236 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Warren	6ef1537c1b	fix(ssh): Add detailed MAC calculation logging for debugging	2026-06-20 14:13:17 +08:00
Warren	ee704095d7	docs: Add Phase 8.3 Docker test results and analysis	2026-06-20 13:44:03 +08:00
Warren	f124082d3d	fix(ssh): Change bind_address to 0.0.0.0 for Docker container access (Phase 8.3)	2026-06-20 13:43:12 +08:00
Warren	fcd2aad0ff	docs: Add Phase 8.3 SCP subsystem test results and summary	2026-06-20 13:16:41 +08:00
Warren	d5a9e95753	feat(ssh): Implement complete SCP file transfer state machine (Phase 8.3)	2026-06-20 12:54:55 +08:00
Warren	cc30a8e9b1	feat(ssh): Add ScpState state machine for SCP file transfer (Phase 8.3 init)	2026-06-20 12:53:25 +08:00
Warren	cdfe227704	docs: Add Phase 8 SCP subsystem technical architecture documentation	2026-06-20 12:46:11 +08:00
Warren	ac84489654	feat(ssh): Replace blocking handle_scp() with direct SCP protocol parsing (Phase 8.2)	2026-06-20 12:06:06 +08:00
Warren	fc6648e4fd	feat(ssh): Implement SCP protocol handling with ChannelReadWrite (Phase 8 complete)	2026-06-20 11:48:57 +08:00
Warren	ac17e1725c	feat(ssh): Add SCP subsystem packet processing framework (Phase 8 partial)	2026-06-20 11:32:55 +08:00
Warren	3e6acee2c5	feat(ssh): Add SCP subsystem initialization (Phase 8 partial)	2026-06-20 01:45:08 +08:00
Warren	495025d006	docs: Update AGENTS.md with Phase 20 WebDAV + SFTP analysis	2026-06-20 01:26:56 +08:00
Warren	62927825d5	feat(web): Add WebDAV endpoint to web server (Port 11438)	2026-06-20 01:14:55 +08:00
Warren	00767c1d26	perf(ssh): Remove ChaCha20-Poly1305 algorithm (AES-GCM already achieves 100 MB/s)	2026-06-19 23:36:47 +08:00
Warren	5f61ebd328	docs: Update AGENTS.md with Phase 3 BufferPool completion	2026-06-19 21:54:56 +08:00
Warren	a4493b8528	perf(ssh): Phase 3 BufferPool - preallocate Vec in hot paths ... Phase 3: Preallocate Vec with capacity to reduce allocations channel.rs: - poll_exec_stdout_and_client(): Vec::with_capacity(channels * 3 + 1) - poll_exec_stdout_with_fds(): Vec::with_capacity(channels * 2) cipher.rs: - AES-CTR decrypt: payload Vec::with_capacity(payload_length) Performance improvement: - ~25% total improvement (Phase 1-3 cumulative) - 100MB transfer: 1 second (~100 MB/s) - 140x improvement from initial 712 KB/s Test: 158 passed, 0 failed	2026-06-19 21:54:01 +08:00
Warren	04a86f77fc	docs: Update AGENTS.md with Phase 18 stdin fix progress	2026-06-19 20:19:39 +08:00
Warren	bd89152e81	feat(ssh): Optimize SSH performance Phase 1-2c + stdin fix ... Phase 1: take_payload() optimization - cipher.rs: Added take_payload() to EncryptedPacket - server.rs: Use take_payload() to avoid .to_vec() copy Phase 2a: reuse_buf for CHANNEL_DATA - channel.rs: Added reuse_buf to ExecProcess - handle_channel_data(): Read directly into reuse buffer Phase 2b: read_buf for stdout/stderr - channel.rs: Added read_buf to ExecProcess - poll_exec_stdout_and_client(): Use read_buf for all reads Phase 2c: AES-GCM padding optimization - cipher.rs: Removed padding .to_vec() in AES-GCM decrypt stdin fix: All exec commands use interactive process - channel.rs: Removed conditional rsync/SCP detection - All exec commands now use handle_interactive_exec() - Fixes cat/grep/sed stdin support (small files working) AES-GCM improvements: - cipher.rs: Added CipherMode enum (AES-GCM vs AES-CTR) - cipher.rs: AES-256 key derivation (32 bytes) - cipher.rs: Nonce format follows OpenSSH inc_iv() - kex.rs: Added aes256-gcm@openssh.com to algorithms Performance: ~21% improvement for small files Test: 158 passed, 0 failed Limitation: Large files (>10MB) not working yet (poll loop issue)	2026-06-19 20:18:20 +08:00
Warren	1650708ac7	Implement Phase 1 AES-GCM packet processing: AEAD encryption/decryption ... Phase 1 complete implementation: - AES-GCM AEAD encryption (EncryptedPacket::new) - AES-GCM AEAD decryption (EncryptedPacket::read) - AES-GCM packet structure: packet_length plaintext + ciphertext + 16-byte tag - AES-GCM nonce: sequence_number (4 bytes -> 12 bytes) - AES-CTR fallback preserved (MtE mode) Key differences AES-GCM vs AES-CTR: - AES-GCM: packet_length is plaintext (as AAD) - AES-CTR: packet_length is encrypted - AES-GCM: 16-byte GCM tag (no separate MAC) - AES-CTR: 32-byte HMAC-SHA256 MAC Performance improvement: - AES-GCM: encrypt+authenticate in one step (AEAD) - AES-CTR: MAC-then-Encrypt (2 steps) Testing: - OpenSSH client negotiated aes256-gcm@openssh.com - cipher_mode set to AesGcm successfully - Next: full SSH connection test	2026-06-19 10:20:29 +08:00
Warren	3575ab7e66	Implement Phase 1: AES-256-GCM algorithm negotiation and cipher mode setting ... Performance optimization Phase 1 implementation: - Add aes-gcm crate dependency (v0.10) - Add CipherMode enum (AesCtr vs AesGcm) - Modify KEX algorithm negotiation: add aes256-gcm@openssh.com - Dynamic cipher mode setting based on KEX result - Fix HMAC trait conflict with fully-qualified syntax Strategy: Conservative approach - Support AES-GCM algorithm negotiation (OpenSSH compatible) - Dynamic cipher mode setting - AES-CTR fallback preserved (packet processing unchanged) Next steps: - Test OpenSSH client AES-GCM negotiation - Implement AES-GCM packet processing if needed - Continue to Phase 4 (parallel encryption)	2026-06-19 10:10:53 +08:00
Warren	c59e33f6e4	Add Caddy configuration management and performance optimization Phase 1-6	2026-06-19 09:53:03 +08:00
Warren	f49e0a8b36	Update AGENTS.md: WebDAV and Download Center status	2026-06-19 09:20:59 +08:00
Warren	a235be312f	Fix duplicate route panic: Remove conflicting '/' route	2026-06-19 09:20:20 +08:00
Warren	00824df4ae	Update AGENTS.md: WebDAV VFS complete, protect Download Center ... - Document WebDAV VFS integration status - Add warning about not affecting Port 11438 - Revert WebDAV routes (temporarily) to protect Download Center - WebDAV can be tested via CLI: webdav-start --port 8002	2026-06-19 09:12:37 +08:00
Warren	eb80c07c85	Implement WebDAV VFS integration: dav-server 0.11 compatible ... - Add webdav.rs module: VfsDavFs, VfsDavFile, VfsDavMetaData - Implement DavFileSystem + Clone for GuardedFileSystem blanket impl - Add clone_boxed to VfsBackend trait (required for Sync) - Update CLI webdav.rs to use VFS instead of SQLite - Add bytes dependency - All 155 tests pass	2026-06-19 08:19:16 +08:00
Warren	df4f3ea4bd	Document WebDAV VFS integration progress (incomplete) ... - Add warning about Download Center protection - Document WebDAV integration status - Note GuardedFileSystem trait issue	2026-06-19 07:32:34 +08:00
Warren	e2d58538f9	Implement Upload Hook for momentry integration (Phase 1) ... - Add upload_hook.rs module: trigger video_probe + video_register on upload - Add UploadHookSection to config: video extensions, binary paths - Integrate with SFTP: handle_close triggers hook on write files - Integrate with SCP/rsync: child process exit triggers hook - All 155 tests pass	2026-06-19 06:26:20 +08:00
Warren	c71811090b	Update AGENTS.md: Add CI Pipeline documentation (v1.19)	2026-06-19 05:22:08 +08:00
Warren	d94cb2df4c	Fix code quality: trailing whitespace, unused imports, clippy warnings ... - Fix trailing whitespace in kex.rs and s3.rs - Add missing KexProposal import in kex_complete.rs - Auto-fix clippy warnings across all crates - All 153 tests pass	2026-06-19 05:21:38 +08:00
Warren	4b37e524cf	Add CI Pipeline: build, test, clippy, fmt check ... - ci.yml: main workflow with build, test, clippy, fmt - macos-build: macOS-specific job - security-audit: dedicated security test job - Remove old linux-test.yml	2026-06-19 04:27:53 +08:00
Warren	756d4154f3	Update AGENTS.md: Security Audit Phase 9 documentation	2026-06-19 04:14:43 +08:00
Warren	963513ef0b	Add Security Audit Phase 9: comprehensive SSH security tests ... - auth_security: password brute force, public key, user status, home dir - crypto_security: AES-CTR, HMAC-SHA256, Curve25519, Ed25519 - file_access_security: path traversal, absolute path, symlink attack - channel_security: window limits, request validation - 18 new security tests, all pass (153 total)	2026-06-19 01:37:59 +08:00
Warren	b1210b0014	Update AGENTS.md: Web frontend Phase 2 documentation	2026-06-19 01:27:48 +08:00
Warren	ea156b65f1	Implement Web frontend Phase 2: Tab switching + search box UI ... - New category_view.html with Apple-style design - Tab switching between Category and Series views - Search box with API integration - Navigation stack for back button - Routes: /downloads and / (root) - All tests pass (135 passed)	2026-06-19 01:25:44 +08:00
Warren	f7cfff27c0	Update AGENTS.md: SFTP authentication DataProvider integration	2026-06-19 01:16:05 +08:00
Warren	dfd76738c9	Refactor sftp/server.rs: integrate DataProvider for authentication ... - MarkBaseSftpServer now accepts Arc<dyn DataProvider> - SshSession implements russh::server::Handler with auth_request - Supports password and public key authentication via DataProvider - Proper impl blocks structure (fix broken code) - run_server() now takes DataProvider parameter	2026-06-19 01:13:23 +08:00
Warren	667d7209e2	Refactor sftp/auth.rs to use DataProvider trait ... - SftpAuth now uses Arc<dyn DataProvider> instead of AuthDb - Add verify_password(), get_user(), get_home_dir() methods - Add unit tests for SftpAuth with SqliteProvider - Maintain backward compatibility with existing tests	2026-06-19 01:06:02 +08:00
Warren	22fcc83535	Update AGENTS.md: S3 VFS + test fixes documentation	2026-06-19 00:50:39 +08:00
Warren	68472e0fb7	Fix all remaining test failures ... - archive::metadata: add failed_files to test_extract_result - archive::tests: use TempDir for validate_extraction_path test - provider::sqlite: fix db path using CARGO_MANIFEST_DIR/../data/auth.sqlite - ssh_server::cipher: use AES-128 key (16 bytes) in test - ssh_server::kex_complete: set kexinit payloads in test - ssh_server::rsync_handler: fix file list flags (use 1, not 0) - ssh_server::sftp_handler: expect SSH_FXP_VERSION at byte 4 (after length prefix) All 135 tests now pass	2026-06-19 00:48:53 +08:00
Warren	5c89b0e169	Fix test compilation errors: archive tests API updates + SSH tests ... - archive/tests/mod.rs: remove optional_formats_test, add test_helpers - archive/tests/test_helpers.rs: update zip/flate2/tar crate APIs - archive/tests/core_formats_test.rs: restructure helper modules - archive/processor.rs: add modified_time field, use actual_ratio() - ssh_server/cipher.rs: add iv_ctos/iv_stoc to SessionKeys tests - ssh_server/crypto.rs: make client_kex/server_kex mutable - ssh_server/sshbuf.rs: fix mutable borrow conflict in test Test result: 123 passed, 12 failed (assertion failures)	2026-06-19 00:25:31 +08:00
Warren	960ee87ce9	Add S3 VFS backend: VfsBackend impl for S3-compatible storage ... - S3Vfs with all 15 VfsBackend methods via rusty-s3 + ureq - S3VfsFile for buffered writes + ranged reads - AWS Signature V4 pre-signed URLs (rusty-s3) - ListObjectsV2 for directory listing (prefix + delimiter) - Path-style URL mapping (/path to bucket/key)	2026-06-18 23:44:52 +08:00
Warren	69efcdf5c5	Update AGENTS.md with public key auth summary	2026-06-18 23:35:53 +08:00
Warren	f90e4f496c	VFS/DataProvider/Config refactoring + SSH public key authentication ... Phase 1-6 of refactoring plan: - VFS abstraction (VfsBackend trait + LocalFs + OpenFlags builder) - DataProvider trait (SqliteProvider + PgProvider, SFTPGo-compatible) - Config refactoring (AppConfig unified sections, env overrides) - SSH handlers (sftp/scp/rsync) migrated to VFS + DataProvider - SSH public key authentication (Ed25519 signature verification) - SSH stderr → CHANNEL_EXTENDED_DATA support - Web auth uses DataProvider instead of direct SQL - User home directory from provider (per-user isolation) - PostgreSQL auth provider for SFTPGo compatibility	2026-06-18 23:35:18 +08:00
Warren	83fb0de78a	Fix 5MB SFTP download hang: batch process SFTP packets + WINDOW_ADJUST chaining ... Root cause: handle_channel_data processed only ONE SFTP packet per call, leaving remaining batched packets stuck in the buffer. Client waited for READ responses while server waited for more data — deadlock after ~3.1MB. Fix: - sftp_handler.rs: fix SSH_FXP_VERSION format (remove uint32 extension_count) - sftp_handler.rs: fix handle_open error mapping (.ok() → build_status_from_io_error) - channel.rs: batch-process ALL complete SFTP packets from buffer in loop - channel.rs: add pending_packets VecDeque for multi-response queuing - channel.rs: chain WINDOW_ADJUST + SFTP response when window is low - channel.rs: add adjust_remote_window() for client WINDOW_ADJUST - server.rs: drain pending_packets after each CHANNEL_DATA handler Verified: 5MB upload + download with matching MD5	2026-06-18 17:15:00 +08:00
Warren	1d81db3af5	Enterprise-grade SFTP reliability improvements ... - Remove all unwrap() calls from SftpAttrs::serialize() and from_metadata() - Add extension advertisement in SSH_FXP_VERSION (10 extensions declared) - Map std::io::ErrorKind to proper SSH_FX_* status codes (NotFound→FX_NO_SUCH_FILE etc.) - Add restrict_absolute flag for chroot-like path confinement mode - Add MAX_HANDLES limit (4096) to prevent handle exhaustion - Add MAX_XFER_SIZE (1MB) and MAX_HASH_SIZE (256MB) OOM protection - Fix test compilation errors (SftpHandler::new signature) - Add build_status_from_io_error() helper for consistent error mapping	2026-06-18 06:42:33 +08:00
Warren	5344a7c16e	Fix rsync: Use real rsync subprocess instead of in-process handler ... In-process RsyncHandler couldn't match openrsync protocol 29 flow after version exchange. Changed handle_rsync_exec() to use handle_interactive_exec() (spawning real rsync --server subprocess), same approach as SCP handler. All file sizes (5MB, 20MB, 50MB, 100MB) successfully transferred with MD5 verification passing. Transfer speed ~712 KB/s limited by AES-256-CTR encryption overhead.	2026-06-18 06:01:16 +08:00
Warren	7fc1f81482	Phase 16.6: Critical discovery - stdin完整但文件未保存 ... 关键发现： - stdin数据：104870522 bytes（约100MB，完整接收） - stdout输出：58 bytes（几乎无输出） - stderr输出：0 bytes（无错误） - upload_100mb.bin: 不存在 结论： - SSH server正确转发stdin数据（完整100MB） - rsync child process接收数据但未写入文件 - 问题不在SSH server，在rsync child process	2026-06-18 00:25:24 +08:00
Warren	ce615d69be	Phase 16 final summary: 50MB success, 100MB pending ... 最终成果： - ✅ 性能优化26倍（780 KB/s → 20+ MB/s） - ✅ 50MB大文件传输成功（MD5一致） - ⚠️ 100MB问题待修复（无CHANNEL_DATA） Git commits: 9个 版本: 1.14（Phase 16基本完成） 下一步： - 总结当前成果或继续修复100MB	2026-06-18 00:11:41 +08:00
Warren	d585a5ee96	Phase 16.5: 100MB diagnosis - no CHANNEL_DATA packets received ... 关键发现： - iteration 0多次启动（poll loop多次调用） - CHANNEL_DATA packet: 0次 ⚠️⚠️⚠️⚠️⚠️ - child process正常退出 - rsync client显示传输成功 问题诊断： - SSH server没有接收rsync数据 - 可能使用SFTP subsystem（不是exec） - 需要检查SFTP handler 下一步：检查SFTP subsystem处理逻辑	2026-06-18 00:11:12 +08:00
Warren	d956bda64a	Phase 16: iteration limit exceeded (10504 vs 2000) ... 根本原因： - iteration次数：10504次（超出2000限制） - 导致100MB传输中断 症状： - SSH server异常退出 - 文件保存失败 修复方案： - 修正iteration计数逻辑 - 或移除iteration限制 - 或暂时接受50MB限制	2026-06-17 23:10:17 +08:00