A relay configured with upstream_api_url = "http://HOST:9090" fails every key
sync with a bare "API returned HTTP 404", which reads like the server is down
or the token is wrong. Neither is true: the management API is nested under the
target server's api.webpath (create_api_router mounts it at
"/{webpath}/api"), because that secret segment is what keeps the panel from
being discoverable by scanners. A bare host:port therefore resolves to a route
that does not exist and the token is never even looked at.
Nothing said so — the config template, the wizard prompt and the shipped
example all suggested exactly the host:port form that cannot work.
- sync_keys now reports the full URL and, for 404 specifically, states that
the webpath must be included and what the URL should look like. 401 is
called out separately as a token mismatch, since the two are otherwise
indistinguishable from the log.
- The relay config template, the shipped example and the wizard prompt now
show the path-bearing form, and the wizard warns when the URL entered has
no path segment rather than letting it fail later.
Docs under docs/ and the wiki are being rewritten concurrently and are left
alone here.
Reflect the crypto hardening in the EN/RU specification:
- Section 6: transport keys now come from Noise Split() over the chaining
key ck (includes the ee DH secret), giving forward secrecy; added the
rationale for why keys must NOT come from the handshake hash h, and the
wire-version-5 gate.
- Section 8: documented the handshake-trial CPU-DoS defense (per-key
secret/marker caching + trial-path token bucket).
- Corrected the handshake replay window (±300s / 5min, was mis-stated as
±30s) and PSK derivation (HKDF-SHA256).
- README.md/README.ru.md: License section still said "Business Source
License 1.1 ... converts to MIT in 2030" while the badge right above it,
Cargo.toml, and LICENSE itself all say AGPL-3.0 — a direct contradiction.
Now both say AGPL-3.0 and link to LICENSE.
- README.md/README.ru.md: CLI Reference / Quick Start described the old
flag-based interface (--init, --check, --generate-key, --links, bare
positional URL) that no longer exists after the subcommand refactor.
Rewrote both to the current `ostp <command>` surface (run/connect/setup/
init/check/gk/links/import/update/migrate/prober/proxy-env/uninstall),
including gk's alias and update's --branch/--version. RU previously had
no command reference at all; added one to match EN.
- docs/{en,ru}/obfuscation.md: removed the XTLS-Reality section (feature
removed in §A) and replaced it with an accurate description of junk
packets + TCP fragmentation, the actual current supplementary stealth
mechanism, including the per-key junk marker (no global DPI signature).
Also corrected the key-derivation and masking-algorithm descriptions,
which described a much older scheme (SHA-256(access_key)[0..8] + static/
nonce-based XOR) than what derive_all_secrets()/derive_payload_mask()
actually implement now (HKDF with version-gated, domain-separated
outputs; HMAC-SHA256 mask keyed on the packet's own ciphertext). The RU
version was additionally rewritten out of an oddly formal "industrial
telemetry" register into plain technical Russian.
Critical fixes (6):
- protocol.rs: in_flight_count() now counts only retransmittable Data frames,
not Ack/Nack control frames — eliminates false backpressure under load
- protocol.rs: NACK is now rate-limited to once per 30ms — prevents
retransmission storm during normal UDP jitter
- protocol.rs: zombie frames exceeding max_retries+4 are evicted each tick —
prevents unbounded memory growth and stale retransmits
- protocol.rs: Closing state now processes final in-flight packets instead
of silently dropping them — prevents data loss at session teardown
- server/lib.rs: stream_tx changed from bounded(10000) to unbounded_channel —
prevents TCP-reader collapse during Speedtest with 50+ streams
- bridge.rs: liveness timeout raised from 30s to 60s — prevents false
reconnect during heavy Speedtest load
Medium fixes (8):
- protocol.rs: ACK range truncation preserves cumulative range (index 0)
- bridge.rs: Ping now uses send_datagram() for correct TURN wrapping
- dispatcher.rs: replay_cache hard-capped at 100k entries (DoS protection)
- dispatcher.rs: old addr cleaned from addr_to_session on roaming
- server/lib.rs: TCP connect_target() now has 10s timeout
- config.rs: TURN section parsed during hot-reload
- proxy.rs: HTTP header parsing uses 512-byte chunks instead of 1-byte reads
- proxy.rs: stream_id wrap-around skips active IDs to prevent collision
- runner.rs: is_essential_log matches actual log strings from bridge.rs
Other:
- kex.rs: clearly marked as dead PQ stub (not used by protocol)
- README.md + README.ru.md: complete rewrite with architecture diagram
- docs/en/specification.md: updated ARQ section with all new semantics
ospab
ospab