mirror of
https://github.com/YuanDevTeam/Vole.git
synced 2026-11-07 00:05:27 +00:00
yiguodev
608a8f255c
* chore: download latest official mihomo for interop tests * test: capture N0 baseline and protocol feasibility probes * docs: record N0 hybrid REALITY fork verification * test: verify N0 controlled Hysteria2 auth and streams Add an isolated Quinn adapter over existing DIRECT and SOCKS5 datagrams, bounded queues, protect rejection probes, and official latest peer fixtures. Record passing auth/TCP checks and the native Hysteria half-close failure separately. N0 remains incomplete; production sources and dependency locks are unchanged. * test: validate N0 native QUIC hopping and XHTTP H3 Keep the probes isolated from production. Verify one-state Hysteria hopping, protected rebind rejection, Xray H3 entry and existing HY2 regressions. Set only the owned Linux peer MTU to avoid Initial-packet EMSGSIZE; retain native half-close failures as separate gates. * fix: align XHTTP shutdown with Mihomo connection close * test: verify N0 supplied-stream transport interfaces Add isolated TLS, ordinary WebSocket and gRPC probes with owned I/O, bounded buffers and cancellation barriers. Match Mihomo close behavior: preserve TLS/WS reads, distinguish clean WS underlay EOF from truncation, and close both gRPC directions. Use separate official SOCKS5 peers to avoid fixture loop detection. Record 12 Debug/Release tests, 42 official Mihomo checks, dependency audits and Apple/Android compile checks. Keep production dependencies, third-party sources and remaining N0 gates unchanged. * fix: upgrade h2 and retain completed responses after reset * chore: use the current OneXray rustls fork origin * chore: adopt published rustls 0.23.45 and official TLS binding * chore: refresh N1 foundation and spike dependencies * feat: validate next-protocol field and combination catalogs * feat: share immutable TLS policies and bounded close semantics * feat: add shared stream transports and decouple XUDP framing * feat: add controlled datagram foundations and N1 acceptance harness * chore: finalize N1 with verified x25519 dependency * chore: publish N1 against the rustls release branch * feat: add bounded Trojan request and datagram codecs * feat: connect Trojan TLS TCP and UDP through the runtime * feat: support Trojan WebSocket and duplex gRPC transports * feat: enable Trojan and complete N2 consumer acceptance * feat(vmess): add bounded AEAD header and body codecs * fix(vmess): align close acceptance with Mihomo transports * feat(vmess): add UDP codecs and isolated peer comparisons * feat(vmess): complete public runtime and N3 acceptance * docs: bind N3 acceptance and refresh validation guidance * feat(vless): complete N4 transports, Vision and UDP support Extract VLESS assembly, add plain/TLS stream transports, HTTPUpgrade, node-owned gRPC pooling, mTLS and classic REALITY, and implement Vision through public TLS record boundaries. Preserve XHTTP and the XUDP default while adding raw and packetaddr. Complete 145 required groups and 39 field rows against isolated latest official peers, with 160 lifecycle/resource rounds, independent coverage and Apple/Android release builds. Preserve the three explicit WS/REALITY layered close comparisons and historical failures in the acceptance report. No third-party or dependency-lock changes. * feat(vless): complete N5 XHTTP and sing-mux support Add H1/H2/H3 request fields, independent download security and pools, bounded packet-up batching, and h2mux/smux/yamux over controlled transports. Keep Mihomo-aligned close and path semantics, node-owned shutdown barriers, and isolated official-peer fixtures including the approved Caddy mTLS gateway. Validate 416 required groups, 57 fields, 112 two-leg security checks, 240 lifecycle/resource cycles, independent coverage, and Apple/Android release builds. Record native-peer gaps and leave N6-N10, devices, CI, and release gates separate. * feat: integrate boring TLS profiles and retire rustls fork * test(tls): freeze selected fingerprint reference baseline * docs(tls): record selected-profile library acceptance * feat(tls): integrate selected client fingerprints and REALITY profiles * feat(tls): complete selected fingerprint CF5 acceptance * feat(hysteria2): complete N6 client support and acceptance Implement Hysteria2 over official Quinn/h3/rustls and shared controlled IO, including TCP/UDP, bandwidth pacing, Salamander, port hopping, upstream snapshots and synchronous Stop. Keep old-path receives active for the full bounded handover window, preserve independent reader wakeups, and require the exact nested TCP evidence assertions. Validate one frozen N6 run: 36 required groups, 20 field rows, native Mihomo/Hysteria peers, H3 regression, 40 lifecycle rounds and Apple/Android production builds. Record independent coverage, artifact hashes and native-peer limitations. * test(tls): record N7 hybrid REALITY prerequisite evidence Preserve the locked classic-only API failure and distinguish the locally accepted boring hybrid extension from pending VCore S03/D16 integration. Record wrapper feasibility and publication boundaries without changing production configuration or dependencies. * feat(vless): support explicitly required hybrid REALITY * feat(crypto): wrap official BLAKE3 binary-context derivation * feat(vless): implement authenticated Encryption wire transport * feat(vless): enable authenticated Encryption across public transports * build(tls): pin the authenticated ShadowTLS ClientHello hook * feat(vless): add authenticated JLS transport security Pin the separately approved boring JLS revision and expose strict main/download credentials under schema 24. Preserve native CertificateVerify and Finished, cancellation, and controlled IO ownership. Accept the JLS field slice with 122 isolated cases, 80 lifecycle/resource cycles, and Apple/Android release libraries; keep broader N7 gates separate. * docs(n7): reconcile current JLS acceptance progress * chore(vless): retire Restls while retaining JLS * feat(vless): complete N7 static ECH and security combinations Add static ECH for VLESS main and XHTTP download legs using existing TLS backends and official Rust HPKE. Keep Invoke v5 and advance the internal schema to revision 27. Accept the narrowed N7 scope with 43 required groups, 11 fields, 301 isolated native cases, 240 lifecycle/resource rounds, and Apple/Android release builds. Record frozen inputs, 470 container cleanups, explicit upstream comparison gaps, and prior failed runs in docs/acceptance/next-protocols/N7.md. * chore(protocols): retire WireGuard scope and foundations * test: complete N9 protocol integration and resource gates * build: add N10 production artifact evidence gates * fix: restore Windows snapshot encoding and fail-closed delivery CI * fix: use native ARM64 LLVM assembly and scoped delivery CI * build: keep delivery lockfile bytes stable across platforms * fix: preserve production guard lifecycle and isolate CI feature checks * build: adopt released boring and registry shadowsocks * ci: use release-oriented workflow names * docs: consolidate contracts and streamline test tooling Merge current protocol and platform contracts, remove milestone reports and obsolete spikes, and share core checks between local development and CI. Preserve all 884 executable case definitions and unique legacy assertions. Validation: core Debug/Release, feature checks, Clippy, netstack, offline script tests, formatting and documentation links passed locally. Container interop smoke attempts failed during official peer downloads; business paths remain NOT RUN. * test: replace milestone names with capability-based validation Rename protocol and fingerprint suites, fixtures, and evidence identifiers by capability. Preserve acceptance cases and golden wire data while documenting reference, wire, and interoperability evidence separately. * fix: address review findings and stabilize core CI Flush accepted gRPC/H2 data through the supplied IO before reset, and wait for pending smux writes before FIN. Sanitize AnyTLS peer failures, reject XHTTP userinfo, and remove stale Android delivery artifacts. Close container log capture even when inventory fails. Keep legacy host suites blocked before resource acquisition. Separate Shadowsocks adapter codec checks from upstream strict server acceptance. Lock the random empty-request zero-padding failure with deterministic negative and positive fixtures, without changing the dependency or production behavior. * test: isolate delivery fixture from Windows home lookup * test: preserve UDP socket semantics during peer teardown The memory peer treated its counterpart closing an mpsc channel as a local UDP BrokenPipe. That could terminate Quinn endpoint IO without waking a pending wait_idle, despite all four datagrams and CONNECTION_CLOSE having arrived. Keep a closed peer link silent and late sends best-effort, add a deterministic fixture regression, and preserve the existing data and shutdown deadlines. Debug/Release, Clippy, and 300 consecutive regression iterations pass. * fix: drain XHTTP uploads before releasing connection drivers * fix: enforce lazy setup deadlines and safe delivery paths Check the original deadline before accepting ready gRPC/H2 headers or sing-mux status, without limiting established reads. Reject symlinks and Windows reparse points in every delivery output path before filesystem mutations. Add deterministic memory and temporary-filesystem regressions. * test: join XHTTP H3 peer tasks during cleanup Quinn retains closed connections for three probe timeouts, so a delayed handshake can legitimately exceed the fixture's two-second wait_idle budget. Own, abort, and join the passive peer tasks after upload and client shutdown instead. Preserve upload integrity and client close bounds, and cover delayed handshakes in both streaming modes.
2.8 KiB
2.8 KiB
服务端测试隔离规则
自 2026-09-23 起，后续所有服务端测试均在隔离容器中执行。本文件是服务端测试部署方式的权威规则，优先于历史脚本和验收记录中的宿主运行说明。
范围
- 协议服务端（Mihomo、Xray、V2Ray、Hysteria、Shadowsocks 等）、UDP echo / TCP / HTTP / DNS 测试原站，以及故障注入中的服务端角色，全部容器化。
- 对照客户端若提供 SOCKS/HTTP 等测试入口，该入口也放在容器中。宿主只运行待测客户端、测试驱动和只读观察工具。
- 纯内存、编解码、离线配置或 mock 单元测试不属于外部服务端互通测试。不能把宿主网络服务改称 mock 来规避隔离。
- 尚未完成容器化、容器不可用或平台不支持的服务端用例记为
BLOCKED/NOT RUN，不得回退到宿主启动。Linux 测试对端不代表 VCore 新增 Linux 产品支持。
执行要求
- 使用本次任务独占、可识别所有权的容器和私有网络。macOS 使用 Apple Container 的 host-only 网络；不发布宿主端口，不改宿主 VPN、路由、DNS 或防火墙。
- 协议对端使用官方最新稳定发行二进制，通过官方
latest下载链接获取；不查版本 API、不本地编译、不修改第三方源码、不静默复用旧缓存。镜像使用官方稳定标签，在当次运行记录解析后的 digest。记录容器内实际版本、二进制和下载包校验值。 - 保留 Mihomo 回环保护和第三方默认 socket 行为；不能通过关闭保护、放宽数据正确性/超时或重试业务包掩盖失败。
- 原站和协议对端的地址必须来自本次容器网络。配置、证书与测试凭据仅放临时目录，fixture 只读挂载，日志保持有界且脱敏。
- 注册清理后再启动资源。成功、失败、超时、SIGINT 和部分启动都必须停止并删除本次拥有的容器，检查剩余资源；不得停止或清理其他任务的容器。
- 报告分别记录隔离拓扑、真实流量结果、源码身份和清理结果。基础设施/清理失败不能记为互通通过；定向诊断通过不等于阶段签收。
已批准的局部例外：H3/mTLS 测试网关可用官方最新稳定版 xcaddy 编译官方最新稳定版 Caddy，再导入隔离容器。保留 go.mod/go.sum、工具版本、构建日志、二进制 hash 和容器内版本；不修改第三方源码、不新增协议 decoder。Caddy 只终结 H3/TLS 并转发 HTTP，XHTTP 会话与 VLESS 解码仍由同一个原生 Xray handler 负责。此例外不允许编译 Mihomo/Xray 等对端，也不把本地构建称为官方预编译产物。
历史宿主测试保留为历史证据，不追改为容器测试。旧脚本即使有 --container，若原站或反向服务仍在宿主，也不满足本规则；迁移前不得用于新的服务端验收。