mirror of
https://github.com/EasyTier/EasyTier.git
synced 2026-10-08 19:06:14 -08:00
KKRainbow
7af7bdc16a
* build(core): consolidate crypto dependencies and trim features
Align AES-GCM, ChaCha20Poly1305, HMAC, SHA2 and HKDF with the versions
already required by Snow and STUN. Align base64 with pbjson, and explain
the coordinated upgrade constraints beside the manifest entries. Adapt
AEAD and HMAC calls without changing packet or key formats, and pin the
WireGuard client key derivation with an independent HKDF vector.
Limit Snow to the Noise algorithms used by the core. Use crossbeam-utils
directly, keep the futures executor in tests, and remove UUID fast-rng
from the core while retaining existing features in native consumers.
Enable browser entropy and certificate time for the rustls backend.
Core default normal/build dependencies fall from 255 to 224 packages;
duplicated package names fall from 24 to 5 against upstream 4837468d.
Validation: Docker tests pass: 970 core, 33 proto (2 ignored), 5
WireGuard, and TCP/UDP three-node encrypted relays. Clippy passes with
warnings denied for core, proto, native and web targets. Browser
default/ChaCha20, WASI and minimal native compile checks pass. Workspace
formatting passes.
* fix(tls): select ring explicitly across application entry points
Building easytier and easytier-web together enabled both ring and aws-lc
through reqwest 0.13. HTTPS endpoint discovery used rustls automatic
provider selection and could panic before sending a ClientHello.
Use reqwest rustls-no-provider to share ring, and explicitly install the
process default before starting CLI, GUI and web services. Initialize it
for standalone webhook construction too, retaining any provider already
selected by the host.
Pass ring directly to HTTPS discovery and WebSocket TLS builders so
library use is independent of application initialization order. Keep
existing certificate verification, SNI and protocol settings.
Add a duplex-stream regression that reproduces the original panic with
both backends enabled, and run it in CI. Explain provider selection and
feature-unification constraints next to the relevant code.
Validation: the new regression fails before the fix and passes after it.
Docker tests pass: 10 discovery, 13 webhook, 2 WebSocket, WSS three-node
AES-GCM relay, and WSS credential connectivity. Clippy with warnings
denied and fmt pass. GUI, browser, WASI, minimal native, endpoint-only
and WebSocket-only compile checks pass. Linux and Windows release
dependency trees contain only the ring runtime backend.
Fixes #2607
* ci: remove the separate rustls backend regression step
Keep the HTTPS discovery regression in the existing test archive and
runner. Avoid an extra core test build solely to enable both rustls
backends; that combination was verified locally before the TLS fix.
* build(web): share reqwest 0.13 with the OIDC client
Disable the reqwest 0.12 client bundled with openidconnect/oauth2 and
use the official oauth2-reqwest adapter around the workspace reqwest
0.13 client. Pin the pre-release adapter version until its API
stabilizes.
Keep the existing redirect policy and 30-second timeout. Initialize the
ring provider when constructing OIDC configuration, including outside
the web application entry point.
Exercise discovery, JWKS fetching, token success and OAuth error
responses against a local mock provider. Verify redirects are not
followed. Refresh Cargo.lock to remove reqwest 0.12 without unrelated
upgrades.
Validation: Docker OIDC tests (2) and webhook tests (13) pass. Clippy
with warnings denied for native/core/proto/web all targets and full
features passes, as does workspace formatting. The default core/web
dependency graph has one reqwest version and 45 multi-version names
instead of 46; the TLS runtime still selects ring only.
OpenHarmonyOS 项目构建说明
本项目需要 OpenHarmonyOS SDK 和多个基础库支持才能成功编译。请按照以下步骤准备构建环境。 如存在任何编译问题，请前往Easytier for OHOS
前置要求
1. 安装 OpenHarmonyOS SDK
SDK 下载链接：
OpenHarmony 每日构建版本
版本要求：
请选择版本号 小于 OpenHarmony_5.1.0.58 的 ohos-sdk-full 版本
下载后请解压到适当位置（如 /usr/local/ohos-sdk），并记下安装路径。
2. 编译依赖库
在编译本项目前，需要先自行编译以下四个基础库：
- glib
- libffi
- pcre2
- zlib
这些库需要使用 OpenHarmonyOS 的工具链进行交叉编译。
环境配置
1. 设置环境变量
创建并运行以下脚本设置环境变量（请根据您的实际 SDK 安装路径修改）：
#!/bin/bash
# 请修改为您的实际 SDK 路径
export OHOS_SDK_PATH="/usr/local/ohos-sdk/linux"
export OHOS_TOOLCHAIN_DIR="${OHOS_SDK_PATH}/native/llvm"
export TARGET_ARCH="aarch64-linux-ohos"
export OHOS_SYSROOT="${OHOS_SDK_PATH}/native/sysroot"
export CC="${OHOS_TOOLCHAIN_DIR}/bin/aarch64-unknown-linux-ohos-clang"
export CXX="${OHOS_TOOLCHAIN_DIR}/bin/aarch64-unknown-linux-ohos-clang++"
export AS="${OHOS_TOOLCHAIN_DIR}/bin/llvm-as"
export AR="${OHOS_TOOLCHAIN_DIR}/bin/llvm-ar"
export LD="${OHOS_TOOLCHAIN_DIR}/bin/ld.lld"
export RANLIB="${OHOS_TOOLCHAIN_DIR}/bin/llvm-ranlib"
export STRIP="${OHOS_TOOLCHAIN_DIR}/bin/llvm-strip"
export OBJDUMP="${OHOS_TOOLCHAIN_DIR}/bin/llvm-objdump"
export OBJCOPY="${OHOS_TOOLCHAIN_DIR}/bin/llvm-objcopy"
export NM="${OHOS_TOOLCHAIN_DIR}/bin/llvm-nm"
export CFLAGS="-fPIC -D__MUSL__=1 -march=armv8-a --target=${TARGET_ARCH} -Wno-error --sysroot=${OHOS_SYSROOT} -I${OHOS_SYSROOT}/usr/include/${TARGET_ARCH}"
export CXXFLAGS="${CFLAGS}"
export LDFLAGS="--sysroot=${OHOS_SYSROOT} -L${OHOS_SYSROOT}/usr/lib/${TARGET_ARCH} -fuse-ld=${LD}"
export PKG_CONFIG_PATH="${OHOS_SYSROOT}/usr/lib/pkgconfig:${OHOS_SYSROOT}/usr/local/lib/pkgconfig"
export PKG_CONFIG_LIBDIR="${OHOS_SYSROOT}/usr/lib:${OHOS_SYSROOT}/usr/local/lib"
export PKG_CONFIG_SYSROOT_DIR="${OHOS_SYSROOT}"
export HOST_TRIPLET="${TARGET_ARCH}"
export BUILD_TRIPLET="$(dpkg-architecture -qDEB_BUILD_GNU_TYPE)"
export PATH="${OHOS_TOOLCHAIN_DIR}/bin:${PATH}"
echo "OpenHarmonyOS 环境变量已设置:"
echo "OHOS_SDK_PATH: ${OHOS_SDK_PATH}"
echo "OHOS_TOOLCHAIN_DIR: ${OHOS_TOOLCHAIN_DIR}"
echo "OHOS_SYSROOT: ${OHOS_SYSROOT}"
echo "PKG_CONFIG_PATH: ${PKG_CONFIG_PATH}"
echo "PATH: ${PATH}"