Welcome
+This website is being prepared. Please check back later.
+This site is ready for your content.
+ + +` + const initBundleInstructions = `AutoCAR native deployment bundle This is a private, self-signed-certificate deployment, not a publicly trusted diff --git a/cmd/autocar/init_integration_test.go b/cmd/autocar/init_integration_test.go index 79eb090..299612c 100644 --- a/cmd/autocar/init_integration_test.go +++ b/cmd/autocar/init_integration_test.go @@ -42,7 +42,7 @@ func TestInitGeneratedBundleCarriesNativeTraffic(t *testing.T) { // overridden below with the independently bound QUIC/TLS ephemeral ports; // nothing reserves and releases a port in anticipation of another listener. if err := runInitWith([]string{ - "--server", target.Listener.Addr().String(), "--out", dir, + "--protocol=native", "--server", target.Listener.Addr().String(), "--out", dir, }, io.Discard); err != nil { t.Fatal(err) } @@ -184,3 +184,143 @@ func TestInitGeneratedBundleCarriesNativeTraffic(t *testing.T) { }) } } + +// Only this local harness permits loopback destinations. It checks the generated +// web bundle against live H2/H3 transports without changing relay policy. +func TestInitGeneratedDefaultBundleCarriesWebTraffic(t *testing.T) { + target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + payload, err := io.ReadAll(io.LimitReader(r.Body, 64<<10)) + if err != nil { + http.Error(w, "read test payload", http.StatusBadRequest) + return + } + _, _ = w.Write(payload) + })) + t.Cleanup(func() { + target.CloseClientConnections() + target.Close() + }) + dir := filepath.Join(t.TempDir(), "generated web bundle") + if err := runInitWith([]string{"--server", target.Listener.Addr().String(), "--out", dir}, io.Discard); err != nil { + t.Fatal(err) + } + + serverFlags := flag.NewFlagSet("server", flag.ContinueOnError) + protocol := serverFlags.String("protocol", "", "") + listen := serverFlags.String("listen", "", "") + certFile := serverFlags.String("cert", "", "") + keyFile := serverFlags.String("key", "", "") + tokenFile := serverFlags.String("token-file", "", "") + coverRoot := serverFlags.String("cover-root", "", "") + if err := parseFlagsWithConfig(serverFlags, []string{ + "--config", filepath.Join(dir, "server", "server.json"), "--listen=127.0.0.1:0", + }); err != nil { + t.Fatal(err) + } + if *protocol != "web" || *coverRoot != filepath.Join(dir, "server", "cover") { + t.Fatal("generated web protocol or cover directory did not survive config parsing") + } + certificate, err := security.LoadKeyPair(*certFile, *keyFile) + if err != nil { + t.Fatal(err) + } + token, err := config.LoadSecret(*tokenFile, "") + if err != nil { + t.Fatal(err) + } + tlsConfig, err := security.NewServerTLSConfig(security.ServerTLSOptions{ + Certificates: []tls.Certificate{certificate}, + }) + if err != nil { + t.Fatal(err) + } + cover, err := buildCoverHandler(*coverRoot, "") + if err != nil { + t.Fatal(err) + } + relay, err := tunnel.ListenWeb(tunnel.WebServerConfig{ + TCPAddress: *listen, UDPAddress: *listen, + Token: token, TLSConfig: tlsConfig, Cover: cover, + Dialer: &net.Dialer{Timeout: 5 * time.Second}, + }) + if err != nil { + t.Fatal(err) + } + ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) + serveDone := make(chan error, 1) + go func() { serveDone <- relay.Serve(ctx) }() + t.Cleanup(func() { + cancel() + _ = relay.Close() + select { + case err := <-serveDone: + if err != nil { + t.Errorf("web relay shutdown: %v", err) + } + case <-time.After(5 * time.Second): + t.Error("web relay did not shut down") + } + }) + + for _, mode := range []string{"h2", "h3", "web-auto"} { + t.Run(mode, func(t *testing.T) { + var tf tunnelFlags + clientFlags := flag.NewFlagSet("client", flag.ContinueOnError) + addTunnelFlags(clientFlags, &tf) + args := []string{ + "--config", filepath.Join(dir, "client", "client.json"), + "--server", relay.TCPAddr().String(), "--open-timeout=10s", + } + if mode != "web-auto" { + args = append(args, "--transport", mode) + } + if err := parseFlagsWithConfig(clientFlags, args); err != nil { + t.Fatal(err) + } + if tf.mode != mode { + t.Fatalf("parsed transport = %q, want %q", tf.mode, mode) + } + dialer, err := buildTunnelDialer(tf) + if err != nil { + t.Fatal(err) + } + defer dialer.Close() + probeCtx, stopProbe := context.WithTimeout(ctx, 10*time.Second) + defer stopProbe() + conn, err := dialer.DialContext(probeCtx, "tcp", target.Listener.Addr().String()) + if err != nil { + t.Fatalf("authenticated web tunnel open: %v", err) + } + defer conn.Close() + deadline, _ := probeCtx.Deadline() + if err := conn.SetDeadline(deadline); err != nil { + t.Fatal(err) + } + payload := bytes.Repeat([]byte("generated bundle web traffic\n"), 1024) + request, err := http.NewRequestWithContext(probeCtx, http.MethodPost, target.URL, bytes.NewReader(payload)) + if err != nil { + t.Fatal(err) + } + if err := request.Write(conn); err != nil { + t.Fatalf("write web tunnel payload: %v", err) + } + response, err := http.ReadResponse(bufio.NewReader(conn), request) + if err != nil { + t.Fatalf("read web tunnel response: %v", err) + } + defer response.Body.Close() + got, err := io.ReadAll(io.LimitReader(response.Body, int64(len(payload))+1)) + if err != nil || response.StatusCode != http.StatusOK || !bytes.Equal(got, payload) { + t.Fatalf("web payload roundtrip: status=%d bytes=%d error=%v", response.StatusCode, len(got), err) + } + wantTransport := mode + if mode == "web-auto" { + wantTransport = "h3" + } + reporter, ok := dialer.(selectedTransportReporter) + if !ok || reporter.SelectedTransport() != wantTransport { + t.Fatalf("successful %s exchange did not report transport %s", mode, wantTransport) + } + }) + } +} diff --git a/cmd/autocar/init_test.go b/cmd/autocar/init_test.go index c74a3a1..b3d5b92 100644 --- a/cmd/autocar/init_test.go +++ b/cmd/autocar/init_test.go @@ -10,6 +10,8 @@ import ( "errors" "flag" "io" + "net/http" + "net/http/httptest" "os" "path/filepath" "reflect" @@ -24,17 +26,31 @@ import ( func TestInitCreatesPrivatePortableMatchingBundle(t *testing.T) { for _, test := range []struct { - server string - name string + server string + name string + protocol string + transport string }{ - {"relay.example.com:8443", ""}, - {"127.0.0.1:443", "relay.example.com"}, - {"[::1]:8443", ""}, + {"relay.example.com:8443", "", "", "web-auto"}, + {"127.0.0.1:443", "relay.example.com", "", "web-auto"}, + {"[::1]:8443", "", "", "web-auto"}, + {"relay.example.com:8443", "", "native", "auto"}, + {"127.0.0.1:443", "relay.example.com", "native", "auto"}, + {"[::1]:8443", "", "native", "auto"}, + {"relay.example.com:8443", "", "web", "web-auto"}, + {"relay.example.com:8443", "", " Native ", "auto"}, } { - t.Run(test.server+test.name, func(t *testing.T) { + t.Run(test.server+test.name+"/"+test.protocol, func(t *testing.T) { dir := filepath.Join(t.TempDir(), "new bundle") var stdout bytes.Buffer args := []string{"--server", test.server, "--out", dir, "--days=2"} + if test.protocol != "" { + args = append(args, "--protocol", test.protocol) + } + wantProtocol := "web" + if test.transport == "auto" { + wantProtocol = "native" + } if test.name != "" { args = append(args, "--server-name", test.name) } @@ -44,8 +60,16 @@ func TestInitCreatesPrivatePortableMatchingBundle(t *testing.T) { if !strings.Contains(stdout.String(), "No service or network connection was started") { t.Fatal("initialization output did not state its offline scope") } + if !strings.Contains(stdout.String(), "Created "+wantProtocol+" configuration bundle") { + t.Fatal("initialization output did not identify the generated protocol") + } files := snapshotInitBundle(t, dir) wantFiles := []string{".gitignore", "server/.gitignore", "client/.gitignore", "README.txt", "server/server.json", "server/server.crt", "server/server.key", "server/relay-token", "client/client.json", "client/server.crt", "client/relay-token"} + wantDirectories := []string{".", "server", "client"} + if wantProtocol == "web" { + wantFiles = append(wantFiles, "server/cover/index.html") + wantDirectories = append(wantDirectories, "server/cover") + } if len(files) != len(wantFiles) { t.Fatalf("unexpected bundle file count: %d", len(files)) } @@ -61,7 +85,7 @@ func TestInitCreatesPrivatePortableMatchingBundle(t *testing.T) { } } if runtime.GOOS != "windows" { - for _, name := range []string{".", "server", "client"} { + for _, name := range wantDirectories { info, err := os.Stat(filepath.Join(dir, name)) if err != nil || info.Mode().Perm() != 0o700 { t.Fatalf("directory %s must have mode 0700", name) @@ -101,7 +125,7 @@ func TestInitCreatesPrivatePortableMatchingBundle(t *testing.T) { if err := parseFlagsWithConfig(fs, []string{"--config", filepath.Join(dir, "client", "client.json")}); err != nil { t.Fatal(err) } - if tf.mode != "auto" || tf.systemRoots || tf.server != test.server { + if tf.mode != test.transport || tf.systemRoots || tf.server != test.server { t.Fatal("generated client changed transport, server or trust defaults") } if err := cert.VerifyHostname(tf.serverName); err != nil { @@ -120,9 +144,21 @@ func TestInitCreatesPrivatePortableMatchingBundle(t *testing.T) { } _ = dialer.Close() server, err := readCommandConfig(filepath.Join(dir, "server", "server.json")) - if err != nil || server["protocol"] != "native" || server["allow-private"] != nil || server["disable-tcp-fallback"] != nil { + if err != nil || server["protocol"] != wantProtocol || server["allow-private"] != nil || server["disable-tcp-fallback"] != nil { t.Fatal("generated server changed safe defaults") } + if wantProtocol == "web" { + if server["cover-root"] != "cover" || server["cover-upstream"] != nil { + t.Fatal("web bundle does not use its isolated static cover directory") + } + } else { + if server["cover-root"] != nil || server["cover-upstream"] != nil { + t.Fatal("native bundle unexpectedly contains cover options") + } + if files["README.txt"] != sha256.Sum256([]byte(initBundleInstructions)) { + t.Fatal("native bundle instructions changed") + } + } if err := runInitWith(args, io.Discard); err == nil { t.Fatal("existing output was accepted") } @@ -148,6 +184,9 @@ func TestInitRejectsInvalidOptionsBeforeWriting(t *testing.T) { {"--server", "relay:443", "--server-name", "*.example.com"}, {"--server", "relay:443", "--server-name", "relay:443"}, {"--server", "relay:443", "--days=0"}, {"--server", "relay:443", "--days=1826"}, + {"--server", "relay:443", "--protocol="}, + {"--server", "relay:443", "--protocol", "auto"}, + {"--server", "relay:443", "--protocol", "quic"}, {"--server", "relay:443", "unexpected"}, } { dir := filepath.Join(t.TempDir(), "not-created") @@ -223,24 +262,89 @@ func TestInitHelpAndPartialFailure(t *testing.T) { func TestInitGeneratedConfigurationsPassOfflineChecks(t *testing.T) { clearPreflightEnvironment(t) + dnsCalls := denyPreflightDNS(t) + for _, protocol := range []string{"default-web", "native"} { + t.Run(protocol, func(t *testing.T) { + dir := filepath.Join(t.TempDir(), "bundle") + args := []string{"--server=relay.invalid:8443", "--out", dir} + if protocol == "native" { + args = append(args, "--protocol=native") + } + if err := runInitWith(args, io.Discard); err != nil { + t.Fatal(err) + } + before := snapshotInitBundle(t, dir) + for _, role := range []string{"server", "client"} { + if err := run(context.Background(), []string{role, "--config", filepath.Join(dir, role, role+".json"), "--check"}); err != nil { + t.Fatalf("generated %s offline check: %v", role, err) + } + } + if !reflect.DeepEqual(before, snapshotInitBundle(t, dir)) { + t.Fatal("offline checks changed the generated bundle") + } + // The client trust anchor must contain only the certificate. + data, err := os.ReadFile(filepath.Join(dir, "client", "server.crt")) + if err != nil { + t.Fatal(err) + } + block, rest := pem.Decode(data) + if block == nil || block.Type != "CERTIFICATE" || len(bytes.TrimSpace(rest)) != 0 { + t.Fatal("client trust anchor has unexpected PEM material") + } + }) + } + if dnsCalls.Load() != 0 { + t.Fatal("generated configuration checks performed a DNS lookup") + } +} + +func TestInitDefaultWebCoverKeepsCredentialsOutsideDocumentRoot(t *testing.T) { dir := filepath.Join(t.TempDir(), "bundle") if err := runInitWith([]string{"--server=relay.invalid:8443", "--out", dir}, io.Discard); err != nil { t.Fatal(err) } - for _, role := range []string{"server", "client"} { - if err := run(context.Background(), []string{role, "--config", filepath.Join(dir, role, role+".json"), "--check"}); err != nil { - t.Fatalf("generated %s offline check: %v", role, err) + root := filepath.Join(dir, "server", "cover") + entries, err := os.ReadDir(root) + if err != nil || len(entries) != 1 || entries[0].Name() != "index.html" || entries[0].IsDir() { + t.Fatal("public cover directory contains unexpected files") + } + page, err := os.ReadFile(filepath.Join(root, "index.html")) + if err != nil { + t.Fatal(err) + } + for _, name := range []string{"relay-token", "server.key", "server.crt", "server.json"} { + private, err := os.ReadFile(filepath.Join(dir, "server", name)) + if err != nil { + t.Fatal(err) + } + if bytes.Contains(page, bytes.TrimSpace(private)) { + t.Fatalf("cover page contains private bundle file %s", name) + } + } + handler, err := buildCoverHandler(root, "") + if err != nil { + t.Fatal(err) + } + response := httptest.NewRecorder() + handler.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "https://relay.invalid/", nil)) + if response.Code != http.StatusOK || !bytes.Equal(response.Body.Bytes(), page) { + t.Fatalf("cover page response: status=%d", response.Code) + } + for _, path := range []string{"/relay-token", "/server.key", "/server.crt", "/server.json", "/../server.key"} { + response := httptest.NewRecorder() + handler.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "https://relay.invalid"+path, nil)) + if response.Code == http.StatusOK { + t.Fatalf("cover served private path %s", path) } } - // Confirm this really is a certificate-only client package, not another - // private key hidden behind the trust-anchor filename. - data, err := os.ReadFile(filepath.Join(dir, "client", "server.crt")) + instructions, err := os.ReadFile(filepath.Join(dir, "README.txt")) if err != nil { t.Fatal(err) } - block, rest := pem.Decode(data) - if block == nil || block.Type != "CERTIFICATE" || len(bytes.TrimSpace(rest)) != 0 { - t.Fatal("client trust anchor has unexpected PEM material") + for _, text := range []string{"web-cover deployment bundle", "web/web-auto", "server/cover/", "outside that directory", "init --protocol=native"} { + if !bytes.Contains(instructions, []byte(text)) { + t.Fatalf("web instructions omit %q", text) + } } } diff --git a/cmd/autocar/main.go b/cmd/autocar/main.go index b556b87..33b43d1 100644 --- a/cmd/autocar/main.go +++ b/cmd/autocar/main.go @@ -67,7 +67,7 @@ func printUsage() { Usage: autocar server [options] run the remote native or web-cover relay autocar client [options] run local SOCKS5 and HTTP(S) proxies - autocar init [options] generate a new private native deployment bundle + autocar init [options] generate a private web-cover bundle (or explicit native) autocar cert [options] generate a self-signed TLS certificate autocar token [options] generate a strong shared token autocar bench-server [options] run a benchmark source/sink target diff --git a/cmd/autocar/main_test.go b/cmd/autocar/main_test.go index 4ea3e53..c903617 100644 --- a/cmd/autocar/main_test.go +++ b/cmd/autocar/main_test.go @@ -246,6 +246,7 @@ func TestRunHelpAndUnknownCommand(t *testing.T) { func TestServerRejectsFallbackSourceLimitAboveGlobalLimit(t *testing.T) { err := runServer(context.Background(), []string{ + "--protocol", "native", "--cert", "unused.crt", "--key", "unused.key", "--max-streams", "1", @@ -287,7 +288,7 @@ func TestServerUDPLimitValidation(t *testing.T) { } for _, test := range tests { t.Run(test.name, func(t *testing.T) { - arguments := append([]string{"--cert", "unused.crt", "--key", "unused.key"}, test.arguments...) + arguments := append([]string{"--protocol", "native", "--cert", "unused.crt", "--key", "unused.key"}, test.arguments...) err := runServer(context.Background(), arguments) if err == nil || !strings.Contains(err.Error(), test.want) { t.Fatalf("runServer error = %v, want substring %q", err, test.want) diff --git a/cmd/autocar/preflight_test.go b/cmd/autocar/preflight_test.go index 5bd4cd9..2bbb0b0 100644 --- a/cmd/autocar/preflight_test.go +++ b/cmd/autocar/preflight_test.go @@ -89,6 +89,9 @@ func TestPreflightClientAllTransportsStayOffline(t *testing.T) { } }) } + if err := runClient(context.Background(), files.clientArgs()); err != nil { + t.Fatalf("default web-auto preflight: %v", err) + } if got := dnsCalls.Load(); got != 0 { t.Fatalf("offline checks attempted %d DNS connections", got) } @@ -107,8 +110,10 @@ func TestPreflightServerModesStayOffline(t *testing.T) { name string args []string }{ - {"native", nil}, - {"native mTLS", []string{"--client-ca", files.cert}}, + {"native", []string{"--protocol", "native"}}, + {"native mTLS", []string{"--protocol", "native", "--client-ca", files.cert}}, + {"default web static", []string{"--cover-root", files.cover}}, + {"default web upstream", []string{"--cover-upstream", "https://cover.invalid/"}}, {"web static", []string{"--protocol", "web", "--cover-root", files.cover}}, {"web unresolved upstream", []string{"--protocol", "web", "--cover-upstream", "https://cover.invalid/"}}, {"web live upstream", []string{"--protocol", "web", "--cover-upstream", upstream.URL}}, @@ -199,7 +204,8 @@ func TestPreflightClientRejectsInvalidConfiguration(t *testing.T) { {"CA malformed", "parse CA file", []string{"--ca", files.token}}, {"token missing", "stat secret file", []string{"--token-file", missing}}, {"mTLS pair missing", "supplied together", []string{"--client-cert", files.cert}}, - {"mTLS key missing", "open TLS private key", []string{"--client-cert", files.cert, "--client-key", missing}}, + {"mTLS key missing", "open TLS private key", []string{"--transport", "auto", "--client-cert", files.cert, "--client-key", missing}}, + {"default web mTLS", "web transports do not support mTLS", []string{"--client-cert", files.cert, "--client-key", files.key}}, {"HTTPS pair missing", "requires --proxy-cert", []string{"--https", "127.0.0.1:8443"}}, {"HTTPS key missing", "open TLS private key", []string{"--https", "127.0.0.1:8443", "--proxy-cert", files.cert, "--proxy-key", missing}}, {"idle timeout", "--idle-timeout", []string{"--idle-timeout", "-1s"}}, @@ -248,7 +254,8 @@ func TestPreflightServerRejectsInvalidConfiguration(t *testing.T) { {"web mTLS", "incompatible", []string{"--protocol", "web", "--cover-root", files.cover, "--client-ca", files.cert}}, } { t.Run(test.name, func(t *testing.T) { - err := runServer(context.Background(), append(files.serverArgs(), test.args...)) + args := append(files.serverArgs(), "--protocol", "native") + err := runServer(context.Background(), append(args, test.args...)) if err == nil || !strings.Contains(err.Error(), test.want) { t.Fatalf("error = %v, want substring %q", err, test.want) } @@ -257,7 +264,7 @@ func TestPreflightServerRejectsInvalidConfiguration(t *testing.T) { if err := os.WriteFile(files.token, []byte("short"), 0o600); err != nil { t.Fatal(err) } - if err := runServer(context.Background(), files.serverArgs()); err == nil || !strings.Contains(err.Error(), "token length") { + if err := runServer(context.Background(), append(files.serverArgs(), "--cover-root", files.cover)); err == nil || !strings.Contains(err.Error(), "token length") { t.Fatalf("short token accepted: %v", err) } } @@ -286,12 +293,13 @@ func TestPreflightLocalFilesAndLogs(t *testing.T) { slog.SetDefault(slog.New(slog.NewTextHandler(&output, nil))) t.Cleanup(func() { slog.SetDefault(original) }) if err := runClient(context.Background(), append(files.clientArgs(), + "--transport", "auto", "--https", "127.0.0.1:8443", "--proxy-cert", files.cert, "--proxy-key", files.key, "--client-cert", files.cert, "--client-key", files.key, )); err != nil { t.Fatal(err) } - if err := runServer(context.Background(), files.serverArgs()); err != nil { + if err := runServer(context.Background(), append(files.serverArgs(), "--cover-root", files.cover)); err != nil { t.Fatal(err) } for path, previous := range before { @@ -359,7 +367,7 @@ func TestServerExplicitEmptyClientCAFailsClosed(t *testing.T) { cancel() for _, check := range []string{"true", "false"} { t.Run("check="+check, func(t *testing.T) { - args := append(files.serverArgs(), "--check="+check, "--listen", "127.0.0.1:0", "--client-ca", emptyCA) + args := append(files.serverArgs(), "--protocol", "native", "--check="+check, "--listen", "127.0.0.1:0", "--client-ca", emptyCA) err := runServer(ctx, args) if err == nil || !strings.Contains(err.Error(), "client CA") { t.Fatalf("empty client CA must never disable mTLS, error = %v", err) @@ -380,8 +388,8 @@ func TestPreflightRejectsInsecureCredentialPermissions(t *testing.T) { args []string }{ {"client token", files.token, runClient, files.clientArgs()}, - {"server token", files.token, runServer, files.serverArgs()}, - {"server key", files.key, runServer, files.serverArgs()}, + {"server token", files.token, runServer, append(files.serverArgs(), "--cover-root", files.cover)}, + {"server key", files.key, runServer, append(files.serverArgs(), "--cover-root", files.cover)}, {"proxy key", files.key, runClient, append(files.clientArgs(), "--https", "127.0.0.1:8443", "--proxy-cert", files.cert, "--proxy-key", files.key)}, } { t.Run(test.name, func(t *testing.T) { diff --git a/cmd/autocar/server.go b/cmd/autocar/server.go index 566da3b..53aa648 100644 --- a/cmd/autocar/server.go +++ b/cmd/autocar/server.go @@ -25,7 +25,7 @@ import ( func runServer(parent context.Context, args []string) error { fs := flag.NewFlagSet("server", flag.ContinueOnError) check := fs.Bool("check", false, "validate local configuration and exit without DNS, network connections, or listeners (numeric ports required)") - serverProtocolText := fs.String("protocol", "native", "relay protocol: native or web") + serverProtocolText := fs.String("protocol", "web", "relay protocol: web (requires a cover origin) or native") listen := fs.String("listen", ":443", "primary UDP listen address") tcpListen := fs.String("tcp-listen", "", "TCP listener address; defaults to --listen") disableFallback := fs.Bool("disable-tcp-fallback", false, "disable the TCP/TLS fallback listener") diff --git a/cmd/autocar/web_cli_test.go b/cmd/autocar/web_cli_test.go index 6cbe666..7fd8077 100644 --- a/cmd/autocar/web_cli_test.go +++ b/cmd/autocar/web_cli_test.go @@ -56,11 +56,13 @@ func TestValidateServerProtocolOptions(t *testing.T) { } func TestRunServerValidatesWebCoverBeforeCredentials(t *testing.T) { - err := runServer(context.Background(), []string{"--protocol", "web"}) - if err == nil || !strings.Contains(err.Error(), "exactly one") { - t.Fatalf("missing web cover error = %v", err) + for _, args := range [][]string{nil, {"--protocol", "web"}} { + err := runServer(context.Background(), args) + if err == nil || !strings.Contains(err.Error(), "exactly one") { + t.Fatalf("missing web cover error for %v = %v", args, err) + } } - err = runServer(context.Background(), []string{ + err := runServer(context.Background(), []string{ "--protocol", "web", "--cover-root", "/srv/www", "--client-ca", "clients.pem", @@ -92,7 +94,7 @@ func TestBuildUpstreamCoverRejectsNonHTTPOrigin(t *testing.T) { } } -func TestRunWebServerAcceptsCanceledLifecycle(t *testing.T) { +func TestRunDefaultWebServerAcceptsCanceledLifecycle(t *testing.T) { directory := t.TempDir() certFile := filepath.Join(directory, "server.crt") keyFile := filepath.Join(directory, "server.key") @@ -115,7 +117,6 @@ func TestRunWebServerAcceptsCanceledLifecycle(t *testing.T) { ctx, cancel := context.WithCancel(context.Background()) cancel() if err := runServer(ctx, []string{ - "--protocol", "web", "--listen", "127.0.0.1:0", "--cover-root", coverRoot, "--cert", certFile, @@ -146,6 +147,9 @@ func TestTunnelHelpListsWebTransports(t *testing.T) { var flags tunnelFlags addTunnelFlags(fs, &flags) fs.PrintDefaults() + if flags.mode != "web-auto" || !strings.Contains(output.String(), `default "web-auto"`) { + t.Fatalf("client transport default must be web-auto: flags=%q help=%s", flags.mode, output.String()) + } for _, mode := range []string{"web-auto", "h3", "h2"} { if !strings.Contains(output.String(), mode) { t.Errorf("tunnel help omitted %q: %s", mode, output.String()) diff --git a/cmd/autocar/web_defaults_test.go b/cmd/autocar/web_defaults_test.go new file mode 100644 index 0000000..60bbf04 --- /dev/null +++ b/cmd/autocar/web_defaults_test.go @@ -0,0 +1,77 @@ +package main + +import ( + "bytes" + "context" + "encoding/json" + "flag" + "testing" + + "github.com/cppla/autocar/internal/tunnel" +) + +func TestTunnelTransportDefaultAndExplicitNativeCompatibility(t *testing.T) { + for _, test := range []struct { + name, config, want string + args []string + }{ + {name: "omitted", want: "web-auto"}, + {name: "empty config", config: `{}`, want: "web-auto"}, + {name: "native CLI", args: []string{"--transport=auto"}, want: "auto"}, + {name: "native config", config: `{"transport":"auto"}`, want: "auto"}, + {name: "CLI overrides native config", config: `{"transport":"auto"}`, args: []string{"--transport=web-auto"}, want: "web-auto"}, + } { + t.Run(test.name, func(t *testing.T) { + fs := flag.NewFlagSet("client", flag.ContinueOnError) + var flags tunnelFlags + addTunnelFlags(fs, &flags) + args := test.args + if test.config != "" { + args = append([]string{"--config", writeTestCommandConfig(t, test.config)}, args...) + } + if err := parseFlagsWithConfig(fs, args); err != nil { + t.Fatal(err) + } + if flags.mode != test.want { + t.Fatalf("transport=%q want=%q", flags.mode, test.want) + } + }) + } +} + +func TestServerExplicitNativeConfigurationSurvivesDefaultChange(t *testing.T) { + clearPreflightEnvironment(t) + files := newPreflightFiles(t) + for _, args := range [][]string{ + {"--protocol=native"}, + {"--config", writeTestCommandConfig(t, `{"protocol":"native"}`)}, + {"--config", writeTestCommandConfig(t, `{"protocol":"web"}`), "--protocol=native"}, + } { + if err := runServer(context.Background(), append(files.serverArgs(), args...)); err != nil { + t.Fatalf("explicit native configuration %v: %v", args, err) + } + } +} + +func TestDoctorDefaultsToWebAuto(t *testing.T) { + dialer := &fakeDoctorDialer{snapshot: tunnel.ClientSnapshot{ + SelectedTransport: "h3", ClientPacing: "not-applicable", RelayPacing: "not-applicable", + }} + var stdout, stderr bytes.Buffer + err := runDoctorWith(context.Background(), []string{"--target", "target.invalid:443", "--json"}, &stdout, &stderr, func(flags tunnelFlags) (closeDialer, error) { + if flags.mode != "web-auto" { + t.Fatalf("doctor default transport=%q", flags.mode) + } + return dialer, nil + }) + if err != nil { + t.Fatal(err) + } + var result doctorResult + if err := json.Unmarshal(stdout.Bytes(), &result); err != nil { + t.Fatal(err) + } + if result.RequestedTransport != "web-auto" || result.SelectedTransport != "h3" || !dialer.closed { + t.Fatalf("default doctor result=%+v closed=%t", result, dialer.closed) + } +} diff --git a/cmd/autocar/web_public_origin_test.go b/cmd/autocar/web_public_origin_test.go index 9fb5550..c3dce27 100644 --- a/cmd/autocar/web_public_origin_test.go +++ b/cmd/autocar/web_public_origin_test.go @@ -15,7 +15,7 @@ func TestRunServerPublicOriginValidationBeforeCredentials(t *testing.T) { args []string want string }{ - {"native", []string{"--cover-public-origin", "https://site.test"}, "requires --protocol=web"}, + {"native", []string{"--protocol", "native", "--cover-public-origin", "https://site.test"}, "requires --protocol=web"}, {"static", []string{"--protocol", "web", "--cover-root", "/unused", "--cover-public-origin", "https://site.test"}, "requires --protocol=web"}, {"http public", []string{"--protocol", "web", "--cover-upstream", "http://origin.test", "--cover-public-origin", "http://site.test"}, "configure upstream cover"}, {"whitespace public", []string{"--protocol", "web", "--cover-upstream", "http://origin.test", "--cover-public-origin", " "}, "configure upstream cover"}, diff --git a/docker-compose.yml b/docker-compose.yml index 876462b..67c2503 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -18,8 +18,10 @@ services: profiles: ["server"] command: - server + - --protocol=web - --listen=:8443 - --tcp-listen=:8443 + - --cover-root=/srv/www - --cert=/run/autocar/server.crt - --key=/run/autocar/server.key - --token-file=/run/autocar/relay-token @@ -27,6 +29,7 @@ services: - "${AUTOCAR_RELAY_PORT:-443}:8443/udp" - "${AUTOCAR_RELAY_PORT:-443}:8443/tcp" volumes: + - ./examples/cover:/srv/www:ro - ./secrets/server.crt:/run/autocar/server.crt:ro - ./secrets/server.key:/run/autocar/server.key:ro - ./secrets/relay-token:/run/autocar/relay-token:ro @@ -38,7 +41,7 @@ services: - client - --server=${AUTOCAR_RELAY:-relay.example.com:443} - --server-name=${AUTOCAR_SERVER_NAME:-relay.example.com} - - --transport=${AUTOCAR_TRANSPORT:-auto} + - --transport=${AUTOCAR_TRANSPORT:-web-auto} - --ca=/run/autocar/relay-ca.crt - --token-file=/run/autocar/relay-token - --socks=0.0.0.0:1080 diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md index 7205a62..95caaf3 100644 --- a/docs/ARCHITECTURE.md +++ b/docs/ARCHITECTURE.md @@ -2,9 +2,11 @@ AutoCAR is a split proxy. It terminates local proxy connections and creates new connections at an authenticated relay. The native preferred QUIC path avoids -nesting a reliable TCP stream inside another reliable TCP stream. The opt-in +nesting a reliable TCP stream inside another reliable TCP stream. The default web-cover path instead prioritizes normal HTTP compatibility: H3 is preferred, with genuine HTTPS/H2 over TCP available when UDP is blocked. +Current source CLI defaults are `web` on the relay and `web-auto` on the client; +explicit native configurations remain available and unchanged. ```mermaid flowchart LR diff --git a/docs/BENCHMARK.md b/docs/BENCHMARK.md index 8ce4e99..cd8002c 100644 --- a/docs/BENCHMARK.md +++ b/docs/BENCHMARK.md @@ -12,6 +12,11 @@ Start the bounded target: ./autocar bench-server --listen 127.0.0.1:9000 ``` +`bench-client` defaults to `web-auto` in current source builds. The example +below explicitly selects native `quic` to measure native pacing; match the +transport family to the relay. For web measurements, use `web-auto`, `h3`, or +`h2`; web paths report native pacing as `not-applicable`. + Measure direct and tunneled paths with the same payload, warmup and iterations: ```bash @@ -38,9 +43,10 @@ used that rounded index for medians too, selecting the upper middle observation for even counts. Recompute from raw samples when comparing those reports. The selected transport and sender metadata must remain identical across all measured iterations or the command fails. `transport` is the requested policy -(`auto`, `quic`, `tls` or `direct`); `selected_transport` records the actual -measured path (`quic`, `tls` or `direct`). Do not treat `transport: "auto"` as -evidence that QUIC carried the payload. The output also separates: +(`auto`, `quic`, `tls`, `web-auto`, `h3`, `h2`, or `direct`); +`selected_transport` records the actual measured path (`quic`, `tls`, `h3`, `h2`, +or `direct`). Do not treat `transport: "auto"` or `"web-auto"` as evidence that +QUIC or H3 carried the payload. Native QUIC output also separates: - `local_tx_acceleration`: the client's current sender; - `payload_sender_acceleration`: the sender of the measured payload; diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md index 9d8d932..805035f 100644 --- a/docs/DEPLOYMENT.md +++ b/docs/DEPLOYMENT.md @@ -2,10 +2,14 @@ AutoCAR has two trusted endpoints: a local proxy client and a relay. Native mode prefers AutoCAR v2 over QUIC/UDP and can use a separate native TLS/TCP listener. -Experimental, opt-in web-cover mode presents one normal website over H1/H2/TCP -and H3/UDP and can carry new TCP flows over H2 when UDP is unavailable. Choose one relay protocol -per endpoint and configure clients to match it. The defaults remain a `native` -relay and an `auto` client; installing v1.0.1 does not enable web-cover. +Web-cover mode presents one normal website over H1/H2/TCP and H3/UDP and can +carry new TCP flows over H2 when UDP is unavailable. Current source builds default +to a `web` relay and `web-auto` for `client`, `doctor`, and `bench-client`. +The relay still requires exactly one explicit cover source. Choose one relay +protocol per endpoint and configure clients to match it. Existing explicit +`native`/`auto` settings remain valid; see [default migration](#11-migrating-to-web-cover-defaults) +before upgrading commands or configs that omit those settings. The historical +v1.0.1 binary defaults to `native`/`auto`. ## 1. Build and create credentials @@ -18,7 +22,7 @@ files, and benchmark commands reject them before startup. Normal flag syntax and ### Generate a new paired bundle With a build containing `init` and `--check` (not the published v1.0.1 binary), -you can generate matching native server/client configuration without contacting +you can generate matching web server/client configuration without contacting any network: ```bash @@ -43,6 +47,11 @@ contain the shared token and must remain private. Unix directories are `0700` and files `0600`; Windows deployments must restrict their ACLs independently. Assign ownership/read access to each host's runtime user. Generated `.gitignore` files help prevent accidental Git adds; they are not a storage/access boundary. +The default bundle includes `server/cover/index.html`, a small public welcome +page, and sets `cover-root` to that dedicated directory. Replace its content with +your own public site if needed. Never point cover-root at `server/`, the credential +directory, or the repository root. Use `init --protocol native` to generate the +original native relay/auto client bundle without a cover directory. If writing fails, the incomplete private directory is preserved for inspection; do not deploy it or expect a retry to overwrite it. @@ -52,8 +61,10 @@ the two directories independently movable. Both TCP and UDP listeners use the numeric port in `--server`. No firewall, DNS, service installation or system settings are changed. Low ports still require appropriate capability/port mapping; don't use root simply to bind a low port. Local proxy listeners stay -loopback-only and the default destination policy is unchanged. For public-CA or -experimental web-cover deployments, use the manual configuration below instead. +loopback-only and the default destination policy is unchanged. The generated +self-signed certificate is suitable for a private trust deployment, not proof of +browser-equivalent traffic. For public-CA deployments or a fixed upstream cover, +use the manual configuration below instead. ### Manual credentials and runtime user @@ -92,6 +103,7 @@ name and validity checks and has no certificate-verification bypass. ```bash sudo -u autocar /usr/local/bin/autocar server \ + --protocol native \ --listen :8443 \ --tcp-listen :8443 \ --cert /etc/autocar/server.crt \ @@ -132,8 +144,9 @@ relay. ## 3. Web-cover relay +Web is the current default relay protocol, but a cover source is still required. Use web-cover only with a domain and site content you own or are authorized to -serve. The static form is: +serve. The static form makes the protocol explicit for service configuration: ```bash sudo -u autocar /usr/local/bin/autocar server \ @@ -241,6 +254,9 @@ is unavailable rather than crossing the TLS fallback. ### Web-cover client +`web-auto` is the current default for `client`, `doctor`, and `bench-client`. +This example records it explicitly so that the chosen protocol stays clear: + ```bash ./autocar client \ --server relay.example.com:8443 \ @@ -441,6 +457,10 @@ and [examples/server.json](../examples/server.json) into your credential directory and adjust addresses and filenames. These files contain references, not secrets; keep the existing token and private-key permission requirements. Do not overwrite an existing deployment config without reviewing/backing it up. +The supplied templates select web/web-auto. Copy the dedicated +[examples/cover](../examples/cover/index.html) directory alongside the server +JSON, or change `cover-root` to your authorized public-only site. Explicit +native/auto JSON from an existing deployment continues to use that family. ```bash autocar client --config /etc/autocar/client.json @@ -496,7 +516,8 @@ application requests or migrate already-open streams. ## 5. Pacing -Use `adaptive-balanced` first. `conservative` reduces probing on shared or +For native deployments, select `--protocol native` on the relay and a native +client transport. Use `adaptive-balanced` first. `conservative` reduces probing on shared or shallow-buffer paths; `aggressive` should be enabled only after measuring both throughput and queue delay. `reno` disables the AutoCAR pacing layer and leaves the native upstream quic-go path as the baseline. Web H3 uses the separate pinned @@ -507,6 +528,7 @@ Fixed-rate is appropriate only for a measured, provisioned link: ```bash # Relay policy: finite limits in both directions and explicit client opt-in. ./autocar server [credential/policy flags] \ + --protocol native \ --pacing fixed-rate \ --max-upload-mbps 80 \ --max-download-mbps 250 \ @@ -567,7 +589,7 @@ Wants=network-online.target Type=simple User=autocar Group=autocar -ExecStart=/usr/local/bin/autocar server --listen=:443 --tcp-listen=:443 --cert=/etc/autocar/server.crt --key=/etc/autocar/server.key --token-file=/etc/autocar/relay-token --pacing=adaptive --pacing-profile=balanced +ExecStart=/usr/local/bin/autocar server --protocol=web --listen=:443 --tcp-listen=:443 --cover-root=/srv/autocar-cover --cert=/etc/autocar/server.crt --key=/etc/autocar/server.key --token-file=/etc/autocar/relay-token Restart=on-failure RestartSec=2 NoNewPrivileges=true @@ -576,7 +598,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE PrivateTmp=true ProtectSystem=strict ProtectHome=true -ReadOnlyPaths=/etc/autocar +ReadOnlyPaths=/etc/autocar /srv/autocar-cover LimitNOFILE=65536 [Install] @@ -588,22 +610,22 @@ port 443 as an unprivileged user. Alternatively bind both listeners to a port at or above 1024, remove those lines and redirect/publish the port outside the process. -For web-cover, use the same hardening but select web protocol and an authorized -cover source: +Prepare `/srv/autocar-cover` as an authorized public-only site tree and ensure +`User=autocar` can traverse and read it. For an existing native deployment, +retain its client `--transport=auto` and use this explicit native command: ```ini -ExecStart=/usr/local/bin/autocar server --protocol=web --listen=:443 --tcp-listen=:443 --cover-root=/srv/autocar-cover --cert=/etc/autocar/server.crt --key=/etc/autocar/server.key --token-file=/etc/autocar/relay-token +ExecStart=/usr/local/bin/autocar server --protocol=native --listen=:443 --tcp-listen=:443 --cert=/etc/autocar/server.crt --key=/etc/autocar/server.key --token-file=/etc/autocar/relay-token --pacing=adaptive --pacing-profile=balanced ``` -Add the cover directory to `ReadOnlyPaths` (or an equivalent read-only bind) and -ensure `User=autocar` can traverse and read it. +The native service does not need the cover path in `ReadOnlyPaths`. With a post-v1.0.1 configuration-capable build, first manually copy [examples/server.json](../examples/server.json) to `/etc/autocar/server.json` and adjust its settings, as described in the reusable-configuration section. Templates are not bundled or installed automatically by the release archive or -container image. After preparing that runtime-readable file, the native service -can use: +container image. After preparing that runtime-readable file and its dedicated +cover directory, the web service can use: ```ini ExecStart=/usr/local/bin/autocar server --config=/etc/autocar/server.json --listen=:443 @@ -631,25 +653,27 @@ sudo install -o 65532 -g 65532 -m 0600 \ docker run --rm \ -p 443:8443/udp -p 443:8443/tcp \ -v /etc/autocar-container:/etc/autocar:ro \ + -v /srv/autocar-cover:/srv/www:ro \ autocar:local server \ + --protocol=web --cover-root=/srv/www \ --listen=:8443 --tcp-listen=:8443 \ --cert=/etc/autocar/server.crt \ --key=/etc/autocar/server.key \ --token-file=/etc/autocar/relay-token ``` -For a static web-cover container, mount the authorized site read-only and add -the web flags while keeping both TCP and UDP port publications: +Prepare `/srv/autocar-cover` as an authorized public-only site readable by the +container user. Keep its mount separate from the credentials. For native mode, +omit the site mount, select the native protocol explicitly, and use an `auto`, +`quic`, or `tls` client: ```bash docker run --rm \ -p 443:8443/udp -p 443:8443/tcp \ -v /etc/autocar-container:/etc/autocar:ro \ - -v /srv/autocar-cover:/srv/www:ro \ autocar:local server \ - --protocol=web \ + --protocol=native \ --listen=:8443 --tcp-listen=:8443 \ - --cover-root=/srv/www \ --cert=/etc/autocar/server.crt \ --key=/etc/autocar/server.key \ --token-file=/etc/autocar/relay-token @@ -663,6 +687,14 @@ unless the rootless runtime has been explicitly authorized to bind `443`. The image does not need host networking. Apply memory, CPU, PID and file-descriptor limits appropriate to the configured connection limits. +The checked-in `docker-compose.yml` selects a web relay and defaults clients to +`web-auto`. It mounts `examples/cover` read-only at `/srv/www`; replace that +dedicated sample directory with your authorized site, keeping secrets outside +it. `AUTOCAR_TRANSPORT=h2` or `h3` can require one web path. To keep a native +Compose deployment, override the relay command with `--protocol=native` and no +cover flags, and set `AUTOCAR_TRANSPORT=auto` for its clients. Changing only the +client transport does not change the relay protocol. + ## 9. Validation and upgrade Before production: @@ -746,3 +778,32 @@ configuration when a feature change is not intended. These are deployment acceptance steps, not a claim that every operating system, network, or application has been tested. Cross-compiled release archives alone are not native runtime validation for their target platform. + +## 11. Migrating to web-cover defaults + +Current source builds change only omitted selections: `server --protocol` +defaults to `web`, and `client`, `doctor`, and `bench-client --transport` default +to `web-auto`. A server with no cover source fails validation; it does not +automatically serve its working directory. Saved JSON or CLI settings that +explicitly select `native` and `auto` retain their meaning. Native and web +families remain incompatible and there is no silent fallback between them. + +For an existing native deployment, choose one of these paths before restarting: + +- Preserve native behavior by recording `--protocol=native` on the relay and + `--transport=auto` on clients, diagnostics, and benchmarks, or the matching + `"protocol": "native"` and `"transport": "auto"` JSON keys. Native configurations + must not include web cover fields. +- Migrate both endpoints to web/web-auto in a coordinated deployment. Prepare + exactly one dedicated public-only `cover-root` or fixed authorized + `cover-upstream`, keep keys/tokens outside the site tree, and verify ordinary + H1/H2/H3 responses, authenticated TCP, H3 CONNECT-UDP where needed, and H3-to-H2 + TCP fallback. Use a second TCP/UDP port to stage a rolling migration while the + original native endpoint remains available. + +Retain the previous executable, service configuration and protected credentials. +Restarting either endpoint interrupts active streams; applications must reconnect. +For rollback, restore the matching native relay/client selections together and +repeat the path checks. A successful local `--check` validates configuration, +not network availability or traffic classification. The default change itself +does not establish equivalence to browser traffic or passive-fingerprint quality. diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md index 9a49a20..731dcdd 100644 --- a/docs/PROTOCOL.md +++ b/docs/PROTOCOL.md @@ -10,6 +10,9 @@ AutoCAR has two intentionally separate wire families: Neither family provides third-party proxy protocol or AutoCAR v1 compatibility. A relay selects one family with `server --protocol=native|web`; clients must select a matching native (`auto|quic|tls`) or web (`web-auto|h3|h2`) transport. +Current source CLI defaults select `web` and `web-auto`; a web relay still +requires exactly one explicit cover source. Explicit native settings retain +their existing wire format, and neither family silently downgrades to the other. ## Native protocol v2 diff --git a/docs/RELEASING.md b/docs/RELEASING.md index 9dcd3bf..f4561fa 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -2,7 +2,12 @@ An ordinary AutoCAR release delivers functionality and bug fixes. It does not certify browser equivalence, passive indistinguishability, or a comparative -privacy advantage. v1.0.1 keeps native mode as the default and labels web-cover +privacy advantage. Current source defaults to a web relay and web-auto clients, +diagnostics, and benchmarks; exactly one explicit cover source remains required. +Explicit native/auto configurations retain their meaning. Release notes must +call out the coordinated endpoint migration or explicit native/auto option; +see [deployment migration](DEPLOYMENT.md#11-migrating-to-web-cover-defaults). +The historical v1.0.1 release kept native/auto defaults and introduced web-cover as an experimental, explicitly enabled feature. ## Ordinary release quality @@ -10,7 +15,7 @@ as an experimental, explicitly enabled feature. From the exact, clean release commit, use an explicit version and UTC build time: ```sh -make release VERSION=v1.0.1 BUILD_DATE=2026-09-08T00:00:00Z +make release VERSION=v1.1.0 BUILD_DATE=2026-10-04T00:00:00Z ``` Use a recorded UTC build time rather than copying the example timestamp. The diff --git a/docs/WEB_COVER.md b/docs/WEB_COVER.md index a1af77a..441285d 100644 --- a/docs/WEB_COVER.md +++ b/docs/WEB_COVER.md @@ -1,17 +1,25 @@ # Web-cover mode -AutoCAR v1.0.1 introduces an experimental, opt-in `web` relay mode for deployments +AutoCAR v1.0.1 introduced an experimental, opt-in `web` relay mode for deployments that need a genuine HTTPS origin and reliable TCP service across both UDP-capable and UDP-blocked networks. It is intended for lawful privacy, normal website compatibility, and service continuity on infrastructure the operator owns or is authorized to use. -The default remains a `native` relay and an `auto` client. A normal v1.0.1 -feature/bugfix release does not certify passive-fingerprint quality. Enable -web-cover only after validating the application's required TCP and UDP paths; -see [upgrade and rollback](DEPLOYMENT.md#10-v100-to-v101-upgrade-and-rollback). -Web clients and relays must both support v1.0.1 web mode; v1.0.0 supports native -`autocar/2` only. Web mode never silently downgrades to that native protocol. +Current source builds default to a `web` relay and `web-auto` for clients, +`doctor`, and `bench-client`; the historical v1.0.1 binary retains native/auto +defaults. The relay still requires exactly one explicit `--cover-root` or +`--cover-upstream`. `init` defaults to a paired web/web-auto bundle with a +dedicated `server/cover/index.html`; `init --protocol native` retains the original +native/auto bundle. Existing explicit native/auto JSON is unchanged. + +Validate the application's required TCP and UDP paths before deployment; see +[default migration and rollback](DEPLOYMENT.md#11-migrating-to-web-cover-defaults). +Coordinate the protocol change on both endpoints, or explicitly pin native/auto +before upgrading an existing native deployment. Web clients and relays must +both support the required web features; v1.0.0 supports native `autocar/2` only. +Web mode never silently downgrades to that native protocol. Changing defaults +does not certify passive-fingerprint quality. It is not an “undetectable” mode. Standard HTTP does not make all TLS, QUIC, HTTP framing, packet-size, timing, traffic-volume, endpoint, or application @@ -142,7 +150,10 @@ separate modes and are not wire-compatible. ## Relay configuration -The relay requires exactly one cover source. +The relay defaults to web and requires exactly one explicit cover source. There +is no automatic working-directory or credential-directory cover. Use a dedicated +public-only directory, such as the generated `server/cover/`; never serve the +bundle's `server/` directory or the repository root. ### Static directory @@ -364,6 +375,10 @@ still explicitly choose `--ca` or `--system-roots`. ## Client transports +`web-auto` is the default for `client`, `doctor`, and `bench-client` in current +source builds. The explicit setting below also works with an already configured +web relay and makes the protocol family visible in saved commands. + Recommended configuration: ```bash diff --git a/docs/releases/v1.1.0.md b/docs/releases/v1.1.0.md new file mode 100644 index 0000000..3d16919 --- /dev/null +++ b/docs/releases/v1.1.0.md @@ -0,0 +1,53 @@ +# AutoCAR v1.1.0 + +面向个人部署的功能增强与稳定性更新。新部署默认启用 Web-cover：服务端默认 +`web`，客户端、`doctor` 和隧道基准测试默认 `web-auto`（H3 优先，新 TCP 流在 +传输失败时回退 H2）。这次默认值变更不代表流量与真实浏览器等价或抗识别效果 +已经得到验证。 + +## 主要变化 + +- `autocar init` 默认生成匹配的 Web-cover 双端配置、自签证书、独立网站目录 + 和受保护的随机令牌；`init --protocol=native` 保留 native/auto 部署方式。 +- 支持 JSON 配置，命令行可覆盖配置项，文件路径相对于配置目录解析。 + `client --check`、`server --check` 提供离线检查，不连接网络或打开监听器。 +- `doctor` 提供认证 TCP 路径检查、传输状态和稳定错误码；可显式选择 UDP DNS + 检查，必须指定测试目标和 DNS 名称，不默认访问第三方解析器。 +- 完善网站上游代理的流式请求/响应、trailers、WebSocket 和固定公开源会话支持； + 静态网站目录限制路径逃逸和私密文件访问。 +- 改善 H2 连接复用、TLS 恢复、超时和退出资源回收，以及 H3 连接初始化、 + 认证和取消边界；完善 native QUIC/TLS 的取消、回退和关闭行为。 +- 修复 SOCKS5 UDP 会话与目标队列隔离、HTTP 代理流式传输、基准测试退出回收、 + native 自适应 pacing 和命令行意外位置参数处理。 + +## 升级前必须确认 + +显式设置了 `protocol: native` 和 `transport: auto` 的旧配置不变。省略这些字段 +的旧启动命令或配置会采用新的 Web 默认值，不能只更换一端二进制并假定协议不变。 + +- 保留旧部署：升级前在服务端明确设置 `--protocol=native`，客户端明确设置 + `--transport=auto`；使用 JSON 时补上对应字段。 +- 切换 Web-cover：准备独立网站目录或已获授权的固定 HTTP(S) 上游，服务端明确 + 设置 `--cover-root` 或 `--cover-upstream` 二选一，客户端使用 `web-auto`。 + 推荐在独立端口验证后同时切换两端，保留旧二进制、配置和凭据以便回滚。 +- 手动启动时不会自动把当前目录当作网站，也不会自动访问第三方站点。 + 缺少 cover 配置会明确拒绝启动；`init` 自动生成的仅是可替换的示例页面。 +- v1.0.0 不支持 Web 参数；旧版 native 回滚需恢复原配置，不能携带新 Web 参数。 + v1.0.1 没有 `init`、JSON 配置和离线检查命令。 + +下载后先验证 `SHA256SUMS`，再按自己的网络、证书、出口策略和应用进行验收。 + +## 已知限制 + +- H2 只承载 TCP；H3 到 H2 的回退只影响新 TCP 流，不迁移已建立的流，也不承载 UDP。 + H3 CONNECT-UDP 单包上限为 1,150 字节，无分片或 Capsule 数据回退。 +- Web 不支持 mTLS 和 native fixed-rate pacing。需要这些能力时显式使用 native。 +- H2 目标端 EOF 会结束该 CONNECT 响应并停止剩余上传；收到 EOF 后仍需继续上传的 + 应用应使用 H3。正常客户端上传半关闭仍允许接收目标回复。 +- 默认握手画像、网站 cover 和本地功能测试不能证明与真实浏览器不可区分。 + 未完成的全量被动识别实验不作为本版本的性能或抗识别结论。 +- 交叉构建不等于所有目标系统均完成原生运行测试。 + +安装包覆盖 Linux amd64/arm64、macOS arm64、Windows amd64，内含可执行文件、 +MIT 许可证和第三方许可清单。部署说明见 +[DEPLOYMENT.md](https://github.com/cppla/autocar/blob/v1.1.0/docs/DEPLOYMENT.md)。 diff --git a/examples/client.json b/examples/client.json index e5f5540..67bdfce 100644 --- a/examples/client.json +++ b/examples/client.json @@ -2,5 +2,5 @@ "server": "relay.example.com:8443", "ca": "server.crt", "token-file": "relay-token", - "transport": "auto" + "transport": "web-auto" } diff --git a/examples/cover/index.html b/examples/cover/index.html new file mode 100644 index 0000000..5789da4 --- /dev/null +++ b/examples/cover/index.html @@ -0,0 +1,19 @@ + + + + + +This website is being prepared. Please check back later.
+