Files
Easytier/easytier-proto/proto/api_manage.proto
T
KKRainbow 4a10d1c2b9 feat(mobile): add embedded runtime and managed network updates (#2532)
* feat(mobile): add embedded iOS runtime API

Add a thin panic-safe C ABI crate for embedding no-TUN instances
on iOS. Expose lifecycle, status, JSON-RPC, string ownership, and
error handling.

Build device and simulator XCFramework static libraries on macOS.
Add exact named-instance deletion to the iOS and Android wrappers.
Cover wrapper lifecycle and the port-forward patch flow on host
targets.

* fix(gateway): recover TCP port-forward listeners

Release an unusable TCP port-forward listener after an accept
failure. Retry binding until the forward is cancelled. Keep the old
listener released while rebinding so mobile sockets can recover.

Expose opt-in iOS diagnostics for listener and connection events.
Trace configuration removal and adapter shutdown. Add tests for
recovery, release-before-rebind, and cancellation.

* feat(web): persist incremental managed config patches

Add a revision-CAS PATCH contract for managed configs while keeping
the existing Full PUT path for compatibility and recovery.

Apply Full and Patch mutations with their revision in one SQLite
transaction. Reject ownership conflicts and invalidate revisions on
alternate web-owned writes.

Document limits, failure semantics, rollout order, and verification.
Cover delta updates, conflicts, idempotency, and transaction rollback.

* feat(web): apply managed config patches to live sessions

Carry Patch fences and touched instance IDs into live sessions.
Reconcile only those instances when the applied revision matches the
Patch base. Fall back to Full reconciliation for gaps and restarts.

Invalidate the applied revision around every direct runtime mutation.
Fence revision advancement with the runtime cache epoch so stale
reconcile rounds cannot overwrite a newer invalidation.

Require deletion responses to confirm each requested instance before
advancing the revision. Raise the managed PUT and PATCH body limit to
32 MiB and return typed conflicts for publisher recovery.

* fix(core): retry transient accepted TCP errors

Keep TCP tunnel listeners alive when an accepted socket fails during
upgrade with a retryable connection-state error.

Share the retryable I/O classifier with the socket listener. Cover a
rejected connection followed by success and propagation of permanent
errors.

* feat(core): add internal Peer Relay edge projection

Derive the local advertised OSPF row from physical adjacency and transport-authenticated credential relay coverage. Keep full local adjacency only in the temporary SPF snapshot so direct destinations retain a fallback route.

Leave Peer Relay disabled at the public configuration seam. A follow-up change can expose the preference without coupling route projection to credential reauthorization.

feat(config): expose Peer Relay routing preference

Add prefer_peer_relay to public protobuf, TOML, management patch, and
hosted runtime surfaces.

Read the preference from live peer context so runtime config updates take
effect. Refresh authenticated peer metadata when the option is enabled.

Cover dynamic enable and disable in a five-node, dual-admin credential
topology, including forwarded relay coverage and local fallback.
2026-08-28 00:43:26 +08:00

246 lines
7.0 KiB
Protocol Buffer

syntax = "proto3";
import "common.proto";
import "peer_rpc.proto";
import "api_instance.proto";
import "acl.proto";
package api.manage;
enum NetworkingMethod {
PublicServer = 0;
Manual = 1;
Standalone = 2;
}
enum ConfigSource {
ConfigSourceUnspecified = 0;
ConfigSourceUser = 1;
ConfigSourceWeb = 2;
}
message NetworkConfig {
optional string instance_id = 1;
optional bool dhcp = 2;
optional string virtual_ipv4 = 3;
optional int32 network_length = 4;
optional string hostname = 5;
optional string network_name = 6;
optional string network_secret = 7;
optional NetworkingMethod networking_method = 8;
optional string public_server_url = 9;
repeated string peer_urls = 10;
repeated string proxy_cidrs = 11;
optional bool enable_vpn_portal = 12 [deprecated = true];
optional int32 vpn_portal_listen_port = 13 [deprecated = true];
optional string vpn_portal_client_network_addr = 14 [deprecated = true];
optional int32 vpn_portal_client_network_len = 15 [deprecated = true];
optional bool advanced_settings = 16;
repeated string listener_urls = 17;
// optional int32 rpc_port = 18;
optional bool latency_first = 19;
optional string dev_name = 20;
optional bool use_smoltcp = 21;
optional bool disable_ipv6 = 47;
optional bool enable_kcp_proxy = 22;
optional bool disable_kcp_input = 23;
optional bool disable_p2p = 24;
optional bool bind_device = 25;
optional bool no_tun = 26;
optional bool enable_exit_node = 27;
optional bool relay_all_peer_rpc = 28;
optional bool multi_thread = 29;
optional bool enable_relay_network_whitelist = 30;
repeated string relay_network_whitelist = 31;
optional bool enable_manual_routes = 32;
repeated string routes = 33;
repeated string exit_nodes = 34;
optional bool proxy_forward_by_system = 35;
optional bool disable_encryption = 36;
optional bool enable_socks5 = 37;
optional int32 socks5_port = 38;
optional bool disable_udp_hole_punching = 39;
optional int32 mtu = 40;
repeated string mapped_listeners = 41;
optional bool enable_magic_dns = 42;
optional bool enable_private_mode = 43;
// repeated string rpc_portal_whitelists = 44;
optional bool enable_quic_proxy = 45;
optional bool disable_quic_input = 46;
optional int32 quic_listen_port = 50 [deprecated = true];
repeated PortForwardConfig port_forwards = 48;
optional bool disable_sym_hole_punching = 49;
optional bool p2p_only = 51;
optional common.CompressionAlgoPb data_compress_algo = 52;
optional string encryption_algorithm = 53;
optional bool disable_tcp_hole_punching = 54;
common.SecureModeConfig secure_mode = 55;
optional acl.Acl acl = 56;
optional string credential_file = 57;
optional bool lazy_p2p = 58;
optional bool need_p2p = 59;
optional uint64 instance_recv_bps_limit = 60;
optional bool disable_upnp = 61;
optional bool ipv6_public_addr_provider = 62;
optional bool ipv6_public_addr_auto = 63;
optional string ipv6_public_addr_prefix = 64;
optional bool disable_relay_data = 65;
optional bool enable_udp_broadcast_relay = 66;
optional uint32 socket_mark = 67;
repeated NetworkPeerConfig peers = 68;
optional VpnPortalConfig vpn_portal_config = 69;
repeated ManagedCredentialConfig managed_credentials = 71;
optional bool prefer_peer_relay = 72;
}
message ManagedCredentialConfig {
string credential_id = 1;
string credential_secret = 2;
repeated string groups = 3;
bool allow_relay = 4;
repeated string allowed_proxy_cidrs = 5;
int64 expiry_unix = 6;
optional bool reusable = 7;
}
message ManagedCredentialSet {
repeated ManagedCredentialConfig entries = 1;
}
message VpnPortalClientConfig {
string name = 1;
string virtual_ip = 2;
repeated string groups = 3;
}
message VpnPortalConfig {
string wireguard_listen = 1;
optional string wireguard_private_key = 2;
repeated VpnPortalClientConfig clients = 3;
}
message NetworkPeerConfig {
string uri = 1;
optional string peer_public_key = 2;
}
message PortForwardConfig {
string bind_ip = 1;
uint32 bind_port = 2;
string dst_ip = 3;
uint32 dst_port = 4;
string proto = 5;
}
message MyNodeInfo {
common.Ipv4Inet virtual_ipv4 = 1;
string hostname = 2;
string version = 3;
peer_rpc.GetIpListResponse ips = 4;
common.StunInfo stun_info = 5;
repeated common.Url listeners = 6;
optional string vpn_portal_cfg = 7 [deprecated = true];
uint32 peer_id = 8;
}
message NetworkInstanceRunningInfo {
string dev_name = 1;
MyNodeInfo my_node_info = 2;
repeated string events = 3;
repeated api.instance.Route routes = 4;
repeated api.instance.PeerInfo peers = 5;
repeated api.instance.PeerRoutePair peer_route_pairs = 6;
bool running = 7;
optional string error_msg = 8;
peer_rpc.RouteForeignNetworkSummary foreign_network_summary = 9;
}
message NetworkInstanceRunningInfoMap {
map<string, NetworkInstanceRunningInfo> map = 1;
}
message NetworkMeta {
common.UUID inst_id = 1;
string network_name = 2;
uint32 config_permission = 3;
string instance_name = 4;
ConfigSource source = 5;
}
message ValidateConfigRequest { NetworkConfig config = 1; }
message ValidateConfigResponse { string toml_config = 1; }
message RunNetworkInstanceRequest {
common.UUID inst_id = 1;
NetworkConfig config = 2;
bool overwrite = 3;
ConfigSource source = 4;
}
message RunNetworkInstanceResponse { common.UUID inst_id = 1; }
message RetainNetworkInstanceRequest { repeated common.UUID inst_ids = 1; }
message RetainNetworkInstanceResponse {
repeated common.UUID remain_inst_ids = 1;
}
message CollectNetworkInfoRequest { repeated common.UUID inst_ids = 1; }
message CollectNetworkInfoResponse { NetworkInstanceRunningInfoMap info = 1; }
message ListNetworkInstanceRequest {}
message ListNetworkInstanceResponse { repeated common.UUID inst_ids = 1; }
message DeleteNetworkInstanceRequest { repeated common.UUID inst_ids = 1; }
message DeleteNetworkInstanceResponse {
repeated common.UUID remain_inst_ids = 1;
}
message GetNetworkInstanceConfigRequest { common.UUID inst_id = 1; }
message GetNetworkInstanceConfigResponse {
NetworkConfig config = 1;
ConfigSource source = 2;
}
message ListNetworkInstanceMetaRequest { repeated common.UUID inst_ids = 1; }
message ListNetworkInstanceMetaResponse { repeated NetworkMeta metas = 1; }
service WebClientService {
rpc ValidateConfig(ValidateConfigRequest) returns (ValidateConfigResponse) {}
rpc RunNetworkInstance(RunNetworkInstanceRequest)
returns (RunNetworkInstanceResponse) {}
rpc RetainNetworkInstance(RetainNetworkInstanceRequest)
returns (RetainNetworkInstanceResponse) {}
rpc CollectNetworkInfo(CollectNetworkInfoRequest)
returns (CollectNetworkInfoResponse) {}
rpc ListNetworkInstance(ListNetworkInstanceRequest)
returns (ListNetworkInstanceResponse) {}
rpc DeleteNetworkInstance(DeleteNetworkInstanceRequest)
returns (DeleteNetworkInstanceResponse) {}
rpc GetNetworkInstanceConfig(GetNetworkInstanceConfigRequest)
returns (GetNetworkInstanceConfigResponse) {}
rpc ListNetworkInstanceMeta(ListNetworkInstanceMetaRequest)
returns (ListNetworkInstanceMetaResponse) {}
}