314 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Warren	5c9b51fc49	P1: AsyncS3Vfs implementation (Phase 3) ... - AsyncS3Vfs: spawn_blocking wrapper over S3Vfs - AsyncS3File: tokio::sync::Mutex for async state - Add Clone derive to S3Vfs - All backend methods wrapped with spawn_blocking Phase 3 complete: AsyncS3Vfs working Phase 4 pending: AsyncSmbVfs Phase 5 pending: WebDAV integration Tests: 293 passed, 0 failed	2026-06-21 21:08:48 +08:00
Warren	790efe13f4	P1: AsyncLocalFs implementation (Phase 2) ... - AsyncLocalFile: tokio::fs::File wrapper - AsyncLocalFs: AsyncVfsBackend impl using tokio::fs - Key methods: read_dir, open_file, stat, create_dir, remove_file, rename - 4 async tests passing Phase 2 complete: AsyncLocalFs working Phase 3 pending: AsyncS3Vfs Phase 4 pending: AsyncSmbVfs Phase 5 pending: WebDAV integration Tests: 293 passed, 0 failed	2026-06-21 20:59:41 +08:00
Warren	6242a5eaab	P1: AsyncVfsBackend trait design (Phase 1 - framework) ... - Add AsyncVfsBackend + AsyncVfsFile trait definitions - Use cfg(feature = "async-vfs") for optional compilation - Design notes for Phase 2-5 implementation - Estimated: ~13 hours (multi-day project) Phase 2: AsyncLocalFs (tokio::fs) Phase 3: AsyncS3Vfs (async client) Phase 4: AsyncSmbVfs (async wrapper) Phase 5: WebDAV integration Tests: 289 passed, 0 failed	2026-06-21 20:52:31 +08:00
Warren	ed55c6050e	P2: Streaming read optimization (64KB chunk cache) ... - Add read_cache + read_cache_offset fields to VfsDavFile - Read-ahead 64KB chunks to reduce VFS calls - Serve from cache when data is available - Invalidate cache on seek() - Reduces memory allocations and VFS syscall overhead Tests: 289 passed, 0 failed	2026-06-21 19:16:12 +08:00
Warren	9c82830959	P1: WebDAV ACL enforcement (RFC 3744) ... - Add enable_acl field to VfsDavFs - Add check_acl() helper method - ACL checks in open(), read_dir(), create_dir(), remove_dir(), remove_file(), rename() - Uses VfsAceMask for permission checks (ReadData, WriteData, etc.) - Returns FsError::Forbidden if ACL denies access Tests: 289 passed, 0 failed	2026-06-21 18:37:48 +08:00
Warren	2a0376cc58	Update AGENTS.md: Phase 22 complete with 10 commits summary	2026-06-21 18:31:08 +08:00
Warren	a56207db0b	P3: Quota enforcement - check before write in flush() ... - Check VfsBackend quota before writing buffered data - Return FsError::InsufficientStorage (507) if limit exceeded - Log warning with current/adding/limit values Tests: 289 passed, 0 failed	2026-06-21 18:24:44 +08:00
Warren	12ec190831	Add Range request test: verify dav-server partial content support ... - test_range_request: GET with Range header returns 206 + partial content - Verify Content-Range header present - Test bytes=5-10 returns correct 6-byte slice Tests: 289 passed, 0 failed	2026-06-21 18:21:48 +08:00
Warren	b71510b2e8	P0 fix: Mutex/RwLock poison recovery for webdav_locks and webdav_version ... - Add recover_mutex() helper in webdav_locks.rs - Add recover_rwlock() helper in webdav_version.rs - Replace all .unwrap() calls with recovery pattern - Tests: 288 passed, 0 failed	2026-06-21 18:11:48 +08:00
Warren	1408646424	AGENTS.md: Update WebDAV Phase 22 documentation ... - Document all P0-P3 improvements completed - Add Phase 22 section with detailed changes - Update Phase 21 status (all completed)	2026-06-21 17:28:31 +08:00
Warren	0322e2d4b6	WebDAV error handling improvements: map_vfs_error helper ... - Add map_vfs_error() to map VfsError to FsError properly - NotFound → NotFound, PermissionDenied → Forbidden, etc. - Update create_dir/remove_dir/remove_file/rename/set_atime/set_mtime/get_quota - Add executable() method to VfsDavMetaData (mode & 0o111) Tests: 288 passed, 0 failed	2026-06-21 16:50:23 +08:00
Warren	43c135e877	WebDAV additional fixes: dead props compaction + accessed metadata ... - save_props/patch_props: filter empty entries before persisting - VfsDavMetaData: add accessed field + accessed() method Tests: 288 passed, 0 failed	2026-06-21 16:45:03 +08:00
Warren	ab11983c1b	WebDAV MKCOL: return 405 Exists if directory already exists (RFC 4918) ... P3 fix: - create_dir: check vfs.exists() before creating - Return FsError::Exists (405 Method Not Allowed) if path exists Tests: 36 webdav tests pass	2026-06-21 16:16:43 +08:00
Warren	5000ba7c14	WebDAV async + cache TTL: spawn_blocking for props persistence, 5min TTL eviction ... P2 improvements: - patch_props: use tokio::spawn_blocking for blocking VFS writes - WEBDAV_HANDLER_CACHE: add CachedHandler with Instant timestamp - TTL check on each request (300s = 5 minutes), recreate if expired - create_handler_for_user() helper function Tests: 288 passed, 0 failed	2026-06-21 16:14:42 +08:00
Warren	9acd174388	WebDAV improvements: flush fix, RwLock recovery, expired lock cleanup, atomic set_times ... P0 fixes: - flush(): add flushed flag, proper error logging, Drop warning for data loss - props_data RwLock: replace unwrap() with try_read/try_write recovery - PersistedLs: add is_expired() + cleanup_expired_locks() helper P1 improvements: - Props persistence via VFS (load_props/save_props/patch_props) - COPY/MOVE sync dead props (copy on COPY, move key on rename) - Atomic set_atime/set_mtime via filetime crate (no race condition) New files: - webdav_locks.rs: PersistedLs with lock persistence + expiry cleanup Tests: 288 passed, 0 failed	2026-06-21 16:07:12 +08:00
Warren	614275f77a	Add SMB Client Restrictions (Phase 1-3): access control for SMB clients ... Features: - IpSpec: IP address specification (Single/Cidr/Range/Any) - TimeSpec: Time-based restrictions (HourRange/DayOfWeek/DayHour) - ClientRule: Allow/Deny rules with IP/user/time/share - ClientAcl: Priority-based rule matching - ClientRestrictionManager: Global/Share/User ACLs Security: - Restrict SMB client access by IP address - Time-based access control (business hours only) - User-specific and share-specific ACLs - CIDR notation support (192.168.1.0/24) Files: - vendor/smb-server/src/client_restrictions.rs (443 lines) - vendor/smb-server/src/lib.rs (+1 line) Tests: 7 passed (smb-server), 317 passed (markbase-core)	2026-06-21 12:51:37 +08:00
Warren	a475de45c9	Add SSH Port Forwarding ACL (Phase 1-3): prevent SSH tunnel abuse ... Features: - ForwardRule: Allow/Deny rules with address/port specifications - ForwardAcl: User-specific ACL with priority-based rule matching - ForwardAclManager: Global ACL manager for all users - OpenSSH-style PermitOpen/PermitListen parsing - 8 unit tests for all operations Security: - Prevent unauthorized SSH tunnel creation - Restrict forwarding to specific hosts/ports - Default deny policy for unknown users Files: - markbase-core/src/ssh_server/forward_acl.rs (493 lines) - markbase-core/src/ssh_server/mod.rs (+1 line) Tests: 317 passed (+8)	2026-06-21 12:48:56 +08:00
Warren	a28b7f0929	Add SMB Share Snapshots (Phase 1-4): FSCTL_SRV_SNAPSHOT_* handlers ... Features: - SnapshotManager: Share snapshot management - SnapshotEntry/SnapshotState: Snapshot metadata structures - FSCTL_SRV_SNAPSHOT_CREATE/READ/WRITE/DELETE handlers - GMT token format support (@GMT-YYYY.MM.DD-HH.MM.SS) - 7 unit tests for all operations Files: - vendor/smb-server/src/snapshot.rs (245 lines) - vendor/smb-server/src/handlers/ioctl.rs (+88 lines) - vendor/smb-server/src/proto/messages/ioctl.rs (+8 lines enum) - vendor/smb-server/src/server.rs (+2 lines) - vendor/smb-server/src/ntstatus.rs (+1 line) - vendor/smb-server/src/lib.rs (+1 line) Tests: 7 passed (smb-server), 309 passed (markbase-core)	2026-06-21 12:38:15 +08:00
Warren	204186e34b	Add WebDAV Versioning (Phase 1-5): version control with history tracking ... Features: - WebDavVersioning: Version control using HashMap storage - VersionInfo/VersionHistory: Version metadata structures - create_version/get_version/delete_version operations - restore_version: Restore from previous version - SHA-256 checksum calculation - 11 unit tests for all operations Files: - markbase-core/src/webdav_version.rs (391 lines) - markbase-core/src/lib.rs (add module) Tests: 309 passed (+11)	2026-06-21 12:15:37 +08:00
Warren	2ca543fd66	Add SSH Structured Logging (Phase 1-5): ssh_audit_log.rs module with JSON tracing ... Features: - SshAuditLog: Structured audit logging using tracing crate - 16 audit event types (connection/auth/command/file/port_forward) - JSON output format via tracing-subscriber json layer - 10 unit tests for all audit events Files: - markbase-core/src/ssh_server/ssh_audit_log.rs (289 lines) - markbase-core/Cargo.toml (tracing + json layer) - markbase-core/src/ssh_server/mod.rs (export module) Tests: 298 passed (+10)	2026-06-21 11:29:04 +08:00
Warren	3d0d031677	Add SMB Previous Versions tests: GMT token generation and snapshot listing/open/restore verification	2026-06-21 06:20:17 +08:00
Warren	d368a7a4c0	Implement SSH Multiplexing: Connection/Session/Channel management with expiration and cleanup	2026-06-21 05:31:06 +08:00
Warren	30c1e5fff9	Implement SSH Known Hosts Verification: Parse ~/.ssh/known_hosts + verify host keys + hashed host support	2026-06-21 05:24:33 +08:00
Warren	5238a84972	Implement SMB Durable Handles (Phase 1): Persistent FileId + reconnect + expiration + cleanup	2026-06-21 05:11:39 +08:00
Warren	b014390d12	Implement SSH Connection Rate Limiting: IP rate limit + global rate limit + auth brute force prevention	2026-06-21 05:01:04 +08:00
Warren	56e73ad8a4	Implement SSH Host Key Management (Phase 1): Generate/Load/Rotate Ed25519 keys	2026-06-21 04:57:15 +08:00
Warren	bb886449d7	Implement SSH config file support Phase 1 ... - ssh_config.rs module with SshConfigParser - Parse ~/.ssh/config format (OpenSSH standard) - SshHostConfig struct with common options: HostName, User, Port, IdentityFile PreferredAuthentications, Ciphers, MACs, KexAlgorithms Compression, ConnectTimeout, ServerAliveInterval StrictHostKeyChecking, ProxyCommand, ProxyJump - Merge default config (*) with host-specific config - Unit tests: 5 tests (parse_simple, parse_default, identity_file, list_hosts) All 187 tests pass.	2026-06-21 02:36:32 +08:00
Warren	b24e4f727b	Implement SSH X11 forwarding Phase 4: Save X11ForwardContext ... - Save X11ForwardContext to Channel.x11_forward_context - Clone context for later use in data forwarding - Prepare for actual X11 data forwarding in handle_channel_data All 182 tests pass.	2026-06-21 02:32:32 +08:00
Warren	df707bee7e	Implement SSH X11 forwarding Phase 3: Channel structure ... - Add x11_forward_context field to Channel struct - Initialize x11_forward_context: None in all Channel creations - Prepare for actual X11 data forwarding All 182 tests pass.	2026-06-21 02:29:56 +08:00
Warren	d3997acfcc	Implement SSH X11 forwarding Phase 2 ... - Add 'x11' channel type in handle_channel_open() - Add handle_x11_channel_open() method - Add 'x11-req' request in handle_channel_request() - Add handle_x11_request() method - Parse x11-req parameters (single_connection, auth_protocol, auth_cookie, screen_number) - Create X11ForwardContext from DISPLAY env All 182 tests pass.	2026-06-21 02:20:46 +08:00
Warren	929ad150d8	Implement SSH X11 forwarding Phase 1 ... - x11_forward.rs module with X11ForwardContext - parse_display() to parse DISPLAY env variable - read_xauthority_cookie() to read MIT-MAGIC-COOKIE-1 - X11Connection for socket forwarding - Unit tests: parse_display/disabled/display_env All tests pass.	2026-06-21 02:11:55 +08:00
Warren	913296fe96	Implement SSH Compression Phase 3: Actual packet compression ... - EncryptedPacket::new(): compress payload before encryption - EncryptedPacket::read(): decompress payload after decryption - Apply to AES-GCM, ChaCha20-Poly1305, and AES-CTR modes - Compression order: compress → encrypt (write) - Decompression order: decrypt → decompress (read) All 179 tests pass.	2026-06-21 02:07:35 +08:00
Warren	93e33b04a7	Implement SSH Compression Phase 2: Integration ... - Add compression_ctos/compression_stoc to EncryptionContext - Default impl: CompressionContext::new(6) - from_session_keys(): initialize compression fields - enable_compression() method (based on KEX negotiation) - server.rs: enable compression after NEWKEYS (if negotiated) All 179 tests pass.	2026-06-21 01:51:39 +08:00
Warren	a5375075b8	Implement SSH Compression support Phase 1 ... - compression.rs module with CompressionContext - Compress/Decompress using flate2 (raw deflate, no zlib header) - enable/disable/is_enabled methods - compress/decompress with Sync flush - Unit tests: disabled/enabled/roundtrip/supported All tests pass.	2026-06-21 01:40:07 +08:00
Warren	a8e4e28533	Update AGENTS.md: SMB Oplocks + Lease complete (Phase 1-7 + ACK)	2026-06-21 01:33:44 +08:00
Warren	c3e21560b6	Implement SMB 3.x Lease support Phase 5 ... - WRITE handler trigger lease break (READ leases conflict with WRITE) - READ handler trigger lease break (HANDLE leases may conflict) - Send LeaseBreakNotification via notification channel All 229 tests pass.	2026-06-21 01:24:59 +08:00
Warren	4620475ba8	Implement SMB 3.x Lease support Phase 4 ... - CLOSE handler unregister lease_key from LeaseManager - Extract lease_key from Open struct before close All 229 tests pass.	2026-06-21 01:24:02 +08:00
Warren	344d13435e	Implement SMB 3.x Lease support Phase 3 ... - CREATE handler parse RqLs create context - Extract LeaseKey (16 bytes) + LeaseState (4 bytes) - Check can_grant() before registration - Register with LeaseManager - Set Open.lease_key/lease_state fields All 229 tests pass.	2026-06-21 01:23:32 +08:00
Warren	21a9c3c6c4	Implement SMB 3.x Lease support Phase 1-2 ... Phase 1: Open struct lease fields - lease_key: Option<[u8; 16]> - LeaseKey GUID - lease_state: Option<u32> - READ/HANDLE/WRITE flags - lease_flags: Option<u32> - BREAKING etc. Phase 2: LeaseManager - LeaseEntry with lease_key/state/flags - register/unregister/can_grant methods - break_lease returns LeaseBreakNotification - LeaseBreakNotification struct (MS-SMB2 §2.2.26) ServerState: lease_manager field added All 229 tests pass.	2026-06-21 01:20:18 +08:00
Warren	3cf503d05f	Implement Oplock Break Acknowledgement handler (MS-SMB2 §2.2.24) ... - Parse client's OPLOCK_BREAK_ACK - Update Open.oplock_level in Open struct - Update OplockManager entry via update_oplock_level() - Return confirmation response All 229 tests pass.	2026-06-21 01:15:21 +08:00
Warren	063a697e83	Add READ handler oplock break (Phase 5.5) ... - Trigger oplock break before read if conflicting opens exist - Use granted_access from Open struct - Send notifications via notification_tx channel - Fix WRITE handler granted_access source (from Tree) All 229 tests pass.	2026-06-21 01:13:35 +08:00
Warren	2dd50e4cb6	Implement SMB Oplocks Phase 3+5 ... Phase 3: NotificationQueue - Add notification_tx to Connection struct - Modify writer.rs to use tokio::select! for response + notification - Add write_to_bytes() to OplockBreakNotification - Support server→client async messages Phase 5: WRITE Handler oplock break - Get path/share_access before write - Trigger OplockManager.break_oplock() - Send OPLOCK_BREAK_NOTIFICATION to affected clients - Encode and send via notification channel All 229 tests pass.	2026-06-21 00:35:48 +08:00
Warren	be9fe72742	Update AGENTS.md: SMB Oplocks Phase 1-4-6-7 complete	2026-06-21 00:26:48 +08:00
Warren	276308af12	Implement SMB Byte-range Lock (Phase 7) ... - Add LockManager to oplock.rs: - LockRange struct for tracking byte-range locks - acquire() - check conflicts before granting lock - release() - remove specific lock by offset/length - clear() - clear all locks when file closed - ranges_overlap() - helper for conflict detection - Add LockManager to ServerState - Update handlers/lock.rs: - Parse LockRequest and LockElement - Process each lock element (acquire/release) - Support FLAG_EXCLUSIVE_LOCK, FLAG_SHARED_LOCK, FLAG_UNLOCK - Return STATUS_LOCK_NOT_GRANTED on conflict - Update handlers/close.rs: - Clear all locks when file closed - Add STATUS_LOCK_NOT_GRANTED to ntstatus.rs All 229 tests pass.	2026-06-21 00:25:55 +08:00
Warren	54ce0d6916	Implement SMB Oplocks Phase 4+6 ... Phase 4: CREATE Handler dynamic oplock granting - Use OplockManager.can_grant() to determine oplock level - Register OplockEntry if oplock granted - Support ShareAccess compatibility checking - Grant Level II if exclusive/batch oplock exists Phase 6: CLOSE Handler oplock cleanup - Unregister from OplockManager when file closed - Only unregister if oplock_level > 0 All 229 tests pass.	2026-06-21 00:19:51 +08:00
Warren	27707bbe0e	Implement SMB Oplocks Phase 1-2 ... Phase 1: Data structures - Add oplock_level and share_access fields to Open struct - Update Open::new() signature with new parameters - Update handlers/create.rs to pass oplock params Phase 2: OplockManager - Create oplock.rs with OplockManager struct - OplockEntry for tracking per-client oplock state - can_grant() - check ShareAccess compatibility - register() / unregister() - lifecycle management - break_oplock() - generate OPLOCK_BREAK_NOTIFICATION - Add OplockManager to ServerState - Add Hash trait to SmbPath for HashMap key All 229 tests pass.	2026-06-21 00:17:24 +08:00
Warren	487b4450f8	Implement SSH Banner/MOTD support ... - Add banner and banner_file fields to SshSecurityConfig - Enterprise default: 'MarkBaseSSH - Secure File Transfer Server' - Support banner_file for reading from /etc/motd - Send SSH_MSG_USERAUTH_BANNER before USERAUTH_SUCCESS - Pass security_config to perform_ssh_auth function All 229 tests pass.	2026-06-20 23:33:19 +08:00
Warren	783356852e	Implement SSH Keep-alive support ... - Add keep_alive_interval and keep_alive_max_count to SshSecurityConfig - Enterprise default: 15s interval, 3 max failures - Development default: 30s interval, 5 max failures - Track last_activity timestamp in service loop - Send keepalive@openssh.com channel request when idle - Disconnect after max keepalive failures - Add build_keepalive_request() and get_first_session_channel() - Prevents connection timeout on idle SSH sessions All 229 tests pass.	2026-06-20 23:29:14 +08:00
Warren	82ff713b24	Implement SSH Agent forwarding support ... - Add auth_agent_socket field to Channel struct - Add handle_auth_agent_request() for auth-agent-req@openssh.com - Check SSH_AUTH_SOCK environment variable for agent socket - Respond with SSH_MSG_CHANNEL_SUCCESS if agent available - Foundation for SSH agent forwarding through jump hosts All 229 tests pass.	2026-06-20 23:25:38 +08:00
Warren	a48e253660	Update AGENTS.md: All VFS-layer SMB features complete (Dedup + RAID-Z)	2026-06-20 23:18:05 +08:00