+- 🛠️ **Zero Config**: Simple deployment with statically linked executables  
+
+## Quick Start
+
+### 📥 Installation
+
+Choose the installation method that best suits your needs:
+
+Linux (Recommended):
 ```bash
 curl -fsSL "https://github.com/EasyTier/EasyTier/blob/main/script/install.sh?raw=true" | sudo bash -s install
 ```
 
-Windows (run with administrator privileges):
+Homebrew (MacOS/Linux):
-
-```powershell
-irm "https://github.com/EasyTier/EasyTier/blob/main/script/install.ps1?raw=true" | iex
-```
-
-Homebrew (macOS/Linux):
-
 ```bash
 brew tap brewforge/chinese
 brew install --cask easytier-gui
 ```
 
-Install from source (latest development version):
+Windows (Recommended, run with administrator privileges):
+```powershell
+irm "https://github.com/EasyTier/EasyTier/blob/main/script/install.ps1?raw=true" | iex
+```
 
+Install via cargo (Latest development version): 
 ```bash
 cargo install --git https://github.com/EasyTier/EasyTier.git easytier
 ```
 
-More installation options:
+[Install pre-built binary](https://github.com/EasyTier/EasyTier/releases) (Recommended, All platforms supported)
 
-- [CLI installation guide](https://easytier.rs/en/guide/installation.html)
+[Install via Docker](https://easytier.cn/en/guide/installation.html#installation-methods)
-- [GUI installation guide](https://easytier.rs/en/guide/installation_gui.html)
-- [Pre-built binaries](https://github.com/EasyTier/EasyTier/releases)
-- [OpenWrt package](https://github.com/EasyTier/luci-app-easytier)
-- [One-click register service](https://easytier.rs/en/guide/network/oneclick-install-as-service.html)
 
-### Quick Example
+[Install OpenWrt ipk package](https://github.com/EasyTier/luci-app-easytier)
 
-Join the same network from multiple nodes with a shared public node:
+Additional steps:
+
+[One-Click Register Service](https://easytier.cn/en/guide/network/oneclick-install-as-service.html) (Automatically start when the system boots and run in the background)
+
+### 🚀 Basic Usage
+
+#### Quick Networking with Shared Nodes
+
+EasyTier supports quick networking using shared public nodes. When you don't have a public IP, you can use the free shared nodes provided by the EasyTier community. Nodes will automatically attempt NAT traversal and establish P2P connections. When P2P fails, data will be relayed through shared nodes.
+
+When using shared nodes, each node entering the network needs to provide the same `--network-name` and `--network-secret` parameters as the unique identifier of the network.
+
+Taking two nodes as an example (Please use more complex network name to avoid conflicts):
+
+1. Run on Node A:
 
 ```bash
-# Node A
+# Run with administrator privileges
-sudo easytier-core -d --network-name demo --network-secret demo -p tcp://<SharedNodeIP>:11010
+sudo easytier-core -d --network-name abc --network-secret abc -p tcp://<SharedNodeIP>:11010
-
-# Node B
-sudo easytier-core -d --network-name demo --network-secret demo -p tcp://<SharedNodeIP>:11010
 ```
 
-Use the same `--network-name` and `--network-secret` on every node to join the same network. After startup, check peers with `easytier-cli peer`, `easytier-cli route`, or `easytier-cli node`.
+2. Run on Node B:
 
-## Why EasyTier
+```bash
+# Run with administrator privileges
+sudo easytier-core -d --network-name abc --network-secret abc -p tcp://<SharedNodeIP>:11010
+```
 
-- 🔒 **Decentralized**: Nodes are equal and independent, with no centralized controller required.
+After successful execution, you can check the network status using `easytier-cli`:
-- 🚀 **Easy to Use**: Use EasyTier from the web console, GUI clients, or the command line.
-- 🌍 **Cross-Platform**: Supports Windows, macOS, Linux, FreeBSD, Android, and multiple CPU architectures.
-- 🔐 **Secure**: Protects traffic with AES-GCM or WireGuard encryption.
-- 🔌 **Efficient NAT Traversal**: Supports UDP and IPv6 traversal, including NAT4-to-NAT4 scenarios.
-- 🌐 **Subnet Proxy**: Share private subnets with other nodes in the virtual network.
-- 🔄 **Intelligent Routing**: Chooses lower-latency paths automatically for a better network experience.
-- ⚡ **High Performance**: Uses zero-copy data paths and supports TCP, UDP, WS, WSS, WG, QUIC, and more.
 
-## Learn More
+```text
+| ipv4         | hostname       | cost  | lat_ms | loss_rate | rx_bytes | tx_bytes | tunnel_proto | nat_type | id         | version         |
+| ------------ | -------------- | ----- | ------ | --------- | -------- | -------- | ------------ | -------- | ---------- | --------------- |
+| 10.126.126.1 | abc-1          | Local | *      | *         | *        | *        | udp          | FullCone | 439804259  | 2.6.2-70e69a38~ |
+| 10.126.126.2 | abc-2          | p2p   | 3.452  | 0         | 17.33 kB | 20.42 kB | udp          | FullCone | 390879727  | 2.6.2-70e69a38~ |
+|              | PublicServer_a | p2p   | 27.796 | 0.000     | 50.01 kB | 67.46 kB | tcp          | Unknown  | 3771642457 | 2.6.2-70e69a38~ |
+```
 
-- [Introduction](https://easytier.rs/en/guide/introduction.html)
+You can test connectivity between nodes:
-- [Command line networking](https://easytier.rs/en/guide/networking.html)
-- [Decentralized networking](https://easytier.rs/en/guide/network/decentralized-networking.html)
-- [Networking with web console](https://easytier.rs/en/guide/network/web-console.html)
-- [WireGuard client access](https://easytier.rs/en/guide/network/use-easytier-with-wireguard-client.html)
-- [Subnet proxy (point-to-network)](https://easytier.rs/en/guide/network/point-to-networking.html)
-- [Bandwidth and latency optimization](https://easytier.rs/en/guide/network/kcp-proxy.html)
-- [Hosting public shared nodes](https://easytier.rs/en/guide/network/host-public-server.html)
-- [Third-party graphical interfaces](https://easytier.rs/en/guide/installation_gui.html#third-party-graphical-interfaces)
 
-## Community
+```bash
+# Test connectivity
+ping 10.126.126.1
+ping 10.126.126.2
+```
+
+Note: If you cannot ping through, it may be that the firewall is blocking incoming traffic. Please turn off the firewall or add allow rules.
+
+To improve availability, you can connect to multiple shared nodes simultaneously:
+
+```bash
+# Connect to multiple shared nodes
+sudo easytier-core -d --network-name abc --network-secret abc -p tcp://<SharedNodeIP1>:11010 -p udp://<SharedNodeIP2>:11010
+```
+
+Once your network is set up successfully, you can easily configure it to start automatically on system boot. Refer to the [One-Click Register Service guide](https://easytier.cn/en/guide/network/oneclick-install-as-service.html) for step-by-step instructions on registering EasyTier as a system service.
+
+#### Decentralized Networking
+
+EasyTier is fundamentally decentralized, with no distinction between server and client. As long as one device can communicate with any node in the virtual network, it can join the virtual network. Here's how to set up a decentralized network:
+
+1. Start First Node (Node A):
+
+```bash
+# Start the first node
+sudo easytier-core -i 10.144.144.1
+```
+
+After startup, this node will listen on the following ports by default:
+- TCP: 11010
+- UDP: 11010
+- WebSocket: 11011
+- WebSocket SSL: 11012
+- WireGuard: 11013
+
+2. Connect Second Node (Node B):
+
+```bash
+# Connect to the first node using its public IP
+sudo easytier-core -i 10.144.144.2 -p udp://FIRST_NODE_PUBLIC_IP:11010
+```
+
+3. Verify Connection:
+
+```bash
+# Test connectivity
+ping 10.144.144.2
+
+# View connected peers
+easytier-cli peer
+
+# View routing information
+easytier-cli route
+
+# View local node information
+easytier-cli node
+```
+
+For more nodes to join the network, they can connect to any existing node in the network using the `-p` parameter:
+
+```bash
+# Connect to any existing node using its public IP
+sudo easytier-core -i 10.144.144.3 -p udp://ANY_EXISTING_NODE_PUBLIC_IP:11010
+```
+
+### 🔍 Advanced Features
+
+#### Subnet Proxy
+
+Assuming the network topology is as follows, Node B wants to share its accessible subnet 10.1.1.0/24 with other nodes:
+
+```mermaid
+flowchart LR
+
+subgraph Node A Public IP 22.1.1.1
+nodea[EasyTier<br/>10.144.144.1]
+end
+
+subgraph Node B
+nodeb[EasyTier<br/>10.144.144.2]
+end
+
+id1[[10.1.1.0/24]]
+
+nodea <--> nodeb <-.-> id1
+```
+
+To share a subnet, add the `-n` parameter when starting EasyTier:
+
+```bash
+# Share subnet 10.1.1.0/24 with other nodes
+sudo easytier-core -i 10.144.144.2 -n 10.1.1.0/24
+```
+
+Subnet proxy information will automatically sync to each node in the virtual network, and each node will automatically configure the corresponding route. You can verify the subnet proxy setup:
+
+1. Check if the routing information has been synchronized (the proxy_cidrs column shows the proxied subnets):
+
+```bash
+# View routing information
+easytier-cli route
+```
+
+![Routing Information](/assets/image-3.png)
+
+2. Test if you can access nodes in the proxied subnet:
+
+```bash
+# Test connectivity to proxied subnet
+ping 10.1.1.2
+```
+
+#### WireGuard Integration
+
+EasyTier can act as a WireGuard server, allowing any device with a WireGuard client (including iOS and Android) to access the EasyTier network. Here's an example setup:
+
+```mermaid
+flowchart LR
+
+ios[[iPhone<br/>WireGuard Installed]]
+
+subgraph Node A Public IP 22.1.1.1
+nodea[EasyTier<br/>10.144.144.1]
+end
+
+subgraph Node B
+nodeb[EasyTier<br/>10.144.144.2]
+end
+
+id1[[10.1.1.0/24]]
+
+ios <-.-> nodea <--> nodeb <-.-> id1
+```
+
+1. Start EasyTier with WireGuard portal enabled:
+
+```bash
+# Listen on 0.0.0.0:11013 and use 10.14.14.0/24 subnet for WireGuard clients
+sudo easytier-core -i 10.144.144.1 --vpn-portal wg://0.0.0.0:11013/10.14.14.0/24
+```
+
+2. Get WireGuard client configuration:
+
+```bash
+# Get WireGuard client configuration
+easytier-cli vpn-portal
+```
+
+3. In the output configuration:
+   - Set `Interface.Address` to an available IP from the WireGuard subnet
+   - Set `Peer.Endpoint` to the public IP/domain of your EasyTier node
+   - Import the modified configuration into your WireGuard client
+
+#### Self-Hosted Public Shared Node
+
+You can run your own public shared node to help other nodes discover each other. A public shared node is just a regular EasyTier network (with same network name and secret) that other networks can connect to.
+
+To run a public shared node:
+
+```bash
+# No need to specify IPv4 address for public shared nodes
+sudo easytier-core --network-name mysharednode --network-secret mysharednode
+```
+
+## Related Projects
+
+- [ZeroTier](https://www.zerotier.com/): A global virtual network for connecting devices.
+- [TailScale](https://tailscale.com/): A VPN solution aimed at simplifying network configuration.
+
+### Contact Us
 
 - 💬 **[Telegram Group](https://t.me/easytier)**
-- 👥 **QQ Groups**: [No.1 949700262](https://qm.qq.com/q/wFoTUChqZW), [No.2 837676408](https://qm.qq.com/q/4V33DrfgHe), [No.3 957189589](https://qm.qq.com/q/YNyTQjwlai)
+- 👥 **[QQ Group]**
+  - No.1 [949700262](https://qm.qq.com/q/wFoTUChqZW)
+  - No.2 [837676408](https://qm.qq.com/q/4V33DrfgHe)
+  - No.3 [957189589](https://qm.qq.com/q/YNyTQjwlai)
 
 ## License
 
@@ -108,20 +306,21 @@ CDN acceleration and security protection for this project are sponsored by Tence
   </a>
 </p>
 
-Special thanks to [Langlang Cloud](https://langlangy.cn/?i26c5a5) and [RainCloud](https://www.rainyun.com/NjM0NzQ1_) for sponsoring our public servers.
+Special thanks to [Langlang Cloud](https://langlangy.cn/?i26c5a5)  and [RainCloud](https://www.rainyun.com/NjM0NzQ1_) for sponsoring our public servers.
 
 <p align="center">
-  <a href="https://langlangy.cn/?i26c5a5" target="_blank">
+<a href="https://langlangy.cn/?i26c5a5" target="_blank">
-    <img src="assets/langlang.png" width="200" alt="Langlang Cloud Logo">
+<img src="assets/langlang.png" width="200">
-  </a>
+</a>
-  <a href="https://www.rainyun.com/NjM0NzQ1_" target="_blank">
+<a href="https://langlangy.cn/?i26c5a5" target="_blank">
-    <img src="assets/raincloud.png" width="200" alt="RainCloud Logo">
+<img src="assets/raincloud.png" width="200">
-  </a>
+</a>
 </p>
 
-If you find EasyTier helpful, please consider sponsoring us. Software development and maintenance require time and effort, and your sponsorship helps us keep improving EasyTier.
+
+If you find EasyTier helpful, please consider sponsoring us. Software development and maintenance require a lot of time and effort, and your sponsorship will help us better maintain and improve EasyTier.
 
 <p align="center">
-  <img src="assets/wechat.png" width="200" alt="WeChat sponsor QR code">
+<img src="assets/wechat.png" width="200">
-  <img src="assets/alipay.png" width="200" alt="Alipay sponsor QR code">
+<img src="assets/alipay.png" width="200">
 </p>

README_CN.md

@@ -11,88 +11,286 @@
 
 [简体中文](/README_CN.md) | [English](/README.md)
 
-> ✨ 一个由 Rust 和 Tokio 驱动的简单、安全、去中心化 SD-WAN 组网方案
+> ✨ 一个由 Rust 和 Tokio 驱动的简单、安全、去中心化的异地组网方案
 
-🌐 **[官网文档](https://easytier.cn)** | 🚀 **[快速开始](https://easytier.cn/guide/introduction.html)** | 📝 **[下载发布版本](https://github.com/EasyTier/EasyTier/releases)** | 🌍 **[国际站](https://easytier.rs)** | ❤️ **[赞助](#赞助)**
+<p align="center">
+<img src="assets/config-page.png" width="300" alt="配置页面">
+<img src="assets/running-page.png" width="300" alt="运行页面">
+</p>
+
+📚 **[完整文档](https://easytier.cn)** | 🖥️ **[Web 控制台](https://easytier.cn/web)** | 📝 **[下载发布版本](https://github.com/EasyTier/EasyTier/releases)** | 🧩 **[第三方工具](https://easytier.cn/guide/installation_gui.html#%E7%AC%AC%E4%B8%89%E6%96%B9%E5%9B%BE%E5%BD%A2%E7%95%8C%E9%9D%A2)** | ❤️ **[赞助](#赞助)**
+
+## 特性
+
+### 核心特性
+
+- 🔒 **去中心化**：节点平等且独立，无需中心化服务
+- 🚀 **易于使用**：支持通过网页、客户端和命令行多种操作方式
+- 🌍 **跨平台**：支持 Win/MacOS/Linux/FreeBSD/Android 和 X86/ARM/MIPS 架构
+- 🔐 **安全**：AES-GCM 或 WireGuard 加密，防止中间人攻击
+
+### 高级功能
+
+- 🔌 **高效 NAT 穿透**：支持 UDP 和 IPv6 穿透，可在 NAT4-NAT4 网络中工作
+- 🌐 **子网代理**：节点可以共享子网供其他节点访问
+- 🔄 **智能路由**：延迟优先和自动路由选择，提供最佳网络体验
+- ⚡ **高性能**：整个链路零拷贝，支持 TCP/UDP/WSS/WG 协议
+
+### 网络优化
+
+- 📊 **UDP 丢包抗性**：KCP/QUIC 代理在高丢包环境下优化延迟和带宽
+- 🔧 **Web 管理**：通过 Web 界面轻松配置和监控
+- 🛠️ **零配置**：静态链接的可执行文件，简单部署
 
 ## 快速开始
 
-### 安装
+### 📥 安装
 
-Linux：
+选择最适合您需求的安装方式：
 
+Linux（推荐）：
 ```bash
 curl -fsSL "https://github.com/EasyTier/EasyTier/blob/main/script/install.sh?raw=true" | sudo bash -s install
 ```
 
-Windows（请使用管理员权限运行）：
+Homebrew（MacOS/Linux）：
-
-```powershell
-irm "https://github.com/EasyTier/EasyTier/blob/main/script/install.ps1?raw=true" | iex
-```
-
-Homebrew（macOS/Linux）：
-
 ```bash
 brew tap brewforge/chinese
 brew install --cask easytier-gui
 ```
 
-通过 cargo 安装（最新开发版本）：
+Windows（推荐，请以管理员权限运行）：
+```powershell
+irm "https://github.com/EasyTier/EasyTier/blob/main/script/install.ps1?raw=true" | iex
+```
 
+通过 cargo 安装（最新开发版本）：
 ```bash
 cargo install --git https://github.com/EasyTier/EasyTier.git easytier
 ```
 
-更多安装方式：
+[下载预编译文件](https://github.com/EasyTier/EasyTier/releases)（推荐，支持所有平台）
 
-- [CLI 安装文档](https://easytier.cn/guide/installation.html)
+[通过 Docker 安装](https://easytier.cn/guide/installation.html#%E5%AE%89%E8%A3%85%E6%96%B9%E5%BC%8F)
-- [GUI 安装文档](https://easytier.cn/guide/installation_gui.html)
-- [下载预编译文件](https://github.com/EasyTier/EasyTier/releases)
-- [OpenWrt 插件](https://github.com/EasyTier/luci-app-easytier)
-- [一键注册系统服务](https://easytier.cn/guide/network/oneclick-install-as-service.html)
 
-### 最小示例
+[安装 OpenWrt ipk 软件包](https://github.com/EasyTier/luci-app-easytier)
 
-使用共享公共节点，让多台设备加入同一个网络：
+附加步骤：
+
+[一键注册系统服务](https://easytier.cn/guide/network/oneclick-install-as-service.html)（系统启动时自动后台运行）
+
+### 🚀 基本用法
+
+#### 使用共享节点快速组网
+
+EasyTier 支持使用共享节点快速组网。当您没有公网 IP 时，可以使用公共共享节点。节点会自动尝试 NAT 穿透并建立 P2P 连接。当 P2P 失败时，数据将通过共享节点中继。
+
+使用共享节点时，每个进入网络的节点需要提供相同的 `--network-name` 和 `--network-secret` 参数作为网络的唯一标识符。
+
+以两个节点为例（请使用更复杂的网络名称以避免冲突）：
+
+1. 在节点 A 上运行：
 
 ```bash
-# 节点 A
+# 以管理员权限运行
-sudo easytier-core -d --network-name demo --network-secret demo -p tcp://<共享节点IP>:11010
+sudo easytier-core -d --network-name abc --network-secret abc -p tcp://<共享节点IP>:11010
-
-# 节点 B
-sudo easytier-core -d --network-name demo --network-secret demo -p tcp://<共享节点IP>:11010
 ```
 
-所有节点使用相同的 `--network-name` 和 `--network-secret` 即可加入同一个网络。启动后可通过 `easytier-cli peer`、`easytier-cli route` 或 `easytier-cli node` 查看状态。
+2. 在节点 B 上运行：
 
-## 为什么选择 EasyTier
+```bash
+# 以管理员权限运行
+sudo easytier-core -d --network-name abc --network-secret abc -p tcp://<共享节点IP>:11010
+```
 
-- 🔒 **去中心化**：节点平等独立，无需中心化控制器。
+执行成功后，可以使用 `easytier-cli` 检查网络状态：
-- 🚀 **易于使用**：支持 Web 控制台、图形界面和命令行多种使用方式。
-- 🌍 **跨平台**：支持 Windows、macOS、Linux、FreeBSD、Android 和多种 CPU 架构。
-- 🔐 **安全**：支持 AES-GCM 或 WireGuard 加密，保护网络通信。
-- 🔌 **高效 NAT 穿透**：支持 UDP、IPv6 穿透，可打通 NAT4-NAT4 场景。
-- 🌐 **子网代理**：可将私有子网共享给虚拟网络中的其他节点访问。
-- 🔄 **智能路由**：自动选择更优链路，降低延迟并提升体验。
-- ⚡ **高性能**：全链路零拷贝，支持 TCP、UDP、WS、WSS、WG、QUIC 等协议。
 
-## 深入了解
+```text
+| ipv4         | hostname       | cost  | lat_ms | loss_rate | rx_bytes | tx_bytes | tunnel_proto | nat_type | id         | version         |
+| ------------ | -------------- | ----- | ------ | --------- | -------- | -------- | ------------ | -------- | ---------- | --------------- |
+| 10.126.126.1 | abc-1          | Local | *      | *         | *        | *        | udp          | FullCone | 439804259  | 2.6.2-70e69a38~ |
+| 10.126.126.2 | abc-2          | p2p   | 3.452  | 0         | 17.33 kB | 20.42 kB | udp          | FullCone | 390879727  | 2.6.2-70e69a38~ |
+|              | PublicServer_a | p2p   | 27.796 | 0.000     | 50.01 kB | 67.46 kB | tcp          | Unknown  | 3771642457 | 2.6.2-70e69a38~ |
+```
 
-- [简介](https://easytier.cn/guide/introduction.html)
+您可以测试节点之间的连通性：
-- [命令行组网](https://easytier.cn/guide/networking.html)
-- [去中心化组网](https://easytier.cn/guide/network/decentralized-networking.html)
-- [通过 Web 控制台组网](https://easytier.cn/guide/network/web-console.html)
-- [使用 WireGuard 客户端接入](https://easytier.cn/guide/network/use-easytier-with-wireguard-client.html)
-- [子网代理](https://easytier.cn/guide/network/point-to-networking.html)
-- [带宽与延迟优化](https://easytier.cn/guide/network/kcp-proxy.html)
-- [自建公共共享节点](https://easytier.cn/guide/network/host-public-server.html)
-- [第三方图形界面](https://easytier.cn/guide/installation_gui.html#%E7%AC%AC%E4%B8%89%E6%96%B9%E5%9B%BE%E5%BD%A2%E7%95%8C%E9%9D%A2)
 
-## 社区
+```bash
+# 测试连通性
+ping 10.126.126.1
+ping 10.126.126.2
+```
+
+注意：如果无法 ping 通，可能是防火墙阻止了入站流量。请关闭防火墙或添加允许规则。
+
+为了提高可用性，您可以同时连接多个共享节点：
+
+```bash
+# 连接多个共享节点
+sudo easytier-core -d --network-name abc --network-secret abc -p tcp://<公共节点IP>:11010 -p udp://<公共节点IP>:11010
+```
+
+#### 去中心化组网
+
+EasyTier 本质上是去中心化的，没有服务器和客户端的区分。只要一个设备能与虚拟网络中的任何节点通信，它就可以加入虚拟网络。以下是如何设置去中心化网络：
+
+1. 启动第一个节点（节点 A）：
+
+```bash
+# 启动第一个节点
+sudo easytier-core -i 10.144.144.1
+```
+
+启动后，该节点将默认监听以下端口：
+- TCP：11010
+- UDP：11010
+- WebSocket：11011
+- WebSocket SSL：11012
+- WireGuard：11013
+
+2. 连接第二个节点（节点 B）：
+
+```bash
+# 使用第一个节点的公网 IP 连接
+sudo easytier-core -i 10.144.144.2 -p udp://第一个节点的公网IP:11010
+```
+
+3. 验证连接：
+
+```bash
+# 测试连通性
+ping 10.144.144.2
+
+# 查看已连接的对等节点
+easytier-cli peer
+
+# 查看路由信息
+easytier-cli route
+
+# 查看本地节点信息
+easytier-cli node
+```
+
+更多节点要加入网络，可以使用 `-p` 参数连接到网络中的任何现有节点：
+
+```bash
+# 使用任何现有节点的公网 IP 连接
+sudo easytier-core -i 10.144.144.3 -p udp://任何现有节点的公网IP:11010
+```
+
+### 🔍 高级功能
+
+#### 子网代理
+
+假设网络拓扑如下，节点 B 想要与其他节点共享其可访问的子网 10.1.1.0/24：
+
+```mermaid
+flowchart LR
+
+subgraph 节点 A 公网 IP 22.1.1.1
+nodea[EasyTier<br/>10.144.144.1]
+end
+
+subgraph 节点 B
+nodeb[EasyTier<br/>10.144.144.2]
+end
+
+id1[[10.1.1.0/24]]
+
+nodea <--> nodeb <-.-> id1
+```
+
+要共享子网，在启动 EasyTier 时添加 `-n` 参数：
+
+```bash
+# 与其他节点共享子网 10.1.1.0/24
+sudo easytier-core -i 10.144.144.2 -n 10.1.1.0/24
+```
+
+子网代理信息将自动同步到虚拟网络中的每个节点，每个节点将自动配置相应的路由。您可以验证子网代理设置：
+
+1. 检查路由信息是否已同步（proxy_cidrs 列显示代理的子网）：
+
+```bash
+# 查看路由信息
+easytier-cli route
+```
+
+![路由信息](/assets/image-3.png)
+
+2. 测试是否可以访问代理子网中的节点：
+
+```bash
+# 测试到代理子网的连通性
+ping 10.1.1.2
+```
+
+#### WireGuard 集成
+
+EasyTier 可以作为 WireGuard 服务器，允许任何安装了 WireGuard 客户端的设备（包括 iOS 和 Android）访问 EasyTier 网络。以下是设置示例：
+
+```mermaid
+flowchart LR
+
+ios[[iPhone<br/>已安装 WireGuard]]
+
+subgraph 节点 A 公网 IP 22.1.1.1
+nodea[EasyTier<br/>10.144.144.1]
+end
+
+subgraph 节点 B
+nodeb[EasyTier<br/>10.144.144.2]
+end
+
+id1[[10.1.1.0/24]]
+
+ios <-.-> nodea <--> nodeb <-.-> id1
+```
+
+1. 启动启用 WireGuard 门户的 EasyTier：
+
+```bash
+# 在 0.0.0.0:11013 上监听，并使用 10.14.14.0/24 子网作为 WireGuard 客户端
+sudo easytier-core -i 10.144.144.1 --vpn-portal wg://0.0.0.0:11013/10.14.14.0/24
+```
+
+2. 获取 WireGuard 客户端配置：
+
+```bash
+# 获取 WireGuard 客户端配置
+easytier-cli vpn-portal
+```
+
+3. 在输出配置中：
+   - 将 `Interface.Address` 设置为 WireGuard 子网中的可用 IP
+   - 将 `Peer.Endpoint` 设置为您的 EasyTier 节点的公网 IP/域名
+   - 将修改后的配置导入到您的 WireGuard 客户端
+
+#### 自建公共共享节点
+
+您可以运行自己的公共共享节点来帮助其他节点相互发现。公共共享节点只是一个普通的 EasyTier 网络（具有相同的网络名称和密钥），其他网络可以连接到它。
+
+要运行公共共享节点：
+
+```bash
+# 公共共享节点无需指定 IPv4 地址
+sudo easytier-core --network-name mysharednode --network-secret mysharednode
+```
+
+网络设置成功后，您可以轻松配置它以在系统启动时自动启动。请参阅 [一键注册服务指南](https://easytier.cn/en/guide/network/oneclick-install-as-service.html) 了解如何将 EasyTier 注册为系统服务。
+
+## 相关项目
+
+- [ZeroTier](https://www.zerotier.com/)：用于连接设备的全球虚拟网络。
+- [TailScale](https://tailscale.com/)：旨在简化网络配置的 VPN 解决方案。
+
+### 联系我们
 
 - 💬 **[Telegram 群组](https://t.me/easytier)**
-- 👥 **QQ 群**：[一群 949700262](https://qm.qq.com/q/wFoTUChqZW)、[二群 837676408](https://qm.qq.com/q/4V33DrfgHe)、[三群 957189589](https://qm.qq.com/q/YNyTQjwlai)
+- 👥 **QQ 群**
+  - 一群 [949700262](https://qm.qq.com/q/wFoTUChqZW)
+  - 二群 [837676408](https://qm.qq.com/q/4V33DrfgHe)
+  - 三群 [957189589](https://qm.qq.com/q/YNyTQjwlai)
 
 ## 许可证
 
@@ -103,25 +301,25 @@ EasyTier 在 [LGPL-3.0](https://github.com/EasyTier/EasyTier/blob/main/LICENSE)
 本项目的 CDN 加速和安全防护由腾讯云 EdgeOne 赞助。
 
 <p align="center">
-  <a href="https://edgeone.ai/?from=github" target="_blank">
+<a href="https://edgeone.ai/?from=github" target="_blank">
-    <img src="assets/edgeone.png" width="200" alt="EdgeOne Logo">
+<img src="assets/edgeone.png" width="200">
-  </a>
+</a>
 </p>
 
 特别感谢 [浪浪云](https://langlangy.cn/?i26c5a5) 和 [雨云](https://www.rainyun.com/NjM0NzQ1_) 赞助我们的公共服务器。
 
 <p align="center">
-  <a href="https://langlangy.cn/?i26c5a5" target="_blank">
+<a href="https://langlangy.cn/?i26c5a5" target="_blank">
-    <img src="assets/langlang.png" width="200" alt="浪浪云 Logo">
+<img src="assets/langlang.png" width="200">
-  </a>
+</a>
-  <a href="https://www.rainyun.com/NjM0NzQ1_" target="_blank">
+<a href="https://langlangy.cn/?i26c5a5" target="_blank">
-    <img src="assets/raincloud.png" width="200" alt="雨云 Logo">
+<img src="assets/raincloud.png" width="200">
-  </a>
+</a>
 </p>
 
-如果您觉得 EasyTier 有帮助，欢迎赞助我们。软件开发和维护需要持续投入，您的支持将帮助我们更好地维护和改进 EasyTier。
+如果您觉得 EasyTier 有帮助，请考虑赞助我们。软件开发和维护需要大量的时间和精力，您的赞助将帮助我们更好地维护和改进 EasyTier。
 
 <p align="center">
-  <img src="assets/wechat.png" width="200" alt="微信赞助二维码">
+<img src="assets/wechat.png" width="200">
-  <img src="assets/alipay.png" width="200" alt="支付宝赞助二维码">
+<img src="assets/alipay.png" width="200">
 </p>

easytier-contrib/easytier-android-jni/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "easytier-android-jni"
 version = "0.1.0"
-edition = "2021"
+edition.workspace = true
 
 [lib]
 crate-type = ["cdylib"]

easytier-contrib/easytier-android-jni/src/lib.rs

@@ -1,7 +1,7 @@
 use easytier::proto::api::manage::{NetworkInstanceRunningInfo, NetworkInstanceRunningInfoMap};
+use jni::JNIEnv;
 use jni::objects::{JClass, JObjectArray, JString};
 use jni::sys::{jint, jstring};
-use jni::JNIEnv;
 use once_cell::sync::Lazy;
 use std::ffi::{CStr, CString};
 use std::ptr;
@@ -15,7 +15,7 @@ pub struct KeyValuePair {
 }
 
 // 声明外部 C 函数
-extern "C" {
+unsafe extern "C" {
     fn set_tun_fd(inst_name: *const std::ffi::c_char, fd: std::ffi::c_int) -> std::ffi::c_int;
     fn get_error_msg(out: *mut *const std::ffi::c_char);
     fn free_string(s: *const std::ffi::c_char);
@@ -68,7 +68,7 @@ fn throw_exception(env: &mut JNIEnv, message: &str) {
 }
 
 /// 设置 TUN 文件描述符
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_setTunFd(
     mut env: JNIEnv,
     _class: JClass,
@@ -87,17 +87,17 @@ pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_setTunFd(
 
     unsafe {
         let result = set_tun_fd(inst_name_cstr.as_ptr(), fd);
-        if result != 0 {
+        if result != 0
-            if let Some(error) = get_last_error() {
+            && let Some(error) = get_last_error()
-                throw_exception(&mut env, &error);
+        {
-            }
+            throw_exception(&mut env, &error);
         }
         result
     }
 }
 
 /// 解析配置
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_parseConfig(
     mut env: JNIEnv,
     _class: JClass,
@@ -115,17 +115,17 @@ pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_parseConfig(
 
     unsafe {
         let result = parse_config(config_cstr.as_ptr());
-        if result != 0 {
+        if result != 0
-            if let Some(error) = get_last_error() {
+            && let Some(error) = get_last_error()
-                throw_exception(&mut env, &error);
+        {
-            }
+            throw_exception(&mut env, &error);
         }
         result
     }
 }
 
 /// 运行网络实例
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_runNetworkInstance(
     mut env: JNIEnv,
     _class: JClass,
@@ -143,17 +143,17 @@ pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_runNetworkInstance(
 
     unsafe {
         let result = run_network_instance(config_cstr.as_ptr());
-        if result != 0 {
+        if result != 0
-            if let Some(error) = get_last_error() {
+            && let Some(error) = get_last_error()
-                throw_exception(&mut env, &error);
+        {
-            }
+            throw_exception(&mut env, &error);
         }
         result
     }
 }
 
 /// 保持网络实例
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_retainNetworkInstance(
     mut env: JNIEnv,
     _class: JClass,
@@ -165,10 +165,10 @@ pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_retainNetworkInstance(
     if instance_names.is_null() {
         unsafe {
             let result = retain_network_instance(ptr::null(), 0);
-            if result != 0 {
+            if result != 0
-                if let Some(error) = get_last_error() {
+                && let Some(error) = get_last_error()
-                    throw_exception(&mut env, &error);
+            {
-                }
+                throw_exception(&mut env, &error);
             }
             return result;
         }
@@ -187,10 +187,10 @@ pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_retainNetworkInstance(
     if array_length == 0 {
         unsafe {
             let result = retain_network_instance(ptr::null(), 0);
-            if result != 0 {
+            if result != 0
-                if let Some(error) = get_last_error() {
+                && let Some(error) = get_last_error()
-                    throw_exception(&mut env, &error);
+            {
-                }
+                throw_exception(&mut env, &error);
             }
             return result;
         }
@@ -234,17 +234,17 @@ pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_retainNetworkInstance(
 
     unsafe {
         let result = retain_network_instance(c_string_ptrs.as_ptr(), c_string_ptrs.len());
-        if result != 0 {
+        if result != 0
-            if let Some(error) = get_last_error() {
+            && let Some(error) = get_last_error()
-                throw_exception(&mut env, &error);
+        {
-            }
+            throw_exception(&mut env, &error);
         }
         result
     }
 }
 
 /// 收集网络信息
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_collectNetworkInfos(
     mut env: JNIEnv,
     _class: JClass,
@@ -304,7 +304,7 @@ pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_collectNetworkInfos(
 }
 
 /// 获取最后的错误信息
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "system" fn Java_com_easytier_jni_EasyTierJNI_getLastError(
     env: JNIEnv,
     _class: JClass,

easytier-contrib/easytier-ffi/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "easytier-ffi"
 version = "0.1.0"
-edition = "2021"
+edition.workspace = true
 
 [lib]
 crate-type = ["cdylib"]

easytier-contrib/easytier-ffi/src/lib.rs

@@ -30,7 +30,7 @@ fn set_error_msg(msg: &str) {
 
 /// # Safety
 /// Set the tun fd
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn set_tun_fd(
     inst_name: *const std::ffi::c_char,
     fd: std::ffi::c_int,
@@ -59,7 +59,7 @@ pub unsafe extern "C" fn set_tun_fd(
 
 /// # Safety
 /// Get the last error message
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn get_error_msg(out: *mut *const std::ffi::c_char) {
     let msg_buf = ERROR_MSG.lock().unwrap();
     if msg_buf.is_empty() {
@@ -74,7 +74,7 @@ pub unsafe extern "C" fn get_error_msg(out: *mut *const std::ffi::c_char) {
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn free_string(s: *const std::ffi::c_char) {
     if s.is_null() {
         return;
@@ -86,7 +86,7 @@ pub extern "C" fn free_string(s: *const std::ffi::c_char) {
 
 /// # Safety
 /// Parse the config
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn parse_config(cfg_str: *const std::ffi::c_char) -> std::ffi::c_int {
     let cfg_str = unsafe {
         assert!(!cfg_str.is_null());
@@ -105,7 +105,7 @@ pub unsafe extern "C" fn parse_config(cfg_str: *const std::ffi::c_char) -> std::
 
 /// # Safety
 /// Run the network instance
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn run_network_instance(cfg_str: *const std::ffi::c_char) -> std::ffi::c_int {
     let cfg_str = unsafe {
         assert!(!cfg_str.is_null());
@@ -144,7 +144,7 @@ pub unsafe extern "C" fn run_network_instance(cfg_str: *const std::ffi::c_char)
 
 /// # Safety
 /// Retain the network instance
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn retain_network_instance(
     inst_names: *const *const std::ffi::c_char,
     length: usize,
@@ -188,7 +188,7 @@ pub unsafe extern "C" fn retain_network_instance(
 
 /// # Safety
 /// Collect the network infos
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn collect_network_infos(
     infos: *mut KeyValuePair,
     max_length: usize,

easytier-contrib/easytier-magisk/action.sh

@@ -1,43 +1,74 @@
 #!/data/adb/magisk/busybox sh
 MODDIR=${0%/*}
 MODULE_PROP="${MODDIR}/module.prop"
+IP_RULE_SCRIPT="${MODDIR}/hotspot_iprule.sh"
 
 ET_STATUS=""
 REDIR_STATUS=""
-# 更新module.prop文件中的description
+IS_RUNNING=false
+
+# 确保辅助脚本有执行权限
+chmod +x "${IP_RULE_SCRIPT}" 2>/dev/null
+
+# 更新 module.prop 文件中的 description
 update_module_description() {
     local status_message=$1
-    sed -i "/^description=/c\description=[状态]${status_message}" ${MODULE_PROP}
+    # 检查 module.prop 文件存在且 description 发生变化了再写入
+    if [ -f "${MODULE_PROP}" ]; then
+        local current_desc=$(grep "^description=" "${MODULE_PROP}")
+        local new_desc="description=[状态] ${status_message}"
+        if [ "${current_desc}" != "${new_desc}" ]; then
+            sed -i "s#^description=.*#${new_desc}#" "${MODULE_PROP}"
+        fi
+    fi
 }
 
-
+# 判断程序启动状态
 if [ -f "${MODDIR}/disable" ]; then
-    ET_STATUS="已关闭"
+    IS_RUNNING=false
-elif pgrep -f 'easytier-core' >/dev/null; then
+    ET_STATUS="主程序已关闭"
-    if [ -f "${MODDIR}/config/command_args"]; then
+
-        ET_STATUS="主程序已开启(启动参数模式)"
+elif pgrep -f "${MODDIR}/easytier-core" >/dev/null; then
+    IS_RUNNING=true
+    if [ -f "${MODDIR}/config/command_args" ]; then
+        ET_STATUS="主程序正在运行（启动参数模式）"
     else
-        ET_STATUS="主程序已开启(配置文件模式)"
+        ET_STATUS="主程序正在运行（配置文件模式）"
     fi
+    
+elif [ -z "$ET_STATUS" ]; then
+    # 既没 disable 也没运行，说明是异常停止或未启动
+    ET_STATUS="主程序启动失败或未运行"
 fi
 
-#ET_STATUS不存在说明开启模块未正常运行，不修改状态
+# 无论主程序是否运行，都允许切换“开关文件”的状态，以便下次生效
-if [ -n "$ET_STATUS" ]; then
+if [ -f "${MODDIR}/enable_IP_rule" ]; then
-    if [ -f "${MODDIR}/enable_IP_rule" ]; then
+    rm -f "${MODDIR}/enable_IP_rule"
-        rm -f "${MODDIR}/enable_IP_rule"
+    
-        ${MODDIR}/hotspot_iprule.sh del
+    "${IP_RULE_SCRIPT}" del >/dev/null 2>&1
-        REDIR_STATUS="转发已禁用"
+    
-        echo "热点子网转发已禁用"
+    REDIR_STATUS="转发已禁用"
-        echo "[ET-NAT] IP rule disabled." >> "${MODDIR}/log.log"
+    echo "热点子网转发已禁用"
-    else
+    echo "[ET-NAT] Action: IP rule disabled." >> "${MODDIR}/log.log"
-        touch "${MODDIR}/enable_IP_rule"
-        ${MODDIR}/hotspot_iprule.sh del
-        ${MODDIR}/hotspot_iprule.sh add_once
-        REDIR_STATUS="转发已激活"
-        echo "热点子网转发已激活,热点开启后将自动将热点加入转发网络（要求已配置本地网络cidr=参数）。转发规则将随着热点开关而自动开关。该状态将保持到转发被禁用为止。"
-        echo "[ET-NAT] IP rule enabled." >> "${MODDIR}/log.log"
-    fi
-    update_module_description "${ET_STATUS} | ${REDIR_STATUS}"
 else
-    echo "主程序未正常启动，请先检查配置文件"
+    touch "${MODDIR}/enable_IP_rule"
+
+    if [ "$IS_RUNNING" = true ]; then
+        "${IP_RULE_SCRIPT}" del >/dev/null 2>&1
+        "${IP_RULE_SCRIPT}" add_once
+        echo "转发规则将立即生效，无需重启"
+    else
+        echo "主程序未运行，转发规则将在下次启动时生效"
+    fi
+    
+    REDIR_STATUS="转发已激活"
+    echo "----------------------------------"
+    echo "热点子网转发已激活"
+    echo "热点开启后将自动将热点加入转发网络"
+    echo "需要在配置中提前配置好 cidr 参数"
+    echo "----------------------------------"
+    echo "[ET-NAT] Action: IP rule enabled." >> "${MODDIR}/log.log"
 fi
+
+sync
+update_module_description "${ET_STATUS}| ${REDIR_STATUS}"

easytier-contrib/easytier-magisk/customize.sh

@@ -5,12 +5,15 @@ LATESTARTSERVICE=true
 
 set_perm_recursive $MODPATH 0 0 0777 0777
 
-ui_print '安装完成'
+ui_print "系统架构为：$ARCH"
-ui_print '当前架构为' + $ARCH
+ui_print "系统 SDK 版本：$API"
-ui_print '当前系统版本为' + $API
+ui_print "EasyTier 安装位置：/data/adb/modules/easytier_magisk"
-ui_print '安装目录为:  /data/adb/modules/easytier_magisk'
+ui_print "配置文件位置：/data/adb/modules/easytier_magisk/config/config.toml"
-ui_print '配置文件位置:  /data/adb/modules/easytier_magisk/config/config.toml'
+ui_print "如需使用启动参数模式，请将 /data/adb/modules/easytier_magisk/config/command_args_sample 重命名为 command_args，并修改其中的内容"
-ui_print '如果需要自定义启动参数，可将 /data/adb/modules/easytier_magisk/config/command_args_sample 重命名为 command_args，并修改其中内容，使用自定义启动参数时会忽略配置文件'
+ui_print "config 目录中存在 command_args 文件时，模块会自动忽略 config.toml 文件"
-ui_print '修改配置文件后在magisk app禁用应用再启动即可生效'
+ui_print "----------------------------------"
-ui_print '点击操作按钮可启动/关闭热点子网转发，配合easytier的子网代理功能实现手机热点访问easytier网络'
+ui_print "注意！启动参数文件中不能存在 \" 和 '，配置文件则没有这个限制"
-ui_print '记得重启'
+ui_print "----------------------------------"
+ui_print "修改配置后无需重启设备，在 Magisk 中禁用 EasyTier 模块，等待 10 秒后重新启用即可让新配置生效"
+ui_print "点击 Magisk 中模块左下角的“操作”按钮可以禁用或激活热点子网转发，使用该功能前需要在配置中提前配置好 cidr 参数"
+ui_print "模块安装完成，重启设备生效"

easytier-contrib/easytier-magisk/easytier_core.sh

@@ -2,64 +2,111 @@
 
 MODDIR=${0%/*}
 CONFIG_FILE="${MODDIR}/config/config.toml"
+COMMAND_ARGS="${MODDIR}/config/command_args"
 LOG_FILE="${MODDIR}/log.log"
 MODULE_PROP="${MODDIR}/module.prop"
 EASYTIER="${MODDIR}/easytier-core"
+
+# 处理获取到的设备型号中可能出现的空格
+BRAND=$(getprop ro.product.brand | tr ' ' '-')
+MODEL=$(getprop ro.product.model | tr ' ' '-')
+DEVICE_HOSTNAME="${BRAND}-${MODEL}"
 REDIR_STATUS=""
 
-# 更新module.prop文件中的description
+# 更新 module.prop 文件中的 description
 update_module_description() {
     local status_message=$1
-    sed -i "/^description=/c\description=[状态]${status_message}" ${MODULE_PROP}
+    # 检查 module.prop 文件存在且 description 发生变化了再写入
+    if [ -f "${MODULE_PROP}" ]; then
+        local current_desc=$(grep "^description=" "${MODULE_PROP}")
+        local new_desc="description=[状态] ${status_message}"
+        if [ "${current_desc}" != "${new_desc}" ]; then
+            sed -i "s#^description=.*#${new_desc}#" "${MODULE_PROP}"
+        fi
+    fi
 }
 
-if [ -f "${MODDIR}/enable_IP_rule" ]; then
+# 检查并初始化 TUN 设备
-    REDIR_STATUS="转发已激活"
-else
-    REDIR_STATUS="转发已禁用"
-fi
-
 if [ ! -e /dev/net/tun ]; then
     if [ ! -d /dev/net ]; then
         mkdir -p /dev/net
     fi
-
+    
     ln -s /dev/tun /dev/net/tun
 fi
 
 while true; do
-    if ls $MODDIR | grep -q "disable"; then
+    # 获取子网转发激活状态
-        update_module_description "关闭中 | ${REDIR_STATUS}"
+    if [ -f "${MODDIR}/enable_IP_rule" ]; then
-        if pgrep -f 'easytier-core' >/dev/null; then
+        REDIR_STATUS="转发已激活"
-            echo "开关控制$(date "+%Y-%m-%d %H:%M:%S") 进程已存在，正在关闭 ..."
-            pkill easytier-core # 关闭进程
-        fi
     else
-        if ! pgrep -f 'easytier-core' >/dev/null; then
+        REDIR_STATUS="转发已禁用"
-            if [ ! -f "$CONFIG_FILE" ]; then
+    fi
-                update_module_description "config.toml不存在"
-                sleep 3s
-                continue
-            fi
 
-            # 如果 config 目录下存在 command_args 文件，则读取其中的内容作为启动参数
+    # 检查模块是否被禁用
-            if [ -f "${MODDIR}/config/command_args" ]; then
+    if [ -f "${MODDIR}/disable" ]; then
-                TZ=Asia/Shanghai ${EASYTIER} $(cat ${MODDIR}/config/command_args) --hostname "$(getprop ro.product.brand)-$(getprop ro.product.model)" > ${LOG_FILE} &
+        update_module_description "主程序已关闭 | ${REDIR_STATUS}"
-                sleep 5s # 等待easytier-core启动完成
+        if pgrep -f "${EASYTIER}" >/dev/null; then
-                update_module_description "主程序已开启(启动参数模式) | ${REDIR_STATUS}"
+            echo "开关控制 $(date "+%Y-%m-%d %H:%M:%S") 进程已存在，正在关闭"
-            else
+            pkill -f "${EASYTIER}"
-                TZ=Asia/Shanghai ${EASYTIER} -c ${CONFIG_FILE} --hostname "$(getprop ro.product.brand)-$(getprop ro.product.model)" > ${LOG_FILE} &
-                sleep 5s # 等待easytier-core启动完成
-                update_module_description "主程序已开启(配置文件模式) | ${REDIR_STATUS}"
-            fi
-            ip rule add from all lookup main
-            if ! pgrep -f 'easytier-core' >/dev/null; then
-                update_module_descriptio "主程序启动失败，请检查配置文件"
-            fi
-        else
-            echo "开关控制$(date "+%Y-%m-%d %H:%M:%S") 进程已存在"
         fi
+        sleep 10s
+        continue
     fi
     
-    sleep 3s # 暂停3秒后再次执行循环
+    # 检查进程是否已经在运行
-done
+    if pgrep -f "${EASYTIER}" >/dev/null; then
+        sleep 10s
+        continue
+    fi
+    
+    # 检查配置文件是否存在
+    if [ ! -f "${CONFIG_FILE}" ] && [ ! -f "${COMMAND_ARGS}" ]; then
+        update_module_description "缺少配置文件或启动参数文件"
+        sleep 10s
+        continue
+    fi
+    
+    # 如果 config 目录下存在 command_args 文件，则读取其中的内容作为启动参数
+    if [ -f "${COMMAND_ARGS}" ]; then
+        # 启动参数模式
+        CMD_CONTENT=$(tr '\r\n' ' ' < "${COMMAND_ARGS}")
+        
+        if echo "${CMD_CONTENT}" | grep -q "\-\-hostname"; then
+            FINAL_ARGS="${CMD_CONTENT}"
+        else
+            FINAL_ARGS="${CMD_CONTENT} --hostname ${DEVICE_HOSTNAME}"
+        fi
+        
+        TZ=Asia/Shanghai "${EASYTIER}" ${FINAL_ARGS} > "${LOG_FILE}" 2>&1 &
+        STR_MODE="启动参数模式"
+        
+        # 否则读取 config.toml 的内容作为启动参数
+    else
+        # 配置文件模式
+        if grep -q "^[[:space:]]*hostname[[:space:]]*=" "${CONFIG_FILE}"; then
+            TZ=Asia/Shanghai "${EASYTIER}" -c "${CONFIG_FILE}" > "${LOG_FILE}" 2>&1 &
+        else
+            TZ=Asia/Shanghai "${EASYTIER}" -c "${CONFIG_FILE}" --hostname "${DEVICE_HOSTNAME}" > "${LOG_FILE}" 2>&1 &
+        fi
+        
+        STR_MODE="配置文件模式"
+    fi
+    
+    # 等待进程启动
+    sleep 5s
+    
+    # 启动后的扫尾工作
+    if pgrep -f "${EASYTIER}" >/dev/null; then
+        
+        if ! ip rule show | grep -q "lookup main"; then
+            ip rule add from all lookup main
+        fi
+        
+        update_module_description "主程序正在运行（${STR_MODE}）| ${REDIR_STATUS}"
+    else
+        update_module_description "主程序启动失败，请检查配置文件或启动参数"
+    fi
+    
+    sleep 10s
+done

easytier-contrib/easytier-magisk/module.prop

@@ -1,6 +1,6 @@
 id=easytier_magisk
 name=EasyTier_Magisk
-version=v2.5.0
+version=v2.6.3
 versionCode=1
 author=EasyTier
 description=easytier magisk module @EasyTier(https://github.com/EasyTier/EasyTier)

easytier-contrib/easytier-magisk/uninstall.sh

@@ -1,3 +1,5 @@
 MODDIR=${0%/*}
-pkill easytier-core # 结束 easytier-core 进程
+pkill -f "${MODDIR}/easytier-core"
-rm -rf $MODDIR/*
+
+# 使用 ${MODDIR:?} 确保变量非空，避免执行 rm -rf /*
+rm -rf "${MODDIR:?}/"*

easytier-contrib/easytier-ohrs/Cargo.lock

@@ -1083,7 +1083,7 @@ checksum = "7454e41ff9012c00d53cf7f475c5e3afa3b91b7c90568495495e8d9bf47a1055"
 
 [[package]]
 name = "easytier"
-version = "2.5.0"
+version = "2.6.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -1101,6 +1101,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "cfg-if",
+ "cfg_aliases",
  "chrono",
  "cidr",
  "clap",
@@ -1115,6 +1116,7 @@ dependencies = [
  "easytier-rpc-build",
  "encoding",
  "flume",
+ "forwarded-header-value",
  "futures",
  "gethostname",
  "git-version",
@@ -1131,6 +1133,7 @@ dependencies = [
  "humantime-serde",
  "idna",
  "indoc",
+ "itertools 0.14.0",
  "kcp-sys",
  "machine-uid",
  "multimap",
@@ -1153,7 +1156,9 @@ dependencies = [
  "prost-build",
  "prost-reflect",
  "prost-reflect-build",
- "prost-types",
+ "prost-wkt",
+ "prost-wkt-build",
+ "prost-wkt-types",
  "quinn",
  "quinn-plaintext",
  "rand 0.8.5",
@@ -1173,6 +1178,7 @@ dependencies = [
  "smoltcp",
  "snow",
  "socket2 0.5.10",
+ "strum",
  "stun_codec",
  "sys-locale",
  "tabled",
@@ -1354,6 +1360,17 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
+[[package]]
+name = "erased-serde"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2add8a07dd6a8d93ff627029c51de145e12686fbc36ecb298ac22e74cf02dec"
+dependencies = [
+ "serde",
+ "serde_core",
+ "typeid",
+]
+
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -1471,6 +1488,16 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "forwarded-header-value"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8835f84f38484cc86f110a805655697908257fb9a7af005234060891557198e9"
+dependencies = [
+ "nonempty",
+ "thiserror 1.0.69",
+]
+
 [[package]]
 name = "futures"
 version = "0.3.31"
@@ -2217,6 +2244,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "inventory"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4f0c30c76f2f4ccee3fe55a2435f691ca00c0e4bd87abe4f4a851b1d4dac39b"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "io-uring"
 version = "0.7.10"
@@ -2824,6 +2860,12 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "nonempty"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9e591e719385e6ebaeb5ce5d3887f7d5676fceca6411d1925ccc95745f3d6f7"
+
 [[package]]
 name = "normpath"
 version = "1.5.0"
@@ -3413,6 +3455,52 @@ dependencies = [
  "prost",
 ]
 
+[[package]]
+name = "prost-wkt"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "497e1e938f0c09ef9cabe1d49437b4016e03e8f82fbbe5d1c62a9b61b9decae1"
+dependencies = [
+ "chrono",
+ "inventory",
+ "prost",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "typetag",
+]
+
+[[package]]
+name = "prost-wkt-build"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07b8bf115b70a7aa5af1fd5d6e9418492e9ccb6e4785e858c938e28d132a884b"
+dependencies = [
+ "heck 0.5.0",
+ "prost",
+ "prost-build",
+ "prost-types",
+ "quote",
+]
+
+[[package]]
+name = "prost-wkt-types"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8cdde6df0a98311c839392ca2f2f0bcecd545f86a62b4e3c6a49c336e970fe5"
+dependencies = [
+ "chrono",
+ "prost",
+ "prost-build",
+ "prost-types",
+ "prost-wkt",
+ "prost-wkt-build",
+ "regex",
+ "serde",
+ "serde_derive",
+ "serde_json",
+]
+
 [[package]]
 name = "quick-xml"
 version = "0.38.3"
@@ -3456,9 +3544,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.13"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes",
  "fastbloom",
@@ -4136,6 +4224,12 @@ version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d66dc143e6b11c1eddc06d5c423cfc97062865baf299914ab64caa38182078fe"
 
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
 [[package]]
 name = "siphasher"
 version = "1.0.1"
@@ -4225,6 +4319,27 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
 [[package]]
 name = "stun_codec"
 version = "0.3.5"
@@ -4575,9 +4690,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-websockets"
-version = "0.8.3"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "842e11addde61da7c37ef205cd625ebcd7b607076ea62e4698f06bfd5fd01a03"
+checksum = "dad543404f98bfc969aeb71994105c592acfc6c43323fddcd016bb208d1c65cb"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -4588,10 +4703,11 @@ dependencies = [
  "httparse",
  "ring",
  "rustls-pki-types",
+ "simdutf8",
  "tokio",
  "tokio-rustls",
  "tokio-util",
- "webpki-roots 0.26.11",
+ "webpki-roots 1.0.2",
 ]
 
 [[package]]
@@ -4823,12 +4939,42 @@ dependencies = [
  "wintun",
 ]
 
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
 [[package]]
 name = "typenum"
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
+[[package]]
+name = "typetag"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be2212c8a9b9bcfca32024de14998494cf9a5dfa59ea1b829de98bac374b86bf"
+dependencies = [
+ "erased-serde",
+ "inventory",
+ "once_cell",
+ "serde",
+ "typetag-impl",
+]
+
+[[package]]
+name = "typetag-impl"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27a7a9b72ba121f6f1f6c3632b85604cac41aedb5ddc70accbebb6cac83de846"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
 [[package]]
 name = "unicase"
 version = "2.8.1"

easytier-contrib/easytier-uptime/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "easytier-uptime"
 version = "0.1.0"
-edition = "2021"
+edition.workspace = true
 
 [dependencies]
 tokio = { version = "1.0", features = ["full"] }
@@ -12,6 +12,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1.0", features = ["v4", "serde"] }
+guarden = "0.1"
 
 # Axum web framework
 axum = { version = "0.8.4", features = ["macros"] }

easytier-contrib/easytier-uptime/src/api/handlers.rs

@@ -1,7 +1,7 @@
 use std::ops::{Div, Mul};
 
-use axum::extract::{Path, State};
 use axum::Json;
+use axum::extract::{Path, State};
 use sea_orm::{
     ColumnTrait, Condition, EntityTrait, IntoActiveModel, ModelTrait, Order, PaginatorTrait,
     QueryFilter, QueryOrder, QuerySelect, Set, TryIntoModel,
@@ -14,7 +14,7 @@ use crate::api::{
     models::*,
 };
 use crate::db::entity::{self, health_records, shared_nodes};
-use crate::db::{operations::*, Db};
+use crate::db::{Db, operations::*};
 use crate::health_checker_manager::HealthCheckerManager;
 use axum_extra::extract::Query;
 use std::sync::Arc;
@@ -273,7 +273,7 @@ pub struct InstanceFilterParams {
 use crate::config::AppConfig;
 use axum::http::{HeaderMap, StatusCode};
 use chrono::{Duration, Utc};
-use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
+use jsonwebtoken::{DecodingKey, EncodingKey, Header, Validation, decode, encode};
 use serde::Serialize;
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -370,19 +370,19 @@ pub async fn admin_get_nodes(
         let ids = NodeOperations::filter_node_ids_by_tag(&app_state.db, &tag).await?;
         filtered_ids = Some(ids);
     }
-    if let Some(tags) = filters.tags {
+    if let Some(tags) = filters.tags
-        if !tags.is_empty() {
+        && !tags.is_empty()
-            let ids_any = NodeOperations::filter_node_ids_by_tags_any(&app_state.db, &tags).await?;
+    {
-            filtered_ids = match filtered_ids {
+        let ids_any = NodeOperations::filter_node_ids_by_tags_any(&app_state.db, &tags).await?;
-                Some(mut existing) => {
+        filtered_ids = match filtered_ids {
-                    existing.extend(ids_any);
+            Some(mut existing) => {
-                    existing.sort();
+                existing.extend(ids_any);
-                    existing.dedup();
+                existing.sort();
-                    Some(existing)
+                existing.dedup();
-                }
+                Some(existing)
-                None => Some(ids_any),
+            }
-            };
+            None => Some(ids_any),
-        }
+        };
     }
     if let Some(ids) = filtered_ids {
         if ids.is_empty() {

easytier-contrib/easytier-uptime/src/api/routes.rs

@@ -1,5 +1,5 @@
-use axum::routing::{delete, get, post, put};
 use axum::Router;
+use axum::routing::{delete, get, post, put};
 use tower_http::compression::CompressionLayer;
 use tower_http::cors::CorsLayer;
 

easytier-contrib/easytier-uptime/src/db/cleanup.rs

@@ -1,7 +1,7 @@
-use crate::db::entity::*;
 use crate::db::Db;
+use crate::db::entity::*;
 use sea_orm::*;
-use tokio::time::{sleep, Duration};
+use tokio::time::{Duration, sleep};
 use tracing::{error, info, warn};
 
 /// 数据清理策略配置

easytier-contrib/easytier-uptime/src/db/mod.rs

@@ -5,12 +5,12 @@ pub mod operations;
 use std::fmt;
 
 use sea_orm::{
-    prelude::*, sea_query::OnConflict, ColumnTrait as _, DatabaseConnection, DbErr, EntityTrait,
+    ColumnTrait as _, DatabaseConnection, DbErr, EntityTrait, QueryFilter as _, Set,
-    QueryFilter as _, Set, SqlxSqliteConnector, Statement, TransactionTrait as _,
+    SqlxSqliteConnector, Statement, TransactionTrait as _, prelude::*, sea_query::OnConflict,
 };
 use sea_orm_migration::MigratorTrait as _;
 use serde::{Deserialize, Serialize};
-use sqlx::{migrate::MigrateDatabase as _, Sqlite, SqlitePool};
+use sqlx::{Sqlite, SqlitePool, migrate::MigrateDatabase as _};
 
 use crate::migrator;
 

easytier-contrib/easytier-uptime/src/db/operations.rs

@@ -1,8 +1,8 @@
 use crate::api::CreateNodeRequest;
-use crate::db::entity::*;
 use crate::db::Db;
 use crate::db::HealthStats;
 use crate::db::HealthStatus;
+use crate::db::entity::*;
 use sea_orm::*;
 use std::collections::{HashMap, HashSet};
 

easytier-contrib/easytier-uptime/src/health_checker.rs

@@ -7,21 +7,21 @@ use std::{
 use anyhow::Context as _;
 use dashmap::DashMap;
 use easytier::{
-    common::{
+    common::config::{
-        config::{ConfigFileControl, ConfigLoader, NetworkIdentity, PeerConfig, TomlConfigLoader},
+        ConfigFileControl, ConfigLoader, NetworkIdentity, PeerConfig, TomlConfigLoader,
-        scoped_task::ScopedTask,
     },
-    defer,
     instance_manager::NetworkInstanceManager,
 };
+use guarden::defer;
 use serde::{Deserialize, Serialize};
 use sqlx::any;
+use tokio_util::task::AbortOnDropHandle;
 use tracing::{debug, error, info, instrument, warn};
 
 use crate::db::{
+    Db, HealthStatus,
     entity::shared_nodes,
     operations::{HealthOperations, NodeOperations},
-    Db, HealthStatus,
 };
 
 pub struct HealthCheckOneNode {
@@ -240,7 +240,7 @@ pub struct HealthChecker {
     db: Db,
     instance_mgr: Arc<NetworkInstanceManager>,
     inst_id_map: DashMap<i32, uuid::Uuid>,
-    node_tasks: DashMap<i32, ScopedTask<()>>,
+    node_tasks: DashMap<i32, AbortOnDropHandle<()>>,
     node_records: Arc<DashMap<i32, HealthyMemRecord>>,
     node_cfg: Arc<DashMap<i32, TomlConfigLoader>>,
 }
@@ -465,7 +465,7 @@ impl HealthChecker {
         }
 
         // 启动健康检查任务
-        let task = ScopedTask::from(tokio::spawn(Self::node_health_check_task(
+        let task = AbortOnDropHandle::new(tokio::spawn(Self::node_health_check_task(
             node_id,
             cfg.get_id(),
             Arc::clone(&self.instance_mgr),

easytier-contrib/easytier-uptime/src/health_checker_manager.rs

@@ -1,11 +1,11 @@
 use std::{collections::HashSet, sync::Arc, time::Duration};
 
 use anyhow::Context as _;
-use tokio::time::{interval, Interval};
+use tokio::time::{Interval, interval};
 use tracing::{error, info};
 
 use crate::{
-    db::{entity::shared_nodes, operations::NodeOperations, Db},
+    db::{Db, entity::shared_nodes, operations::NodeOperations},
     health_checker::HealthChecker,
 };
 

easytier-contrib/easytier-uptime/src/main.rs

@@ -10,7 +10,7 @@ mod migrator;
 use api::routes::create_routes;
 use clap::Parser;
 use config::AppConfig;
-use db::{operations::NodeOperations, Db};
+use db::{Db, operations::NodeOperations};
 use easytier::common::log;
 use health_checker::HealthChecker;
 use health_checker_manager::HealthCheckerManager;
@@ -49,7 +49,9 @@ async fn main() -> anyhow::Result<()> {
 
     // 如果提供了管理员密码，设置环境变量
     if let Some(password) = args.admin_password {
-        env::set_var("ADMIN_PASSWORD", password);
+        unsafe {
+            env::set_var("ADMIN_PASSWORD", password);
+        }
     }
 
     tracing::info!(

easytier-gui/package.json

@@ -1,7 +1,7 @@
 {
   "name": "easytier-gui",
   "type": "module",
-  "version": "2.5.0",
+  "version": "2.6.3",
   "private": true,
   "packageManager": "pnpm@9.12.1+sha512.e5a7e52a4183a02d5931057f7a0dbff9d5e9ce3161e33fa68ae392125b79282a8a8a470a51dfc8a0ed86221442eb2fb57019b0990ed24fab519bf0e1bc5ccfc4",
   "scripts": {
@@ -59,4 +59,4 @@
     "vue-i18n": "^10.0.0",
     "vue-tsc": "^2.1.10"
   }
-}
+}

easytier-gui/src-tauri/Cargo.toml

@@ -1,9 +1,9 @@
 [package]
 name = "easytier-gui"
-version = "2.5.0"
+version = "2.6.3"
 description = "EasyTier GUI"
 authors = ["you"]
-edition = "2021"
+edition.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -11,15 +11,6 @@ edition = "2021"
 name = "app_lib"
 crate-type = ["staticlib", "cdylib", "rlib"]
 
-[build-dependencies]
-tauri-build = { version = "2.0.0-rc", features = [] }
-
-# enable thunk-rs when compiling for x86_64 or i686 windows
-[target.x86_64-pc-windows-msvc.build-dependencies]
-thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = ["win7"] }
-
-[target.i686-pc-windows-msvc.build-dependencies]
-thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = ["win7"] }
 
 [dependencies]
 # wry 0.47 may crash on android, see https://github.com/EasyTier/EasyTier/issues/527
@@ -66,6 +57,14 @@ libc = "0.2"
 [target.'cfg(target_os = "macos")'.dependencies]
 security-framework-sys = "2.9.0"
 
+
+[build-dependencies]
+tauri-build = { version = "2.0.0-rc", features = [] }
+thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = [
+    "win7",
+] }
+
+
 [features]
 # This feature is used for production builds or when a dev server is not specified, DO NOT REMOVE!!
 custom-protocol = ["tauri/custom-protocol"]

easytier-gui/src-tauri/build.rs

@@ -1,12 +1,12 @@
-fn main() {
+use std::env;
-    // enable thunk-rs when target os is windows and arch is x86_64 or i686
+
-    #[cfg(target_os = "windows")]
+fn main() {
-    if !std::env::var("TARGET")
+    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
-        .unwrap_or_default()
+    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
-        .contains("aarch64")
+    // enable thunk-rs when target os is windows and arch is x86_64 or i686
-    {
+    if target_os == "windows" && (target_arch == "x86" || target_arch == "x86_64") {
-        thunk::thunk();
+        thunk::thunk();
-    }
+    }
-
+
-    tauri_build::build();
+    tauri_build::build();
-}
+}

easytier-gui/src-tauri/capabilities/migrated.json

@@ -36,6 +36,7 @@
     "core:tray:allow-set-show-menu-on-left-click",
     "core:tray:allow-set-tooltip",
     "vpnservice:allow-ping",
+    "vpnservice:allow-get-vpn-status",
     "vpnservice:allow-prepare-vpn",
     "vpnservice:allow-start-vpn",
     "vpnservice:allow-stop-vpn",
@@ -47,4 +48,4 @@
     "os:allow-platform",
     "os:allow-locale"
   ]
-}
+}

easytier-gui/src-tauri/gen/android/app/build.gradle.kts

@@ -1,5 +1,6 @@
 import java.util.Properties
 import java.io.FileInputStream
+import groovy.json.JsonSlurper
 
 plugins {
     id("com.android.application")
@@ -14,6 +15,35 @@ val tauriProperties = Properties().apply {
     }
 }
 
+val versionPattern = Regex("""^(\d+)\.(\d+)\.(\d+)$""")
+
+val tauriVersionName = tauriProperties.getProperty("tauri.android.versionName")?.ifBlank { null } ?: run {
+    val tauriConfFile = file("../../../tauri.conf.json")
+    check(tauriConfFile.exists()) { "Missing tauri.conf.json at ${tauriConfFile.path}" }
+
+    val tauriConf = tauriConfFile.reader(Charsets.UTF_8).use { JsonSlurper().parse(it) as? Map<*, *> }
+        ?: error("Failed to parse ${tauriConfFile.path} as a JSON object")
+    tauriConf["version"] as? String
+        ?: error("Missing string field \"version\" in ${tauriConfFile.path}")
+}
+
+val tauriVersionMatch = versionPattern.matchEntire(tauriVersionName)
+    ?: error("Android version must use x.y.z format, but got \"$tauriVersionName\"")
+
+val tauriVersionCode = if (tauriProperties.getProperty("tauri.android.versionName")?.ifBlank { null } != null) {
+    val versionCodeProp = tauriProperties.getProperty("tauri.android.versionCode")
+    if (versionCodeProp != null) {
+        versionCodeProp.toIntOrNull()
+            ?: error("Property \"tauri.android.versionCode\" must be an integer, but got \"$versionCodeProp\"")
+    } else {
+        val (major, minor, patch) = tauriVersionMatch.destructured
+        major.toInt() * 1_000_000 + minor.toInt() * 1_000 + patch.toInt()
+    }
+} else {
+    val (major, minor, patch) = tauriVersionMatch.destructured
+    major.toInt() * 1_000_000 + minor.toInt() * 1_000 + patch.toInt()
+}
+
 android {
     compileSdk = 34
     namespace = "com.kkrainbow.easytier"
@@ -22,8 +52,8 @@ android {
         applicationId = "com.kkrainbow.easytier"
         minSdk = 24
         targetSdk = 34
-        versionCode = tauriProperties.getProperty("tauri.android.versionCode", "1").toInt()
+        versionCode = tauriVersionCode
-        versionName = tauriProperties.getProperty("tauri.android.versionName", "1.0")
+        versionName = tauriVersionName
     }
     signingConfigs {
         create("release") {
@@ -82,4 +112,4 @@ dependencies {
     androidTestImplementation("androidx.test.espresso:espresso-core:3.5.0")
 }
 
-apply(from = "tauri.build.gradle.kts")
+apply(from = "tauri.build.gradle.kts")

easytier-gui/src-tauri/src/elevate/linux.rs

@@ -4,7 +4,7 @@
  *--------------------------------------------------------------------------------------------*/
 
 use super::Command;
-use anyhow::{anyhow, Result};
+use anyhow::{Result, anyhow};
 use std::env;
 use std::ffi::OsStr;
 use std::process::{Command as StdCommand, Output};

easytier-gui/src-tauri/src/elevate/macos.rs

@@ -30,10 +30,10 @@ use std::os::unix::process::ExitStatusExt;
 use std::path::Path;
 use std::ptr;
 
-use libc::{fileno, wait, EINTR, SHUT_WR};
+use libc::{EINTR, SHUT_WR, fileno, wait};
 use security_framework_sys::authorization::{
-    errAuthorizationSuccess, kAuthorizationFlagDefaults, kAuthorizationFlagDestroyRights,
     AuthorizationCreate, AuthorizationExecuteWithPrivileges, AuthorizationFree, AuthorizationRef,
+    errAuthorizationSuccess, kAuthorizationFlagDefaults, kAuthorizationFlagDestroyRights,
 };
 
 const ENV_PATH: &str = "PATH";

easytier-gui/src-tauri/src/elevate/windows.rs

@@ -11,11 +11,11 @@ use std::process::{ExitStatus, Output};
 use winapi::shared::minwindef::{DWORD, LPVOID};
 use winapi::um::processthreadsapi::{GetCurrentProcess, OpenProcessToken};
 use winapi::um::securitybaseapi::GetTokenInformation;
-use winapi::um::winnt::{TokenElevation, HANDLE, TOKEN_ELEVATION, TOKEN_QUERY};
+use winapi::um::winnt::{HANDLE, TOKEN_ELEVATION, TOKEN_QUERY, TokenElevation};
-use windows::core::{w, HSTRING, PCWSTR};
 use windows::Win32::Foundation::HWND;
 use windows::Win32::UI::Shell::ShellExecuteW;
 use windows::Win32::UI::WindowsAndMessaging::SW_HIDE;
+use windows::core::{HSTRING, PCWSTR, w};
 
 /// The implementation of state check and elevated executing varies on each platform
 impl Command {

easytier-gui/src-tauri/src/lib.rs

@@ -15,16 +15,18 @@ use easytier::rpc_service::remote_client::{
 use easytier::web_client::{self, WebClient};
 use easytier::{
     common::{
-        config::{ConfigLoader, FileLoggerConfig, LoggingConfigBuilder, TomlConfigLoader},
+        config::{
+            ConfigLoader, ConfigSource, FileLoggerConfig, LoggingConfigBuilder, TomlConfigLoader,
+        },
         log,
     },
     instance_manager::NetworkInstanceManager,
     launcher::NetworkConfig,
     rpc_service::ApiRpcServer,
+    tunnel::TunnelListener,
     tunnel::ring::RingTunnelListener,
     tunnel::tcp::TcpTunnelListener,
-    tunnel::TunnelListener,
+    utils::panic::setup_panic_handler,
-    utils::{self},
 };
 use std::ops::Deref;
 use std::sync::Arc;
@@ -118,7 +120,7 @@ async fn run_network_instance(
     let client_manager = get_client_manager!()?;
     let toml_config = cfg.gen_config().map_err(|e| e.to_string())?;
     client_manager
-        .pre_run_network_instance_hook(&app, &toml_config)
+        .pre_run_network_instance_hook(&app, &toml_config, manager::PersistedConfigSource::User)
         .await?;
     client_manager
         .handle_run_network_instance(app.clone(), cfg, save)
@@ -206,6 +208,20 @@ async fn update_network_config_state(
         .parse()
         .map_err(|e: uuid::Error| e.to_string())?;
     let client_manager = get_client_manager!()?;
+    if !disabled {
+        let (cfg, source) = client_manager
+            .handle_get_network_config_with_source(app.clone(), instance_id)
+            .await
+            .map_err(|e| e.to_string())?;
+        let toml_config = cfg.gen_config().map_err(|e| e.to_string())?;
+        client_manager
+            .pre_run_network_instance_hook(
+                &app,
+                &toml_config,
+                manager::PersistedConfigSource::from_runtime_source(source),
+            )
+            .await?;
+    }
     client_manager
         .handle_update_network_state(app.clone(), instance_id, disabled)
         .await
@@ -215,6 +231,10 @@ async fn update_network_config_state(
         client_manager
             .post_stop_network_instances_hook(&app)
             .await?;
+    } else {
+        client_manager
+            .post_run_network_instance_hook(&app, &instance_id)
+            .await?;
     }
 
     Ok(())
@@ -258,7 +278,7 @@ async fn get_config(app: AppHandle, instance_id: String) -> Result<NetworkConfig
 #[tauri::command]
 async fn load_configs(
     app: AppHandle,
-    configs: Vec<NetworkConfig>,
+    configs: Vec<manager::StoredGuiConfig>,
     enabled_networks: Vec<String>,
 ) -> Result<(), String> {
     get_client_manager!()?
@@ -545,10 +565,10 @@ fn toggle_window_visibility(app: &tauri::AppHandle) {
 }
 
 fn get_exe_path() -> String {
-    if let Ok(appimage_path) = std::env::var("APPIMAGE") {
+    if let Ok(appimage_path) = std::env::var("APPIMAGE")
-        if !appimage_path.is_empty() {
+        && !appimage_path.is_empty()
-            return appimage_path;
+    {
-        }
+        return appimage_path;
     }
     std::env::current_exe()
         .map(|p| p.to_string_lossy().to_string())
@@ -582,8 +602,8 @@ mod manager {
     use easytier::proto::rpc_types::controller::BaseController;
     use easytier::rpc_service::logger::LoggerRpcService;
     use easytier::rpc_service::remote_client::PersistentConfig;
-    use easytier::tunnel::ring::RingTunnelConnector;
     use easytier::tunnel::TunnelConnector;
+    use easytier::tunnel::ring::RingTunnelConnector;
     use easytier::web_client::WebClientHooks;
 
     pub(super) struct GuiHooks {
@@ -598,7 +618,11 @@ mod manager {
         ) -> Result<(), String> {
             let client_manager = get_client_manager!()?;
             client_manager
-                .pre_run_network_instance_hook(&self.app, cfg)
+                .pre_run_network_instance_hook(
+                    &self.app,
+                    cfg,
+                    PersistedConfigSource::from_runtime_source(cfg.get_network_config_source()),
+                )
                 .await
         }
 
@@ -617,14 +641,87 @@ mod manager {
         }
     }
 
+    #[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+    #[serde(rename_all = "snake_case")]
+    #[derive(Default)]
+    pub(super) enum PersistedConfigSource {
+        User,
+        Webhook,
+        #[serde(other)]
+        #[default]
+        Legacy,
+    }
+
+    impl PersistedConfigSource {
+        pub(super) fn from_runtime_source(source: ConfigSource) -> Self {
+            match source {
+                ConfigSource::User => Self::User,
+                ConfigSource::Webhook => Self::Webhook,
+            }
+        }
+
+        fn merge_persisted(self, incoming: Self) -> Self {
+            match (self, incoming) {
+                // Older runtimes report missing source as `user`. Keep the stronger persisted
+                // ownership until webhook sync or an explicit user save repairs it.
+                (Self::Webhook, Self::User) | (Self::Legacy, Self::User) => self,
+                (_, next) => next,
+            }
+        }
+
+        fn to_runtime_source(self) -> ConfigSource {
+            match self {
+                Self::User | Self::Legacy => ConfigSource::User,
+                Self::Webhook => ConfigSource::Webhook,
+            }
+        }
+
+        #[cfg(any(test, target_os = "android"))]
+        fn is_webhook_like(self) -> bool {
+            matches!(self, Self::Webhook)
+        }
+    }
+
     #[derive(Clone)]
-    pub(super) struct GUIConfig(String, pub(crate) NetworkConfig);
+    pub(super) struct GUIConfig {
+        inst_id: String,
+        pub(crate) config: NetworkConfig,
+        source: PersistedConfigSource,
+    }
+
+    #[derive(Clone, serde::Serialize, serde::Deserialize)]
+    pub(super) struct StoredGuiConfig {
+        config: NetworkConfig,
+        #[serde(default)]
+        source: PersistedConfigSource,
+    }
+
+    impl GUIConfig {
+        fn new(inst_id: String, config: NetworkConfig, source: PersistedConfigSource) -> Self {
+            Self {
+                inst_id,
+                config,
+                source,
+            }
+        }
+
+        fn into_stored(self) -> StoredGuiConfig {
+            StoredGuiConfig {
+                config: self.config,
+                source: self.source,
+            }
+        }
+    }
+
     impl PersistentConfig<anyhow::Error> for GUIConfig {
         fn get_network_inst_id(&self) -> &str {
-            &self.0
+            &self.inst_id
         }
         fn get_network_config(&self) -> Result<NetworkConfig, anyhow::Error> {
-            Ok(self.1.clone())
+            Ok(self.config.clone())
+        }
+        fn get_network_config_source(&self) -> ConfigSource {
+            self.source.to_runtime_source()
         }
     }
 
@@ -641,13 +738,12 @@ mod manager {
         }
 
         fn save_configs(&self, app: &AppHandle) -> anyhow::Result<()> {
-            let configs: Result<Vec<String>, _> = self
+            let configs = self
                 .network_configs
                 .iter()
-                .map(|entry| serde_json::to_string(&entry.value().1))
+                .map(|entry| entry.value().clone().into_stored())
-                .collect();
+                .collect::<Vec<_>>();
-            let payload = format!("[{}]", configs?.join(","));
+            app.emit("save_configs", configs)?;
-            app.emit_str("save_configs", payload)?;
             Ok(())
         }
 
@@ -666,8 +762,14 @@ mod manager {
             app: &AppHandle,
             inst_id: Uuid,
             cfg: NetworkConfig,
+            source: PersistedConfigSource,
         ) -> anyhow::Result<()> {
-            let config = GUIConfig(inst_id.to_string(), cfg);
+            let source = self
+                .network_configs
+                .get(&inst_id)
+                .map(|existing| existing.source.merge_persisted(source))
+                .unwrap_or(source);
+            let config = GUIConfig::new(inst_id.to_string(), cfg, source);
             self.network_configs.insert(inst_id, config);
             self.save_configs(app)
         }
@@ -679,8 +781,14 @@ mod manager {
             app: AppHandle,
             network_inst_id: Uuid,
             network_config: NetworkConfig,
+            source: ConfigSource,
         ) -> Result<(), anyhow::Error> {
-            self.save_config(&app, network_inst_id, network_config)?;
+            self.save_config(
+                &app,
+                network_inst_id,
+                network_config,
+                PersistedConfigSource::from_runtime_source(source),
+            )?;
             self.enabled_networks.insert(network_inst_id);
             self.save_enabled_networks(&app)?;
             Ok(())
@@ -797,17 +905,36 @@ mod manager {
                 .network_configs
                 .iter()
                 .filter(|v| self.storage.enabled_networks.contains(v.key()))
-                .filter(|v| !v.1.no_tun())
+                .filter(|v| !v.config.no_tun())
-                .filter_map(|c| c.1.instance_id().parse::<uuid::Uuid>().ok())
+                .filter_map(|c| c.config.instance_id().parse::<uuid::Uuid>().ok())
+        }
+
+        #[cfg(target_os = "android")]
+        pub fn get_enabled_instances_with_webhook_like_tun_ids(
+            &self,
+        ) -> impl Iterator<Item = uuid::Uuid> + '_ {
+            self.storage
+                .network_configs
+                .iter()
+                .filter(|v| self.storage.enabled_networks.contains(v.key()))
+                .filter(|v| !v.config.no_tun())
+                .filter(|v| v.source.is_webhook_like())
+                .filter_map(|c| c.config.instance_id().parse::<uuid::Uuid>().ok())
         }
 
         #[cfg(target_os = "android")]
         pub(super) async fn disable_instances_with_tun(
             &self,
             app: &AppHandle,
+            webhook_only: bool,
         ) -> Result<(), easytier::rpc_service::remote_client::RemoteClientError<anyhow::Error>>
         {
-            let inst_ids: Vec<uuid::Uuid> = self.get_enabled_instances_with_tun_ids().collect();
+            let inst_ids: Vec<uuid::Uuid> = if webhook_only {
+                self.get_enabled_instances_with_webhook_like_tun_ids()
+                    .collect()
+            } else {
+                self.get_enabled_instances_with_tun_ids().collect()
+            };
             for inst_id in inst_ids {
                 self.handle_update_network_state(app.clone(), inst_id, true)
                     .await?;
@@ -828,16 +955,32 @@ mod manager {
             &self,
             app: &AppHandle,
             cfg: &easytier::common::config::TomlConfigLoader,
+            source: PersistedConfigSource,
         ) -> Result<(), String> {
             let instance_id = cfg.get_id();
-            app.emit("pre_run_network_instance", instance_id)
+            app.emit("pre_run_network_instance", instance_id.to_string())
                 .map_err(|e| e.to_string())?;
 
             #[cfg(target_os = "android")]
             if !cfg.get_flags().no_tun {
-                self.disable_instances_with_tun(app)
+                match source {
-                    .await
+                    PersistedConfigSource::User | PersistedConfigSource::Legacy => {
-                    .map_err(|e| e.to_string())?;
+                        self.disable_instances_with_tun(app, false)
+                            .await
+                            .map_err(|e| e.to_string())?;
+                    }
+                    PersistedConfigSource::Webhook => {
+                        self.disable_instances_with_tun(app, true)
+                            .await
+                            .map_err(|e| e.to_string())?;
+                        if self.get_enabled_instances_with_tun_ids().next().is_some() {
+                            return Err(
+                                "Android only supports one active TUN network; user-managed VPN remains active"
+                                    .to_string(),
+                            );
+                        }
+                    }
+                }
             }
 
             self.storage
@@ -845,6 +988,7 @@ mod manager {
                     app,
                     instance_id,
                     NetworkConfig::new_from_config(cfg).map_err(|e| e.to_string())?,
+                    source,
                 )
                 .map_err(|e| e.to_string())?;
 
@@ -867,20 +1011,21 @@ mod manager {
                         let app_clone = app.clone();
                         let instance_id_clone = *instance_id;
                         tokio::spawn(async move {
+                            let instance_id_str = instance_id_clone.to_string();
                             loop {
                                 match event_receiver.recv().await {
                                     Ok(easytier::common::global_ctx::GlobalCtxEvent::DhcpIpv4Changed(_, _)) => {
-                                        let _ = app_clone.emit("dhcp_ip_changed", instance_id_clone);
+                                        let _ = app_clone.emit("dhcp_ip_changed", &instance_id_str);
                                     }
                                     Ok(easytier::common::global_ctx::GlobalCtxEvent::ProxyCidrsUpdated(_, _)) => {
-                                        let _ = app_clone.emit("proxy_cidrs_updated", instance_id_clone);
+                                        let _ = app_clone.emit("proxy_cidrs_updated", &instance_id_str);
                                     }
                                     Ok(_) => {}
                                     Err(tokio::sync::broadcast::error::RecvError::Closed) => {
                                         break;
                                     }
                                     Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
-                                        let _ = app_clone.emit("event_lagged", instance_id_clone);
+                                        let _ = app_clone.emit("event_lagged", &instance_id_str);
                                         event_receiver = event_receiver.resubscribe();
                                     }
                                 }
@@ -892,7 +1037,7 @@ mod manager {
 
             self.storage.enabled_networks.insert(*instance_id);
 
-            app.emit("post_run_network_instance", instance_id)
+            app.emit("post_run_network_instance", instance_id.to_string())
                 .map_err(|e| e.to_string())?;
 
             Ok(())
@@ -947,15 +1092,15 @@ mod manager {
         pub(super) async fn load_configs(
             &self,
             app: AppHandle,
-            configs: Vec<NetworkConfig>,
+            configs: Vec<StoredGuiConfig>,
             enabled_networks: Vec<String>,
         ) -> anyhow::Result<()> {
             self.storage.network_configs.clear();
-            for cfg in configs {
+            for stored in configs {
-                let instance_id = cfg.instance_id();
+                let instance_id = stored.config.instance_id();
                 self.storage.network_configs.insert(
                     instance_id.parse()?,
-                    GUIConfig(instance_id.to_string(), cfg),
+                    GUIConfig::new(instance_id.to_string(), stored.config, stored.source),
                 );
             }
 
@@ -964,28 +1109,35 @@ mod manager {
                 .get_rpc_client(app.clone())
                 .ok_or_else(|| anyhow::anyhow!("RPC client not found"))?;
             for id in enabled_networks {
-                if let Ok(uuid) = id.parse() {
+                if let Ok(uuid) = id.parse()
-                    if !self.storage.enabled_networks.contains(&uuid) {
+                    && !self.storage.enabled_networks.contains(&uuid)
-                        let config = self
+                {
-                            .storage
+                    let config = self
-                            .network_configs
+                        .storage
-                            .get(&uuid)
+                        .network_configs
-                            .map(|i| i.value().1.clone());
+                        .get(&uuid)
-                        if config.is_none() {
+                        .map(|i| (i.value().config.clone(), i.value().source));
-                            continue;
+                    let Some((config, source)) = config else {
-                        }
+                        continue;
-                        client
+                    };
-                            .run_network_instance(
+                    let toml_config = config.gen_config()?;
-                                BaseController::default(),
+                    self.pre_run_network_instance_hook(&app, &toml_config, source)
-                                RunNetworkInstanceRequest {
+                        .await
-                                    inst_id: None,
+                        .map_err(|e| anyhow::anyhow!(e))?;
-                                    config,
+                    client
-                                    overwrite: false,
+                        .run_network_instance(
-                                },
+                            BaseController::default(),
-                            )
+                            RunNetworkInstanceRequest {
-                            .await?;
+                                inst_id: None,
-                        self.storage.enabled_networks.insert(uuid);
+                                config: Some(config),
-                    }
+                                overwrite: false,
+                                source: source.to_runtime_source().to_rpc(),
+                            },
+                        )
+                        .await?;
+                    self.post_run_network_instance_hook(&app, &uuid)
+                        .await
+                        .map_err(|e| anyhow::anyhow!(e))?;
                 }
             }
             Ok(())
@@ -1011,6 +1163,44 @@ mod manager {
             &self.storage
         }
     }
+
+    #[cfg(test)]
+    mod tests {
+        use super::{PersistedConfigSource, StoredGuiConfig};
+        use easytier::proto::api::manage::NetworkConfig;
+
+        #[test]
+        fn stored_gui_config_defaults_missing_source_to_legacy() {
+            let stored: StoredGuiConfig = serde_json::from_value(serde_json::json!({
+                "config": NetworkConfig::default(),
+            }))
+            .unwrap();
+            assert_eq!(stored.source, PersistedConfigSource::Legacy);
+        }
+
+        #[test]
+        fn persisted_source_merge_keeps_legacy_and_webhook_over_ambiguous_user() {
+            assert_eq!(
+                PersistedConfigSource::Legacy.merge_persisted(PersistedConfigSource::User),
+                PersistedConfigSource::Legacy
+            );
+            assert_eq!(
+                PersistedConfigSource::Webhook.merge_persisted(PersistedConfigSource::User),
+                PersistedConfigSource::Webhook
+            );
+            assert_eq!(
+                PersistedConfigSource::Legacy.merge_persisted(PersistedConfigSource::Webhook),
+                PersistedConfigSource::Webhook
+            );
+        }
+
+        #[test]
+        fn only_webhook_configs_are_webhook_like() {
+            assert!(!PersistedConfigSource::Legacy.is_webhook_like());
+            assert!(!PersistedConfigSource::User.is_webhook_like());
+            assert!(PersistedConfigSource::Webhook.is_webhook_like());
+        }
+    }
 }
 
 #[cfg(not(target_os = "android"))]
@@ -1099,7 +1289,7 @@ pub fn run_gui() -> std::process::ExitCode {
         process::exit(0);
     }
 
-    utils::setup_panic_handler();
+    setup_panic_handler();
 
     let mut builder = tauri::Builder::default();
 

easytier-gui/src-tauri/tauri.conf.json

@@ -17,7 +17,7 @@
     "createUpdaterArtifacts": false
   },
   "productName": "easytier-gui",
-  "version": "2.5.0",
+  "version": "2.6.3",
   "identifier": "com.kkrainbow.easytier",
   "plugins": {
     "shell": {
@@ -36,4 +36,4 @@
       "csp": null
     }
   }
-}
+}

easytier-gui/src/auto-imports.d.ts

@@ -93,6 +93,7 @@ declare global {
   const shallowReadonly: typeof import('vue')['shallowReadonly']
   const shallowRef: typeof import('vue')['shallowRef']
   const storeToRefs: typeof import('pinia')['storeToRefs']
+  const syncMobileVpnService: typeof import('./composables/mobile_vpn')['syncMobileVpnService']
   const toRaw: typeof import('vue')['toRaw']
   const toRef: typeof import('vue')['toRef']
   const toRefs: typeof import('vue')['toRefs']
@@ -217,6 +218,7 @@ declare module 'vue' {
     readonly shallowReadonly: UnwrapRef<typeof import('vue')['shallowReadonly']>
     readonly shallowRef: UnwrapRef<typeof import('vue')['shallowRef']>
     readonly storeToRefs: UnwrapRef<typeof import('pinia')['storeToRefs']>
+    readonly syncMobileVpnService: UnwrapRef<typeof import('./composables/mobile_vpn')['syncMobileVpnService']>
     readonly toRaw: UnwrapRef<typeof import('vue')['toRaw']>
     readonly toRef: UnwrapRef<typeof import('vue')['toRef']>
     readonly toRefs: UnwrapRef<typeof import('vue')['toRefs']>

easytier-gui/src/composables/backend.ts

@@ -6,6 +6,7 @@ import { GetNetworkMetasResponse } from 'node_modules/easytier-frontend-lib/dist
 type NetworkConfig = NetworkTypes.NetworkConfig
 type ValidateConfigResponse = Api.ValidateConfigResponse
 type ListNetworkInstanceIdResponse = Api.ListNetworkInstanceIdResponse
+type ConfigSource = 'user' | 'webhook' | 'legacy'
 interface ServiceOptions {
   config_dir: string
   rpc_portal: string
@@ -16,6 +17,39 @@ interface ServiceOptions {
 
 export type ServiceStatus = "Running" | "Stopped" | "NotInstalled"
 
+interface StoredGuiConfig {
+  config: NetworkConfig
+  source: ConfigSource
+}
+
+function parseStoredConfigs(raw: string | null): StoredGuiConfig[] {
+  const parsed: unknown = JSON.parse(raw || '[]')
+  if (!Array.isArray(parsed)) {
+    return []
+  }
+
+  return parsed.flatMap((entry): StoredGuiConfig[] => {
+    if (entry && typeof entry === 'object' && 'config' in entry) {
+      const { config, source } = entry as {
+        config?: NetworkConfig
+        source?: ConfigSource
+      }
+      if (!config) {
+        return []
+      }
+      return [{
+        config: NetworkTypes.normalizeNetworkConfig(config),
+        source: source === 'user' || source === 'webhook' ? source : 'legacy',
+      }]
+    }
+
+    return [{
+      config: NetworkTypes.normalizeNetworkConfig(entry as NetworkConfig),
+      source: 'legacy',
+    }]
+  })
+}
+
 export async function parseNetworkConfig(cfg: NetworkConfig) {
   return invoke<string>('parse_network_config', { cfg: NetworkTypes.toBackendNetworkConfig(cfg) })
 }
@@ -71,9 +105,12 @@ export async function getConfig(instanceId: string) {
 }
 
 export async function sendConfigs(enabledNetworks: string[]) {
-  const networkList: NetworkConfig[] = JSON.parse(localStorage.getItem('networkList') || '[]');
+  const networkList = parseStoredConfigs(localStorage.getItem('networkList'))
   return await invoke('load_configs', {
-    configs: networkList.map((config) => NetworkTypes.toBackendNetworkConfig(NetworkTypes.normalizeNetworkConfig(config))),
+    configs: networkList.map(({ config, source }) => ({
+      config: NetworkTypes.toBackendNetworkConfig(config),
+      source,
+    })),
     enabledNetworks
   })
 }

easytier-gui/src/composables/event.ts

@@ -1,6 +1,12 @@
 import { Event, listen } from "@tauri-apps/api/event";
 import { type } from "@tauri-apps/plugin-os";
 import { NetworkTypes } from "easytier-frontend-lib"
+import { Utils } from "easytier-frontend-lib";
+
+interface StoredGuiConfig {
+    config: NetworkTypes.NetworkConfig
+    source?: 'user' | 'webhook' | 'legacy'
+}
 
 const EVENTS = Object.freeze({
     SAVE_CONFIGS: 'save_configs',
@@ -12,44 +18,82 @@ const EVENTS = Object.freeze({
     EVENT_LAGGED: 'event_lagged',
 });
 
-function onSaveConfigs(event: Event<NetworkTypes.NetworkConfig[]>) {
+function onSaveConfigs(event: Event<StoredGuiConfig[]>) {
     console.log(`Received event '${EVENTS.SAVE_CONFIGS}': ${event.payload}`);
-    localStorage.setItem('networkList', JSON.stringify(event.payload.map((config) => NetworkTypes.normalizeNetworkConfig(config))));
+    localStorage.setItem(
+        'networkList',
+        JSON.stringify(event.payload.map(({ config, source }) => ({
+            config: NetworkTypes.normalizeNetworkConfig(config),
+            source: source ?? 'legacy',
+        }))),
+    );
 }
 
-async function onPreRunNetworkInstance(event: Event<string>) {
+function normalizeInstanceIdPayload(payload: unknown): string {
+    if (typeof payload === 'string') {
+        return payload
+    }
+
+    if (payload && typeof payload === 'object') {
+        const uuid = payload as Partial<Utils.UUID>
+        if (
+            typeof uuid.part1 === 'number'
+            && typeof uuid.part2 === 'number'
+            && typeof uuid.part3 === 'number'
+            && typeof uuid.part4 === 'number'
+        ) {
+            return Utils.UuidToStr(uuid as Utils.UUID)
+        }
+    }
+
+    if (payload == null) {
+        return ''
+    }
+
+    const fallback = String(payload)
+    return fallback === '[object Object]' ? '' : fallback
+}
+
+async function onPreRunNetworkInstance(event: Event<unknown>) {
+    const instanceId = normalizeInstanceIdPayload(event.payload)
+    console.log(`Received event '${EVENTS.PRE_RUN_NETWORK_INSTANCE}', raw payload:`, event.payload, 'normalized:', instanceId)
     if (type() === 'android') {
-        await prepareVpnService(event.payload);
+        await prepareVpnService(instanceId);
     }
 }
 
-async function onPostRunNetworkInstance(event: Event<string>) {
+async function onPostRunNetworkInstance(event: Event<unknown>) {
+    const instanceId = normalizeInstanceIdPayload(event.payload)
+    console.log(`Received event '${EVENTS.POST_RUN_NETWORK_INSTANCE}', raw payload:`, event.payload, 'normalized:', instanceId)
     if (type() === 'android') {
-        await onNetworkInstanceChange(event.payload);
+        await onNetworkInstanceChange(instanceId);
     }
 }
 
-async function onVpnServiceStop(event: Event<string>) {
+async function onVpnServiceStop(event: Event<unknown>) {
-    await onNetworkInstanceChange(event.payload);
+    console.log(`Received event '${EVENTS.VPN_SERVICE_STOP}', raw payload:`, event.payload)
+    await syncMobileVpnService();
 }
 
-async function onDhcpIpChanged(event: Event<string>) {
+async function onDhcpIpChanged(event: Event<unknown>) {
-    console.log(`Received event '${EVENTS.DHCP_IP_CHANGED}' for instance: ${event.payload}`);
+    const instanceId = normalizeInstanceIdPayload(event.payload)
+    console.log(`Received event '${EVENTS.DHCP_IP_CHANGED}' for instance: ${instanceId}`);
     if (type() === 'android') {
-        await onNetworkInstanceChange(event.payload);
+        await onNetworkInstanceChange(instanceId);
     }
 }
 
-async function onProxyCidrsUpdated(event: Event<string>) {
+async function onProxyCidrsUpdated(event: Event<unknown>) {
-    console.log(`Received event '${EVENTS.PROXY_CIDRS_UPDATED}' for instance: ${event.payload}`);
+    const instanceId = normalizeInstanceIdPayload(event.payload)
+    console.log(`Received event '${EVENTS.PROXY_CIDRS_UPDATED}' for instance: ${instanceId}`);
     if (type() === 'android') {
-        await onNetworkInstanceChange(event.payload);
+        await onNetworkInstanceChange(instanceId);
     }
 }
 
-async function onEventLagged(event: Event<string>) {
+async function onEventLagged(event: Event<unknown>) {
     if (type() === 'android') {
-        await onNetworkInstanceChange(event.payload);
+        await onNetworkInstanceChange(normalizeInstanceIdPayload(event.payload));
     }
 }
 

easytier-gui/src/composables/mobile_vpn.ts

@@ -1,7 +1,7 @@
 import type { NetworkTypes } from 'easytier-frontend-lib'
 import { addPluginListener } from '@tauri-apps/api/core'
 import { Utils } from 'easytier-frontend-lib'
-import { prepare_vpn, start_vpn, stop_vpn } from 'tauri-plugin-vpnservice-api'
+import { get_vpn_status, prepare_vpn, start_vpn, stop_vpn } from 'tauri-plugin-vpnservice-api'
 
 type Route = NetworkTypes.Route
 
@@ -24,6 +24,53 @@ const curVpnStatus: vpnStatus = {
   dns: undefined,
 }
 
+async function requestVpnPermission() {
+  console.log('prepare vpn')
+  const prepare_ret = await prepare_vpn()
+  console.log('prepare vpn', JSON.stringify((prepare_ret)))
+  if (prepare_ret?.errorMsg?.length) {
+    throw new Error(prepare_ret.errorMsg)
+  }
+
+  const granted = prepare_ret?.granted ?? true
+  if (!granted) {
+    console.info('vpn permission request was denied or dismissed')
+  }
+
+  return granted
+}
+
+function resetVpnConfigStatus() {
+  curVpnStatus.ipv4Addr = undefined
+  curVpnStatus.ipv4Cidr = undefined
+  curVpnStatus.routes = []
+  curVpnStatus.dns = undefined
+}
+
+function syncVpnStatusFromNative(status: Awaited<ReturnType<typeof get_vpn_status>>) {
+  curVpnStatus.running = status?.running ?? false
+  if (!curVpnStatus.running) {
+    resetVpnConfigStatus()
+    return
+  }
+
+  const ipv4WithCidr = status?.ipv4Addr
+  if (ipv4WithCidr?.length) {
+    const [ipv4Addr, cidr] = ipv4WithCidr.split('/')
+    curVpnStatus.ipv4Addr = ipv4Addr
+
+    const parsedCidr = Number(cidr)
+    curVpnStatus.ipv4Cidr = Number.isInteger(parsedCidr) ? parsedCidr : undefined
+  }
+  else {
+    curVpnStatus.ipv4Addr = undefined
+    curVpnStatus.ipv4Cidr = undefined
+  }
+
+  curVpnStatus.routes = [...(status?.routes ?? [])]
+  curVpnStatus.dns = status?.dns ?? undefined
+}
+
 async function waitVpnStatus(target_status: boolean, timeout_sec: number) {
   const start_time = Date.now()
   while (curVpnStatus.running !== target_status) {
@@ -34,18 +81,19 @@ async function waitVpnStatus(target_status: boolean, timeout_sec: number) {
   }
 }
 
-async function doStopVpn() {
+async function doStopVpn(force = false) {
-  if (!curVpnStatus.running) {
+  const wasRunning = curVpnStatus.running
+  if (!force && !wasRunning) {
     return
   }
   console.log('stop vpn')
   const stop_ret = await stop_vpn()
   console.log('stop vpn', JSON.stringify((stop_ret)))
-  await waitVpnStatus(false, 3)
+  if (wasRunning) {
+    await waitVpnStatus(false, 3)
+  }
 
-  curVpnStatus.ipv4Addr = undefined
+  resetVpnConfigStatus()
-  curVpnStatus.routes = []
-  curVpnStatus.dns = undefined
 }
 
 async function doStartVpn(ipv4Addr: string, cidr: number, routes: string[], dns?: string) {
@@ -54,19 +102,32 @@ async function doStartVpn(ipv4Addr: string, cidr: number, routes: string[], dns?
   }
 
   console.log('start vpn service', ipv4Addr, cidr, routes, dns)
-  const start_ret = await start_vpn({
+  const request = {
     ipv4Addr: `${ipv4Addr}/${cidr}`,
     routes,
     dns,
     disallowedApplications: ['com.kkrainbow.easytier'],
     mtu: 1300,
-  })
+  }
+
+  let start_ret = await start_vpn(request)
+  console.log('start vpn response', JSON.stringify(start_ret))
+  if (start_ret?.errorMsg === 'need_prepare') {
+    const granted = await requestVpnPermission()
+    if (!granted) {
+      throw new Error('vpn_permission_denied')
+    }
+    start_ret = await start_vpn(request)
+    console.log('start vpn retry response', JSON.stringify(start_ret))
+  }
+
   if (start_ret?.errorMsg?.length) {
     throw new Error(start_ret.errorMsg)
   }
   await waitVpnStatus(true, 3)
 
   curVpnStatus.ipv4Addr = ipv4Addr
+  curVpnStatus.ipv4Cidr = cidr
   curVpnStatus.routes = routes
   curVpnStatus.dns = dns
 }
@@ -75,13 +136,16 @@ async function onVpnServiceStart(payload: any) {
   console.log('vpn service start', JSON.stringify(payload))
   curVpnStatus.running = true
   if (payload.fd) {
-    setTunFd(payload.fd)
+    await setTunFd(payload.fd).catch((e) => {
+      console.error('set tun fd failed', e)
+    })
   }
 }
 
 async function onVpnServiceStop(payload: any) {
   console.log('vpn service stop', JSON.stringify(payload))
   curVpnStatus.running = false
+  resetVpnConfigStatus()
 }
 
 async function registerVpnServiceListener() {
@@ -135,15 +199,25 @@ export async function onNetworkInstanceChange(instanceId: string) {
   }
 
   if (!instanceId) {
-    await doStopVpn()
+    console.warn('vpn service skipped because instance id is empty')
+    if (curVpnStatus.running) {
+      await doStopVpn()
+    }
     return
   }
   const config = await getConfig(instanceId)
+  console.log('vpn service loaded config', instanceId, JSON.stringify({
+    no_tun: config.no_tun,
+    dhcp: config.dhcp,
+    enable_magic_dns: config.enable_magic_dns,
+  }))
   if (config.no_tun) {
+    console.log('vpn service skipped because no_tun is enabled', instanceId)
     return
   }
   const curNetworkInfo = (await collectNetworkInfo(instanceId)).info.map[instanceId]
   if (!curNetworkInfo || curNetworkInfo?.error_msg?.length) {
+    console.warn('vpn service skipped because network info is unavailable', instanceId, curNetworkInfo?.error_msg)
     await doStopVpn()
     return
   }
@@ -170,27 +244,39 @@ export async function onNetworkInstanceChange(instanceId: string) {
 
   const routes = getRoutesForVpn(curNetworkInfo?.routes, config)
 
-  const dns = config.enable_magic_dns ? '100.100.100.101' : undefined;
+  const dns = config.enable_magic_dns ? '100.100.100.101' : undefined
 
   const ipChanged = virtual_ip !== curVpnStatus.ipv4Addr
+  const cidrChanged = network_length !== curVpnStatus.ipv4Cidr
   const routesChanged = JSON.stringify(routes) !== JSON.stringify(curVpnStatus.routes)
   const dnsChanged = dns != curVpnStatus.dns
+  const configChanged = ipChanged || cidrChanged || routesChanged || dnsChanged
+  const shouldStartVpn = !curVpnStatus.running
 
-  if (ipChanged || routesChanged || dnsChanged) {
+  if (shouldStartVpn || configChanged) {
     console.info('vpn service virtual ip changed', JSON.stringify(curVpnStatus), virtual_ip)
-    try {
+    if (curVpnStatus.running) {
-      await doStopVpn()
+      try {
-    }
+        await doStopVpn()
-    catch (e) {
+      }
-      console.error(e)
+      catch (e) {
+        console.error(e)
+      }
     }
 
     try {
       await doStartVpn(virtual_ip, network_length, routes, dns)
     }
     catch (e) {
-      console.error('start vpn service failed, stop all other network insts.', e)
+      if (e instanceof Error && e.message === 'need_prepare') {
-      await runNetworkInstance(config, true); //on android config should always be saved
+        console.info('vpn permission is required before starting the Android VPN service')
+        return
+      }
+      if (e instanceof Error && e.message === 'vpn_permission_denied') {
+        console.info('vpn permission request was denied or dismissed')
+        return
+      }
+      console.error('start vpn service failed', e)
     }
   }
 }
@@ -202,6 +288,22 @@ async function isNoTunEnabled(instanceId: string | undefined) {
   return (await getConfig(instanceId)).no_tun ?? false
 }
 
+async function findRunningTunInstanceId() {
+  const instanceIds = await listNetworkInstanceIds()
+  const runningIds = instanceIds.running_inst_ids.map(Utils.UuidToStr)
+  console.log('vpn service sync running instances', JSON.stringify(runningIds))
+
+  for (const instanceId of runningIds) {
+    if (await isNoTunEnabled(instanceId)) {
+      continue
+    }
+
+    return instanceId
+  }
+
+  return undefined
+}
+
 export async function initMobileVpnService() {
   await registerVpnServiceListener()
 }
@@ -210,10 +312,22 @@ export async function prepareVpnService(instanceId: string) {
   if (await isNoTunEnabled(instanceId)) {
     return
   }
-  console.log('prepare vpn')
+  await requestVpnPermission()
-  const prepare_ret = await prepare_vpn()
+}
-  console.log('prepare vpn', JSON.stringify((prepare_ret)))
+
-  if (prepare_ret?.errorMsg?.length) {
+export async function syncMobileVpnService() {
-    throw new Error(prepare_ret.errorMsg)
+  syncVpnStatusFromNative(await get_vpn_status())
-  }
+  const instanceId = await findRunningTunInstanceId()
+  if (instanceId) {
+    console.log('vpn service sync selected instance', instanceId)
+    await onNetworkInstanceChange(instanceId)
+    return
+  }
+
+  if (dhcpPollingTimer) {
+    clearTimeout(dhcpPollingTimer)
+    dhcpPollingTimer = null
+  }
+
+  await doStopVpn(true)
 }

easytier-gui/src/composables/mode.ts

@@ -18,6 +18,7 @@ export interface ServiceMode extends WebClientConfig {
     rpc_portal: string
     file_log_level: 'off' | 'warn' | 'info' | 'debug' | 'trace'
     file_log_dir: string
+    installed_core_version?: string
 }
 
 export interface RemoteMode {

easytier-gui/src/pages/index.vue

@@ -9,13 +9,14 @@ import { exit } from '@tauri-apps/plugin-process'
 import { I18nUtils, RemoteManagement, Utils } from "easytier-frontend-lib"
 import type { MenuItem } from 'primevue/menuitem'
 import { useTray } from '~/composables/tray'
+import { initMobileVpnService } from '~/composables/mobile_vpn'
 import { GUIRemoteClient } from '~/modules/api'
 
 import { useToast, useConfirm } from 'primevue'
 import { loadMode, saveMode, WebClientConfig, type Mode } from '~/composables/mode'
 import { saveLastNetworkInstanceId, loadLastNetworkInstanceId } from '~/composables/config'
 import ModeSwitcher from '~/components/ModeSwitcher.vue'
-import { getServiceStatus } from '~/composables/backend'
+import { getEasytierVersion, getServiceStatus } from '~/composables/backend'
 
 const { t, locale } = useI18n()
 const confirm = useConfirm()
@@ -84,6 +85,20 @@ async function onUninstallService() {
   });
 }
 
+function stripModeMetadata(mode: Mode) {
+  if (mode.mode !== 'service') {
+    return mode
+  }
+
+  const serviceConfig = { ...mode }
+  delete serviceConfig.installed_core_version
+  return serviceConfig
+}
+
+function modeConfigChanged(next: Mode) {
+  return JSON.stringify(stripModeMetadata(next)) !== JSON.stringify(stripModeMetadata(currentMode.value))
+}
+
 async function onStopService() {
   isModeSaving.value = true
   manualDisconnect.value = true
@@ -133,13 +148,14 @@ async function initWithMode(mode: Mode) {
       }
       url = mode.remote_rpc_address
       break;
-    case 'service':
+    case 'service': {
       if (!mode.config_dir || !mode.file_log_dir || !mode.file_log_level || !mode.rpc_portal) {
         toast.add({ severity: 'error', summary: t('error'), detail: t('mode.service_config_empty'), life: 10000 })
         return initWithMode({ ...mode, mode: 'normal' });
       }
       let serviceStatus = await getServiceStatus()
-      if (serviceStatus === "NotInstalled" || JSON.stringify(mode) !== JSON.stringify(currentMode.value)) {
+      const coreVersion = await getEasytierVersion()
+      if (serviceStatus === "NotInstalled" || modeConfigChanged(mode) || mode.installed_core_version !== coreVersion) {
         mode.config_server_url = mode.config_server_url || undefined
         await initService({
           config_dir: mode.config_dir,
@@ -148,6 +164,7 @@ async function initWithMode(mode: Mode) {
           rpc_portal: mode.rpc_portal,
           config_server: mode.config_server_url,
         })
+        mode.installed_core_version = coreVersion
         serviceStatus = await getServiceStatus()
       }
       if (serviceStatus === "Stopped") {
@@ -156,6 +173,7 @@ async function initWithMode(mode: Mode) {
       url = "tcp://" + mode.rpc_portal.replace("0.0.0.0", "127.0.0.1")
       retrys = 5
       break;
+    }
     case 'normal':
       url = mode.rpc_portal;
       break;
@@ -189,9 +207,25 @@ async function initWithMode(mode: Mode) {
   clientRunning.value = await isClientRunning()
 }
 
-onMounted(() => {
+onMounted(async () => {
+  const cleanupFns: Array<() => void> = []
+
+  if (type() === 'android') {
+    try {
+      await initMobileVpnService()
+      console.error("easytier init vpn service done")
+    } catch (e: any) {
+      console.error("easytier init vpn service failed", e)
+    }
+  }
+
+  cleanupFns.push(await listenGlobalEvents())
   currentMode.value = loadMode()
-  initWithMode(currentMode.value);
+  await initWithMode(currentMode.value);
+
+  onUnmounted(() => {
+    cleanupFns.forEach(unlisten => unlisten())
+  })
 });
 
 useTray(true)
@@ -347,22 +381,6 @@ async function connectRpcClient(isNormalMode: boolean, url?: string) {
   console.log("easytier rpc connection established, isNormalMode: ", isNormalMode)
 }
 
-onMounted(async () => {
-  if (type() === 'android') {
-    try {
-      await initMobileVpnService()
-      console.error("easytier init vpn service done")
-    } catch (e: any) {
-      console.error("easytier init vpn service failed", e)
-    }
-  }
-  const unlisten = await listenGlobalEvents()
-
-  onUnmounted(() => {
-    unlisten()
-  })
-})
-
 async function openConfigServerDialog() {
   editingMode.value = JSON.parse(JSON.stringify(loadMode()))
   configServerDialogVisible.value = true

easytier-rpc-build/Cargo.toml

@@ -2,13 +2,12 @@
 name = "easytier-rpc-build"
 description = "Protobuf RPC Service Generator for EasyTier"
 version = "0.1.0"
-edition = "2021"
+edition.workspace = true
 homepage = "https://github.com/EasyTier/EasyTier"
 repository = "https://github.com/EasyTier/EasyTier"
 authors = ["kkrainbow"]
 keywords = ["vpn", "p2p", "network", "easytier"]
 categories = ["network-programming", "command-line-utilities"]
-rust-version = "1.93.0"
 license-file = "LICENSE"
 readme = "README.md"
 

easytier-web/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "easytier-web"
-version = "2.5.0"
+version = "2.6.3"
-edition = "2021"
+edition.workspace = true
 description = "Config server for easytier. easytier-core gets config from this and web frontend use it as restful api server."
 
 [dependencies]
@@ -10,6 +10,7 @@ tracing = { version = "0.1", features = ["log"] }
 anyhow = { version = "1.0" }
 thiserror = "1.0"
 tokio = { version = "1", features = ["full"] }
+tokio-util = { version = "0.7", features = ["rt"] }
 dashmap = "6.1"
 url = "2.2"
 async-trait = "0.1"
@@ -69,13 +70,11 @@ subtle = "2.6"
 
 mimalloc = { version = "*" }
 
+[build-dependencies]
+thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = [
+    "win7",
+] }
+
 [features]
 default = []
 embed = ["dep:axum-embed"]
-
-# enable thunk-rs when compiling for x86_64 or i686 windows
-[target.x86_64-pc-windows-msvc.build-dependencies]
-thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = ["win7"] }
-
-[target.i686-pc-windows-msvc.build-dependencies]
-thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = ["win7"] }

easytier-web/build.rs

@@ -1,10 +1,10 @@
+use std::env;
+
 fn main() {
+    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
     // enable thunk-rs when target os is windows and arch is x86_64 or i686
-    #[cfg(target_os = "windows")]
+    if target_os == "windows" && (target_arch == "x86" || target_arch == "x86_64") {
-    if !std::env::var("TARGET")
-        .unwrap_or_default()
-        .contains("aarch64")
-    {
         thunk::thunk();
     }
 }

easytier-web/frontend-lib/src/components/Config.vue

@@ -1,7 +1,7 @@
 <script setup lang="ts">
+import { AutoComplete, Button, Checkbox, Dialog, Divider, InputNumber, InputText, Panel, Password, SelectButton, ToggleButton } from 'primevue'
 import InputGroup from 'primevue/inputgroup'
 import InputGroupAddon from 'primevue/inputgroupaddon'
-import { Checkbox, InputText, InputNumber, AutoComplete, Panel, Divider, ToggleButton, Button, Password, Dialog } from 'primevue'
 import {
   addRow,
   DEFAULT_NETWORK_CONFIG,
@@ -11,6 +11,7 @@ import {
 } from '../types/network'
 import { ref, onMounted, onUnmounted, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
+import AclManager from './acl/AclManager.vue'
 import UrlListInput from './UrlListInput.vue'
 
 const props = defineProps<{
@@ -80,6 +81,7 @@ const bool_flags: BoolFlag[] = [
   { field: 'latency_first', help: 'latency_first_help' },
   { field: 'use_smoltcp', help: 'use_smoltcp_help' },
   { field: 'disable_ipv6', help: 'disable_ipv6_help' },
+  { field: 'ipv6_public_addr_auto', help: 'ipv6_public_addr_auto_help' },
   { field: 'enable_kcp_proxy', help: 'enable_kcp_proxy_help' },
   { field: 'disable_kcp_input', help: 'disable_kcp_input_help' },
   { field: 'enable_quic_proxy', help: 'enable_quic_proxy_help' },
@@ -97,6 +99,7 @@ const bool_flags: BoolFlag[] = [
   { field: 'disable_encryption', help: 'disable_encryption_help' },
   { field: 'disable_tcp_hole_punching', help: 'disable_tcp_hole_punching_help' },
   { field: 'disable_udp_hole_punching', help: 'disable_udp_hole_punching_help' },
+  { field: 'disable_upnp', help: 'disable_upnp_help' },
   { field: 'disable_sym_hole_punching', help: 'disable_sym_hole_punching_help' },
   { field: 'enable_magic_dns', help: 'enable_magic_dns_help' },
   { field: 'enable_private_mode', help: 'enable_private_mode_help' },
@@ -209,7 +212,8 @@ watch(() => curNetwork.value, syncNormalizedNetwork, { immediate: true, deep: fa
                   </div>
                   <div class="items-center flex flex-col p-fluid gap-y-2">
                     <UrlListInput id="initial_nodes" v-model="curNetwork.peer_urls" :protos="protos"
-                      :add-label="t('add_initial_node')" :placeholder="t('initial_node_placeholder')" />
+                      defaultUrl="tcp://:11010" :add-label="t('add_initial_node')"
+                      :placeholder="t('initial_node_placeholder')" />
                   </div>
                 </div>
               </div>
@@ -305,6 +309,19 @@ watch(() => curNetwork.value, syncNormalizedNetwork, { immediate: true, deep: fa
                 </div>
               </div>
 
+              <div class="flex flex-row gap-x-9 flex-wrap">
+                <div class="flex flex-col gap-2 basis-5/12 grow">
+                  <div class="flex">
+                    <label for="instance_recv_bps_limit">{{ t('instance_recv_bps_limit') }}</label>
+                    <span class="pi pi-question-circle ml-2 self-center"
+                      v-tooltip="t('instance_recv_bps_limit_help')"></span>
+                  </div>
+                  <InputNumber id="instance_recv_bps_limit" v-model="curNetwork.instance_recv_bps_limit"
+                    aria-describedby="instance_recv_bps_limit-help" :format="false"
+                    :placeholder="t('instance_recv_bps_limit_placeholder')" :min="1" fluid />
+                </div>
+              </div>
+
               <div class="flex flex-row gap-x-9 flex-wrap">
                 <div class="flex flex-col gap-2 basis-5/12 grow">
                   <div class="flex">
@@ -474,6 +491,18 @@ watch(() => curNetwork.value, syncNormalizedNetwork, { immediate: true, deep: fa
             </div>
           </Panel>
 
+          <Divider />
+
+          <Panel :header="t('acl.title')" toggleable collapsed>
+            <div v-if="curNetwork.acl" class="flex flex-col gap-y-2">
+              <AclManager v-model="curNetwork.acl" />
+            </div>
+            <div v-else class="flex justify-center p-4">
+              <Button :label="t('acl.enabled')"
+                @click="curNetwork.acl = { acl_v1: { chains: [], group: { declares: [], members: [] } } }" />
+            </div>
+          </Panel>
+
           <div class="flex pt-6 justify-center">
             <Button :label="t('run_network')" icon="pi pi-arrow-right" icon-pos="right" :disabled="configInvalid"
               @click="$emit('runNetwork', curNetwork)" />

easytier-web/frontend-lib/src/components/UrlInput.vue

@@ -2,7 +2,7 @@
 import { AutoComplete, Button, Dialog, InputNumber, InputText } from 'primevue'
 import InputGroup from 'primevue/inputgroup'
 import InputGroupAddon from 'primevue/inputgroupaddon'
-import { computed, onMounted, onUnmounted, ref, watch } from 'vue'
+import { computed, ref, watch } from 'vue'
 import { useI18n } from 'vue-i18n'
 
 const props = defineProps<{
@@ -13,59 +13,94 @@ const props = defineProps<{
 const { t } = useI18n()
 const url = defineModel<string>({ required: true })
 const editing = ref(false)
-const container = ref<HTMLElement | null>(null)
+const hostFocused = ref(false)
-const internalCompact = ref(false)
 
-onMounted(() => {
+const parseUrl = (val: string | null | undefined): { proto: string; host: string; port: number | null } => {
-    if (container.value) {
-        const observer = new ResizeObserver(entries => {
-            for (const entry of entries) {
-                internalCompact.value = entry.contentRect.width < 400
-            }
-        })
-        observer.observe(container.value)
-
-        onUnmounted(() => {
-            observer.disconnect()
-        })
-    }
-})
-
-const parseUrl = (val: string | null | undefined) => {
     const getValidPort = (portStr: string, proto: string) => {
         const p = parseInt(portStr)
         return isNaN(p) ? (props.protos[proto] ?? 11010) : p
     }
+    const parseByPattern = (input: string) => {
+        const trimmed = input.trim()
+        if (!trimmed) {
+            return null
+        }
+        const match = trimmed.match(/^(\w+):\/\/(.*)$/)
+        const proto = match ? match[1] : 'tcp'
+        const rest = match ? match[2] : trimmed
+        const authority = rest.split(/[/?#]/)[0]
+        if (!authority) {
+            return null
+        }
+        const hostAndMaybePort = authority.includes('@') ? authority.slice(authority.lastIndexOf('@') + 1) : authority
+        if (hostAndMaybePort.startsWith('[')) {
+            const ipv6End = hostAndMaybePort.indexOf(']')
+            if (ipv6End > 0) {
+                const host = hostAndMaybePort.slice(0, ipv6End + 1)
+                const remain = hostAndMaybePort.slice(ipv6End + 1)
+                // null = no explicit port in URL; do not fabricate a default
+                const port: number | null = remain.startsWith(':') ? getValidPort(remain.slice(1), proto) : null
+                return { proto, host, port }
+            }
+        }
+        const portMatch = hostAndMaybePort.match(/^(.*):(\d+)$/)
+        const host = portMatch ? portMatch[1] : hostAndMaybePort
+        // null = no explicit port in URL; buildUrlValue will omit the port entirely,
+        // preserving the protocol's implied standard port (e.g. 443 for wss://).
+        const port: number | null = portMatch ? parseInt(portMatch[2]) : null
+        return { proto, host, port }
+    }
 
     if (!val) {
         return { proto: 'tcp', host: '', port: props.protos['tcp'] ?? 11010 }
     }
-    try {
+    const parsedByPattern = parseByPattern(val)
-        const urlObj = new URL(val)
+    if (parsedByPattern) {
-        const proto = urlObj.protocol.replace(':', '')
+        return parsedByPattern
-        return {
-            proto: proto,
-            host: urlObj.hostname,
-            port: getValidPort(urlObj.port, proto)
-        }
-    } catch (e) {
-        // Fallback for incomplete or invalid URLs
-        const match = val.match(/^(\w+):\/\/(.*)$/)
-        if (match) {
-            const proto = match[1]
-            const rest = match[2]
-            const portMatch = rest.match(/:(\d+)$/)
-            return {
-                proto,
-                host: portMatch ? rest.slice(0, portMatch.index) : rest,
-                port: portMatch ? parseInt(portMatch[1]) : (props.protos[proto] ?? 11010)
-            }
-        }
-        return { proto: 'tcp', host: '', port: 11010 }
     }
+    return { proto: 'tcp', host: '', port: null }
 }
 
 const internalValue = ref(parseUrl(url.value))
+const defaultHost = '0.0.0.0'
+
+const buildUrlValue = (value: { proto: string, host: string, port: number | null }, forceDefaultHost = false) => {
+    const proto = value.proto || 'tcp'
+    const rawHost = (value.host ?? '').trim()
+    const host = rawHost || (forceDefaultHost ? defaultHost : '')
+    if (!host) {
+        return null
+    }
+    // Omit port when the protocol uses no port (protos value = 0), or when the
+    // original URL had no explicit port (port === null) – avoids overwriting an
+    // implicit standard port (e.g. 443 for wss) with an EasyTier default (11012).
+    if (props.protos[proto] === 0 || value.port === null) {
+        return `${proto}://${host}`
+    }
+    return `${proto}://${host}:${value.port}`
+}
+
+const syncUrlFromInternal = (forceDefaultHost = false) => {
+    const nextUrl = buildUrlValue(internalValue.value, forceDefaultHost)
+    if (!nextUrl || nextUrl === url.value) {
+        return
+    }
+    url.value = nextUrl
+}
+
+const onHostBlur = () => {
+    hostFocused.value = false
+    syncUrlFromInternal(true)
+}
+
+const onHostFocus = () => {
+    hostFocused.value = true
+}
+
+const onDialogConfirm = () => {
+    syncUrlFromInternal(true)
+    editing.value = false
+}
 
 const isNoPortProto = computed(() => {
     return props.protos[internalValue.value.proto] === 0
@@ -73,28 +108,22 @@ const isNoPortProto = computed(() => {
 
 // Sync from external
 watch(() => url.value, (newVal) => {
+    if (hostFocused.value) {
+        return
+    }
     const parsed = parseUrl(newVal)
+    const internalHost = internalValue.value.host ?? ''
+    const sameHost = parsed.host === internalHost || (!internalHost.trim() && parsed.host === defaultHost)
     if (parsed.proto !== internalValue.value.proto ||
-        parsed.host !== internalValue.value.host ||
+        !sameHost ||
         parsed.port !== internalValue.value.port) {
         internalValue.value = parsed
     }
 })
 
 // Sync to external
-watch(internalValue, (newVal) => {
+watch(internalValue, () => {
-    const proto = newVal.proto || 'tcp'
+    syncUrlFromInternal(false)
-    const host = newVal.host || '0.0.0.0'
-    let port = newVal.port
-    if (isNaN(parseInt(port as any))) {
-        port = props.protos[proto] ?? 11010
-    }
-
-    if (props.protos[proto] === 0) {
-        url.value = `${proto}://${host}`
-    } else {
-        url.value = `${proto}://${host}:${port}`
-    }
 }, { deep: true })
 
 const protoOptions = computed(() => Object.keys(props.protos))
@@ -123,26 +152,30 @@ const onProtoChange = (newProto: string) => {
 </script>
 
 <template>
-    <div ref="container" class="w-full">
+    <div class="url-input-container w-full min-w-0 overflow-hidden">
-        <InputGroup v-if="!internalCompact" class="w-full">
+        <InputGroup class="url-input-full w-full min-w-0">
             <AutoComplete :model-value="internalValue.proto" :suggestions="filteredProtos" dropdown
                 class="max-w-32 proto-autocomplete-in-group" @complete="searchProtos"
                 @update:model-value="onProtoChange" />
-            <InputText v-model="internalValue.host" :placeholder="placeholder || '0.0.0.0'" class="grow" />
+            <InputText v-model="internalValue.host" :placeholder="placeholder || '0.0.0.0'" class="grow min-w-0"
+                @focus="onHostFocus" @blur="onHostBlur" />
             <template v-if="!isNoPortProto">
                 <InputGroupAddon>
                     <span style="font-weight: bold">:</span>
                 </InputGroupAddon>
                 <InputNumber v-model="internalValue.port" :format="false" :min="1" :max="65535" class="max-w-24"
-                    fluid />
+                    :placeholder="String(protos[internalValue.proto] ?? 11010)" fluid />
             </template>
+            <!-- Rendered in both responsive branches; keep action slot content free of side effects and duplicate IDs. -->
             <slot name="actions"></slot>
         </InputGroup>
 
-        <div v-else class="flex justify-between items-center p-2 border rounded w-full">
+        <div
-            <span class="truncate mr-2">{{ url }}</span>
+            class="url-input-compact flex justify-between items-center p-2 border rounded w-full min-w-0 overflow-hidden">
-            <div class="flex items-center">
+            <span class="truncate mr-2 min-w-0 flex-1 overflow-hidden">{{ url }}</span>
-                <Button icon="pi pi-pencil" class="p-button-sm p-button-text" @click="editing = true" />
+            <div class="flex items-center shrink-0">
+                <Button icon="pi pi-pencil" class="p-button-sm p-button-text" :aria-label="t('web.common.edit')"
+                    @click="editing = true" />
                 <slot name="actions"></slot>
             </div>
         </div>
@@ -156,15 +189,17 @@ const onProtoChange = (newProto: string) => {
                 </div>
                 <div class="flex flex-col gap-2">
                     <label>{{ t('web.common.address') || 'Address' }}</label>
-                    <InputText v-model="internalValue.host" :placeholder="placeholder || '0.0.0.0'" class="w-full" />
+                    <InputText v-model="internalValue.host" :placeholder="placeholder || '0.0.0.0'" class="w-full"
+                        @focus="onHostFocus" @blur="onHostBlur" />
                 </div>
                 <div v-if="!isNoPortProto" class="flex flex-col gap-2">
                     <label>{{ t('port') }}</label>
-                    <InputNumber v-model="internalValue.port" :format="false" :min="1" :max="65535" class="w-full" />
+                    <InputNumber v-model="internalValue.port" :format="false" :min="1" :max="65535" class="w-full"
+                        :placeholder="String(protos[internalValue.proto] ?? 11010)" />
                 </div>
             </div>
             <template #footer>
-                <Button :label="t('web.common.confirm') || 'Done'" icon="pi pi-check" @click="editing = false"
+                <Button :label="t('web.common.confirm') || 'Done'" icon="pi pi-check" @click="onDialogConfirm"
                     autofocus />
             </template>
         </Dialog>
@@ -172,6 +207,28 @@ const onProtoChange = (newProto: string) => {
 </template>
 
 <style scoped>
+.url-input-container {
+    container-type: inline-size;
+}
+
+.url-input-full {
+    display: none;
+}
+
+.url-input-compact {
+    display: flex;
+}
+
+@container (min-width: 400px) {
+    .url-input-full {
+        display: flex;
+    }
+
+    .url-input-compact {
+        display: none;
+    }
+}
+
 .proto-autocomplete-in-group,
 .proto-autocomplete-in-group :deep(.p-autocomplete-input),
 .proto-autocomplete-in-group :deep(.p-autocomplete-dropdown) {

easytier-web/frontend-lib/src/components/acl/AclChainEditor.vue

@@ -0,0 +1,218 @@
+<script setup lang="ts">
+import { Button, Column, DataTable, Divider, InputText, Select, SelectButton, ToggleButton } from 'primevue'
+import { ref, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { AclAction, AclChain, AclChainType, AclProtocol, AclRule } from '../../types/network'
+import AclRuleDialog from './AclRuleDialog.vue'
+
+const props = defineProps<{
+  groupNames?: string[]
+}>()
+
+const chain = defineModel<AclChain>({ required: true })
+
+const { t } = useI18n()
+
+watch(() => chain.value.rules, (newRules) => {
+  if (!newRules) return
+  const isSorted = newRules.every((rule, i) => i === 0 || (rule.priority || 0) <= (newRules[i - 1].priority || 0))
+  if (!isSorted) {
+    chain.value.rules.sort((a, b) => (b.priority || 0) - (a.priority || 0))
+  }
+}, { deep: true, immediate: true })
+
+const actionOptions = [
+  { label: () => t('acl.allow'), value: AclAction.Allow },
+  { label: () => t('acl.drop'), value: AclAction.Drop },
+]
+
+const chainTypeOptions = [
+  { label: () => t('acl.inbound'), value: AclChainType.Inbound },
+  { label: () => t('acl.outbound'), value: AclChainType.Outbound },
+  { label: () => t('acl.forward'), value: AclChainType.Forward },
+]
+
+const editingRule = ref<AclRule | null>(null)
+const editingRuleIndex = ref(-1)
+const showRuleDialog = ref(false)
+
+function getProtocolLabel(proto: AclProtocol) {
+  switch (proto) {
+    case AclProtocol.Any: return t('acl.any')
+    case AclProtocol.TCP: return 'TCP'
+    case AclProtocol.UDP: return 'UDP'
+    case AclProtocol.ICMP: return 'ICMP'
+    case AclProtocol.ICMPv6: return 'ICMPv6'
+    default: return t('event.Unknown')
+  }
+}
+
+function getActionLabel(action: AclAction) {
+  switch (action) {
+    case AclAction.Allow: return t('acl.allow')
+    case AclAction.Drop: return t('acl.drop')
+    default: return t('event.Unknown')
+  }
+}
+
+function addRule() {
+  editingRuleIndex.value = -1
+  editingRule.value = {
+    name: '',
+    description: '',
+    priority: chain.value.rules.length,
+    enabled: true,
+    protocol: AclProtocol.Any,
+    ports: [],
+    source_ips: [],
+    destination_ips: [],
+    source_ports: [],
+    action: AclAction.Allow,
+    rate_limit: 0,
+    burst_limit: 0,
+    stateful: false,
+    source_groups: [],
+    destination_groups: [],
+  }
+  showRuleDialog.value = true
+}
+
+function editRule(index: number) {
+  editingRuleIndex.value = index
+  editingRule.value = JSON.parse(JSON.stringify(chain.value.rules[index]))
+  showRuleDialog.value = true
+}
+
+function deleteRule(index: number) {
+  chain.value.rules.splice(index, 1)
+}
+
+function saveRule(rule: AclRule) {
+  if (editingRuleIndex.value === -1) {
+    chain.value.rules.push(rule)
+  } else {
+    chain.value.rules[editingRuleIndex.value] = rule
+  }
+  chain.value.rules.sort((a, b) => (b.priority || 0) - (a.priority || 0))
+}
+
+function onRowReorder(event: any) {
+  chain.value.rules = event.value
+  // Update priorities based on new order (higher priority at top)
+  chain.value.rules.forEach((rule, index) => {
+    rule.priority = chain.value.rules.length - index - 1
+  })
+}
+</script>
+
+<template>
+  <div class="flex flex-col gap-6">
+    <!-- Chain Metadata Section -->
+    <div
+      class="grid grid-cols-1 md:grid-cols-2 gap-4 p-4 bg-gray-50 rounded-lg border border-gray-200 dark:bg-gray-900 dark:border-gray-700">
+      <div class="flex flex-col gap-2">
+        <label class="font-bold text-sm">{{ t('acl.chain.name') }}</label>
+        <InputText v-model="chain.name" size="small" />
+      </div>
+      <div class="flex flex-col gap-2">
+        <label class="font-bold text-sm">{{ t('acl.rule.description') }}</label>
+        <InputText v-model="chain.description" size="small" />
+      </div>
+
+      <div class="flex items-center gap-6 col-span-full border-t pt-2 mt-2 dark:border-gray-700">
+        <div class="flex items-center gap-2">
+          <label class="font-bold text-sm">{{ t('acl.rule.enabled') }}</label>
+          <ToggleButton v-model="chain.enabled" on-icon="pi pi-check" off-icon="pi pi-times"
+            :on-label="t('web.common.enable')" :off-label="t('web.common.disable')" class="w-24" />
+        </div>
+        <div class="flex items-center gap-2">
+          <label class="font-bold text-sm">{{ t('acl.chain.type') }}</label>
+          <Select v-model="chain.chain_type" :options="chainTypeOptions" :option-label="opt => opt.label()"
+            option-value="value" size="small" class="w-40" />
+        </div>
+        <div class="flex items-center gap-2 ml-auto">
+          <label class="font-bold text-sm">{{ t('acl.default_action') }}</label>
+          <SelectButton v-model="chain.default_action" :options="actionOptions" :option-label="opt => opt.label()"
+            option-value="value" :allow-empty="false" />
+        </div>
+      </div>
+    </div>
+
+    <div class="flex flex-row items-center gap-4 justify-between">
+      <h4 class="text-md font-bold">{{ t('acl.rules') }}</h4>
+      <Button icon="pi pi-plus" :label="t('acl.add_rule')" severity="success" size="small" @click="addRule" />
+    </div>
+
+    <DataTable :value="chain.rules" @row-reorder="onRowReorder" responsiveLayout="scroll">
+      <Column rowReorder headerStyle="width: 3rem" />
+      <Column field="enabled" :header="t('acl.rule.enabled')">
+        <template #body="{ data }">
+          <i class="pi" :class="data.enabled ? 'pi-check-circle text-green-500' : 'pi-times-circle text-red-500'"></i>
+        </template>
+      </Column>
+      <Column field="name" :header="t('acl.rule.name')" />
+      <Column :header="t('acl.match')">
+        <template #body="{ data }">
+          <div class="flex flex-col gap-2 py-1">
+            <div class="flex items-center gap-2">
+              <span
+                class="px-2 py-0.5 bg-blue-100 text-blue-700 dark:bg-blue-900/30 dark:text-blue-400 rounded-md text-[10px] font-bold uppercase tracking-wider">
+                {{ getProtocolLabel(data.protocol) }}
+              </span>
+            </div>
+
+            <div class="flex flex-col sm:flex-row sm:items-center gap-1 sm:gap-3">
+              <div class="flex items-center gap-1.5 min-w-0">
+                <span class="text-[10px] font-bold text-gray-400 uppercase w-7">Src</span>
+                <div class="flex flex-wrap gap-1 items-center overflow-hidden">
+                  <span v-for="ip in data.source_ips" :key="ip"
+                    class="font-mono text-xs bg-surface-100 dark:bg-surface-800 px-1.5 py-0.5 rounded">{{ ip }}</span>
+                  <span v-for="grp in data.source_groups" :key="grp"
+                    class="text-xs font-bold text-purple-600 dark:text-purple-400">@{{ grp }}</span>
+                  <span v-if="data.source_ports.length" class="text-xs text-blue-600 dark:text-blue-400 font-mono">:{{
+                    data.source_ports.join(',') }}</span>
+                  <span v-if="!data.source_ips.length && !data.source_groups.length" class="text-gray-400">*</span>
+                </div>
+              </div>
+
+              <i class="pi pi-arrow-right hidden sm:block text-gray-300 text-xs"></i>
+              <Divider layout="horizontal" class="sm:hidden my-1" />
+
+              <div class="flex items-center gap-1.5 min-w-0">
+                <span class="text-[10px] font-bold text-gray-400 uppercase w-7">Dst</span>
+                <div class="flex flex-wrap gap-1 items-center overflow-hidden">
+                  <span v-for="ip in data.destination_ips" :key="ip"
+                    class="font-mono text-xs bg-surface-100 dark:bg-surface-800 px-1.5 py-0.5 rounded">{{ ip }}</span>
+                  <span v-for="grp in data.destination_groups" :key="grp"
+                    class="text-xs font-bold text-purple-600 dark:text-purple-400">@{{ grp }}</span>
+                  <span v-if="data.ports.length" class="text-xs text-blue-600 dark:text-blue-400 font-mono">:{{
+                    data.ports.join(',') }}</span>
+                  <span v-if="!data.destination_ips.length && !data.destination_groups.length"
+                    class="text-gray-400">*</span>
+                </div>
+              </div>
+            </div>
+          </div>
+        </template>
+      </Column>
+      <Column field="action" :header="t('acl.rule.action')">
+        <template #body="{ data }">
+          <span :class="data.action === AclAction.Allow ? 'text-green-600' : 'text-red-600 font-bold'">
+            {{ getActionLabel(data.action) }}
+          </span>
+        </template>
+      </Column>
+      <Column :header="t('web.common.edit')">
+        <template #body="{ index }">
+          <div class="flex gap-2">
+            <Button icon="pi pi-pencil" text rounded @click="editRule(index)" />
+            <Button icon="pi pi-trash" severity="danger" text rounded @click="deleteRule(index)" />
+          </div>
+        </template>
+      </Column>
+    </DataTable>
+
+    <AclRuleDialog v-if="showRuleDialog && editingRule" v-model:visible="showRuleDialog" v-model:rule="editingRule"
+      :group-names="props.groupNames" @save="saveRule" />
+  </div>
+</template>

easytier-web/frontend-lib/src/components/acl/AclGroupEditor.vue

@@ -0,0 +1,115 @@
+<script setup lang="ts">
+import { Button, Column, DataTable, Dialog, InputText, MultiSelect, Password } from 'primevue';
+import { ref } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { GroupIdentity, GroupInfo } from '../../types/network';
+
+const props = defineProps<{
+  groupNames?: string[]
+}>()
+
+const group = defineModel<GroupInfo>({ required: true })
+const emit = defineEmits(['rename-group'])
+
+const { t } = useI18n()
+
+const editingGroup = ref<GroupIdentity | null>(null)
+const editingGroupIndex = ref(-1)
+const showGroupDialog = ref(false)
+const oldGroupName = ref('')
+
+function addGroup() {
+  editingGroupIndex.value = -1
+  editingGroup.value = {
+    group_name: '',
+    group_secret: '',
+  }
+  oldGroupName.value = ''
+  showGroupDialog.value = true
+}
+
+function editGroup(index: number) {
+  editingGroupIndex.value = index
+  editingGroup.value = JSON.parse(JSON.stringify(group.value.declares[index]))
+  oldGroupName.value = editingGroup.value?.group_name || ''
+  showGroupDialog.value = true
+}
+
+function deleteGroup(index: number) {
+  group.value.declares.splice(index, 1)
+}
+
+function saveGroup() {
+  if (!editingGroup.value) return
+  const newName = editingGroup.value.group_name
+
+  if (editingGroupIndex.value === -1) {
+    group.value.declares.push(editingGroup.value)
+  } else {
+    if (oldGroupName.value && oldGroupName.value !== newName) {
+      // Sync in members
+      group.value.members = group.value.members.map(m => m === oldGroupName.value ? newName : m)
+      // Notify parent to sync in rules
+      emit('rename-group', { oldName: oldGroupName.value, newName })
+    }
+    group.value.declares[editingGroupIndex.value] = editingGroup.value
+  }
+  showGroupDialog.value = false
+}
+
+</script>
+
+<template>
+  <div class="flex flex-col gap-6">
+    <div class="flex flex-col gap-2">
+      <div class="flex justify-between items-center">
+        <div class="flex flex-col">
+          <label class="font-bold text-lg">{{ t('acl.group.declares') }}</label>
+          <small class="text-gray-500">{{ t('acl.group.help') }}</small>
+        </div>
+        <Button icon="pi pi-plus" :label="t('web.common.add')" severity="success" @click="addGroup" />
+      </div>
+
+      <DataTable :value="group.declares" responsiveLayout="scroll">
+        <Column field="group_name" :header="t('acl.group.name')" />
+        <Column field="group_secret" :header="t('acl.group.secret')">
+          <template #body="{ data }">
+            <Password v-model="data.group_secret" :feedback="false" toggleMask readonly plain class="w-full" />
+          </template>
+        </Column>
+        <Column :header="t('web.common.edit')" headerStyle="width: 8rem">
+          <template #body="{ index }">
+            <div class="flex gap-2">
+              <Button icon="pi pi-pencil" text rounded @click="editGroup(index)" />
+              <Button icon="pi pi-trash" severity="danger" text rounded @click="deleteGroup(index)" />
+            </div>
+          </template>
+        </Column>
+      </DataTable>
+    </div>
+
+    <div class="flex flex-col gap-2">
+      <label class="font-bold text-lg">{{ t('acl.group.members') }}</label>
+      <MultiSelect v-model="group.members" :options="props.groupNames" multiple fluid filter
+        :placeholder="t('acl.group.members')" />
+    </div>
+
+    <!-- Group Identity Dialog -->
+    <Dialog v-model:visible="showGroupDialog" modal :header="t('acl.groups')" :style="{ width: '400px' }">
+      <div v-if="editingGroup" class="flex flex-col gap-4 pt-2">
+        <div class="flex flex-col gap-2">
+          <label class="font-bold">{{ t('acl.group.name') }}</label>
+          <InputText v-model="editingGroup.group_name" fluid />
+        </div>
+        <div class="flex flex-col gap-2">
+          <label class="font-bold">{{ t('acl.group.secret') }}</label>
+          <Password v-model="editingGroup.group_secret" :feedback="false" toggleMask fluid />
+        </div>
+      </div>
+      <template #footer>
+        <Button :label="t('web.common.cancel')" icon="pi pi-times" @click="showGroupDialog = false" text />
+        <Button :label="t('web.common.save')" icon="pi pi-save" @click="saveGroup" />
+      </template>
+    </Dialog>
+  </div>
+</template>

easytier-web/frontend-lib/src/components/acl/AclManager.vue

@@ -0,0 +1,150 @@
+<script setup lang="ts">
+import { Button, Menu, Tab, TabList, TabPanel, TabPanels, Tabs } from 'primevue'
+import { computed, ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { Acl, AclAction, AclChainType } from '../../types/network'
+import AclChainEditor from './AclChainEditor.vue'
+import AclGroupEditor from './AclGroupEditor.vue'
+
+const acl = defineModel<Acl>({ required: true })
+
+const { t } = useI18n()
+
+const activeTab = ref(0)
+const menu = ref()
+
+const addMenuModel = ref([
+  { label: () => t('acl.inbound'), command: () => addChain(AclChainType.Inbound) },
+  { label: () => t('acl.outbound'), command: () => addChain(AclChainType.Outbound) },
+  { label: () => t('acl.forward'), command: () => addChain(AclChainType.Forward) },
+])
+
+function addChain(type: AclChainType) {
+  if (!acl.value.acl_v1) {
+    acl.value.acl_v1 = { chains: [], group: { declares: [], members: [] } }
+  }
+
+  let defaultName = ''
+  switch (type) {
+    case AclChainType.Inbound: defaultName = 'Inbound'; break;
+    case AclChainType.Outbound: defaultName = 'Outbound'; break;
+    case AclChainType.Forward: defaultName = 'Forward'; break;
+  }
+
+  acl.value.acl_v1.chains.push({
+    name: defaultName,
+    chain_type: type,
+    description: '',
+    enabled: true,
+    rules: [],
+    default_action: AclAction.Allow
+  })
+
+  activeTab.value = acl.value.acl_v1.chains.length - 1
+}
+
+function removeChain(index: number) {
+  if (confirm(t('acl.delete_chain_confirm'))) {
+    acl.value.acl_v1?.chains.splice(index, 1)
+    if (activeTab.value >= (acl.value.acl_v1?.chains.length || 0)) {
+      activeTab.value = Math.max(0, (acl.value.acl_v1?.chains.length || 0))
+    }
+  }
+}
+
+function handleRenameGroup({ oldName, newName }: { oldName: string, newName: string }) {
+  if (!acl.value.acl_v1) return
+  acl.value.acl_v1.chains.forEach(chain => {
+    chain.rules.forEach(rule => {
+      rule.source_groups = rule.source_groups.map(g => g === oldName ? newName : g)
+      rule.destination_groups = rule.destination_groups.map(g => g === oldName ? newName : g)
+    })
+  })
+}
+
+const groupNames = computed(() => {
+  return acl.value.acl_v1?.group?.declares.map(g => g.group_name) || []
+})
+
+const tabs = computed(() => {
+  const chains = acl.value.acl_v1?.chains || []
+  const result: { type: string, label: string, index: number }[] = []
+
+  if (chains.length === 0) {
+    result.push({ type: 'empty', label: t('acl.chains'), index: 0 })
+  }
+  else {
+    chains.forEach((c, index) => {
+      result.push({
+        type: 'chain',
+        label: c.name || `Chain ${index}`,
+        index
+      })
+    })
+  }
+
+  result.push({ type: 'groups', label: t('acl.groups'), index: result.length })
+  return result
+})
+</script>
+
+<template>
+  <div class="flex flex-col gap-4">
+    <Tabs v-model:value="activeTab">
+      <div class="flex items-center border-b border-surface-200 dark:border-surface-700">
+        <TabList class="flex-grow min-w-0 overflow-x-auto" style="border-bottom: none;">
+          <Tab v-for="tab in tabs" :key="tab.type + tab.index" :value="tab.index">
+            <div class="flex items-center gap-2 whitespace-nowrap">
+              {{ tab.label }}
+              <Button v-if="tab.type === 'chain'" icon="pi pi-times" severity="danger" text rounded size="small"
+                class="w-6 h-6 p-0" @click.stop="removeChain(tab.index)" />
+            </div>
+          </Tab>
+        </TabList>
+        <div
+          class="flex-shrink-0 flex items-center px-2 bg-white dark:bg-gray-900 border-l border-surface-100 dark:border-surface-800">
+          <Button icon="pi pi-plus" text rounded size="small" class="w-8 h-8 p-0"
+            @click="(event) => menu.toggle(event)" />
+          <Menu ref="menu" :model="addMenuModel" :popup="true" />
+        </div>
+      </div>
+      <TabPanels>
+        <TabPanel v-for="tab in tabs" :key="'panel' + tab.type + tab.index" :value="tab.index">
+          <!-- Empty State within TabPanel -->
+          <div v-if="tab.type === 'empty'"
+            class="py-8 flex flex-col items-center justify-center border-2 border-dashed border-surface-200 rounded-lg bg-surface-50 dark:bg-surface-900 dark:border-surface-700">
+            <i class="pi pi-shield text-5xl mb-4 text-primary" />
+            <div class="text-xl font-bold mb-2">{{ t('acl.chains') }}</div>
+            <p class="text-surface-500 mb-8 text-center max-w-sm px-4">{{ t('acl.help') }}</p>
+            <div class="flex flex-wrap gap-3 justify-center">
+              <Button :label="t('acl.inbound')" icon="pi pi-arrow-down-left" @click="addChain(AclChainType.Inbound)" />
+              <Button :label="t('acl.outbound')" icon="pi pi-arrow-up-right" @click="addChain(AclChainType.Outbound)" />
+              <Button :label="t('acl.forward')" icon="pi pi-directions" @click="addChain(AclChainType.Forward)" />
+            </div>
+          </div>
+
+          <!-- Rule Chains -->
+          <div v-if="tab.type === 'chain' && acl.acl_v1 && acl.acl_v1.chains[tab.index]" class="py-4">
+            <AclChainEditor v-model="acl.acl_v1.chains[tab.index]" :group-names="groupNames" />
+          </div>
+
+          <!-- Group Management -->
+          <div v-if="tab.type === 'groups'" class="py-4">
+            <template v-if="acl.acl_v1">
+              <AclGroupEditor v-if="acl.acl_v1.group" v-model="acl.acl_v1.group" :group-names="groupNames"
+                @rename-group="handleRenameGroup" />
+              <div v-else class="flex justify-center p-4">
+                <Button :label="t('web.common.add') + ' ' + t('acl.groups')"
+                  @click="acl.acl_v1.group = { declares: [], members: [] }" />
+              </div>
+            </template>
+            <div v-else class="flex justify-center p-4">
+              <Button :label="t('acl.enabled')"
+                @click="acl.acl_v1 = { chains: [], group: { declares: [], members: [] } }" />
+            </div>
+          </div>
+        </TabPanel>
+      </TabPanels>
+    </Tabs>
+  </div>
+</template>

easytier-web/frontend-lib/src/components/acl/AclRuleDialog.vue

@@ -0,0 +1,150 @@
+<script setup lang="ts">
+import { AutoComplete, Button, Checkbox, Dialog, InputNumber, InputText, MultiSelect, Panel, SelectButton, ToggleButton } from 'primevue';
+import { computed, ref } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { AclAction, AclProtocol, AclRule } from '../../types/network';
+
+const props = defineProps<{
+  visible: boolean
+  groupNames?: string[]
+}>()
+
+const emit = defineEmits(['update:visible', 'save'])
+
+const rule = defineModel<AclRule>('rule', { required: true })
+
+const { t } = useI18n()
+
+const protocolOptions = [
+  { label: () => t('acl.any'), value: AclProtocol.Any },
+  { label: 'TCP', value: AclProtocol.TCP },
+  { label: 'UDP', value: AclProtocol.UDP },
+  { label: 'ICMP', value: AclProtocol.ICMP },
+  { label: 'ICMPv6', value: AclProtocol.ICMPv6 },
+]
+
+const actionOptions = [
+  { label: () => t('acl.allow'), value: AclAction.Allow },
+  { label: () => t('acl.drop'), value: AclAction.Drop },
+]
+
+const showPorts = computed(() => {
+  return rule.value.protocol === AclProtocol.TCP || rule.value.protocol === AclProtocol.UDP || rule.value.protocol === AclProtocol.Any
+})
+
+function close() {
+  emit('update:visible', false)
+}
+
+function save() {
+  emit('save', rule.value)
+  close()
+}
+
+// Suggestions for IP/Port AutoComplete
+const genericSuggestions = ref<string[]>([])
+</script>
+
+<template>
+  <Dialog :visible="visible" @update:visible="emit('update:visible', $event)" modal :header="t('acl.edit_rule')"
+    :style="{ width: '90vw', maxWidth: '600px' }">
+    <div class="flex flex-col gap-4">
+      <div class="flex flex-row gap-4 items-center">
+        <div class="flex flex-col gap-2 grow">
+          <label class="font-bold">{{ t('acl.rule.name') }}</label>
+          <InputText v-model="rule.name" fluid />
+        </div>
+        <div class="flex flex-col gap-2">
+          <label class="font-bold">{{ t('acl.rule.enabled') }}</label>
+          <ToggleButton v-model="rule.enabled" on-icon="pi pi-check" off-icon="pi pi-times"
+            :on-label="t('web.common.enable')" :off-label="t('web.common.disable')" class="w-24" />
+        </div>
+      </div>
+
+      <div class="flex flex-col gap-2">
+        <label class="font-bold">{{ t('acl.rule.description') }}</label>
+        <InputText v-model="rule.description" fluid />
+      </div>
+
+      <div class="flex flex-row gap-4 flex-wrap">
+        <div class="flex flex-col gap-2 grow">
+          <label class="font-bold">{{ t('acl.rule.action') }}</label>
+          <SelectButton v-model="rule.action" :options="actionOptions" :option-label="opt => opt.label()"
+            option-value="value" :allow-empty="false" />
+        </div>
+        <div class="flex flex-col gap-2 grow">
+          <label class="font-bold">{{ t('acl.rule.protocol') }}</label>
+          <SelectButton v-model="rule.protocol" :options="protocolOptions"
+            :option-label="opt => typeof opt.label === 'function' ? opt.label() : opt.label" option-value="value"
+            :allow-empty="false" />
+        </div>
+      </div>
+
+      <Panel :header="t('acl.rules')" toggleable>
+        <div class="flex flex-col gap-4">
+          <div class="flex flex-col gap-2">
+            <label class="font-bold">{{ t('acl.rule.src_ips') }}</label>
+            <AutoComplete v-model="rule.source_ips" multiple fluid :suggestions="genericSuggestions"
+              @complete="genericSuggestions = [$event.query]"
+              :placeholder="t('chips_placeholder', ['10.126.126.0/24'])" />
+          </div>
+          <div class="flex flex-col gap-2">
+            <label class="font-bold">{{ t('acl.rule.dst_ips') }}</label>
+            <AutoComplete v-model="rule.destination_ips" multiple fluid :suggestions="genericSuggestions"
+              @complete="genericSuggestions = [$event.query]"
+              :placeholder="t('chips_placeholder', ['10.126.126.2/32'])" />
+          </div>
+
+          <div v-if="showPorts" class="flex flex-row gap-4 flex-wrap">
+            <div class="flex flex-col gap-2 grow">
+              <label class="font-bold">{{ t('acl.rule.src_ports') }}</label>
+              <AutoComplete v-model="rule.source_ports" multiple fluid :suggestions="genericSuggestions"
+                @complete="genericSuggestions = [$event.query]" placeholder="e.g. 80, 1000-2000" />
+            </div>
+            <div class="flex flex-col gap-2 grow">
+              <label class="font-bold">{{ t('acl.rule.dst_ports') }}</label>
+              <AutoComplete v-model="rule.ports" multiple fluid :suggestions="genericSuggestions"
+                @complete="genericSuggestions = [$event.query]" placeholder="e.g. 80, 1000-2000" />
+            </div>
+          </div>
+        </div>
+      </Panel>
+
+      <Panel :header="t('advanced_settings')" toggleable collapsed>
+        <div class="flex flex-col gap-4">
+          <div class="flex items-center gap-2">
+            <Checkbox v-model="rule.stateful" :binary="true" inputId="rule-stateful" />
+            <label for="rule-stateful" class="font-bold">{{ t('acl.rule.stateful') }}</label>
+          </div>
+
+          <div class="flex flex-row gap-4 flex-wrap">
+            <div class="flex flex-col gap-2 grow">
+              <label class="font-bold">{{ t('acl.rule.rate_limit') }}</label>
+              <InputNumber v-model="rule.rate_limit" :min="0" placeholder="0 = no limit" fluid />
+            </div>
+            <div class="flex flex-col gap-2 grow">
+              <label class="font-bold">{{ t('acl.rule.burst_limit') }}</label>
+              <InputNumber v-model="rule.burst_limit" :min="0" placeholder="0 = no limit" fluid />
+            </div>
+          </div>
+
+          <div class="flex flex-col gap-2">
+            <label class="font-bold">{{ t('acl.rule.src_groups') }}</label>
+            <MultiSelect v-model="rule.source_groups" :options="props.groupNames" multiple fluid filter
+              :placeholder="t('acl.rule.src_groups')" />
+          </div>
+          <div class="flex flex-col gap-2">
+            <label class="font-bold">{{ t('acl.rule.dst_groups') }}</label>
+            <MultiSelect v-model="rule.destination_groups" :options="props.groupNames" multiple fluid filter
+              :placeholder="t('acl.rule.dst_groups')" />
+          </div>
+        </div>
+      </Panel>
+    </div>
+
+    <template #footer>
+      <Button :label="t('web.common.cancel')" icon="pi pi-times" @click="close" text />
+      <Button :label="t('web.common.save')" icon="pi pi-save" @click="save" />
+    </template>
+  </Dialog>
+</template>

easytier-web/frontend-lib/src/locales/cn.yaml

@@ -10,7 +10,7 @@ initial_nodes_help: |
   • 留空 = 节点独立启动，等别人来连，或你后续手动连。
   • 无论直接还是间接连通（通过其他节点搭桥），都能组网互通。
   初始节点可以用自己的，也可以用别人分享的。
-initial_node_placeholder: 例如：tcp://node.example.com:11010
+initial_node_placeholder: 例如：node.example.com
 virtual_ipv4: 虚拟IPv4地址
 virtual_ipv4_dhcp: DHCP
 network_name: 网络名称
@@ -104,6 +104,9 @@ use_smoltcp_help: 使用用户态 TCP/IP 协议栈，避免操作系统防火墙
 disable_ipv6: 禁用IPv6
 disable_ipv6_help: 禁用此节点的IPv6功能，仅使用IPv4进行网络通信。
 
+ipv6_public_addr_auto: 自动获取公网 IPv6
+ipv6_public_addr_auto_help: 自动从共享了 IPv6 子网的对等节点获取一个公网 IPv6 地址。
+
 enable_kcp_proxy: 启用 KCP 代理
 enable_kcp_proxy_help: 将 TCP 流量转为 KCP 流量，降低传输延迟，提升传输速度。
 
@@ -117,7 +120,7 @@ disable_quic_input: 禁用 QUIC 输入
 disable_quic_input_help: 禁用 QUIC 入站流量，其他开启 QUIC 代理的节点仍然使用 TCP 连接到本节点。
 
 disable_p2p: 禁用 P2P
-disable_p2p_help: 禁用 P2P 模式，所有流量通过手动指定的服务器中转。
+disable_p2p_help: 禁用普通自动 P2P。开启 need-p2p 的节点仍可与当前节点建立 P2P。
 
 p2p_only: 仅 P2P
 p2p_only_help: 仅与已经建立P2P连接的对等节点通信，不通过其他节点中转。
@@ -157,6 +160,9 @@ disable_tcp_hole_punching_help: 禁用TCP打洞功能
 disable_udp_hole_punching: 禁用UDP打洞
 disable_udp_hole_punching_help: 禁用UDP打洞功能
 
+disable_upnp: 禁用 UPnP
+disable_upnp_help: 禁用符合条件监听器的运行时 UPnP/NAT-PMP 端口映射；自动端口映射默认开启。
+
 disable_sym_hole_punching: 禁用对称NAT打洞
 disable_sym_hole_punching_help: 禁用对称NAT的打洞（生日攻击），将对称NAT视为锥形NAT处理
 
@@ -196,6 +202,12 @@ mtu_help: |
   TUN设备的MTU，默认为非加密时为1380，加密时为1360。范围：400-1380
 mtu_placeholder: 留空为默认值1380
 
+instance_recv_bps_limit: 实例接收限速
+instance_recv_bps_limit_help: |
+  限制当前实例整体入站流量的总接收速率，单位为字节每秒。
+  留空表示不限速。
+instance_recv_bps_limit_placeholder: 留空表示不限速
+
 mapped_listeners: 监听映射
 mapped_listeners_help: |
   手动指定监听器的公网地址，其他节点可以使用该地址连接到本节点。
@@ -349,6 +361,7 @@ web:
     delete: 删除
     edit: 编辑
     refresh: 刷新
+    add: 添加
     loading: 加载中...
     error: 错误
     success: 成功
@@ -416,3 +429,46 @@ config-server:
 client:
   not_running: 无法连接至远程客户端
   retry: 重试
+
+acl:
+  title: 访问控制
+  help: 访问控制列表，用于限制节点间的通信。
+  enabled: 启用 ACL
+  default_action: 默认动作
+  chains: 规则链
+  inbound: 入站
+  outbound: 出站
+  forward: 转发
+  rules: 规则
+  add_rule: 添加规则
+  edit_rule: 编辑规则
+  rule:
+    name: 规则名称
+    description: 描述
+    enabled: 启用
+    protocol: 协议
+    action: 动作
+    src_ips: 来源 IP
+    dst_ips: 目的 IP
+    src_ports: 来源端口
+    dst_ports: 目的端口
+    rate_limit: 速率限制 (pps)
+    burst_limit: 爆发限制
+    stateful: 状态追踪
+    src_groups: 来源组
+    dst_groups: 目的组
+  groups: 组管理
+  group:
+    declares: 声明组
+    members: 加入组
+    name: 组名
+    secret: 密钥
+    help: 在此处定义网络中的组身份，以便在规则中使用。
+  any: 任意
+  allow: 允许
+  drop: 丢弃
+  delete_chain_confirm: 确定要删除此规则链及其所有规则吗？
+  chain:
+    name: 名称
+    type: 类型
+  match: 匹配

easytier-web/frontend-lib/src/locales/en.yaml

@@ -10,7 +10,7 @@ initial_nodes_help: |
   • Leaving it empty = the node starts alone until others connect to it, or you connect it later yourself.
   • Direct or indirect connectivity, including through relay nodes, can form one network.
   Initial nodes can be your own nodes or ones shared by others.
-initial_node_placeholder: "Example: tcp://node.example.com:11010"
+initial_node_placeholder: "Example: node.example.com"
 virtual_ipv4: Virtual IPv4
 virtual_ipv4_dhcp: DHCP
 network_name: Network Name
@@ -103,6 +103,9 @@ use_smoltcp_help: Use a user-space TCP/IP stack to avoid issues with operating s
 disable_ipv6: Disable IPv6
 disable_ipv6_help: Disable IPv6 functionality for this node, only use IPv4 for network communication.
 
+ipv6_public_addr_auto: Auto Public IPv6
+ipv6_public_addr_auto_help: Auto-obtain a public IPv6 address from a peer that shares its IPv6 subnet.
+
 enable_kcp_proxy: Enable KCP Proxy
 enable_kcp_proxy_help: Convert TCP traffic to KCP traffic to reduce latency and boost transmission speed.
 
@@ -116,7 +119,7 @@ disable_quic_input: Disable QUIC Input
 disable_quic_input_help: Disable inbound QUIC traffic, while nodes with QUIC proxy enabled continue to connect using TCP.
 
 disable_p2p: Disable P2P
-disable_p2p_help: Disable P2P mode; route all traffic through a manually specified relay server.
+disable_p2p_help: Disable ordinary automatic P2P. Nodes with need-p2p enabled can still establish P2P with this node.
 
 p2p_only: P2P Only
 p2p_only_help: Only communicate with peers that have already established P2P connections, do not relay through other nodes.
@@ -156,6 +159,9 @@ disable_tcp_hole_punching_help: Disable tcp hole punching
 disable_udp_hole_punching: Disable UDP Hole Punching
 disable_udp_hole_punching_help: Disable udp hole punching
 
+disable_upnp: Disable UPnP
+disable_upnp_help: Disable runtime UPnP/NAT-PMP port mapping for eligible listeners; automatic port mapping is enabled by default.
+
 disable_sym_hole_punching: Disable Symmetric NAT Hole Punching
 disable_sym_hole_punching_help: Disable special hole punching handling for symmetric NAT (based on birthday attack), treat symmetric NAT as cone NAT
 
@@ -196,6 +202,12 @@ mtu_help: |
   MTU of the TUN device, default is 1380 for non-encryption, 1360 for encryption. Range:400-1380
 mtu_placeholder: Leave blank as default value 1380
 
+instance_recv_bps_limit: Instance Receive Limit
+instance_recv_bps_limit_help: |
+  Limit the total receive bandwidth for the whole instance. Unit: bytes per second.
+  Leave blank for no limit.
+instance_recv_bps_limit_placeholder: Leave blank for no limit
+
 mapped_listeners: Map Listeners
 mapped_listeners_help: |
   Manually specify the public address of the listener, other nodes can use this address to connect to this node.
@@ -349,6 +361,7 @@ web:
     delete: Delete
     edit: Edit
     refresh: Refresh
+    add: Add
     loading: Loading...
     error: Error
     success: Success
@@ -416,3 +429,46 @@ config-server:
 client:
   not_running: Unable to connect to remote client.
   retry: Retry
+
+acl:
+  title: Access Control (ACL)
+  help: Access control list to restrict communication between nodes.
+  enabled: Enable ACL
+  default_action: Default Action
+  chains: Rule Chains
+  inbound: Inbound
+  outbound: Outbound
+  forward: Forward
+  rules: Rules
+  add_rule: Add Rule
+  edit_rule: Edit Rule
+  rule:
+    name: Rule Name
+    description: Description
+    enabled: Enabled
+    protocol: Protocol
+    action: Action
+    src_ips: Source IPs
+    dst_ips: Destination IPs
+    src_ports: Source Ports
+    dst_ports: Destination Ports
+    rate_limit: Rate Limit (pps)
+    burst_limit: Burst Limit
+    stateful: Stateful
+    src_groups: Source Groups
+    dst_groups: Destination Groups
+  groups: Groups
+  group:
+    declares: Declared Groups
+    members: Node Memberships
+    name: Group Name
+    secret: Group Secret
+    help: Define group identities in the network to use them in rules.
+  any: Any
+  allow: Allow
+  drop: Drop
+  delete_chain_confirm: Are you sure you want to delete this rule chain and all its rules?
+  chain:
+    name: Name
+    type: Type
+  match: Match

easytier-web/frontend-lib/src/types/network.ts

@@ -14,6 +14,74 @@ export interface SecureModeConfig {
   local_public_key?: string
 }
 
+export enum AclProtocol {
+  Unspecified = 0,
+  TCP = 1,
+  UDP = 2,
+  ICMP = 3,
+  ICMPv6 = 4,
+  Any = 5,
+}
+
+export enum AclAction {
+  Noop = 0,
+  Allow = 1,
+  Drop = 2,
+}
+
+export enum AclChainType {
+  UnspecifiedChain = 0,
+  Inbound = 1,
+  Outbound = 2,
+  Forward = 3,
+}
+
+export interface AclRule {
+  name: string
+  description: string
+  priority: number
+  enabled: boolean
+  protocol: AclProtocol
+  ports: string[]
+  source_ips: string[]
+  destination_ips: string[]
+  source_ports: string[]
+  action: AclAction
+  rate_limit: number
+  burst_limit: number
+  stateful: boolean
+  source_groups: string[]
+  destination_groups: string[]
+}
+
+export interface AclChain {
+  name: string
+  chain_type: AclChainType
+  description: string
+  enabled: boolean
+  rules: AclRule[]
+  default_action: AclAction
+}
+
+export interface GroupIdentity {
+  group_name: string
+  group_secret: string
+}
+
+export interface GroupInfo {
+  declares: GroupIdentity[]
+  members: string[]
+}
+
+export interface AclV1 {
+  chains: AclChain[]
+  group?: GroupInfo
+}
+
+export interface Acl {
+  acl_v1?: AclV1
+}
+
 export interface NetworkConfig {
   instance_id: string
 
@@ -47,6 +115,7 @@ export interface NetworkConfig {
 
   use_smoltcp?: boolean
   disable_ipv6?: boolean
+  ipv6_public_addr_auto?: boolean
   enable_kcp_proxy?: boolean
   disable_kcp_input?: boolean
   enable_quic_proxy?: boolean
@@ -64,6 +133,7 @@ export interface NetworkConfig {
   disable_encryption?: boolean
   disable_tcp_hole_punching?: boolean
   disable_udp_hole_punching?: boolean
+  disable_upnp?: boolean
   disable_sym_hole_punching?: boolean
 
   enable_relay_network_whitelist?: boolean
@@ -78,12 +148,14 @@ export interface NetworkConfig {
   socks5_port: number
 
   mtu: number | null
+  instance_recv_bps_limit: number | null
   mapped_listeners: string[]
 
   enable_magic_dns?: boolean
   enable_private_mode?: boolean
 
   port_forwards: PortForwardConfig[]
+  acl?: Acl
 }
 
 export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
@@ -120,6 +192,7 @@ export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
 
     use_smoltcp: false,
     disable_ipv6: false,
+    ipv6_public_addr_auto: false,
     enable_kcp_proxy: false,
     disable_kcp_input: false,
     enable_quic_proxy: false,
@@ -137,6 +210,7 @@ export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
     disable_encryption: false,
     disable_tcp_hole_punching: false,
     disable_udp_hole_punching: false,
+    disable_upnp: false,
     disable_sym_hole_punching: false,
     enable_relay_network_whitelist: false,
     relay_network_whitelist: [],
@@ -146,10 +220,20 @@ export function DEFAULT_NETWORK_CONFIG(): NetworkConfig {
     enable_socks5: false,
     socks5_port: 1080,
     mtu: null,
+    instance_recv_bps_limit: null,
     mapped_listeners: [],
     enable_magic_dns: false,
     enable_private_mode: false,
     port_forwards: [],
+    acl: {
+      acl_v1: {
+        group: {
+          declares: [],
+          members: [],
+        },
+        chains: [],
+      },
+    },
   }
 }
 

easytier-web/src/client_manager/mod.rs

@@ -2,8 +2,8 @@ pub mod session;
 pub mod storage;
 
 use std::sync::{
-    atomic::{AtomicU32, Ordering},
     Arc,
+    atomic::{AtomicU32, Ordering},
 };
 
 use dashmap::DashMap;
@@ -19,11 +19,11 @@ use maxminddb::geoip2;
 use session::{Location, Session};
 use storage::{Storage, StorageToken};
 
-use crate::webhook::SharedWebhookConfig;
 use crate::FeatureFlags;
+use crate::webhook::SharedWebhookConfig;
 use tokio::task::JoinSet;
 
-use crate::db::{entity::user_running_network_configs, Db, UserIdInDb};
+use crate::db::{Db, UserIdInDb, entity::user_running_network_configs};
 
 #[derive(rust_embed::Embed)]
 #[folder = "resources/"]
@@ -340,7 +340,7 @@ mod tests {
     };
     use sqlx::Executor;
 
-    use crate::{client_manager::ClientManager, db::Db, FeatureFlags};
+    use crate::{FeatureFlags, client_manager::ClientManager, db::Db};
 
     #[tokio::test]
     async fn test_client() {
@@ -379,19 +379,26 @@ mod tests {
 
         let req = tokio::time::timeout(Duration::from_secs(12), async {
             loop {
-                let session = mgr
+                let sessions = mgr
                     .client_sessions
                     .iter()
-                    .next()
+                    .map(|item| item.value().clone())
-                    .map(|item| item.value().clone());
+                    .collect::<Vec<_>>();
-                let Some(session) = session else {
+                if sessions.is_empty() {
                     tokio::time::sleep(Duration::from_millis(100)).await;
                     continue;
-                };
+                }
-                let mut waiter = session.data().read().await.heartbeat_waiter();
+                let mut found_req = None;
-                if let Ok(req) = waiter.recv().await {
+                for session in sessions {
+                    if let Some(req) = session.data().read().await.req() {
+                        found_req = Some(req);
+                        break;
+                    }
+                }
+                if let Some(req) = found_req {
                     break req;
                 }
+                tokio::time::sleep(Duration::from_millis(100)).await;
             }
         })
         .await

easytier-web/src/db/entity/user_running_network_configs.rs

@@ -1,6 +1,9 @@
 //! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.0
 
-use easytier::{launcher::NetworkConfig, rpc_service::remote_client::PersistentConfig};
+use easytier::{
+    common::config::ConfigSource, launcher::NetworkConfig,
+    rpc_service::remote_client::PersistentConfig,
+};
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};
 
@@ -12,10 +15,12 @@ pub struct Model {
     pub user_id: i32,
     #[sea_orm(column_type = "Text")]
     pub device_id: String,
-    #[sea_orm(column_type = "Text", unique)]
+    #[sea_orm(column_type = "Text")]
     pub network_instance_id: String,
     #[sea_orm(column_type = "Text")]
     pub network_config: String,
+    #[sea_orm(column_type = "Text")]
+    pub source: String,
     pub disabled: bool,
     pub create_time: DateTimeWithTimeZone,
     pub update_time: DateTimeWithTimeZone,
@@ -48,4 +53,7 @@ impl PersistentConfig<DbErr> for Model {
     fn get_network_config(&self) -> Result<NetworkConfig, DbErr> {
         serde_json::from_str(&self.network_config).map_err(|e| DbErr::Json(e.to_string()))
     }
+    fn get_network_config_source(&self) -> ConfigSource {
+        self.source.parse().unwrap_or(ConfigSource::User)
+    }
 }

easytier-web/src/db/mod.rs

@@ -3,16 +3,17 @@
 pub mod entity;
 
 use easytier::{
+    common::config::ConfigSource,
     launcher::NetworkConfig,
     rpc_service::remote_client::{ListNetworkProps, Storage},
 };
 use entity::user_running_network_configs;
 use sea_orm::{
-    prelude::Expr, sea_query::OnConflict, ColumnTrait as _, DatabaseConnection, DbErr, EntityTrait,
+    ColumnTrait as _, DatabaseConnection, DbErr, EntityTrait, QueryFilter as _, Set,
-    QueryFilter as _, Set, SqlxSqliteConnector, TransactionTrait as _,
+    SqlxSqliteConnector, TransactionTrait as _, prelude::Expr, sea_query::OnConflict,
 };
 use sea_orm_migration::MigratorTrait as _;
-use sqlx::{migrate::MigrateDatabase as _, types::chrono, Sqlite, SqlitePool};
+use sqlx::{Sqlite, SqlitePool, migrate::MigrateDatabase as _, types::chrono};
 use uuid::Uuid;
 
 use crate::migrator;
@@ -149,18 +150,24 @@ impl Storage<(UserIdInDb, Uuid), user_running_network_configs::Model, DbErr> for
         (user_id, device_id): (UserIdInDb, Uuid),
         network_inst_id: Uuid,
         network_config: NetworkConfig,
+        source: ConfigSource,
     ) -> Result<(), DbErr> {
         let txn = self.orm_db().begin().await?;
 
         use entity::user_running_network_configs as urnc;
 
-        let on_conflict = OnConflict::column(urnc::Column::NetworkInstanceId)
+        let on_conflict = OnConflict::columns([
-            .update_columns([
+            urnc::Column::UserId,
-                urnc::Column::NetworkConfig,
+            urnc::Column::DeviceId,
-                urnc::Column::Disabled,
+            urnc::Column::NetworkInstanceId,
-                urnc::Column::UpdateTime,
+        ])
-            ])
+        .update_columns([
-            .to_owned();
+            urnc::Column::NetworkConfig,
+            urnc::Column::Source,
+            urnc::Column::Disabled,
+            urnc::Column::UpdateTime,
+        ])
+        .to_owned();
         let insert_m = urnc::ActiveModel {
             user_id: sea_orm::Set(user_id),
             device_id: sea_orm::Set(device_id.to_string()),
@@ -168,6 +175,7 @@ impl Storage<(UserIdInDb, Uuid), user_running_network_configs::Model, DbErr> for
             network_config: sea_orm::Set(
                 serde_json::to_string(&network_config).map_err(|e| DbErr::Json(e.to_string()))?,
             ),
+            source: sea_orm::Set(source.as_str().to_string()),
             disabled: sea_orm::Set(false),
             create_time: sea_orm::Set(chrono::Local::now().fixed_offset()),
             update_time: sea_orm::Set(chrono::Local::now().fixed_offset()),
@@ -184,13 +192,14 @@ impl Storage<(UserIdInDb, Uuid), user_running_network_configs::Model, DbErr> for
 
     async fn delete_network_configs(
         &self,
-        (user_id, _): (UserIdInDb, Uuid),
+        (user_id, device_id): (UserIdInDb, Uuid),
         network_inst_ids: &[Uuid],
     ) -> Result<(), DbErr> {
         use entity::user_running_network_configs as urnc;
 
         urnc::Entity::delete_many()
             .filter(urnc::Column::UserId.eq(user_id))
+            .filter(urnc::Column::DeviceId.eq(device_id.to_string()))
             .filter(
                 urnc::Column::NetworkInstanceId
                     .is_in(network_inst_ids.iter().map(|id| id.to_string())),
@@ -203,7 +212,7 @@ impl Storage<(UserIdInDb, Uuid), user_running_network_configs::Model, DbErr> for
 
     async fn update_network_config_state(
         &self,
-        (user_id, _): (UserIdInDb, Uuid),
+        (user_id, device_id): (UserIdInDb, Uuid),
         network_inst_id: Uuid,
         disabled: bool,
     ) -> Result<(), DbErr> {
@@ -211,6 +220,7 @@ impl Storage<(UserIdInDb, Uuid), user_running_network_configs::Model, DbErr> for
 
         urnc::Entity::update_many()
             .filter(urnc::Column::UserId.eq(user_id))
+            .filter(urnc::Column::DeviceId.eq(device_id.to_string()))
             .filter(urnc::Column::NetworkInstanceId.eq(network_inst_id.to_string()))
             .col_expr(urnc::Column::Disabled, Expr::value(disabled))
             .col_expr(
@@ -271,10 +281,14 @@ impl Storage<(UserIdInDb, Uuid), user_running_network_configs::Model, DbErr> for
 
 #[cfg(test)]
 mod tests {
-    use easytier::{proto::api::manage::NetworkConfig, rpc_service::remote_client::Storage};
+    use easytier::{
-    use sea_orm::{ColumnTrait, EntityTrait, QueryFilter as _};
+        common::config::ConfigSource,
+        proto::api::manage::NetworkConfig,
+        rpc_service::remote_client::{PersistentConfig, Storage},
+    };
+    use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter as _, Set};
 
-    use crate::db::{entity::user_running_network_configs, Db, ListNetworkProps};
+    use crate::db::{Db, ListNetworkProps, entity::user_running_network_configs};
 
     #[tokio::test]
     async fn test_user_network_config_management() {
@@ -288,9 +302,14 @@ mod tests {
         let inst_id = uuid::Uuid::new_v4();
         let device_id = uuid::Uuid::new_v4();
 
-        db.insert_or_update_user_network_config((user_id, device_id), inst_id, network_config)
+        db.insert_or_update_user_network_config(
-            .await
+            (user_id, device_id),
-            .unwrap();
+            inst_id,
+            network_config,
+            ConfigSource::User,
+        )
+        .await
+        .unwrap();
 
         let result = user_running_network_configs::Entity::find()
             .filter(user_running_network_configs::Column::UserId.eq(user_id))
@@ -300,6 +319,7 @@ mod tests {
             .unwrap();
         println!("{:?}", result);
         assert_eq!(result.network_config, network_config_json);
+        assert_eq!(result.get_network_config_source(), ConfigSource::User);
 
         // overwrite the config
         let network_config = NetworkConfig {
@@ -307,9 +327,14 @@ mod tests {
             ..Default::default()
         };
         let network_config_json = serde_json::to_string(&network_config).unwrap();
-        db.insert_or_update_user_network_config((user_id, device_id), inst_id, network_config)
+        db.insert_or_update_user_network_config(
-            .await
+            (user_id, device_id),
-            .unwrap();
+            inst_id,
+            network_config,
+            ConfigSource::Webhook,
+        )
+        .await
+        .unwrap();
 
         let result2 = user_running_network_configs::Entity::find()
             .filter(user_running_network_configs::Column::UserId.eq(user_id))
@@ -319,6 +344,11 @@ mod tests {
             .unwrap();
         println!("device: {}, {:?}", device_id, result2);
         assert_eq!(result2.network_config, network_config_json);
+        assert_eq!(result2.get_network_config_source(), ConfigSource::Webhook);
+        assert_eq!(
+            result2.get_runtime_network_config_source(),
+            ConfigSource::Webhook
+        );
 
         assert_eq!(result.create_time, result2.create_time);
         assert_ne!(result.update_time, result2.update_time);
@@ -341,4 +371,101 @@ mod tests {
             .unwrap();
         assert!(result3.is_none());
     }
+
+    #[tokio::test]
+    async fn test_legacy_network_config_defaults_to_user_runtime_source() {
+        let db = Db::memory_db().await;
+        let user_id = 1;
+        let inst_id = uuid::Uuid::new_v4();
+        let device_id = uuid::Uuid::new_v4();
+
+        user_running_network_configs::ActiveModel {
+            user_id: Set(user_id),
+            device_id: Set(device_id.to_string()),
+            network_instance_id: Set(inst_id.to_string()),
+            network_config: Set(serde_json::to_string(&NetworkConfig {
+                network_name: Some("legacy".to_string()),
+                ..Default::default()
+            })
+            .unwrap()),
+            source: Set("legacy".to_string()),
+            disabled: Set(false),
+            create_time: Set(sqlx::types::chrono::Local::now().fixed_offset()),
+            update_time: Set(sqlx::types::chrono::Local::now().fixed_offset()),
+            ..Default::default()
+        }
+        .insert(db.orm_db())
+        .await
+        .unwrap();
+
+        let result = user_running_network_configs::Entity::find()
+            .filter(user_running_network_configs::Column::UserId.eq(user_id))
+            .one(db.orm_db())
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(result.get_network_config_source(), ConfigSource::User);
+        assert_eq!(
+            result.get_runtime_network_config_source(),
+            ConfigSource::User
+        );
+    }
+
+    #[tokio::test]
+    async fn test_user_network_config_same_instance_id_is_scoped_by_device() {
+        let db = Db::memory_db().await;
+        let user_id = db.auto_create_user("user-1").await.unwrap().id;
+        let device1 = uuid::Uuid::new_v4();
+        let device2 = uuid::Uuid::new_v4();
+        let inst_id = uuid::Uuid::new_v4();
+
+        db.insert_or_update_user_network_config(
+            (user_id, device1),
+            inst_id,
+            NetworkConfig {
+                network_name: Some("cfg-1".to_string()),
+                ..Default::default()
+            },
+            ConfigSource::User,
+        )
+        .await
+        .unwrap();
+        db.insert_or_update_user_network_config(
+            (user_id, device2),
+            inst_id,
+            NetworkConfig {
+                network_name: Some("cfg-2".to_string()),
+                ..Default::default()
+            },
+            ConfigSource::User,
+        )
+        .await
+        .unwrap();
+
+        let first = db
+            .get_network_config((user_id, device1), &inst_id.to_string())
+            .await
+            .unwrap()
+            .unwrap();
+        let second = db
+            .get_network_config((user_id, device2), &inst_id.to_string())
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(first.user_id, user_id);
+        assert_eq!(first.device_id, device1.to_string());
+        assert_eq!(second.user_id, user_id);
+        assert_eq!(second.device_id, device2.to_string());
+
+        let device1_configs = db
+            .list_network_configs((user_id, device1), ListNetworkProps::All)
+            .await
+            .unwrap();
+        let device2_configs = db
+            .list_network_configs((user_id, device2), ListNetworkProps::All)
+            .await
+            .unwrap();
+        assert_eq!(device1_configs.len(), 1);
+        assert_eq!(device2_configs.len(), 1);
+    }
 }

easytier-web/src/main.rs

@@ -7,7 +7,7 @@ use std::net::IpAddr;
 use std::sync::Arc;
 
 use clap::Parser;
-use easytier::tunnel::websocket::WSTunnelListener;
+use easytier::tunnel::websocket::WsTunnelListener;
 use easytier::{
     common::{
         config::{ConsoleLoggerConfig, FileLoggerConfig, LoggingConfigLoader},
@@ -16,10 +16,12 @@ use easytier::{
         log,
         network::{local_ipv4, local_ipv6},
     },
-    tunnel::{tcp::TcpTunnelListener, udp::UdpTunnelListener, TunnelListener},
+    tunnel::{TunnelListener, tcp::TcpTunnelListener, udp::UdpTunnelListener},
-    utils::setup_panic_handler,
+    utils::panic::setup_panic_handler,
 };
 
+use easytier::tunnel::IpScheme;
+use easytier::utils::BoxExt;
 use mimalloc::MiMalloc;
 
 mod client_manager;
@@ -192,14 +194,12 @@ impl LoggingConfigLoader for &Cli {
     }
 }
 
-pub fn get_listener_by_url(l: &url::Url) -> Result<Box<dyn TunnelListener>, Error> {
+pub fn get_listener_by_url(scheme: IpScheme, l: &url::Url) -> Option<Box<dyn TunnelListener>> {
-    Ok(match l.scheme() {
+    Some(match scheme {
-        "tcp" => Box::new(TcpTunnelListener::new(l.clone())),
+        IpScheme::Tcp => TcpTunnelListener::new(l.clone()).boxed(),
-        "udp" => Box::new(UdpTunnelListener::new(l.clone())),
+        IpScheme::Udp => UdpTunnelListener::new(l.clone()).boxed(),
-        "ws" => Box::new(WSTunnelListener::new(l.clone())),
+        IpScheme::Ws => WsTunnelListener::new(l.clone()).boxed(),
-        _ => {
+        _ => return None,
-            return Err(Error::InvalidUrl(l.to_string()));
-        }
     })
 }
 
@@ -213,15 +213,23 @@ async fn get_dual_stack_listener(
     ),
     Error,
 > {
-    let is_protocol_support_dual_stack =
+    let scheme = protocol
-        protocol.trim().to_lowercase() == "tcp" || protocol.trim().to_lowercase() == "udp";
+        .parse()
-    let v6_listener = if is_protocol_support_dual_stack && local_ipv6().await.is_ok() {
+        .map_err(|_| Error::InvalidUrl(protocol.to_string()))?;
-        get_listener_by_url(&format!("{}://[::0]:{}", protocol, port).parse().unwrap()).ok()
+    let v6_listener =
-    } else {
+        if local_ipv6().await.is_ok() && matches!(scheme, IpScheme::Tcp | IpScheme::Udp) {
-        None
+            get_listener_by_url(
-    };
+                scheme,
+                &format!("{protocol}://[::]:{port}").parse().unwrap(),
+            )
+        } else {
+            None
+        };
     let v4_listener = if local_ipv4().await.is_ok() {
-        get_listener_by_url(&format!("{}://0.0.0.0:{}", protocol, port).parse().unwrap()).ok()
+        get_listener_by_url(
+            scheme,
+            &format!("{protocol}://0.0.0.0:{port}").parse().unwrap(),
+        )
     } else {
         None
     };

easytier-web/src/migrator/m20260403_000002_scope_network_config_unique.rs

@@ -0,0 +1,120 @@
+use sea_orm_migration::prelude::*;
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260403_000002_scope_network_config_unique"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let db = manager.get_connection();
+
+        db.execute_unprepared(
+            r#"
+            CREATE TABLE user_running_network_configs_new (
+                id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+                user_id INTEGER NOT NULL,
+                device_id TEXT NOT NULL,
+                network_instance_id TEXT NOT NULL,
+                network_config TEXT NOT NULL,
+                disabled BOOLEAN NOT NULL DEFAULT FALSE,
+                create_time TEXT NOT NULL,
+                update_time TEXT NOT NULL,
+                CONSTRAINT fk_user_running_network_configs_user_id_to_users_id
+                    FOREIGN KEY (user_id) REFERENCES users(id)
+                    ON DELETE CASCADE
+                    ON UPDATE CASCADE
+            );
+
+            INSERT INTO user_running_network_configs_new (
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                disabled,
+                create_time,
+                update_time
+            )
+            SELECT
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                disabled,
+                create_time,
+                update_time
+            FROM user_running_network_configs;
+
+            DROP TABLE user_running_network_configs;
+            ALTER TABLE user_running_network_configs_new RENAME TO user_running_network_configs;
+
+            CREATE INDEX idx_user_running_network_configs_user_id
+                ON user_running_network_configs(user_id);
+            CREATE UNIQUE INDEX idx_user_running_network_configs_scope_inst
+                ON user_running_network_configs(user_id, device_id, network_instance_id);
+            "#,
+        )
+        .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let db = manager.get_connection();
+
+        db.execute_unprepared(
+            r#"
+            CREATE TABLE user_running_network_configs_old (
+                id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+                user_id INTEGER NOT NULL,
+                device_id TEXT NOT NULL,
+                network_instance_id TEXT NOT NULL UNIQUE,
+                network_config TEXT NOT NULL,
+                disabled BOOLEAN NOT NULL DEFAULT FALSE,
+                create_time TEXT NOT NULL,
+                update_time TEXT NOT NULL,
+                CONSTRAINT fk_user_running_network_configs_user_id_to_users_id
+                    FOREIGN KEY (user_id) REFERENCES users(id)
+                    ON DELETE CASCADE
+                    ON UPDATE CASCADE
+            );
+
+            INSERT INTO user_running_network_configs_old (
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                disabled,
+                create_time,
+                update_time
+            )
+            SELECT
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                disabled,
+                create_time,
+                update_time
+            FROM user_running_network_configs;
+
+            DROP TABLE user_running_network_configs;
+            ALTER TABLE user_running_network_configs_old RENAME TO user_running_network_configs;
+
+            CREATE INDEX idx_user_running_network_configs_user_id
+                ON user_running_network_configs(user_id);
+            "#,
+        )
+        .await?;
+
+        Ok(())
+    }
+}

easytier-web/src/migrator/m20260421_000003_add_network_config_source.rs

@@ -0,0 +1,125 @@
+use sea_orm_migration::prelude::*;
+
+pub struct Migration;
+
+impl MigrationName for Migration {
+    fn name(&self) -> &str {
+        "m20260421_000003_add_network_config_source"
+    }
+}
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let db = manager.get_connection();
+
+        db.execute_unprepared(
+            r#"
+            CREATE TABLE user_running_network_configs_new (
+                id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+                user_id INTEGER NOT NULL,
+                device_id TEXT NOT NULL,
+                network_instance_id TEXT NOT NULL,
+                network_config TEXT NOT NULL,
+                source TEXT NOT NULL DEFAULT 'user',
+                disabled BOOLEAN NOT NULL DEFAULT FALSE,
+                create_time TEXT NOT NULL,
+                update_time TEXT NOT NULL,
+                CONSTRAINT fk_user_running_network_configs_user_id_to_users_id
+                    FOREIGN KEY (user_id) REFERENCES users(id)
+                    ON DELETE CASCADE
+                    ON UPDATE CASCADE
+            );
+
+            INSERT INTO user_running_network_configs_new (
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                source,
+                disabled,
+                create_time,
+                update_time
+            )
+            SELECT
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                'legacy',
+                disabled,
+                create_time,
+                update_time
+            FROM user_running_network_configs;
+
+            DROP TABLE user_running_network_configs;
+            ALTER TABLE user_running_network_configs_new RENAME TO user_running_network_configs;
+
+            CREATE INDEX idx_user_running_network_configs_user_id
+                ON user_running_network_configs(user_id);
+            CREATE UNIQUE INDEX idx_user_running_network_configs_scope_inst
+                ON user_running_network_configs(user_id, device_id, network_instance_id);
+            "#,
+        )
+        .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        let db = manager.get_connection();
+
+        db.execute_unprepared(
+            r#"
+            CREATE TABLE user_running_network_configs_old (
+                id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+                user_id INTEGER NOT NULL,
+                device_id TEXT NOT NULL,
+                network_instance_id TEXT NOT NULL,
+                network_config TEXT NOT NULL,
+                disabled BOOLEAN NOT NULL DEFAULT FALSE,
+                create_time TEXT NOT NULL,
+                update_time TEXT NOT NULL,
+                CONSTRAINT fk_user_running_network_configs_user_id_to_users_id
+                    FOREIGN KEY (user_id) REFERENCES users(id)
+                    ON DELETE CASCADE
+                    ON UPDATE CASCADE
+            );
+
+            INSERT INTO user_running_network_configs_old (
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                disabled,
+                create_time,
+                update_time
+            )
+            SELECT
+                id,
+                user_id,
+                device_id,
+                network_instance_id,
+                network_config,
+                disabled,
+                create_time,
+                update_time
+            FROM user_running_network_configs;
+
+            DROP TABLE user_running_network_configs;
+            ALTER TABLE user_running_network_configs_old RENAME TO user_running_network_configs;
+
+            CREATE INDEX idx_user_running_network_configs_user_id
+                ON user_running_network_configs(user_id);
+            CREATE UNIQUE INDEX idx_user_running_network_configs_scope_inst
+                ON user_running_network_configs(user_id, device_id, network_instance_id);
+            "#,
+        )
+        .await?;
+
+        Ok(())
+    }
+}

easytier-web/src/migrator/mod.rs

@@ -1,12 +1,18 @@
 use sea_orm_migration::prelude::*;
 
 mod m20241029_000001_init;
+mod m20260403_000002_scope_network_config_unique;
+mod m20260421_000003_add_network_config_source;
 
 pub struct Migrator;
 
 #[async_trait::async_trait]
 impl MigratorTrait for Migrator {
     fn migrations() -> Vec<Box<dyn MigrationTrait>> {
-        vec![Box::new(m20241029_000001_init::Migration)]
+        vec![
+            Box::new(m20241029_000001_init::Migration),
+            Box::new(m20260403_000002_scope_network_config_unique::Migration),
+            Box::new(m20260421_000003_add_network_config_source::Migration),
+        ]
     }
 }

easytier-web/src/restful/auth.rs

@@ -1,7 +1,7 @@
 use axum::{
+    Router,
     http::StatusCode,
     routing::{get, post, put},
-    Router,
 };
 use axum_login::login_required;
 use axum_messages::Message;
@@ -14,8 +14,8 @@ use std::sync::Arc;
 use crate::FeatureFlags;
 
 use super::{
-    users::{AuthSession, Credentials},
     AppStateInner,
+    users::{AuthSession, Credentials},
 };
 
 #[derive(Debug, Deserialize, Serialize)]
@@ -44,7 +44,7 @@ mod put {
     use axum_login::AuthUser;
     use easytier::proto::common::Void;
 
-    use crate::restful::{other_error, users::ChangePassword, HttpHandleError};
+    use crate::restful::{HttpHandleError, other_error, users::ChangePassword};
 
     use super::*;
 
@@ -71,14 +71,14 @@ mod put {
 }
 
 mod post {
-    use axum::{extract::Extension, Json};
+    use axum::{Json, extract::Extension};
     use easytier::proto::common::Void;
 
     use crate::restful::{
-        captcha::extension::{axum_tower_sessions::CaptchaAxumTowerSessionStaticExt, CaptchaUtil},
+        HttpHandleError,
+        captcha::extension::{CaptchaUtil, axum_tower_sessions::CaptchaAxumTowerSessionStaticExt},
         other_error,
         users::RegisterNewUser,
-        HttpHandleError,
     };
 
     use super::*;
@@ -99,7 +99,7 @@ mod post {
                 return Err((
                     StatusCode::INTERNAL_SERVER_ERROR,
                     Json::from(other_error(format!("{:?}", e))),
-                ))
+                ));
             }
         };
 
@@ -150,14 +150,15 @@ mod post {
 
 mod get {
     use crate::restful::{
+        HttpHandleError,
         captcha::{
-            builder::spec::SpecCaptcha,
-            extension::{axum_tower_sessions::CaptchaAxumTowerSessionExt as _, CaptchaUtil},
             NewCaptcha as _,
+            builder::spec::SpecCaptcha,
+            extension::{CaptchaUtil, axum_tower_sessions::CaptchaAxumTowerSessionExt as _},
         },
-        other_error, HttpHandleError,
+        other_error,
     };
-    use axum::{response::Response, Json};
+    use axum::{Json, response::Response};
     use easytier::proto::common::Void;
     use tower_sessions::Session;
 

easytier-web/src/restful/captcha/base/captcha.rs

@@ -2,8 +2,8 @@ use super::super::base::randoms::Randoms;
 
 use super::super::utils::color::Color;
 use super::super::utils::font;
-use base64::prelude::BASE64_STANDARD;
 use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
 
 use rusttype::Font;
 use std::fmt::Debug;

easytier-web/src/restful/captcha/builder/spec.rs

@@ -9,14 +9,14 @@ use super::super::{CaptchaFont, NewCaptcha};
 
 use image::{ImageBuffer, Rgba};
 use imageproc::drawing;
-use rand::{rngs::ThreadRng, Rng};
+use rand::{Rng, rngs::ThreadRng};
 use rusttype::{Font, Scale};
 use std::io::{Cursor, Write};
 use std::sync::Arc;
 
 mod color {
     use image::Rgba;
-    use rand::{rngs::ThreadRng, Rng};
+    use rand::{Rng, rngs::ThreadRng};
     pub fn gen_background_color(rng: &mut ThreadRng) -> Rgba<u8> {
         let red = rng.gen_range(200..=255);
         let green = rng.gen_range(200..=255);
@@ -133,7 +133,7 @@ impl<'a, 'b> CaptchaBuilder<'a, 'b> {
 
     fn draw_line(&self, image: &mut ImageBuffer<Rgba<u8>, Vec<u8>>, rng: &mut ThreadRng) {
         let line_color = color::gen_line_color(rng);
-        let is_h = rng.gen();
+        let is_h = rng.r#gen();
         let (start, end) = if is_h {
             let xa = rng.gen_range(0.0..(self.width as f32) / 2.0);
             let ya = rng.gen_range(0.0..(self.height as f32));

easytier-web/src/restful/mod.rs

@@ -8,32 +8,32 @@ mod users;
 use std::{net::SocketAddr, sync::Arc};
 
 use axum::extract::Path;
-use axum::http::{header, Request, StatusCode};
+use axum::http::{Request, StatusCode, header};
 use axum::middleware::{self as axum_mw, Next};
 use axum::response::Response;
 use axum::routing::{delete, post};
-use axum::{extract::State, routing::get, Extension, Json, Router};
+use axum::{Extension, Json, Router, extract::State, routing::get};
 use axum_login::tower_sessions::{ExpiredDeletion, SessionManagerLayer};
-use axum_login::{login_required, AuthManagerLayerBuilder, AuthUser, AuthzBackend};
+use axum_login::{AuthManagerLayerBuilder, AuthUser, AuthzBackend, login_required};
 use axum_messages::MessagesManagerLayer;
 use easytier::common::config::{ConfigLoader, TomlConfigLoader};
-use easytier::common::scoped_task::ScopedTask;
 use easytier::launcher::NetworkConfig;
 use easytier::proto::rpc_types;
 use network::NetworkApi;
 use sea_orm::DbErr;
 use tokio::net::TcpListener;
+use tokio_util::task::AbortOnDropHandle;
+use tower_sessions::Expiry;
 use tower_sessions::cookie::time::Duration;
 use tower_sessions::cookie::{Key, SameSite};
-use tower_sessions::Expiry;
 use tower_sessions_sqlx_store::SqliteStore;
 use users::{AuthSession, Backend};
 
-use crate::client_manager::storage::StorageToken;
+use crate::FeatureFlags;
 use crate::client_manager::ClientManager;
+use crate::client_manager::storage::StorageToken;
 use crate::db::{Db, UserIdInDb};
 use crate::webhook::SharedWebhookConfig;
-use crate::FeatureFlags;
 
 /// Embed assets for web dashboard, build frontend first
 #[cfg(feature = "embed")]
@@ -199,8 +199,8 @@ impl RestfulServer {
         mut self,
     ) -> Result<
         (
-            ScopedTask<()>,
+            AbortOnDropHandle<()>,
-            ScopedTask<tower_sessions::session_store::Result<()>>,
+            AbortOnDropHandle<tower_sessions::session_store::Result<()>>,
         ),
         anyhow::Error,
     > {
@@ -213,13 +213,11 @@ impl RestfulServer {
         let session_store = SqliteStore::new(self.db.inner());
         session_store.migrate().await?;
 
-        let delete_task: ScopedTask<tower_sessions::session_store::Result<()>> =
+        let delete_task = AbortOnDropHandle::new(tokio::task::spawn(
-            tokio::task::spawn(
+            session_store
-                session_store
+                .clone()
-                    .clone()
+                .continuously_delete_expired(tokio::time::Duration::from_secs(60)),
-                    .continuously_delete_expired(tokio::time::Duration::from_secs(60)),
+        ));
-            )
-            .into();
 
         // Generate a cryptographic key to sign the session cookie.
         let key = Key::generate();
@@ -298,10 +296,9 @@ impl RestfulServer {
             app
         };
 
-        let serve_task: ScopedTask<()> = tokio::spawn(async move {
+        let serve_task = AbortOnDropHandle::new(tokio::spawn(async move {
             axum::serve(listener, app).await.unwrap();
-        })
+        }));
-        .into();
 
         Ok((serve_task, delete_task))
     }

easytier-web/src/restful/network.rs

@@ -1,7 +1,7 @@
 use axum::extract::Path;
 use axum::http::StatusCode;
 use axum::routing::{delete, post};
-use axum::{extract::State, routing::get, Json, Router};
+use axum::{Json, Router, extract::State, routing::get};
 use axum_login::AuthUser;
 use easytier::launcher::NetworkConfig;
 use easytier::proto::common::Void;
@@ -16,7 +16,7 @@ use crate::db::UserIdInDb;
 
 use super::users::AuthSession;
 use super::{
-    convert_db_error, other_error, AppState, AppStateInner, Error, HttpHandleError, RpcError,
+    AppState, AppStateInner, Error, HttpHandleError, RpcError, convert_db_error, other_error,
 };
 
 fn convert_rpc_error(e: RpcError) -> (StatusCode, Json<Error>) {

easytier-web/src/restful/oidc.rs

@@ -4,8 +4,8 @@ use std::time::Duration;
 
 use subtle::ConstantTimeEq;
 
-use axum::routing::get;
 use axum::Router;
+use axum::routing::get;
 use openidconnect::core::{
     CoreAuthDisplay, CoreAuthPrompt, CoreErrorResponseType, CoreGenderClaim, CoreJsonWebKey,
     CoreJweContentEncryptionAlgorithm, CoreJwsSigningAlgorithm, CoreProviderMetadata,
@@ -216,7 +216,9 @@ impl OidcConfig {
         } = opts;
 
         if oidc_issuer_url.is_none() || oidc_client_id.is_none() || oidc_redirect_url.is_none() {
-            return Err(anyhow::anyhow!("--oidc-issuer-url, --oidc-client-id and --oidc-redirect-url are required when using OIDC authentication"));
+            return Err(anyhow::anyhow!(
+                "--oidc-issuer-url, --oidc-client-id and --oidc-redirect-url are required when using OIDC authentication"
+            ));
         }
         if oidc_username_claim.trim().is_empty() {
             return Err(anyhow::anyhow!("--oidc-username-claim cannot be empty"));
@@ -373,18 +375,17 @@ mod route {
             )
                 .into_response();
         }
-        if let Some(verifier) = pkce_verifier {
+        if let Some(verifier) = pkce_verifier
-            if let Err(e) = session
+            && let Err(e) = session
                 .insert("oidc_pkce_verifier", verifier.secret().clone())
                 .await
-            {
+        {
-                tracing::error!("Failed to store pkce_verifier in session: {:?}", e);
+            tracing::error!("Failed to store pkce_verifier in session: {:?}", e);
-                return (
+            return (
-                    StatusCode::INTERNAL_SERVER_ERROR,
+                StatusCode::INTERNAL_SERVER_ERROR,
-                    Json(other_error("Session error")),
+                Json(other_error("Session error")),
-                )
+            )
-                    .into_response();
+                .into_response();
-            }
         }
         if let Err(e) = session.insert("oidc_pkce_used", pkce_enabled).await {
             tracing::error!("Failed to store pkce_used in session: {:?}", e);

easytier-web/src/restful/rpc.rs

@@ -1,15 +1,15 @@
 use axum::{
+    Json, Router,
     extract::{Path, State},
     http::StatusCode,
     routing::post,
-    Json, Router,
 };
 use axum_login::AuthUser as _;
 use easytier::proto::rpc_types::controller::BaseController;
 
 use crate::db::UserIdInDb;
 
-use super::{other_error, AppState, HttpHandleError};
+use super::{AppState, HttpHandleError, other_error};
 
 #[derive(Debug, serde::Deserialize)]
 pub struct ProxyRpcRequest {
@@ -120,7 +120,7 @@ async fn handle_proxy_rpc_by_session(
             return Err((
                 StatusCode::BAD_REQUEST,
                 other_error(format!("Unknown service: {}", service_name)).into(),
-            ))
+            ));
         }
     };
 

easytier-web/src/restful/users.rs

@@ -39,9 +39,9 @@ impl AuthUser for User {
 
     fn session_auth_hash(&self) -> &[u8] {
         self.db_user.password.as_bytes() // We use the password hash as the auth
-                                         // hash--what this means
+        // hash--what this means
-                                         // is when the user changes their password the
+        // is when the user changes their password the
-                                         // auth session becomes invalid.
+        // auth session becomes invalid.
     }
 }
 

easytier-web/src/web/mod.rs

@@ -1,14 +1,15 @@
 use axum::{
+    Router,
     extract::State,
     http::header,
     response::{IntoResponse, Response},
-    routing, Router,
+    routing,
 };
 use axum_embed::ServeEmbed;
-use easytier::common::scoped_task::ScopedTask;
 use rust_embed::RustEmbed;
 use std::net::SocketAddr;
 use tokio::net::TcpListener;
+use tokio_util::task::AbortOnDropHandle;
 
 /// Embed assets for web dashboard, build frontend first
 #[derive(RustEmbed, Clone)]
@@ -58,7 +59,7 @@ pub fn build_router(api_host: Option<url::Url>) -> Router {
 pub struct WebServer {
     bind_addr: SocketAddr,
     router: Router,
-    serve_task: Option<ScopedTask<()>>,
+    serve_task: Option<AbortOnDropHandle<()>>,
 }
 
 impl WebServer {
@@ -70,14 +71,13 @@ impl WebServer {
         })
     }
 
-    pub async fn start(self) -> Result<ScopedTask<()>, anyhow::Error> {
+    pub async fn start(self) -> Result<AbortOnDropHandle<()>, anyhow::Error> {
         let listener = TcpListener::bind(self.bind_addr).await?;
         let app = self.router;
 
-        let task = tokio::spawn(async move {
+        let task = AbortOnDropHandle::new(tokio::spawn(async move {
             axum::serve(listener, app).await.unwrap();
-        })
+        }));
-        .into();
 
         Ok(task)
     }

easytier-web/src/webhook.rs

@@ -49,6 +49,7 @@ impl WebhookConfig {
 pub struct ValidateTokenRequest {
     pub token: String,
     pub machine_id: String,
+    pub public_ip: Option<String>,
     pub hostname: String,
     pub version: String,
     pub os_type: Option<String>,
@@ -65,7 +66,14 @@ pub struct ValidateTokenResponse {
     pub pre_approved: bool,
     #[serde(default)]
     pub binding_version: u64,
-    pub network_config: Option<serde_json::Value>,
+    pub managed_network_configs: Vec<ManagedNetworkConfig>,
+    pub config_revision: String,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct ManagedNetworkConfig {
+    pub instance_id: String,
+    pub network_config: serde_json::Value,
 }
 
 #[derive(Debug, Serialize)]

easytier/.clippy.toml

@@ -0,0 +1,11 @@
+disallowed-methods = [
+    { path = "itertools::Itertools::map_into", reason = "Blocks underlying iterator optimizations. Use the native `.map(Into::into)` instead." },
+    { path = "itertools::Itertools::map_ok", reason = "Blocks underlying iterator optimizations. Use the native `.map(|r| r.map(f))` instead." },
+    { path = "itertools::Itertools::filter_ok", reason = "Blocks underlying iterator optimizations. Use a native approach, e.g., `.filter(|r| r.as_ref().map_or(true, condition))`." },
+    { path = "itertools::Itertools::filter_map_ok", reason = "Blocks underlying iterator optimizations. Use native `.map()` and `.flatten()`, or extract logic into a standard `.filter_map()`." },
+
+    { path = "itertools::Itertools::collect_vec", reason = "Non-standard idiom. Directly use the standard library's `.collect::<Vec<_>>()`." },
+    { path = "itertools::Itertools::try_collect", reason = "Non-standard idiom. Standard `collect()` already supports Result/Option inversion; use `.collect::<Result<_, _>>()`." },
+    { path = "itertools::Itertools::set_from", reason = "Non-standard idiom. Directly use the `.extend()` method provided by the standard library's `Extend` trait." },
+    { path = "itertools::Itertools::concat", reason = "Non-standard idiom. Use native `.flatten().collect()` or a slice's `.concat()` instead." }
+]

easytier/Cargo.toml

@@ -3,12 +3,12 @@ name = "easytier"
 description = "A full meshed p2p VPN, connecting all your devices in one network with one command."
 homepage = "https://github.com/EasyTier/EasyTier"
 repository = "https://github.com/EasyTier/EasyTier"
-version = "2.5.0"
+version = "2.6.3"
-edition = "2021"
+edition.workspace = true
+rust-version.workspace = true
 authors = ["kkrainbow"]
 keywords = ["vpn", "p2p", "network", "easytier"]
 categories = ["network-programming", "command-line-utilities"]
-rust-version = "1.93.0"
 license-file = "LICENSE"
 readme = "README.md"
 
@@ -37,7 +37,7 @@ tracing-subscriber = { version = "0.3", features = [
     "time",
 ] }
 derivative = "2.2.0"
-derive_more = {version = "2.1.1", features = ["full"]}
+derive_more = { version = "2.1.1", features = ["full"] }
 console-subscriber = { version = "0.4.1", optional = true }
 indoc = "2.0.7"
 regex = "1.8"
@@ -50,6 +50,10 @@ time = "0.3"
 toml = "0.8.12"
 chrono = { version = "0.4.37", features = ["serde"] }
 
+guarden = "0.1"
+
+delegate = "0.13.5"
+
 itertools = "0.14.0"
 
 strum = { version = "0.27.2", features = ["derive"] }
@@ -60,7 +64,7 @@ futures = { version = "0.3", features = ["bilock", "unstable"] }
 
 tokio = { version = "1", features = ["full"] }
 tokio-stream = "0.1"
-tokio-util = { version = "0.7.9", features = ["codec", "net", "io"] }
+tokio-util = { version = "0.7.9", features = ["codec", "net", "io", "rt"] }
 
 async-stream = "0.3.5"
 async-trait = "0.1.74"
@@ -79,12 +83,12 @@ quinn = { version = "0.11.8", optional = true, features = ["ring"] }
 quinn-plaintext = { version = "0.3.0", optional = true }
 
 rustls = { version = "0.23.0", features = [
-    "ring","tls12"
+    "ring", "tls12"
 ], default-features = false, optional = true }
 rcgen = { version = "0.12.1", optional = true }
 
 # for websocket
-tokio-websockets = { version = "0.8", optional = true, features = [
+tokio-websockets = { version = "0.13.2", optional = true, features = [
     "rustls-webpki-roots",
     "client",
     "server",
@@ -94,6 +98,7 @@ tokio-websockets = { version = "0.8", optional = true, features = [
 http = { version = "1", default-features = false, features = [
     "std",
 ], optional = true }
+forwarded-header-value = { version = "0.1.1", optional = true }
 tokio-rustls = { version = "0.26", default-features = false, optional = true }
 
 # for tap device
@@ -162,7 +167,6 @@ network-interface = "2.0"
 
 # for ospf route
 petgraph = "0.8.1"
-hashbrown = "0.15.3"
 ordered_hash_map = "0.5.0"
 
 # for wireguard
@@ -217,6 +221,7 @@ async-ringbuf = "0.3.1"
 service-manager = { git = "https://github.com/EasyTier/service-manager-rs.git", branch = "main" }
 
 zstd = { version = "0.13", optional = true }
+lzokay-native = { version = "0.1", optional = true }
 
 kcp-sys = { git = "https://github.com/EasyTier/kcp-sys", rev = "94964794caaed5d388463137da59b97499619e5f", optional = true }
 
@@ -239,6 +244,7 @@ hickory-server = { version = "0.25.2", features = [
     "resolver",
 ], optional = true }
 
+bon = "3.9.1"
 derive_builder = "0.20.2"
 humantime-serde = "1.1.1"
 multimap = "0.10.1"
@@ -249,7 +255,8 @@ shellexpand = "3.1.1"
 
 # for fake tcp
 flume = { version = "0.12", optional = true }
-cfg-if = "1.0"
+igd-next = { version = "0.17.0", features = ["aio_tokio"] }
+natpmp = "0.5.0"
 
 [target.'cfg(any(target_os = "linux", target_os = "macos", target_os = "windows", target_os = "freebsd"))'.dependencies]
 machine-uid = "0.5.3"
@@ -270,11 +277,15 @@ windivert = { git = "https://github.com/EasyTier/windivert-rust.git", rev = "adc
 ] }
 
 [target.'cfg(windows)'.dependencies]
-windows = { version = "0.52.0", features = [
+windows = { version = "0.62.2", features = [
     "Win32_Foundation",
+    "Win32_NetworkManagement_IpHelper",
+    "Win32_NetworkManagement_Ndis",
     "Win32_NetworkManagement_WindowsFirewall",
-    "Win32_System_Com",
     "Win32_Networking",
+    "Win32_System_Com",
+    "Win32_System_Diagnostics",
+    "Win32_System_Diagnostics_Debug",
     "Win32_System_Ole",
     "Win32_System_Variant",
     "Win32_Networking_WinSock",
@@ -283,14 +294,6 @@ windows = { version = "0.52.0", features = [
 encoding = "0.2"
 winreg = "0.52"
 windows-service = "0.7.0"
-windows-sys = { version = "0.52", features = [
-    "Win32_NetworkManagement_IpHelper",
-    "Win32_NetworkManagement_Ndis",
-    "Win32_Networking_WinSock",
-    "Win32_Foundation",
-    "Win32_System_Diagnostics",
-    "Win32_System_Diagnostics_Debug",
-] }
 winapi = { version = "0.3.9", features = ["impl-default"] }
 
 [target.'cfg(not(windows))'.dependencies]
@@ -312,6 +315,7 @@ jemalloc-sys = { package = "tikv-jemalloc-sys", version = "0.6.0", features = [
 ], optional = true }
 
 [build-dependencies]
+cfg_aliases = "0.2.1"
 tonic-build = "0.12"
 globwalk = "0.8.1"
 regex = "1"
@@ -321,22 +325,14 @@ easytier-rpc-build = { path = "../easytier-rpc-build", features = [
     "internal-namespace",
 ] }
 prost-reflect-build = { version = "0.14.0" }
+thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = [
+    "win7",
+] }
 
 [target.'cfg(windows)'.build-dependencies]
 reqwest = { version = "0.12.12", features = ["blocking"] }
 zip = "4.0.0"
 
-# enable thunk-rs when compiling for x86_64 or i686 windows
-[target.x86_64-pc-windows-msvc.build-dependencies]
-thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = [
-    "win7",
-] }
-
-[target.i686-pc-windows-msvc.build-dependencies]
-thunk-rs = { git = "https://github.com/easytier/thunk.git", default-features = false, features = [
-    "win7",
-] }
-
 
 [dev-dependencies]
 serial_test = "3.0.0"
@@ -344,6 +340,7 @@ rstest = "0.25.0"
 futures-util = "0.3.31"
 maplit = "1.0.2"
 tempfile = "3.22.0"
+ctor = "0.8.0"
 
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 defguard_wireguard_rs = "0.4.2"
@@ -362,6 +359,7 @@ default = [
     "faketcp",
     "magic-dns",
     "zstd",
+    "lzo",
 ]
 full = [
     "websocket",
@@ -376,6 +374,7 @@ full = [
     "faketcp",
     "magic-dns",
     "zstd",
+    "lzo",
 ]
 wireguard = ["dep:boringtun", "dep:ring"]
 quic = ["dep:quinn", "dep:quinn-plaintext", "dep:rustls", "dep:rcgen"]
@@ -387,6 +386,7 @@ tun = ["dep:tun"]
 websocket = [
     "dep:tokio-websockets",
     "dep:http",
+    "dep:forwarded-header-value",
     "dep:tokio-rustls",
     "dep:rustls",
     "dep:rcgen",
@@ -405,5 +405,6 @@ tracing = ["tokio/tracing", "dep:console-subscriber"]
 magic-dns = ["dep:hickory-client", "dep:hickory-server"]
 faketcp = ["dep:flume"]
 zstd = ["dep:zstd"]
+lzo = ["dep:lzokay-native"]
 # For Network Extension on macOS
 macos-ne = []

easytier/build.rs

@@ -1,9 +1,9 @@
+use cfg_aliases::cfg_aliases;
+use prost_wkt_build::{FileDescriptorSet, Message as _};
 #[cfg(target_os = "windows")]
 use std::io::Cursor;
 use std::{env, path::PathBuf};
 
-use prost_wkt_build::{FileDescriptorSet, Message as _};
-
 #[cfg(target_os = "windows")]
 struct WindowsBuild {}
 
@@ -86,7 +86,9 @@ impl WindowsBuild {
         } else {
             Self::download_protoc()
         };
-        std::env::set_var("PROTOC", protoc_path);
+        unsafe {
+            std::env::set_var("PROTOC", protoc_path);
+        }
     }
 }
 
@@ -130,12 +132,21 @@ fn check_locale() {
 }
 
 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    cfg_aliases! {
+        mobile: {
+            any(
+                target_os = "android",
+                target_os = "ios",
+                all(target_os = "macos", feature = "macos-ne"),
+                target_env = "ohos"
+            )
+        }
+    }
+
+    let target_os = env::var("CARGO_CFG_TARGET_OS").unwrap_or_default();
+    let target_arch = env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
     // enable thunk-rs when target os is windows and arch is x86_64 or i686
-    #[cfg(target_os = "windows")]
+    if target_os == "windows" && (target_arch == "x86" || target_arch == "x86_64") {
-    if !std::env::var("TARGET")
-        .unwrap_or_default()
-        .contains("aarch64")
-    {
         thunk::thunk();
     }
 
@@ -180,6 +191,11 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         )
         .type_attribute("peer_rpc.RouteForeignNetworkSummary", "#[derive(Hash, Eq)]")
         .type_attribute("common.RpcDescriptor", "#[derive(Hash, Eq)]")
+        .type_attribute("acl.Acl", "#[serde(default)]")
+        .type_attribute("acl.AclV1", "#[serde(default)]")
+        .type_attribute("acl.Chain", "#[serde(default)]")
+        .type_attribute("acl.Rule", "#[serde(default)]")
+        .type_attribute("acl.GroupInfo", "#[serde(default)]")
         .field_attribute(".api.manage.NetworkConfig", "#[serde(default)]")
         .service_generator(Box::new(easytier_rpc_build::ServiceGenerator::default()))
         .btree_map(["."])

easytier/locales/app.yml

@@ -39,6 +39,15 @@ core_clap:
   ipv6:
     en: "ipv6 address of this vpn node, can be used together with ipv4 for dual-stack operation"
     zh-CN: "此VPN节点的IPv6地址，可与IPv4一起使用以进行双栈操作"
+  ipv6_public_addr_provider:
+    en: "share this node's public IPv6 subnet with other peers so they can obtain public IPv6 addresses (Linux only)"
+    zh-CN: "将此节点的公网 IPv6 子网共享给其他节点，使它们也能获得公网 IPv6 地址（仅 Linux 支持）"
+  ipv6_public_addr_auto:
+    en: "auto-obtain a public IPv6 address from a peer that shares its IPv6 subnet"
+    zh-CN: "自动从共享了 IPv6 子网的对等节点获取一个公网 IPv6 地址"
+  ipv6_public_addr_prefix:
+    en: "manually specify the public IPv6 subnet to share, instead of auto-detecting from system routes"
+    zh-CN: "手动指定要共享的公网 IPv6 子网，不自动从系统路由检测"
   dhcp:
     en: "automatically determine and set IP address by Easytier, and the IP address starts from 10.0.0.1 by default. Warning, if there is an IP conflict in the network when using DHCP, the IP will be automatically changed."
     zh-CN: "由Easytier自动确定并设置IP地址，默认从10.0.0.1开始。警告：在使用DHCP时，如果网络中出现IP冲突，IP将自动更改。"
@@ -152,8 +161,8 @@ core_clap:
         如果该参数为空，则禁用转发。默认允许所有网络。
         例如：'*'（所有网络），'def*'（以def为前缀的网络），'net1 net2'（只允许net1和net2）"
   disable_p2p:
-    en: "disable p2p communication, will only relay packets with peers specified by --peers"
+    en: "disable ordinary automatic p2p; still establish p2p with peers marked as need-p2p, and other peers should not proactively connect to this node"
-    zh-CN: "禁用P2P通信，只通过--peers指定的节点转发数据包"
+    zh-CN: "禁用普通自动P2P；仍会与标记为 need-p2p 的节点建立P2P连接，其他节点不应主动与当前节点建立P2P"
   p2p_only:
     en: "only communicate with peers that already establish p2p connection"
     zh-CN: "仅与已经建立P2P连接的对等节点通信"
@@ -172,6 +181,9 @@ core_clap:
   disable_sym_hole_punching:
     en: "if true, disable udp nat hole punching for symmetric nat (NAT4), which is based on birthday attack and may be blocked by ISP."
     zh-CN: "如果为true，则禁用基于生日攻击的对称NAT (NAT4) UDP 打洞功能，该打洞方式可能会被运营商封锁"
+  disable_upnp:
+    en: "disable runtime UPnP/NAT-PMP port mapping for eligible listeners; automatic port mapping is enabled by default"
+    zh-CN: "禁用符合条件监听器的运行时 UPnP/NAT-PMP 端口映射；自动端口映射默认开启"
   relay_all_peer_rpc:
     en: "relay all peer rpc packets, even if the peer is not in the relay network whitelist. this can help peers not in relay network whitelist to establish p2p connection."
     zh-CN: "转发所有对等节点的RPC数据包，即使对等节点不在转发网络白名单中。这可以帮助白名单外网络中的对等节点建立P2P连接。"
@@ -182,8 +194,8 @@ core_clap:
     en: "the url of the ipv6 listener, e.g.: tcp://[::]:11010, if not set, will listen on random udp port"
     zh-CN: "IPv6 监听器的URL，例如：tcp://[::]:11010，如果未设置，将在随机UDP端口上监听"
   compression:
-    en: "compression algorithm to use, support none, zstd. default is none"
+    en: "compression algorithm to use, supported: %{algorithms}. default is none"
-    zh-CN: "要使用的压缩算法，支持 none、zstd。默认为 none"
+    zh-CN: "要使用的压缩算法，支持：%{algorithms}。默认为 none"
   mapped_listeners:
     en: "manually specify the public address of the listener, other nodes can use this address to connect to this node. e.g.: tcp://123.123.123.123:11223, can specify multiple."
     zh-CN: "手动指定监听器的公网地址，其他节点可以使用该地址连接到本节点。例如：tcp://123.123.123.123:11223，可以指定多个。"
@@ -212,11 +224,14 @@ core_clap:
     en: "specify the top-level domain zone for magic DNS. if not provided, defaults to the value from dns_server module (et.net.). only used when accept_dns is true."
     zh-CN: "指定魔法DNS的顶级域名区域。如果未提供，默认使用dns_server模块中的值（et.net.）。仅在accept_dns为true时使用。"
   private_mode:
-    en: "if true, nodes with different network names or passwords from this network are not allowed to perform handshake or relay through this node."
+    en: "if true, foreign networks are only allowed when this node can verify they use the same network secret, or when a foreign credential node is already trusted via admin-issued credential propagation; different or missing secrets are otherwise rejected."
-    zh-CN: "如果为true，则不允许使用了与本网络不相同的网络名称和密码的节点通过本节点进行握手或中转"
+    zh-CN: "如果为true，则仅允许两类 foreign network 接入：本节点能验证其使用相同 network secret 的节点，或已通过 foreign network 管理节点传播而被信任的 credential 节点；否则 secret 不同或缺失时会被拒绝。"
   foreign_relay_bps_limit:
     en: "the maximum bps limit for foreign network relay, default is no limit. unit: BPS (bytes per second)"
     zh-CN: "作为共享节点时，限制非本地网络的流量转发速率，默认无限制，单位 BPS （字节每秒）"
+  instance_recv_bps_limit:
+    en: "the maximum total receive bps limit for this instance, default is no limit. unit: BPS (bytes per second)"
+    zh-CN: "限制当前网络实例整体入站流量的总接收速率，默认无限制，单位 BPS （字节每秒）"
   tcp_whitelist:
     en: "tcp port whitelist. Supports single ports (80) and ranges (8000-9000)"
     zh-CN: "TCP 端口白名单。支持单个端口（80）和范围（8000-9000）"

easytier/src/arch/windows.rs

@@ -3,24 +3,25 @@ use std::{io, mem::ManuallyDrop, net::SocketAddr, os::windows::io::AsRawSocket};
 use anyhow::Context;
 use network_interface::NetworkInterfaceConfig;
 use windows::{
-    core::BSTR,
     Win32::{
-        Foundation::{BOOL, FALSE},
+        Foundation::FALSE,
         NetworkManagement::WindowsFirewall::{
             INetFwPolicy2, INetFwRule, NET_FW_ACTION_ALLOW, NET_FW_PROFILE2_DOMAIN,
             NET_FW_PROFILE2_PRIVATE, NET_FW_PROFILE2_PUBLIC, NET_FW_RULE_DIR_IN,
             NET_FW_RULE_DIR_OUT,
         },
         Networking::WinSock::{
-            htonl, setsockopt, WSAGetLastError, WSAIoctl, IPPROTO_IP, IPPROTO_IPV6,
+            IP_UNICAST_IF, IPPROTO_IP, IPPROTO_IPV6, IPV6_UNICAST_IF, SIO_UDP_CONNRESET,
-            IPV6_UNICAST_IF, IP_UNICAST_IF, SIO_UDP_CONNRESET, SOCKET, SOCKET_ERROR,
+            SO_EXCLUSIVEADDRUSE, SOCKET, SOCKET_ERROR, SOL_SOCKET, WSAGetLastError, WSAIoctl,
+            htonl, setsockopt,
         },
         System::Com::{
-            CoCreateInstance, CoInitializeEx, CoUninitialize, CLSCTX_ALL, COINIT_MULTITHREADED,
+            CLSCTX_ALL, COINIT_MULTITHREADED, CoCreateInstance, CoInitializeEx, CoUninitialize,
         },
         System::Ole::{SafeArrayCreateVector, SafeArrayPutElement},
         System::Variant::{VARENUM, VARIANT, VT_ARRAY, VT_BSTR, VT_VARIANT},
     },
+    core::{BOOL, BSTR},
 };
 
 pub fn disable_connection_reset<S: AsRawSocket>(socket: &S) -> io::Result<()> {
@@ -88,13 +89,7 @@ pub fn find_interface_index(iface_name: &str) -> io::Result<u32> {
     ))
 }
 
-pub fn set_ip_unicast_if<S: AsRawSocket>(
+pub fn set_ip_unicast_if(socket: SOCKET, addr: &SocketAddr, iface: &str) -> io::Result<()> {
-    socket: &S,
-    addr: &SocketAddr,
-    iface: &str,
-) -> io::Result<()> {
-    let handle = SOCKET(socket.as_raw_socket() as usize);
-
     let if_index = find_interface_index(iface)?;
 
     unsafe {
@@ -103,12 +98,12 @@ pub fn set_ip_unicast_if<S: AsRawSocket>(
             SocketAddr::V4(..) => {
                 let if_index = htonl(if_index);
                 let if_index_bytes = if_index.to_ne_bytes();
-                setsockopt(handle, IPPROTO_IP.0, IP_UNICAST_IF, Some(&if_index_bytes))
+                setsockopt(socket, IPPROTO_IP.0, IP_UNICAST_IF, Some(&if_index_bytes))
             }
             SocketAddr::V6(..) => {
                 let if_index_bytes = if_index.to_ne_bytes();
                 setsockopt(
-                    handle,
+                    socket,
                     IPPROTO_IPV6.0,
                     IPV6_UNICAST_IF,
                     Some(&if_index_bytes),
@@ -141,8 +136,17 @@ pub fn setup_socket_for_win<S: AsRawSocket>(
         disable_connection_reset(socket)?;
     }
 
+    let socket = SOCKET(socket.as_raw_socket() as usize);
+
+    // let optval = 1_i32.to_ne_bytes();
+    // unsafe {
+    //     if setsockopt(socket, SOL_SOCKET, SO_EXCLUSIVEADDRUSE, Some(&optval)) == SOCKET_ERROR {
+    //         return Err(io::Error::last_os_error());
+    //     }
+    // }
+
     if let Some(iface) = bind_dev {
-        set_ip_unicast_if(socket, bind_addr, iface.as_str())?;
+        set_ip_unicast_if(socket, bind_addr, &iface)?;
     }
 
     Ok(())
@@ -152,7 +156,7 @@ struct ComInitializer;
 
 impl ComInitializer {
     fn new() -> windows::core::Result<Self> {
-        unsafe { CoInitializeEx(None, COINIT_MULTITHREADED)? };
+        unsafe { CoInitializeEx(None, COINIT_MULTITHREADED).ok()? };
         Ok(Self)
     }
 }
@@ -345,7 +349,7 @@ fn add_protocol_firewall_rules(
 
             SafeArrayPutElement(
                 interface_array,
-                &index as *const _ as *const i32,
+                &index as *const _,
                 &variant_interface as *const _ as *const std::ffi::c_void,
             )?;
 
@@ -354,7 +358,7 @@ fn add_protocol_firewall_rules(
             (*interface_variant.Anonymous.Anonymous).vt = VARENUM(VT_ARRAY.0 | VT_VARIANT.0);
             (*interface_variant.Anonymous.Anonymous).Anonymous.parray = interface_array;
 
-            rule.SetInterfaces(interface_variant)?;
+            rule.SetInterfaces(&interface_variant)?;
 
             // Get rule collection and add new rule
             let rules = policy.Rules()?;

easytier/src/common/acl_processor.rs

@@ -345,7 +345,7 @@ impl AclProcessor {
                     .collect::<Vec<_>>();
 
                 // Sort by priority (higher priority first)
-                rules.sort_by(|a, b| b.priority.cmp(&a.priority));
+                rules.sort_by_key(|r| std::cmp::Reverse(r.priority));
 
                 match chain.chain_type() {
                     ChainType::Inbound => inbound_rules.extend(rules),
@@ -507,7 +507,7 @@ impl AclProcessor {
                     matched_rule: Some(RuleId::Default),
                     should_log: false,
                     log_context: Some(AclLogContext::UnsupportedChainType),
-                }
+                };
             }
         };
 
@@ -679,28 +679,28 @@ impl AclProcessor {
         }
 
         // Source port check
-        if let Some(src_port) = packet_info.src_port {
+        if let Some(src_port) = packet_info.src_port
-            if !rule.src_port_ranges.is_empty() {
+            && !rule.src_port_ranges.is_empty()
-                let matches = rule
+        {
-                    .src_port_ranges
+            let matches = rule
-                    .iter()
+                .src_port_ranges
-                    .any(|(start, end)| src_port >= *start && src_port <= *end);
+                .iter()
-                if !matches {
+                .any(|(start, end)| src_port >= *start && src_port <= *end);
-                    return false;
+            if !matches {
-                }
+                return false;
             }
         }
 
         // Destination port check
-        if let Some(dst_port) = packet_info.dst_port {
+        if let Some(dst_port) = packet_info.dst_port
-            if !rule.dst_port_ranges.is_empty() {
+            && !rule.dst_port_ranges.is_empty()
-                let matches = rule
+        {
-                    .dst_port_ranges
+            let matches = rule
-                    .iter()
+                .dst_port_ranges
-                    .any(|(start, end)| dst_port >= *start && dst_port <= *end);
+                .iter()
-                if !matches {
+                .any(|(start, end)| dst_port >= *start && dst_port <= *end);
-                    return false;
+            if !matches {
-                }
+                return false;
             }
         }
 
@@ -1339,6 +1339,45 @@ mod tests {
         assert_eq!(result.matched_rule, Some(RuleId::Priority(70)));
     }
 
+    #[tokio::test]
+    async fn test_forward_acl_source_ip_whitelist() {
+        let mut acl_config = Acl::default();
+        let mut acl_v1 = AclV1::default();
+        let mut chain = Chain {
+            name: "subnet_proxy_protect".to_string(),
+            chain_type: ChainType::Forward as i32,
+            enabled: true,
+            default_action: Action::Drop as i32,
+            ..Default::default()
+        };
+
+        chain.rules.push(Rule {
+            name: "allow_my_devices".to_string(),
+            priority: 1000,
+            enabled: true,
+            action: Action::Allow as i32,
+            protocol: Protocol::Any as i32,
+            source_ips: vec!["10.172.192.2/32".to_string()],
+            ..Default::default()
+        });
+        acl_v1.chains.push(chain);
+        acl_config.acl_v1 = Some(acl_v1);
+
+        let processor = AclProcessor::new(acl_config);
+        let mut packet_info = create_test_packet_info();
+        packet_info.dst_ip = "192.168.1.10".parse().unwrap();
+
+        packet_info.src_ip = "10.172.192.2".parse().unwrap();
+        let result = processor.process_packet(&packet_info, ChainType::Forward);
+        assert_eq!(result.action, Action::Allow);
+        assert_eq!(result.matched_rule, Some(RuleId::Priority(1000)));
+
+        packet_info.src_ip = "10.172.192.3".parse().unwrap();
+        let result = processor.process_packet(&packet_info, ChainType::Forward);
+        assert_eq!(result.action, Action::Drop);
+        assert_eq!(result.matched_rule, Some(RuleId::Default));
+    }
+
     fn create_test_acl_config() -> Acl {
         let mut acl_config = Acl::default();
 

easytier/src/common/compressor.rs

@@ -1,4 +1,4 @@
-#[cfg(feature = "zstd")]
+#[cfg(any(feature = "zstd", feature = "lzo"))]
 use anyhow::Context;
 #[cfg(feature = "zstd")]
 use dashmap::DashMap;
@@ -9,7 +9,7 @@ use zstd::bulk;
 
 use zerocopy::{AsBytes as _, FromBytes as _};
 
-use crate::tunnel::packet_def::{CompressorAlgo, CompressorTail, ZCPacket, COMPRESSOR_TAIL_SIZE};
+use crate::tunnel::packet_def::{COMPRESSOR_TAIL_SIZE, CompressorAlgo, CompressorTail, ZCPacket};
 
 type Error = anyhow::Error;
 
@@ -53,6 +53,13 @@ impl DefaultCompressor {
                     )
                 })
             }),
+            #[cfg(feature = "lzo")]
+            CompressorAlgo::Lzo => lzokay_native::compress(data).with_context(|| {
+                format!(
+                    "Failed to compress data with algorithm: {:?}",
+                    compress_algo
+                )
+            }),
             CompressorAlgo::None => Ok(data.to_vec()),
         }
     }
@@ -85,6 +92,13 @@ impl DefaultCompressor {
                     compress_algo
                 ))
             }),
+            #[cfg(feature = "lzo")]
+            CompressorAlgo::Lzo => lzokay_native::decompress_all(data, None).with_context(|| {
+                format!(
+                    "Failed to decompress data with algorithm: {:?}",
+                    compress_algo
+                )
+            }),
             CompressorAlgo::None => Ok(data.to_vec()),
         }
     }
@@ -181,14 +195,13 @@ thread_local! {
     static DCTX_MAP: RefCell<DashMap<CompressorAlgo, bulk::Decompressor<'static>>> = RefCell::new(DashMap::new());
 }
 
-#[cfg(all(test, feature = "zstd"))]
+#[cfg(all(test, any(feature = "zstd", feature = "lzo")))]
 pub mod tests {
     use super::*;
 
-    #[tokio::test]
+    async fn test_compress_algo(compress_algo: CompressorAlgo) {
-    async fn test_compress() {
+        let text = vec![b'a'; 4096];
-        let text = b"12345670000000000000000000";
+        let mut packet = ZCPacket::new_with_payload(&text);
-        let mut packet = ZCPacket::new_with_payload(text);
         packet.fill_peer_manager_hdr(0, 0, 0);
 
         let compressor = DefaultCompressor {};
@@ -200,7 +213,7 @@ pub mod tests {
         );
 
         compressor
-            .compress(&mut packet, CompressorAlgo::ZstdDefault)
+            .compress(&mut packet, compress_algo)
             .await
             .unwrap();
         println!(
@@ -215,8 +228,7 @@ pub mod tests {
         assert!(!packet.peer_manager_header().unwrap().is_compressed());
     }
 
-    #[tokio::test]
+    async fn test_short_text_compress_algo(compress_algo: CompressorAlgo) {
-    async fn test_short_text_compress() {
         let text = b"1234";
         let mut packet = ZCPacket::new_with_payload(text);
         packet.fill_peer_manager_hdr(0, 0, 0);
@@ -225,7 +237,7 @@ pub mod tests {
 
         // short text can't be compressed
         compressor
-            .compress(&mut packet, CompressorAlgo::ZstdDefault)
+            .compress(&mut packet, compress_algo)
             .await
             .unwrap();
         assert!(!packet.peer_manager_header().unwrap().is_compressed());
@@ -234,4 +246,28 @@ pub mod tests {
         assert_eq!(packet.payload(), text);
         assert!(!packet.peer_manager_header().unwrap().is_compressed());
     }
+
+    #[cfg(feature = "zstd")]
+    #[tokio::test]
+    async fn test_zstd_compress() {
+        test_compress_algo(CompressorAlgo::ZstdDefault).await;
+    }
+
+    #[cfg(feature = "zstd")]
+    #[tokio::test]
+    async fn test_zstd_short_text_compress() {
+        test_short_text_compress_algo(CompressorAlgo::ZstdDefault).await;
+    }
+
+    #[cfg(feature = "lzo")]
+    #[tokio::test]
+    async fn test_lzo_compress() {
+        test_compress_algo(CompressorAlgo::Lzo).await;
+    }
+
+    #[cfg(feature = "lzo")]
+    #[tokio::test]
+    async fn test_lzo_short_text_compress() {
+        test_short_text_compress_algo(CompressorAlgo::Lzo).await;
+    }
 }

easytier/src/common/config.rs

@@ -6,10 +6,9 @@ use std::{
 };
 
 use anyhow::Context;
-use base64::{prelude::BASE64_STANDARD, Engine as _};
+use base64::{Engine as _, prelude::BASE64_STANDARD};
-use cfg_if::cfg_if;
-use clap::builder::PossibleValue;
 use clap::ValueEnum;
+use clap::builder::PossibleValue;
 use serde::{Deserialize, Serialize};
 use strum::{Display, EnumString, VariantArray};
 use tokio::io::AsyncReadExt as _;
@@ -19,9 +18,10 @@ use crate::{
     instance::dns_server::DEFAULT_ET_DNS_ZONE,
     proto::{
         acl::Acl,
+        api::manage::ConfigSource as RpcConfigSource,
         common::{CompressionAlgoPb, PortForwardConfigPb, SecureModeConfig, SocketType},
     },
-    tunnel::generate_digest_from_str,
+    tunnel::{IpScheme, TunnelScheme, generate_digest_from_str},
 };
 
 use super::env_parser;
@@ -69,9 +69,42 @@ pub fn gen_default_flags() -> Flags {
 
         quic_listen_port: u32::MAX,
         need_p2p: false,
+        instance_recv_bps_limit: u64::MAX,
+        disable_upnp: false,
+        disable_relay_data: false,
     }
 }
 
+fn mapped_listener_allows_implicit_port(url: &url::Url) -> bool {
+    TunnelScheme::try_from(url)
+        .ok()
+        .and_then(|scheme| IpScheme::try_from(scheme).ok())
+        .is_some()
+}
+
+pub fn validate_mapped_listener_url(url: &url::Url) -> Result<(), anyhow::Error> {
+    if url.port().is_none() && !mapped_listener_allows_implicit_port(url) {
+        anyhow::bail!("mapped listener port is missing: {}", url);
+    }
+
+    Ok(())
+}
+
+pub fn parse_mapped_listener_urls(
+    mapped_listeners: &[String],
+) -> Result<Vec<url::Url>, anyhow::Error> {
+    mapped_listeners
+        .iter()
+        .map(|s| {
+            let url: url::Url = s
+                .parse()
+                .with_context(|| format!("mapped listener is not a valid url: {}", s))?;
+            validate_mapped_listener_url(&url)?;
+            Ok(url)
+        })
+        .collect()
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Display, EnumString, VariantArray)]
 #[strum(ascii_case_insensitive)]
 pub enum EncryptionAlgorithm {
@@ -108,10 +141,9 @@ impl ValueEnum for EncryptionAlgorithm {
 #[allow(clippy::derivable_impls)]
 impl Default for EncryptionAlgorithm {
     fn default() -> Self {
-        cfg_if! {
+        cfg_select! {
-            if #[cfg(any(feature = "aes-gcm", feature = "wireguard", feature = "openssl-crypto"))] {
+            any(feature = "aes-gcm", feature = "wireguard", feature = "openssl-crypto") => EncryptionAlgorithm::AesGcm,
-                EncryptionAlgorithm::AesGcm
+            _ => {
-            } else {
                 crate::common::log::warn!("no AEAD encryption algorithm is available, using INSECURE XOR");
                 EncryptionAlgorithm::Xor
             }
@@ -139,6 +171,15 @@ pub trait ConfigLoader: Send + Sync {
     fn get_ipv6(&self) -> Option<cidr::Ipv6Inet>;
     fn set_ipv6(&self, addr: Option<cidr::Ipv6Inet>);
 
+    fn get_ipv6_public_addr_provider(&self) -> bool;
+    fn set_ipv6_public_addr_provider(&self, enabled: bool);
+
+    fn get_ipv6_public_addr_auto(&self) -> bool;
+    fn set_ipv6_public_addr_auto(&self, enabled: bool);
+
+    fn get_ipv6_public_addr_prefix(&self) -> Option<cidr::Ipv6Cidr>;
+    fn set_ipv6_public_addr_prefix(&self, prefix: Option<cidr::Ipv6Cidr>);
+
     fn get_dhcp(&self) -> bool;
     fn set_dhcp(&self, dhcp: bool);
 
@@ -206,6 +247,11 @@ pub trait ConfigLoader: Send + Sync {
     }
     fn set_credential_file(&self, _path: Option<std::path::PathBuf>) {}
 
+    fn get_network_config_source(&self) -> ConfigSource {
+        ConfigSource::User
+    }
+    fn set_network_config_source(&self, _source: Option<ConfigSource>) {}
+
     fn dump(&self) -> String;
 }
 
@@ -225,6 +271,55 @@ pub struct NetworkIdentity {
     pub network_secret_digest: Option<NetworkSecretDigest>,
 }
 
+#[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "snake_case")]
+pub enum ConfigSource {
+    #[default]
+    User,
+    Webhook,
+}
+
+impl ConfigSource {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::User => "user",
+            Self::Webhook => "webhook",
+        }
+    }
+
+    pub fn from_rpc(source: i32) -> Option<Self> {
+        match RpcConfigSource::try_from(source).ok() {
+            Some(RpcConfigSource::Webhook) => Some(Self::Webhook),
+            Some(RpcConfigSource::User) => Some(Self::User),
+            _ => None,
+        }
+    }
+
+    pub fn to_rpc(self) -> i32 {
+        match self {
+            Self::User => RpcConfigSource::User as i32,
+            Self::Webhook => RpcConfigSource::Webhook as i32,
+        }
+    }
+}
+
+impl std::str::FromStr for ConfigSource {
+    type Err = String;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            "user" => Ok(Self::User),
+            "webhook" => Ok(Self::Webhook),
+            other => Err(format!("unknown network config source: {other}")),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
+struct ConfigSourceConfig {
+    source: ConfigSource,
+}
+
 #[derive(Eq, PartialEq, Hash)]
 struct NetworkIdentityWithOnlyDigest {
     network_name: String,
@@ -434,6 +529,9 @@ struct Config {
     instance_id: Option<uuid::Uuid>,
     ipv4: Option<String>,
     ipv6: Option<String>,
+    ipv6_public_addr_provider: Option<bool>,
+    ipv6_public_addr_auto: Option<bool>,
+    ipv6_public_addr_prefix: Option<String>,
     dhcp: Option<bool>,
     network_identity: Option<NetworkIdentity>,
     listeners: Option<Vec<url::Url>>,
@@ -466,6 +564,7 @@ struct Config {
     stun_servers_v6: Option<Vec<String>>,
 
     credential_file: Option<PathBuf>,
+    source: Option<ConfigSourceConfig>,
 }
 
 #[derive(Debug, Clone)]
@@ -480,10 +579,21 @@ impl Default for TomlConfigLoader {
 }
 
 impl TomlConfigLoader {
+    fn normalize_config_source(config: &mut Config) {
+        if matches!(
+            config.source.as_ref().map(|source| source.source),
+            Some(ConfigSource::User)
+        ) {
+            config.source = None;
+        }
+    }
+
     pub fn new_from_str(config_str: &str) -> Result<Self, anyhow::Error> {
         let mut config = toml::de::from_str::<Config>(config_str)
             .with_context(|| format!("failed to parse config file: {}", config_str))?;
 
+        Self::normalize_config_source(&mut config);
+
         config.flags_struct = Some(Self::gen_flags(config.flags.clone().unwrap_or_default()));
 
         let config = TomlConfigLoader {
@@ -603,6 +713,43 @@ impl ConfigLoader for TomlConfigLoader {
         self.config.lock().unwrap().ipv6 = addr.map(|addr| addr.to_string());
     }
 
+    fn get_ipv6_public_addr_provider(&self) -> bool {
+        self.config
+            .lock()
+            .unwrap()
+            .ipv6_public_addr_provider
+            .unwrap_or_default()
+    }
+
+    fn set_ipv6_public_addr_provider(&self, enabled: bool) {
+        self.config.lock().unwrap().ipv6_public_addr_provider = Some(enabled);
+    }
+
+    fn get_ipv6_public_addr_auto(&self) -> bool {
+        self.config
+            .lock()
+            .unwrap()
+            .ipv6_public_addr_auto
+            .unwrap_or_default()
+    }
+
+    fn set_ipv6_public_addr_auto(&self, enabled: bool) {
+        self.config.lock().unwrap().ipv6_public_addr_auto = Some(enabled);
+    }
+
+    fn get_ipv6_public_addr_prefix(&self) -> Option<cidr::Ipv6Cidr> {
+        let locked_config = self.config.lock().unwrap();
+        locked_config
+            .ipv6_public_addr_prefix
+            .as_ref()
+            .and_then(|s| s.parse().ok())
+    }
+
+    fn set_ipv6_public_addr_prefix(&self, prefix: Option<cidr::Ipv6Cidr>) {
+        self.config.lock().unwrap().ipv6_public_addr_prefix =
+            prefix.map(|prefix| prefix.to_string());
+    }
+
     fn get_dhcp(&self) -> bool {
         self.config.lock().unwrap().dhcp.unwrap_or_default()
     }
@@ -620,14 +767,14 @@ impl ConfigLoader for TomlConfigLoader {
         if locked_config.proxy_network.is_none() {
             locked_config.proxy_network = Some(vec![]);
         }
-        if let Some(mapped_cidr) = mapped_cidr.as_ref() {
+        if let Some(mapped_cidr) = mapped_cidr.as_ref()
-            if cidr.network_length() != mapped_cidr.network_length() {
+            && cidr.network_length() != mapped_cidr.network_length()
-                return Err(anyhow::anyhow!(
+        {
-                    "Mapped CIDR must have the same network length as the original CIDR: {} != {}",
+            return Err(anyhow::anyhow!(
-                    cidr.network_length(),
+                "Mapped CIDR must have the same network length as the original CIDR: {} != {}",
-                    mapped_cidr.network_length()
+                cidr.network_length(),
-                ));
+                mapped_cidr.network_length()
-            }
+            ));
         }
         // insert if no duplicate
         if !locked_config
@@ -867,6 +1014,23 @@ impl ConfigLoader for TomlConfigLoader {
         self.config.lock().unwrap().credential_file = path;
     }
 
+    fn get_network_config_source(&self) -> ConfigSource {
+        self.config
+            .lock()
+            .unwrap()
+            .source
+            .as_ref()
+            .map(|source| source.source)
+            .unwrap_or(ConfigSource::User)
+    }
+
+    fn set_network_config_source(&self, source: Option<ConfigSource>) {
+        self.config.lock().unwrap().source = source.and_then(|source| match source {
+            ConfigSource::User => None,
+            other => Some(ConfigSourceConfig { source: other }),
+        });
+    }
+
     fn dump(&self) -> String {
         let default_flags_json = serde_json::to_string(&gen_default_flags()).unwrap();
         let default_flags_hashmap =
@@ -880,14 +1044,15 @@ impl ConfigLoader for TomlConfigLoader {
 
         let mut flag_map: serde_json::Map<String, serde_json::Value> = Default::default();
         for (key, value) in default_flags_hashmap {
-            if let Some(v) = cur_flags_hashmap.get(&key) {
+            if let Some(v) = cur_flags_hashmap.get(&key)
-                if *v != value {
+                && *v != value
-                    flag_map.insert(key, v.clone());
+            {
-                }
+                flag_map.insert(key, v.clone());
             }
         }
 
         let mut config = self.config.lock().unwrap().clone();
+        Self::normalize_config_source(&mut config);
         config.flags = Some(flag_map);
         if config.stun_servers == Some(StunInfoCollector::get_default_servers()) {
             config.stun_servers = None;
@@ -1088,6 +1253,7 @@ pub async fn load_config_from_file(
 #[cfg(test)]
 pub mod tests {
     use super::*;
+    use crate::tests::{remove_env_var, set_env_var};
     use std::io::Write;
     use std::path::PathBuf;
     use tempfile::NamedTempFile;
@@ -1125,6 +1291,162 @@ stun_servers = [
         assert_eq!(stun_servers[2], "txt:stun.easytier.cn");
     }
 
+    #[test]
+    fn test_network_config_source_toml_roundtrip() {
+        let config = TomlConfigLoader::default();
+        assert_eq!(config.get_network_config_source(), ConfigSource::User);
+
+        config.set_network_config_source(Some(ConfigSource::Webhook));
+        let dumped = config.dump();
+
+        assert!(dumped.contains("[source]"));
+        assert!(dumped.contains("source = \"webhook\""));
+
+        let loaded = TomlConfigLoader::new_from_str(&dumped).unwrap();
+        assert_eq!(loaded.get_network_config_source(), ConfigSource::Webhook);
+    }
+
+    #[test]
+    fn test_parse_mapped_listener_urls_allows_ws_without_port() {
+        let parsed = parse_mapped_listener_urls(&[
+            "ws://example.com".to_string(),
+            "wss://example.com/path".to_string(),
+        ])
+        .unwrap();
+
+        assert_eq!(parsed.len(), 2);
+        assert_eq!(parsed[0].scheme(), "ws");
+        assert_eq!(parsed[0].port(), None);
+        assert_eq!(parsed[1].scheme(), "wss");
+        assert_eq!(parsed[1].port(), None);
+    }
+
+    #[test]
+    fn test_parse_mapped_listener_urls_allows_tcp_without_port() {
+        let parsed = parse_mapped_listener_urls(&["tcp://127.0.0.1".to_string()]).unwrap();
+
+        assert_eq!(parsed.len(), 1);
+        assert_eq!(parsed[0].scheme(), "tcp");
+        assert_eq!(parsed[0].port(), None);
+    }
+
+    #[test]
+    fn test_parse_mapped_listener_urls_requires_port_for_non_ip_scheme() {
+        let err = parse_mapped_listener_urls(&["ring://peer-id".to_string()]).unwrap_err();
+
+        assert!(err.to_string().contains("mapped listener port is missing"));
+    }
+
+    #[test]
+    fn test_acl_toml_rule_uses_defaults_for_omitted_fields() {
+        use crate::proto::acl::{Action, ChainType, Protocol};
+
+        let config_str = r#"
+[[acl.acl_v1.chains]]
+name = "subnet_proxy_protect"
+chain_type = 3
+enabled = true
+default_action = 2
+
+[[acl.acl_v1.chains.rules]]
+name = "allow_my_devices"
+priority = 1000
+action = 1
+source_ips = ["10.172.192.2/32"]
+protocol = 5
+enabled = true
+"#;
+
+        let config = TomlConfigLoader::new_from_str(config_str).unwrap();
+        let acl = config.get_acl().unwrap();
+        let acl_v1 = acl.acl_v1.unwrap();
+        let chain = &acl_v1.chains[0];
+        let rule = &chain.rules[0];
+
+        assert_eq!(chain.chain_type, ChainType::Forward as i32);
+        assert_eq!(chain.default_action, Action::Drop as i32);
+        assert_eq!(rule.action, Action::Allow as i32);
+        assert_eq!(rule.protocol, Protocol::Any as i32);
+        assert_eq!(rule.source_ips, vec!["10.172.192.2/32"]);
+        assert!(rule.ports.is_empty());
+        assert!(rule.source_ports.is_empty());
+        assert!(rule.destination_ips.is_empty());
+        assert!(rule.source_groups.is_empty());
+        assert!(rule.destination_groups.is_empty());
+        assert_eq!(rule.rate_limit, 0);
+        assert_eq!(rule.burst_limit, 0);
+        assert!(!rule.stateful);
+    }
+
+    #[test]
+    fn test_acl_toml_group_can_omit_declares_or_members() {
+        let declares_only = r#"
+[acl.acl_v1.group]
+
+[[acl.acl_v1.group.declares]]
+group_name = "admin"
+group_secret = "admin-pw"
+"#;
+        let config = TomlConfigLoader::new_from_str(declares_only).unwrap();
+        let group = config.get_acl().unwrap().acl_v1.unwrap().group.unwrap();
+        assert_eq!(group.declares.len(), 1);
+        assert!(group.members.is_empty());
+
+        let members_only = r#"
+[acl.acl_v1.group]
+members = ["admin"]
+"#;
+        let config = TomlConfigLoader::new_from_str(members_only).unwrap();
+        let group = config.get_acl().unwrap().acl_v1.unwrap().group.unwrap();
+        assert!(group.declares.is_empty());
+        assert_eq!(group.members, vec!["admin"]);
+    }
+
+    #[test]
+    fn test_network_config_source_user_is_implicit() {
+        let config = TomlConfigLoader::default();
+        config.set_network_config_source(Some(ConfigSource::User));
+        let dumped = config.dump();
+
+        assert!(!dumped.contains("[source]"));
+
+        let loaded = TomlConfigLoader::new_from_str(&dumped).unwrap();
+        assert_eq!(loaded.get_network_config_source(), ConfigSource::User);
+
+        let explicit_user = TomlConfigLoader::new_from_str(
+            r#"
+[source]
+source = "user"
+"#,
+        )
+        .unwrap();
+        assert_eq!(
+            explicit_user.get_network_config_source(),
+            ConfigSource::User
+        );
+        assert!(!explicit_user.dump().contains("[source]"));
+    }
+
+    #[test]
+    fn test_ipv6_public_addr_config_roundtrip() {
+        let config = TomlConfigLoader::default();
+        let prefix: cidr::Ipv6Cidr = "2001:db8:100::/64".parse().unwrap();
+
+        config.set_ipv6_public_addr_provider(true);
+        config.set_ipv6_public_addr_auto(true);
+        config.set_ipv6_public_addr_prefix(Some(prefix));
+
+        assert!(config.get_ipv6_public_addr_provider());
+        assert!(config.get_ipv6_public_addr_auto());
+        assert_eq!(config.get_ipv6_public_addr_prefix(), Some(prefix));
+
+        let dumped = config.dump();
+        let loaded = TomlConfigLoader::new_from_str(&dumped).unwrap();
+        assert!(loaded.get_ipv6_public_addr_provider());
+        assert!(loaded.get_ipv6_public_addr_auto());
+        assert_eq!(loaded.get_ipv6_public_addr_prefix(), Some(prefix));
+    }
+
     #[tokio::test]
     async fn full_example_test() {
         let config_str = r#"
@@ -1211,8 +1533,8 @@ proto = "tcp"
     #[tokio::test]
     async fn test_env_var_expansion_and_readonly_flag() {
         // 设置测试环境变量
-        std::env::set_var("TEST_SECRET", "my-test-secret-123");
+        set_env_var("TEST_SECRET", "my-test-secret-123");
-        std::env::set_var("TEST_NETWORK", "test-network");
+        set_env_var("TEST_NETWORK", "test-network");
 
         // 创建临时配置文件，包含环境变量占位符
         let mut temp_file = NamedTempFile::new().unwrap();
@@ -1252,8 +1574,8 @@ network_secret = "${TEST_SECRET}"
         );
 
         // 清理环境变量
-        std::env::remove_var("TEST_SECRET");
+        remove_env_var("TEST_SECRET");
-        std::env::remove_var("TEST_NETWORK");
+        remove_env_var("TEST_NETWORK");
     }
 
     /// RPC API 安全测试（只读配置保护）
@@ -1266,7 +1588,7 @@ network_secret = "${TEST_SECRET}"
     /// `easytier/src/rpc_service/instance_manage.rs` 中实现
     #[tokio::test]
     async fn test_readonly_config_api_protection() {
-        std::env::set_var("API_TEST_SECRET", "secret-value");
+        set_env_var("API_TEST_SECRET", "secret-value");
 
         // 创建包含环境变量的配置
         let mut temp_file = NamedTempFile::new().unwrap();
@@ -1297,7 +1619,7 @@ network_secret = "${API_TEST_SECRET}"
             "Permission flag should be set correctly"
         );
 
-        std::env::remove_var("API_TEST_SECRET");
+        remove_env_var("API_TEST_SECRET");
     }
 
     /// CLI 参数测试（--disable-env-parsing 开关）
@@ -1307,7 +1629,7 @@ network_secret = "${API_TEST_SECRET}"
     /// - 配置不会被标记为只读
     #[tokio::test]
     async fn test_disable_env_parsing_flag() {
-        std::env::set_var("DISABLED_TEST_VAR", "should-not-expand");
+        set_env_var("DISABLED_TEST_VAR", "should-not-expand");
 
         // 创建包含环境变量占位符的配置
         let mut temp_file = NamedTempFile::new().unwrap();
@@ -1345,7 +1667,7 @@ network_secret = "${DISABLED_TEST_VAR}"
             "Config should be NO_DELETE due to no config_dir, not env vars"
         );
 
-        std::env::remove_var("DISABLED_TEST_VAR");
+        remove_env_var("DISABLED_TEST_VAR");
     }
 
     /// 多实例隔离测试
@@ -1356,8 +1678,8 @@ network_secret = "${DISABLED_TEST_VAR}"
     #[tokio::test]
     async fn test_multiple_instances_with_different_env_vars() {
         // 实例1：使用第一组环境变量
-        std::env::set_var("INSTANCE_SECRET", "instance1-secret");
+        set_env_var("INSTANCE_SECRET", "instance1-secret");
-        std::env::set_var("INSTANCE_NAME", "instance-one");
+        set_env_var("INSTANCE_NAME", "instance-one");
 
         let mut temp_file1 = NamedTempFile::new().unwrap();
         let config_content = r#"
@@ -1387,8 +1709,8 @@ network_secret = "${INSTANCE_SECRET}"
         );
 
         // 实例2：修改环境变量后加载同一模板
-        std::env::set_var("INSTANCE_SECRET", "instance2-secret");
+        set_env_var("INSTANCE_SECRET", "instance2-secret");
-        std::env::set_var("INSTANCE_NAME", "instance-two");
+        set_env_var("INSTANCE_NAME", "instance-two");
 
         let mut temp_file2 = NamedTempFile::new().unwrap();
         temp_file2.write_all(config_content.as_bytes()).unwrap();
@@ -1418,8 +1740,8 @@ network_secret = "${INSTANCE_SECRET}"
         );
 
         // 清理
-        std::env::remove_var("INSTANCE_SECRET");
+        remove_env_var("INSTANCE_SECRET");
-        std::env::remove_var("INSTANCE_NAME");
+        remove_env_var("INSTANCE_NAME");
     }
 
     /// 实际配置字段测试（network_secret、peer.uri 等）
@@ -1432,11 +1754,11 @@ network_secret = "${INSTANCE_SECRET}"
     #[tokio::test]
     async fn test_real_config_fields_expansion() {
         // 设置各种实际场景的环境变量
-        std::env::set_var("ET_SECRET", "production-secret-key");
+        set_env_var("ET_SECRET", "production-secret-key");
-        std::env::set_var("PEER_HOST", "peer.example.com");
+        set_env_var("PEER_HOST", "peer.example.com");
-        std::env::set_var("PEER_PORT", "11011");
+        set_env_var("PEER_PORT", "11011");
-        std::env::set_var("LISTEN_PORT", "11010");
+        set_env_var("LISTEN_PORT", "11010");
-        std::env::set_var("NETWORK_NAME", "prod-network");
+        set_env_var("NETWORK_NAME", "prod-network");
 
         // 创建包含多个实际字段的完整配置
         let mut temp_file = NamedTempFile::new().unwrap();
@@ -1484,11 +1806,11 @@ uri = "tcp://${PEER_HOST}:${PEER_PORT}"
         assert!(control.is_no_delete());
 
         // 清理环境变量
-        std::env::remove_var("ET_SECRET");
+        remove_env_var("ET_SECRET");
-        std::env::remove_var("PEER_HOST");
+        remove_env_var("PEER_HOST");
-        std::env::remove_var("PEER_PORT");
+        remove_env_var("PEER_PORT");
-        std::env::remove_var("LISTEN_PORT");
+        remove_env_var("LISTEN_PORT");
-        std::env::remove_var("NETWORK_NAME");
+        remove_env_var("NETWORK_NAME");
     }
 
     /// 带默认值的环境变量
@@ -1498,8 +1820,8 @@ uri = "tcp://${PEER_HOST}:${PEER_PORT}"
     #[tokio::test]
     async fn test_env_var_with_default_value() {
         // 确保变量未定义
-        std::env::remove_var("UNDEFINED_PORT");
+        remove_env_var("UNDEFINED_PORT");
-        std::env::remove_var("UNDEFINED_SECRET");
+        remove_env_var("UNDEFINED_SECRET");
 
         let mut temp_file = NamedTempFile::new().unwrap();
         let config_content = r#"
@@ -1540,7 +1862,7 @@ network_secret = "${UNDEFINED_SECRET:-default-secret}"
     /// - 未定义的环境变量保持原样（shellexpand 的默认行为）
     #[tokio::test]
     async fn test_undefined_env_var_without_default() {
-        std::env::remove_var("COMPLETELY_UNDEFINED");
+        remove_env_var("COMPLETELY_UNDEFINED");
 
         let mut temp_file = NamedTempFile::new().unwrap();
         let config_content = r#"
@@ -1570,6 +1892,8 @@ network_secret = "${COMPLETELY_UNDEFINED}"
 
         // 注意：由于没有实际替换发生，控制标记不应因环境变量而设置
         // 但会因为其他原因（如没有 config_dir）被标记为 NO_DELETE
+        // 这里我们主要验证 NO_DELETE 标记的逻辑
+        // 由于没有 config_dir，文件会被标记为 NO_DELETE，但不是因为环境变量
         assert!(control.is_no_delete());
     }
 
@@ -1581,9 +1905,9 @@ network_secret = "${COMPLETELY_UNDEFINED}"
     #[tokio::test]
     async fn test_boolean_type_env_vars() {
         // 设置布尔类型的环境变量
-        std::env::set_var("ENABLE_DHCP", "true");
+        set_env_var("ENABLE_DHCP", "true");
-        std::env::set_var("ENABLE_ENCRYPTION", "false");
+        set_env_var("ENABLE_ENCRYPTION", "false");
-        std::env::set_var("ENABLE_IPV6", "true");
+        set_env_var("ENABLE_IPV6", "true");
 
         let mut temp_file = NamedTempFile::new().unwrap();
         let config_content = r#"
@@ -1621,9 +1945,9 @@ enable_ipv6 = ${ENABLE_IPV6}
         assert!(control.is_no_delete());
 
         // 清理
-        std::env::remove_var("ENABLE_DHCP");
+        remove_env_var("ENABLE_DHCP");
-        std::env::remove_var("ENABLE_ENCRYPTION");
+        remove_env_var("ENABLE_ENCRYPTION");
-        std::env::remove_var("ENABLE_IPV6");
+        remove_env_var("ENABLE_IPV6");
     }
 
     /// 数字类型环境变量
@@ -1634,8 +1958,8 @@ enable_ipv6 = ${ENABLE_IPV6}
     #[tokio::test]
     async fn test_numeric_type_env_vars() {
         // 设置数字类型的环境变量
-        std::env::set_var("MTU_VALUE", "1400");
+        set_env_var("MTU_VALUE", "1400");
-        std::env::set_var("THREAD_COUNT", "4");
+        set_env_var("THREAD_COUNT", "4");
 
         let mut temp_file = NamedTempFile::new().unwrap();
         let config_content = r#"
@@ -1670,8 +1994,8 @@ multi_thread_count = ${THREAD_COUNT}
         assert!(control.is_no_delete());
 
         // 清理
-        std::env::remove_var("MTU_VALUE");
+        remove_env_var("MTU_VALUE");
-        std::env::remove_var("THREAD_COUNT");
+        remove_env_var("THREAD_COUNT");
     }
 
     /// 混合类型环境变量
@@ -1683,12 +2007,12 @@ multi_thread_count = ${THREAD_COUNT}
     #[tokio::test]
     async fn test_mixed_type_env_vars() {
         // 设置不同类型的环境变量
-        std::env::set_var("MIXED_SECRET", "mixed-secret-key");
+        set_env_var("MIXED_SECRET", "mixed-secret-key");
-        std::env::set_var("MIXED_NETWORK", "production");
+        set_env_var("MIXED_NETWORK", "production");
-        std::env::set_var("MIXED_DHCP", "true");
+        set_env_var("MIXED_DHCP", "true");
-        std::env::set_var("MIXED_MTU", "1500");
+        set_env_var("MIXED_MTU", "1500");
-        std::env::set_var("MIXED_ENCRYPTION", "false");
+        set_env_var("MIXED_ENCRYPTION", "false");
-        std::env::set_var("MIXED_LISTEN_PORT", "12345");
+        set_env_var("MIXED_LISTEN_PORT", "12345");
 
         let mut temp_file = NamedTempFile::new().unwrap();
         let config_content = r#"
@@ -1740,11 +2064,11 @@ enable_encryption = ${MIXED_ENCRYPTION}
         assert!(control.is_no_delete());
 
         // 清理
-        std::env::remove_var("MIXED_SECRET");
+        remove_env_var("MIXED_SECRET");
-        std::env::remove_var("MIXED_NETWORK");
+        remove_env_var("MIXED_NETWORK");
-        std::env::remove_var("MIXED_DHCP");
+        remove_env_var("MIXED_DHCP");
-        std::env::remove_var("MIXED_MTU");
+        remove_env_var("MIXED_MTU");
-        std::env::remove_var("MIXED_ENCRYPTION");
+        remove_env_var("MIXED_ENCRYPTION");
-        std::env::remove_var("MIXED_LISTEN_PORT");
+        remove_env_var("MIXED_LISTEN_PORT");
     }
 }

easytier/src/common/defer.rs

@@ -1,26 +0,0 @@
-#[doc(hidden)]
-pub struct Defer<F: FnOnce()> {
-    // internal struct used by defer! macro
-    func: Option<F>,
-}
-
-impl<F: FnOnce()> Defer<F> {
-    pub fn new(func: F) -> Self {
-        Self { func: Some(func) }
-    }
-}
-
-impl<F: FnOnce()> Drop for Defer<F> {
-    fn drop(&mut self) {
-        if let Some(f) = self.func.take() {
-            f()
-        }
-    }
-}
-
-#[macro_export]
-macro_rules! defer {
-	( $($tt:tt)* ) => {
-		let _deferred = $crate::common::defer::Defer::new(|| { $($tt)* });
-	};
-}

easytier/src/common/dns.rs

@@ -1,6 +1,6 @@
 use std::net::SocketAddr;
-use std::sync::atomic::AtomicBool;
 use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
 
 use anyhow::Context;
 use hickory_proto::runtime::TokioRuntimeProvider;
@@ -73,16 +73,6 @@ pub async fn socket_addrs(
         .port()
         .or_else(default_port_number)
         .ok_or(Error::InvalidUrl(url.to_string()))?;
-    // See https://github.com/EasyTier/EasyTier/pull/947
-    // here is for compatibility with old version
-    let port = match port {
-        0 => match url.scheme() {
-            "ws" => 80,
-            "wss" => 443,
-            _ => port,
-        },
-        _ => port,
-    };
 
     // if host is an ip address, return it directly
     match host {
@@ -121,9 +111,8 @@ pub async fn socket_addrs(
 
 #[cfg(test)]
 mod tests {
-    use crate::defer;
-
     use super::*;
+    use guarden::defer;
 
     #[tokio::test]
     async fn test_socket_addrs() {
@@ -140,4 +129,23 @@ mod tests {
         assert_eq!(2, addrs.len(), "addrs: {:?}", addrs);
         println!("addrs2: {:?}", addrs);
     }
+
+    #[tokio::test]
+    async fn socket_addrs_preserves_explicit_zero_port() {
+        let cases = [
+            ("ws://127.0.0.1:0", 80, 0),
+            ("wss://127.0.0.1:0", 443, 0),
+            ("ws://127.0.0.1", 80, 80),
+            ("wss://127.0.0.1", 443, 443),
+        ];
+
+        for (raw_url, default_port, expected_port) in cases {
+            let url = url::Url::parse(raw_url).unwrap();
+            let addrs = socket_addrs(&url, || Some(default_port)).await.unwrap();
+            assert_eq!(
+                addrs,
+                vec![SocketAddr::from(([127, 0, 0, 1], expected_port))]
+            );
+        }
+    }
 }

easytier/src/common/env_parser.rs

@@ -42,10 +42,11 @@ pub fn expand_env_vars(text: &str) -> (String, bool) {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::tests::{remove_env_var, set_env_var};
 
     #[test]
     fn test_expand_standard_syntax() {
-        std::env::set_var("TEST_VAR_STANDARD", "test_value");
+        set_env_var("TEST_VAR_STANDARD", "test_value");
         let (result, changed) = expand_env_vars("secret=${TEST_VAR_STANDARD}");
         assert_eq!(result, "secret=test_value");
         assert!(changed);
@@ -53,7 +54,7 @@ mod tests {
 
     #[test]
     fn test_expand_short_syntax() {
-        std::env::set_var("TEST_VAR_SHORT", "short_value");
+        set_env_var("TEST_VAR_SHORT", "short_value");
         let (result, changed) = expand_env_vars("key=$TEST_VAR_SHORT");
         assert_eq!(result, "key=short_value");
         assert!(changed);
@@ -62,7 +63,7 @@ mod tests {
     #[test]
     fn test_expand_with_default() {
         // 确保变量未定义
-        std::env::remove_var("UNDEFINED_VAR_WITH_DEFAULT");
+        remove_env_var("UNDEFINED_VAR_WITH_DEFAULT");
         let (result, changed) = expand_env_vars("port=${UNDEFINED_VAR_WITH_DEFAULT:-8080}");
         assert_eq!(result, "port=8080");
         assert!(changed);
@@ -84,8 +85,8 @@ mod tests {
 
     #[test]
     fn test_multiple_vars() {
-        std::env::set_var("VAR1", "value1");
+        set_env_var("VAR1", "value1");
-        std::env::set_var("VAR2", "value2");
+        set_env_var("VAR2", "value2");
         let (result, changed) = expand_env_vars("${VAR1} and ${VAR2}");
         assert_eq!(result, "value1 and value2");
         assert!(changed);
@@ -94,7 +95,7 @@ mod tests {
     #[test]
     fn test_undefined_var_without_default() {
         // 确保变量未定义
-        std::env::remove_var("COMPLETELY_UNDEFINED_VAR");
+        remove_env_var("COMPLETELY_UNDEFINED_VAR");
         let (result, changed) = expand_env_vars("value=${COMPLETELY_UNDEFINED_VAR}");
         // shellexpand::env 对未定义的变量会保持原样
         assert_eq!(result, "value=${COMPLETELY_UNDEFINED_VAR}");
@@ -103,8 +104,8 @@ mod tests {
 
     #[test]
     fn test_complex_toml_config() {
-        std::env::set_var("ET_SECRET", "my-secret-key");
+        set_env_var("ET_SECRET", "my-secret-key");
-        std::env::set_var("ET_PORT", "11010");
+        set_env_var("ET_PORT", "11010");
 
         let config = r#"
 [network_identity]
@@ -123,7 +124,7 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_escape_syntax_double_dollar() {
-        std::env::set_var("ESCAPED_VAR", "should_not_expand");
+        set_env_var("ESCAPED_VAR", "should_not_expand");
         // shellexpand 使用 $$ 作为转义序列，表示字面量的单个 $
         // $$ 会被转义为单个 $，不会触发变量扩展
         let (result, changed) = expand_env_vars("value=$${ESCAPED_VAR}");
@@ -133,7 +134,7 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_escape_syntax_backslash() {
-        std::env::set_var("ESCAPED_VAR", "should_not_expand");
+        set_env_var("ESCAPED_VAR", "should_not_expand");
         // shellexpand 中反斜杠转义的行为：\$ 会展开为 \<变量值>
         // 这不是推荐的转义方式，此测试仅为记录实际行为
         let (result, changed) = expand_env_vars(r"value=\${ESCAPED_VAR}");
@@ -143,7 +144,7 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_multiple_dollar_signs() {
-        std::env::set_var("TEST_VAR", "value");
+        set_env_var("TEST_VAR", "value");
         // 测试多个连续的 $ 符号
         let (result1, changed1) = expand_env_vars("$$");
         assert_eq!(result1, "$");
@@ -161,7 +162,7 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_empty_var_value() {
-        std::env::set_var("EMPTY_VAR", "");
+        set_env_var("EMPTY_VAR", "");
         let (result, changed) = expand_env_vars("value=${EMPTY_VAR}");
         // 变量存在但值为空
         assert_eq!(result, "value=");
@@ -170,7 +171,7 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_default_with_special_chars() {
-        std::env::remove_var("UNDEFINED_SPECIAL");
+        remove_env_var("UNDEFINED_SPECIAL");
         // 测试默认值包含冒号、等号、空格等特殊字符
         let (result, changed) = expand_env_vars("url=${UNDEFINED_SPECIAL:-http://localhost:8080}");
         assert_eq!(result, "url=http://localhost:8080");
@@ -187,9 +188,9 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_var_name_with_numbers_underscores() {
-        std::env::set_var("VAR_123", "num_value");
+        set_env_var("VAR_123", "num_value");
-        std::env::set_var("_VAR", "underscore_prefix");
+        set_env_var("_VAR", "underscore_prefix");
-        std::env::set_var("VAR_", "underscore_suffix");
+        set_env_var("VAR_", "underscore_suffix");
 
         let (result1, changed1) = expand_env_vars("${VAR_123}");
         assert_eq!(result1, "num_value");
@@ -214,7 +215,7 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
         // 注意：未闭合的 ${VAR 实际上 shellexpand 会当作普通文本处理
         // 它会尝试查找名为 "VAR" 的环境变量（到字符串末尾）
-        std::env::remove_var("VAR");
+        remove_env_var("VAR");
         let (result2, _changed2) = expand_env_vars("incomplete ${VAR");
         // 如果 VAR 未定义，shellexpand 会返回错误或保持原样
         assert_eq!(result2, "incomplete ${VAR");
@@ -224,8 +225,8 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_mixed_defined_undefined_vars() {
-        std::env::set_var("DEFINED_VAR", "defined");
+        set_env_var("DEFINED_VAR", "defined");
-        std::env::remove_var("UNDEFINED_VAR");
+        remove_env_var("UNDEFINED_VAR");
 
         // 混合已定义和未定义的变量
         // shellexpand::env 在遇到未定义变量时会返回错误（默认行为）
@@ -237,7 +238,7 @@ uri = "tcp://127.0.0.1:${ET_PORT}"
 
     #[test]
     fn test_nested_braces() {
-        std::env::set_var("OUTER", "outer_value");
+        set_env_var("OUTER", "outer_value");
         // 嵌套的大括号是无效语法，shellexpand::env 会返回错误
         let (result, changed) = expand_env_vars("${OUTER} and ${{INNER}}");
         // 由于语法错误，整个字符串保持不变

easytier/src/common/global_ctx.rs

@@ -1,8 +1,7 @@
-use std::collections::hash_map::DefaultHasher;
-use std::collections::HashMap;
-use std::net::{IpAddr, SocketAddr};
 use std::{
+    collections::{BTreeSet, HashMap, hash_map::DefaultHasher},
     hash::Hasher,
+    net::{IpAddr, SocketAddr},
     sync::{Arc, Mutex},
     time::{SystemTime, UNIX_EPOCH},
 };
@@ -10,28 +9,32 @@ use std::{
 use arc_swap::ArcSwap;
 use dashmap::DashMap;
 
-use crate::common::config::ProxyNetworkConfig;
-use crate::common::shrink_dashmap;
-use crate::common::stats_manager::StatsManager;
-use crate::common::token_bucket::TokenBucketManager;
-use crate::peers::acl_filter::AclFilter;
-use crate::peers::credential_manager::CredentialManager;
-use crate::proto::acl::GroupIdentity;
-use crate::proto::api::config::InstanceConfigPatch;
-use crate::proto::api::instance::PeerConnInfo;
-use crate::proto::common::{PeerFeatureFlag, PortForwardConfigPb};
-use crate::proto::peer_rpc::PeerGroupInfo;
-use crossbeam::atomic::AtomicCell;
-use hmac::{Hmac, Mac};
-use sha2::Sha256;
-
 use super::{
+    PeerId,
     config::{ConfigLoader, Flags},
     netns::NetNS,
     network::IPCollector,
     stun::{StunInfoCollector, StunInfoCollectorTrait},
-    PeerId,
 };
+use crate::{
+    common::{
+        config::ProxyNetworkConfig, shrink_dashmap, stats_manager::StatsManager,
+        token_bucket::TokenBucketManager,
+    },
+    peers::{acl_filter::AclFilter, credential_manager::CredentialManager},
+    proto::{
+        acl::GroupIdentity,
+        api::{config::InstanceConfigPatch, instance::PeerConnInfo},
+        common::{PeerFeatureFlag, PortForwardConfigPb},
+        peer_rpc::PeerGroupInfo,
+    },
+    rpc_service::protected_port,
+    tunnel::matches_protocol,
+};
+use crossbeam::atomic::AtomicCell;
+use hmac::{Hmac, Mac};
+use sha2::Sha256;
+use socket2::Protocol;
 
 pub type NetworkIdentity = crate::common::config::NetworkIdentity;
 
@@ -50,6 +53,11 @@ pub enum GlobalCtxEvent {
     ListenerAcceptFailed(url::Url, String), // (url, error message)
     ConnectionAccepted(String, String),  // (local url, remote url)
     ConnectionError(String, String, String), // (local url, remote url, error message)
+    ListenerPortMappingEstablished {
+        local_listener: url::Url,
+        mapped_listener: url::Url,
+        backend: String,
+    },
 
     Connecting(url::Url),
     ConnectError(String, String, String), // (dst, ip version, error message)
@@ -60,6 +68,8 @@ pub enum GlobalCtxEvent {
 
     DhcpIpv4Changed(Option<cidr::Ipv4Inet>, Option<cidr::Ipv4Inet>), // (old, new)
     DhcpIpv4Conflicted(Option<cidr::Ipv4Inet>),
+    PublicIpv6Changed(Option<cidr::Ipv6Inet>, Option<cidr::Ipv6Inet>), // (old, new)
+    PublicIpv6RoutesUpdated(Vec<cidr::Ipv6Inet>, Vec<cidr::Ipv6Inet>), // (added, removed)
 
     PortForwardAdded(PortForwardConfigPb),
 
@@ -192,6 +202,8 @@ pub struct GlobalCtx {
 
     cached_ipv4: AtomicCell<Option<cidr::Ipv4Inet>>,
     cached_ipv6: AtomicCell<Option<cidr::Ipv6Inet>>,
+    public_ipv6_lease: AtomicCell<Option<cidr::Ipv6Inet>>,
+    public_ipv6_routes: Mutex<BTreeSet<std::net::Ipv6Addr>>,
     cached_proxy_cidrs: AtomicCell<Option<Vec<ProxyNetworkConfig>>>,
 
     ip_collector: Mutex<Option<Arc<IPCollector>>>,
@@ -201,9 +213,16 @@ pub struct GlobalCtx {
     stun_info_collection: Mutex<Arc<dyn StunInfoCollectorTrait>>,
 
     running_listeners: Mutex<Vec<url::Url>>,
+    advertised_ipv6_public_addr_prefix: Mutex<Option<cidr::Ipv6Cidr>>,
 
     flags: ArcSwap<Flags>,
 
+    // Runtime/base advertised feature flags before config-owned fields are
+    // overlaid by set_flags. Keep this separate so config patches do not erase
+    // runtime state such as public-server role, IPv6 provider status, or the
+    // non-whitelist avoid-relay preference.
+    base_feature_flags: AtomicCell<PeerFeatureFlag>,
+
     feature_flags: AtomicCell<PeerFeatureFlag>,
 
     token_bucket_manager: TokenBucketManager,
@@ -234,15 +253,25 @@ impl std::fmt::Debug for GlobalCtx {
 pub type ArcGlobalCtx = std::sync::Arc<GlobalCtx>;
 
 impl GlobalCtx {
-    fn derive_feature_flags(flags: &Flags, current: Option<PeerFeatureFlag>) -> PeerFeatureFlag {
+    fn apply_disable_relay_data_flag(
-        let mut feature_flags = current.unwrap_or_default();
+        flags: &Flags,
+        mut feature_flags: PeerFeatureFlag,
+    ) -> PeerFeatureFlag {
+        if flags.disable_relay_data {
+            feature_flags.avoid_relay_data = true;
+        }
+        feature_flags
+    }
+
+    fn derive_feature_flags(flags: &Flags, mut feature_flags: PeerFeatureFlag) -> PeerFeatureFlag {
         feature_flags.kcp_input = !flags.disable_kcp_input;
         feature_flags.no_relay_kcp = flags.disable_relay_kcp;
         feature_flags.support_conn_list_sync = true;
         feature_flags.quic_input = !flags.disable_quic_input;
         feature_flags.no_relay_quic = flags.disable_relay_quic;
         feature_flags.need_p2p = flags.need_p2p;
-        feature_flags
+        feature_flags.disable_p2p = flags.disable_p2p;
+        Self::apply_disable_relay_data_flag(flags, feature_flags)
     }
 
     pub fn new(config_fs: impl ConfigLoader + 'static) -> Self {
@@ -271,7 +300,8 @@ impl GlobalCtx {
 
         let flags = config_fs.get_flags();
 
-        let feature_flags = Self::derive_feature_flags(&flags, None);
+        let base_feature_flags = PeerFeatureFlag::default();
+        let feature_flags = Self::derive_feature_flags(&flags, base_feature_flags);
 
         let credential_storage_path = config_fs.get_credential_file();
         let credential_manager = Arc::new(CredentialManager::new(credential_storage_path));
@@ -286,6 +316,8 @@ impl GlobalCtx {
             event_bus,
             cached_ipv4: AtomicCell::new(None),
             cached_ipv6: AtomicCell::new(None),
+            public_ipv6_lease: AtomicCell::new(None),
+            public_ipv6_routes: Mutex::new(BTreeSet::new()),
             cached_proxy_cidrs: AtomicCell::new(None),
 
             ip_collector: Mutex::new(Some(Arc::new(IPCollector::new(
@@ -298,9 +330,12 @@ impl GlobalCtx {
             stun_info_collection: Mutex::new(stun_info_collector),
 
             running_listeners: Mutex::new(Vec::new()),
+            advertised_ipv6_public_addr_prefix: Mutex::new(None),
 
             flags: ArcSwap::new(Arc::new(flags)),
 
+            base_feature_flags: AtomicCell::new(base_feature_flags),
+
             feature_flags: AtomicCell::new(feature_flags),
 
             token_bucket_manager: TokenBucketManager::new(),
@@ -372,6 +407,45 @@ impl GlobalCtx {
         self.cached_ipv6.store(None);
     }
 
+    pub fn get_public_ipv6_lease(&self) -> Option<cidr::Ipv6Inet> {
+        self.public_ipv6_lease.load()
+    }
+
+    pub fn set_public_ipv6_lease(&self, addr: Option<cidr::Ipv6Inet>) {
+        self.public_ipv6_lease.store(addr);
+    }
+
+    pub fn set_public_ipv6_routes(&self, routes: BTreeSet<cidr::Ipv6Inet>) {
+        *self.public_ipv6_routes.lock().unwrap() =
+            routes.into_iter().map(|route| route.address()).collect();
+    }
+
+    pub fn is_ip_local_ipv6(&self, ip: &std::net::Ipv6Addr) -> bool {
+        self.get_ipv6().map(|x| x.address() == *ip).unwrap_or(false)
+            || self
+                .get_public_ipv6_lease()
+                .map(|x| x.address() == *ip)
+                .unwrap_or(false)
+    }
+
+    pub fn is_ip_easytier_managed_ipv6(&self, ip: &std::net::Ipv6Addr) -> bool {
+        self.is_ip_local_ipv6(ip) || self.public_ipv6_routes.lock().unwrap().contains(ip)
+    }
+
+    pub fn get_advertised_ipv6_public_addr_prefix(&self) -> Option<cidr::Ipv6Cidr> {
+        *self.advertised_ipv6_public_addr_prefix.lock().unwrap()
+    }
+
+    pub fn set_advertised_ipv6_public_addr_prefix(&self, prefix: Option<cidr::Ipv6Cidr>) -> bool {
+        let mut guard = self.advertised_ipv6_public_addr_prefix.lock().unwrap();
+        if *guard == prefix {
+            return false;
+        }
+
+        *guard = prefix;
+        true
+    }
+
     pub fn get_id(&self) -> uuid::Uuid {
         self.config.get_id()
     }
@@ -386,7 +460,7 @@ impl GlobalCtx {
     pub fn is_ip_local_virtual_ip(&self, ip: &IpAddr) -> bool {
         match ip {
             IpAddr::V4(v4) => self.get_ipv4().map(|x| x.address() == *v4).unwrap_or(false),
-            IpAddr::V6(v6) => self.get_ipv6().map(|x| x.address() == *v6).unwrap_or(false),
+            IpAddr::V6(v6) => self.is_ip_local_ipv6(v6),
         }
     }
 
@@ -457,7 +531,7 @@ impl GlobalCtx {
         self.config.set_flags(flags.clone());
         self.feature_flags.store(Self::derive_feature_flags(
             &flags,
-            Some(self.feature_flags.load()),
+            self.base_feature_flags.load(),
         ));
         self.flags.store(Arc::new(flags));
     }
@@ -522,8 +596,53 @@ impl GlobalCtx {
         self.feature_flags.load()
     }
 
-    pub fn set_feature_flags(&self, flags: PeerFeatureFlag) {
+    /// Replace the runtime/base advertised flags as a complete snapshot.
-        self.feature_flags.store(flags);
+    ///
+    /// This is intended for foreign scoped contexts that inherit an already
+    /// computed feature-flag snapshot from their parent. Most callers should use
+    /// a narrower setter so they do not accidentally overwrite unrelated runtime
+    /// state.
+    pub fn set_base_advertised_feature_flags(&self, feature_flags: PeerFeatureFlag) {
+        self.base_feature_flags.store(feature_flags);
+        let flags = self.flags.load();
+        self.feature_flags
+            .store(Self::apply_disable_relay_data_flag(
+                flags.as_ref(),
+                feature_flags,
+            ));
+    }
+
+    /// Set the avoid-relay preference that is independent of disable_relay_data.
+    ///
+    /// disable_relay_data still forces the effective advertised flag to true,
+    /// but this base preference is preserved when that config flag is toggled.
+    pub fn set_avoid_relay_data_preference(&self, avoid_relay_data: bool) -> bool {
+        let mut base_feature_flags = self.base_feature_flags.load();
+        base_feature_flags.avoid_relay_data = avoid_relay_data;
+        self.base_feature_flags.store(base_feature_flags);
+
+        let mut feature_flags = self.feature_flags.load();
+        let previous = feature_flags.avoid_relay_data;
+        feature_flags.avoid_relay_data = avoid_relay_data || self.flags.load().disable_relay_data;
+        self.feature_flags.store(feature_flags);
+        previous != feature_flags.avoid_relay_data
+    }
+
+    /// Set the runtime IPv6-provider advertised bit without touching
+    /// config-derived feature flags.
+    pub fn set_ipv6_public_addr_provider_feature_flag(&self, enabled: bool) -> bool {
+        let mut base_feature_flags = self.base_feature_flags.load();
+        base_feature_flags.ipv6_public_addr_provider = enabled;
+        self.base_feature_flags.store(base_feature_flags);
+
+        let mut feature_flags = self.feature_flags.load();
+        if feature_flags.ipv6_public_addr_provider == enabled {
+            return false;
+        }
+
+        feature_flags.ipv6_public_addr_provider = enabled;
+        self.feature_flags.store(feature_flags);
+        true
     }
 
     pub fn token_bucket_manager(&self) -> &TokenBucketManager {
@@ -625,40 +744,37 @@ impl GlobalCtx {
     }
 
     fn is_port_in_running_listeners(&self, port: u16, is_udp: bool) -> bool {
-        let check_proto = |listener_proto: &str| {
-            let listener_is_udp = matches!(listener_proto, "udp" | "wg");
-            listener_is_udp == is_udp
-        };
         self.running_listeners
             .lock()
             .unwrap()
             .iter()
-            .any(|x| x.port() == Some(port) && check_proto(x.scheme()))
+            .any(|x| x.port() == Some(port) && matches_protocol!(x, Protocol::UDP) == is_udp)
     }
 
     #[tracing::instrument(ret, skip(self))]
     pub fn should_deny_proxy(&self, dst_addr: &SocketAddr, is_udp: bool) -> bool {
         let _g = self.net_ns.guard();
         let ip = dst_addr.ip();
-        // first check if ip is virtual ip
+        // first check if ip is an EasyTier-managed local address
         // then try bind this ip, if succ means it is local ip
-        let dst_is_local_virtual_ip = self.is_ip_local_virtual_ip(&ip);
+        let dst_is_local_et_ip = self.is_ip_local_virtual_ip(&ip);
         // this is an expensive operation, should be called sparingly
         // 1. tcp/kcp/quic call this only after proxy conn is established
         // 2. udp cache the result in nat entry
         let dst_is_local_phy_ip = std::net::UdpSocket::bind(format!("{}:0", ip)).is_ok();
 
         tracing::trace!(
-            "check should_deny_proxy: dst_addr={}, dst_is_local_virtual_ip={}, dst_is_local_phy_ip={}, is_udp={}",
+            "check should_deny_proxy: dst_addr={}, dst_is_local_et_ip={}, dst_is_local_phy_ip={}, is_udp={}",
             dst_addr,
-            dst_is_local_virtual_ip,
+            dst_is_local_et_ip,
             dst_is_local_phy_ip,
             is_udp
         );
 
-        if dst_is_local_virtual_ip || dst_is_local_phy_ip {
+        if dst_is_local_et_ip || dst_is_local_phy_ip {
             // if is local ip, make sure the port is not one of the listening ports
             self.is_port_in_running_listeners(dst_addr.port(), is_udp)
+                || (!is_udp && protected_port::is_protected_tcp_port(dst_addr.port()))
         } else {
             false
         }
@@ -743,14 +859,15 @@ pub mod tests {
         let mut feature_flags = global_ctx.get_feature_flags();
         feature_flags.avoid_relay_data = true;
         feature_flags.is_public_server = true;
-        global_ctx.set_feature_flags(feature_flags);
+        global_ctx.set_base_advertised_feature_flags(feature_flags);
 
-        let mut flags = global_ctx.get_flags();
+        let mut flags = global_ctx.get_flags().clone();
         flags.disable_kcp_input = true;
         flags.disable_relay_kcp = true;
         flags.disable_quic_input = true;
         flags.disable_relay_quic = true;
         flags.need_p2p = true;
+        flags.disable_p2p = true;
         global_ctx.set_flags(flags);
 
         let feature_flags = global_ctx.get_feature_flags();
@@ -759,9 +876,139 @@ pub mod tests {
         assert!(!feature_flags.quic_input);
         assert!(feature_flags.no_relay_quic);
         assert!(feature_flags.need_p2p);
+        assert!(feature_flags.disable_p2p);
         assert!(feature_flags.support_conn_list_sync);
         assert!(feature_flags.avoid_relay_data);
         assert!(feature_flags.is_public_server);
+        assert!(!feature_flags.ipv6_public_addr_provider);
+    }
+
+    #[tokio::test]
+    async fn set_base_advertised_feature_flags_applies_current_values() {
+        let config = TomlConfigLoader::default();
+        let global_ctx = GlobalCtx::new(config);
+
+        let feature_flags = PeerFeatureFlag {
+            kcp_input: false,
+            no_relay_kcp: true,
+            quic_input: false,
+            no_relay_quic: true,
+            is_public_server: true,
+            ..Default::default()
+        };
+        global_ctx.set_base_advertised_feature_flags(feature_flags);
+
+        assert_eq!(global_ctx.get_feature_flags(), feature_flags);
+    }
+
+    #[tokio::test]
+    async fn set_base_advertised_feature_flags_keeps_disable_relay_data_effective() {
+        let config = TomlConfigLoader::default();
+        let global_ctx = GlobalCtx::new(config);
+
+        let mut flags = global_ctx.get_flags().clone();
+        flags.disable_relay_data = true;
+        global_ctx.set_flags(flags);
+
+        let mut feature_flags = global_ctx.get_feature_flags();
+        feature_flags.avoid_relay_data = false;
+        feature_flags.is_public_server = true;
+        global_ctx.set_base_advertised_feature_flags(feature_flags);
+
+        let advertised_feature_flags = global_ctx.get_feature_flags();
+        assert!(advertised_feature_flags.avoid_relay_data);
+        assert!(advertised_feature_flags.is_public_server);
+
+        let mut flags = global_ctx.get_flags().clone();
+        flags.disable_relay_data = false;
+        global_ctx.set_flags(flags);
+
+        let advertised_feature_flags = global_ctx.get_feature_flags();
+        assert!(!advertised_feature_flags.avoid_relay_data);
+        assert!(advertised_feature_flags.is_public_server);
+    }
+
+    #[tokio::test]
+    async fn disable_relay_data_sets_avoid_relay_feature_flag() {
+        let config = TomlConfigLoader::default();
+        let global_ctx = GlobalCtx::new(config);
+
+        let mut flags = global_ctx.get_flags().clone();
+        flags.disable_relay_data = true;
+        global_ctx.set_flags(flags);
+
+        assert!(global_ctx.get_feature_flags().avoid_relay_data);
+
+        let mut flags = global_ctx.get_flags().clone();
+        flags.disable_relay_data = false;
+        global_ctx.set_flags(flags);
+
+        assert!(!global_ctx.get_feature_flags().avoid_relay_data);
+
+        global_ctx.set_avoid_relay_data_preference(true);
+
+        let mut flags = global_ctx.get_flags().clone();
+        flags.disable_relay_data = true;
+        global_ctx.set_flags(flags);
+
+        assert!(global_ctx.get_feature_flags().avoid_relay_data);
+
+        let mut flags = global_ctx.get_flags().clone();
+        flags.disable_relay_data = false;
+        global_ctx.set_flags(flags);
+
+        assert!(global_ctx.get_feature_flags().avoid_relay_data);
+    }
+
+    #[tokio::test]
+    async fn should_deny_proxy_for_process_wide_rpc_port() {
+        protected_port::clear_protected_tcp_ports_for_test();
+        protected_port::register_protected_tcp_port(15888);
+
+        let config = TomlConfigLoader::default();
+        let global_ctx = GlobalCtx::new(config);
+        let rpc_addr = SocketAddr::from(([127, 0, 0, 1], 15888));
+        let other_tcp_addr = SocketAddr::from(([127, 0, 0, 1], 15889));
+
+        assert!(global_ctx.should_deny_proxy(&rpc_addr, false));
+        assert!(!global_ctx.should_deny_proxy(&rpc_addr, true));
+        assert!(!global_ctx.should_deny_proxy(&other_tcp_addr, false));
+
+        protected_port::clear_protected_tcp_ports_for_test();
+    }
+
+    #[tokio::test]
+    async fn virtual_ipv6_and_public_ipv6_lease_are_stored_separately() {
+        let config = TomlConfigLoader::default();
+        let global_ctx = GlobalCtx::new(config);
+        let virtual_ipv6 = "fd00::1/64".parse().unwrap();
+        let public_ipv6 = "2001:db8::2/64".parse().unwrap();
+
+        global_ctx.set_ipv6(Some(virtual_ipv6));
+        global_ctx.set_public_ipv6_lease(Some(public_ipv6));
+
+        assert_eq!(global_ctx.get_ipv6(), Some(virtual_ipv6));
+        assert_eq!(global_ctx.get_public_ipv6_lease(), Some(public_ipv6));
+    }
+
+    #[tokio::test]
+    async fn public_ipv6_lease_is_treated_as_local_ip() {
+        protected_port::clear_protected_tcp_ports_for_test();
+
+        let config = TomlConfigLoader::default();
+        let global_ctx = GlobalCtx::new(config);
+        let public_ipv6 = "2001:db8::2/64".parse().unwrap();
+        let listener: url::Url = "tcp://[2001:db8::2]:11010".parse().unwrap();
+        global_ctx.set_public_ipv6_lease(Some(public_ipv6));
+        global_ctx.add_running_listener(listener);
+
+        let ip = std::net::IpAddr::V6(public_ipv6.address());
+        let socket = SocketAddr::from((public_ipv6.address(), 11010));
+
+        assert!(global_ctx.is_ip_local_virtual_ip(&ip));
+        assert!(global_ctx.should_deny_proxy(&socket, false));
+
+        protected_port::clear_protected_tcp_ports_for_test();
     }
 
     pub fn get_mock_global_ctx_with_network(

easytier/src/common/ifcfg/darwin.rs

@@ -1,6 +1,6 @@
 use std::net::Ipv4Addr;
 
-use super::{cidr_to_subnet_mask, run_shell_cmd, Error, IfConfiguerTrait};
+use super::{Error, IfConfiguerTrait, cidr_to_subnet_mask, run_shell_cmd};
 use async_trait::async_trait;
 use cidr::{Ipv4Inet, Ipv6Inet};
 
@@ -53,8 +53,8 @@ impl IfConfiguerTrait for MacIfConfiger {
     ) -> Result<(), Error> {
         run_shell_cmd(
             format!(
-                "ifconfig {} {:?}/{:?} 10.8.8.8 up",
+                "ifconfig {} {:?}/{:?} {:?} up",
-                name, address, cidr_prefix,
+                name, address, cidr_prefix, address,
             )
             .as_str(),
         )

easytier/src/common/ifcfg/mod.rs

@@ -119,8 +119,8 @@ async fn run_shell_cmd(cmd: &str) -> Result<(), Error> {
             .creation_flags(CREATE_NO_WINDOW)
             .output()
             .await?;
-        stdout = crate::utils::utf8_or_gbk_to_string(cmd_out.stdout.as_slice());
+        stdout = crate::utils::string::utf8_or_gbk_to_string(cmd_out.stdout.as_slice());
-        stderr = crate::utils::utf8_or_gbk_to_string(cmd_out.stderr.as_slice());
+        stderr = crate::utils::string::utf8_or_gbk_to_string(cmd_out.stderr.as_slice());
     };
 
     #[cfg(not(target_os = "windows"))]
@@ -166,3 +166,14 @@ pub type IfConfiger = DummyIfConfiger;
 
 #[cfg(target_os = "windows")]
 pub use windows::RegistryManager;
+
+#[cfg(target_os = "linux")]
+pub(crate) fn list_ipv6_route_messages()
+-> Result<Vec<netlink_packet_route::route::RouteMessage>, Error> {
+    netlink::NetlinkIfConfiger::list_ipv6_route_messages()
+}
+
+#[cfg(target_os = "linux")]
+pub(crate) fn get_interface_index(name: &str) -> Result<u32, Error> {
+    netlink::NetlinkIfConfiger::get_interface_index(name)
+}

easytier/src/common/ifcfg/netlink.rs

@@ -10,27 +10,27 @@ use anyhow::Context;
 use async_trait::async_trait;
 use cidr::{IpInet, Ipv4Inet, Ipv6Inet};
 use netlink_packet_core::{
-    NetlinkDeserializable, NetlinkHeader, NetlinkMessage, NetlinkPayload, NetlinkSerializable,
+    NLM_F_ACK, NLM_F_CREATE, NLM_F_DUMP, NLM_F_EXCL, NLM_F_REQUEST, NetlinkDeserializable,
-    NLM_F_ACK, NLM_F_CREATE, NLM_F_DUMP, NLM_F_EXCL, NLM_F_REQUEST,
+    NetlinkHeader, NetlinkMessage, NetlinkPayload, NetlinkSerializable,
 };
 use netlink_packet_route::{
+    AddressFamily, RouteNetlinkMessage,
     address::{AddressAttribute, AddressMessage},
     route::{
         RouteAddress, RouteAttribute, RouteHeader, RouteMessage, RouteProtocol, RouteScope,
         RouteType,
     },
-    AddressFamily, RouteNetlinkMessage,
 };
-use netlink_sys::{protocols::NETLINK_ROUTE, Socket, SocketAddr};
+use netlink_sys::{Socket, SocketAddr, protocols::NETLINK_ROUTE};
 use nix::{
     ifaddrs::getifaddrs,
-    libc::{self, ifreq, ioctl, Ioctl, SIOCGIFFLAGS, SIOCGIFMTU, SIOCSIFFLAGS, SIOCSIFMTU},
+    libc::{self, Ioctl, SIOCGIFFLAGS, SIOCGIFMTU, SIOCSIFFLAGS, SIOCSIFMTU, ifreq, ioctl},
     net::if_::InterfaceFlags,
     sys::socket::SockaddrLike as _,
 };
 use pnet::ipnetwork::ip_mask_to_prefix;
 
-use super::{route::Route, Error, IfConfiguerTrait};
+use super::{Error, IfConfiguerTrait, route::Route};
 
 pub(crate) fn dummy_socket() -> Result<std::net::UdpSocket, Error> {
     Ok(std::net::UdpSocket::bind("0:0")?)
@@ -160,7 +160,7 @@ impl From<RouteMessage> for Route {
 pub struct NetlinkIfConfiger {}
 
 impl NetlinkIfConfiger {
-    fn get_interface_index(name: &str) -> Result<u32, Error> {
+    pub(crate) fn get_interface_index(name: &str) -> Result<u32, Error> {
         let name = CString::new(name).with_context(|| "failed to convert interface name")?;
         match unsafe { libc::if_nametoindex(name.as_ptr()) } {
             0 => Err(std::io::Error::last_os_error().into()),
@@ -311,7 +311,7 @@ impl NetlinkIfConfiger {
         Self::set_flags_op(name, SIOCGIFFLAGS, InterfaceFlags::empty())
     }
 
-    fn list_routes() -> Result<Vec<RouteMessage>, Error> {
+    fn list_route_messages(address_family: AddressFamily) -> Result<Vec<RouteMessage>, Error> {
         let mut message = RouteMessage::default();
 
         message.header.table = RouteHeader::RT_TABLE_UNSPEC;
@@ -320,7 +320,7 @@ impl NetlinkIfConfiger {
         message.header.scope = RouteScope::Universe;
         message.header.kind = RouteType::Unicast;
 
-        message.header.address_family = AddressFamily::Inet;
+        message.header.address_family = address_family;
         message.header.destination_prefix_length = 0;
         message.header.source_prefix_length = 0;
 
@@ -367,6 +367,14 @@ impl NetlinkIfConfiger {
 
         Ok(ret_vec)
     }
+
+    fn list_routes() -> Result<Vec<RouteMessage>, Error> {
+        Self::list_route_messages(AddressFamily::Inet)
+    }
+
+    pub(crate) fn list_ipv6_route_messages() -> Result<Vec<RouteMessage>, Error> {
+        Self::list_route_messages(AddressFamily::Inet6)
+    }
 }
 
 #[async_trait]
@@ -551,12 +559,9 @@ impl IfConfiguerTrait for NetlinkIfConfiger {
         message.header.scope = RouteScope::Universe;
         message.header.kind = RouteType::Unicast;
 
-        // Add metric (cost) if specified
+        message
-        if let Some(cost) = cost {
+            .attributes
-            message
+            .push(RouteAttribute::Priority(cost.unwrap_or(65535) as u32));
-                .attributes
-                .push(RouteAttribute::Priority(cost as u32));
-        }
 
         message
             .attributes
@@ -564,9 +569,11 @@ impl IfConfiguerTrait for NetlinkIfConfiger {
                 name,
             )?));
 
-        message
+        if cidr_prefix != 0 {
-            .attributes
+            message
-            .push(RouteAttribute::Destination(RouteAddress::Inet6(address)));
+                .attributes
+                .push(RouteAttribute::Destination(RouteAddress::Inet6(address)));
+        }
 
         send_netlink_req_and_wait_one_resp(RouteNetlinkMessage::NewRoute(message), false)
     }
@@ -577,7 +584,7 @@ impl IfConfiguerTrait for NetlinkIfConfiger {
         address: std::net::Ipv6Addr,
         cidr_prefix: u8,
     ) -> Result<(), Error> {
-        let routes = Self::list_routes()?;
+        let routes = Self::list_route_messages(AddressFamily::Inet6)?;
         let ifidx = NetlinkIfConfiger::get_interface_index(name)?;
 
         for msg in routes {
@@ -598,29 +605,82 @@ impl IfConfiguerTrait for NetlinkIfConfiger {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::process::Command;
 
     const DUMMY_IFACE_NAME: &str = "dummy";
 
     fn run_cmd(cmd: &str) -> String {
-        let output = std::process::Command::new("sh")
+        let output = Command::new("sh")
             .arg("-c")
             .arg(cmd)
             .output()
             .expect("failed to execute process");
+        assert!(
+            output.status.success(),
+            "command failed: {cmd}\nstdout: {}\nstderr: {}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr),
+        );
         String::from_utf8(output.stdout).unwrap()
     }
 
+    fn run_ip(args: &[&str]) {
+        let output = Command::new("ip")
+            .args(args)
+            .output()
+            .expect("failed to execute ip process");
+        assert!(
+            output.status.success(),
+            "ip command failed: {:?}\nstdout: {}\nstderr: {}",
+            args,
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr),
+        );
+    }
+
+    fn test_iface_name(tag: &str) -> String {
+        format!("et{}{:x}", tag, std::process::id() & 0xffff)
+    }
+
+    struct ScopedDummyLink {
+        name: String,
+    }
+
+    impl ScopedDummyLink {
+        fn new(name: &str) -> Self {
+            let _ = Command::new("ip").args(["link", "del", name]).output();
+            run_ip(&["link", "add", name, "type", "dummy"]);
+            run_ip(&["link", "set", name, "up"]);
+            Self {
+                name: name.to_string(),
+            }
+        }
+    }
+
+    impl Drop for ScopedDummyLink {
+        fn drop(&mut self) {
+            let _ = Command::new("ip")
+                .args(["link", "del", &self.name])
+                .output();
+        }
+    }
+
     struct PrepareEnv {}
     impl PrepareEnv {
         fn new() -> Self {
-            let _ = run_cmd(&format!("sudo ip link add {} type dummy", DUMMY_IFACE_NAME));
+            let _ = Command::new("ip")
+                .args(["link", "del", DUMMY_IFACE_NAME])
+                .output();
+            let _ = run_cmd(&format!("ip link add {} type dummy", DUMMY_IFACE_NAME));
             PrepareEnv {}
         }
     }
 
     impl Drop for PrepareEnv {
         fn drop(&mut self) {
-            let _ = run_cmd(&format!("sudo ip link del {}", DUMMY_IFACE_NAME));
+            let _ = Command::new("ip")
+                .args(["link", "del", DUMMY_IFACE_NAME])
+                .output();
         }
     }
 
@@ -701,4 +761,128 @@ mod tests {
             .collect::<Vec<_>>();
         assert!(!routes.contains(&IpAddr::V4("10.5.5.0".parse().unwrap())));
     }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn ipv6_addr_readback_test() {
+        let iface = test_iface_name("a");
+        let _link = ScopedDummyLink::new(&iface);
+        run_ip(&["-6", "addr", "add", "2001:db8:1234::2/64", "dev", &iface]);
+
+        let addrs = NetlinkIfConfiger::list_addresses(&iface).unwrap();
+        assert!(addrs.iter().any(|addr| {
+            addr.address() == IpAddr::V6("2001:db8:1234::2".parse().unwrap())
+                && addr.network_length() == 64
+        }));
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn ipv6_route_readback_test() {
+        let wan_if = test_iface_name("rw");
+        let lan_if = test_iface_name("rl");
+        let _wan = ScopedDummyLink::new(&wan_if);
+        let _lan = ScopedDummyLink::new(&lan_if);
+        run_ip(&[
+            "-6",
+            "addr",
+            "add",
+            "2001:db8:100:ffff::2/64",
+            "dev",
+            &wan_if,
+        ]);
+        run_ip(&[
+            "-6",
+            "route",
+            "add",
+            "default",
+            "from",
+            "2001:db8:100::/56",
+            "dev",
+            &wan_if,
+        ]);
+        run_ip(&["-6", "route", "add", "2001:db8:100::/56", "dev", &lan_if]);
+
+        let wan_ifindex = NetlinkIfConfiger::get_interface_index(&wan_if).unwrap();
+        let lan_ifindex = NetlinkIfConfiger::get_interface_index(&lan_if).unwrap();
+        let routes = NetlinkIfConfiger::list_ipv6_route_messages().unwrap();
+
+        assert!(routes.iter().any(|route| {
+            route.header.kind == RouteType::Unicast
+                && route.header.source_prefix_length == 56
+                && route.attributes.iter().any(|attr| {
+                    matches!(
+                        attr,
+                        RouteAttribute::Source(RouteAddress::Inet6(addr))
+                            if *addr == "2001:db8:100::".parse::<std::net::Ipv6Addr>().unwrap()
+                    )
+                })
+                && route
+                    .attributes
+                    .iter()
+                    .any(|attr| matches!(attr, RouteAttribute::Oif(index) if *index == wan_ifindex))
+                && !route
+                    .attributes
+                    .iter()
+                    .any(|attr| matches!(attr, RouteAttribute::Destination(_)))
+        }));
+
+        assert!(routes.iter().any(|route| {
+            route.header.kind == RouteType::Unicast
+                && route.header.destination_prefix_length == 56
+                && route.attributes.iter().any(|attr| {
+                    matches!(
+                        attr,
+                        RouteAttribute::Destination(RouteAddress::Inet6(addr))
+                            if *addr == "2001:db8:100::".parse::<std::net::Ipv6Addr>().unwrap()
+                    )
+                })
+                && route
+                    .attributes
+                    .iter()
+                    .any(|attr| matches!(attr, RouteAttribute::Oif(index) if *index == lan_ifindex))
+        }));
+    }
+
+    #[serial_test::serial]
+    #[tokio::test]
+    async fn ipv6_route_remove_test() {
+        let iface = test_iface_name("rr");
+        let _link = ScopedDummyLink::new(&iface);
+        let ifcfg = NetlinkIfConfiger {};
+        let route_addr = "2001:db8:200::".parse::<std::net::Ipv6Addr>().unwrap();
+
+        ifcfg
+            .add_ipv6_route(&iface, route_addr, 56, None)
+            .await
+            .unwrap();
+
+        let ifindex = NetlinkIfConfiger::get_interface_index(&iface).unwrap();
+        let has_route = |routes: &[RouteMessage]| {
+            routes.iter().any(|route| {
+                route.header.destination_prefix_length == 56
+                    && route.attributes.iter().any(|attr| {
+                        matches!(
+                            attr,
+                            RouteAttribute::Destination(RouteAddress::Inet6(addr)) if *addr == route_addr
+                        )
+                    })
+                    && route
+                        .attributes
+                        .iter()
+                        .any(|attr| matches!(attr, RouteAttribute::Oif(index) if *index == ifindex))
+            })
+        };
+
+        let routes = NetlinkIfConfiger::list_ipv6_route_messages().unwrap();
+        assert!(has_route(&routes));
+
+        ifcfg
+            .remove_ipv6_route(&iface, route_addr, 56)
+            .await
+            .unwrap();
+
+        let routes = NetlinkIfConfiger::list_ipv6_route_messages().unwrap();
+        assert!(!has_route(&routes));
+    }
 }

easytier/src/common/ifcfg/win/luid.rs

@@ -740,10 +740,6 @@ impl InterfaceLuid {
 
         // SAFETY: TODO
         let ret = unsafe { SetIpInterfaceEntry(&mut row) };
-        if NO_ERROR == ret {
+        if NO_ERROR == ret { Ok(()) } else { Err(ret) }
-            Ok(())
-        } else {
-            Err(ret)
-        }
     }
 }