ospab
/
ostp
mirror of https://github.com/ospab/ostp.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
561 Commits 3 Branches 207 Tags 168 MiB
Commit Graph

14 Commits

Author SHA1 Message Date
ospab f01ed4ec25 fix(server): constant-time comparison for Management API secrets 
check_token() and handle_login() compared bearer tokens, session tokens,
and the password hash with plain ==, which short-circuits on the first
differing byte - a textbook remote timing side-channel against exactly
the long-lived secrets these gates exist to protect. Added subtle (already
in the dependency tree transitively via chacha20poly1305) as a direct
dependency and route every secret comparison through a small secure_eq()
wrapper over ConstantTimeEq. Username comparison in handle_login is left
as-is: it isn't treated as a secret in this threat model (one fixed admin
username), matching standard practice of only constant-timing the
password/token side of an auth check.

Added tests for secure_eq() itself (equal, different, different-length,
empty) alongside the existing check_token coverage.
 2026-07-18 17:38:09 +03:00
ospab 730eab8553 feat: implement built-in DNS server, adblock and dns leak prevention 2026-06-07 19:55:42 +03:00
ospab 7656f3a3ce feat: implement custom Reality protocol with ChaCha20Poly1305 and X25519 2026-05-29 15:00:17 +03:00
ospab cea8ebaa5c feat: Built-in DNS Server with AdBlock and DoH proxy 2026-05-27 22:23:06 +03:00
ospab 7f499d6263 feat: embed web panel via rust-embed with login page and custom webpath 2026-05-26 21:30:49 +03:00
ospab cba7be4b75 Implement config management API, token generation, and update wiki 2026-05-26 19:33:45 +03:00
ospab d79b6f2384 feat: relay node system with HMAC pre-validation and key sync from upstream API 2026-05-26 16:29:23 +03:00
ospab 743ede0602 Fix duplicate rustls CryptoProvider panic 2026-05-25 22:32:55 +03:00
ospab 3e511f1fc5 Implement XTLS-Reality masquerade for UoT/TCP and fix MTU/config settings 2026-05-24 22:49:51 +03:00
ospab ceb760e4ce feat: implement server-side UoT and MTU tuning 2026-05-21 02:23:49 +03:00
ospab 3e6baf5a06 fix: use portable-atomic for AtomicU64 on 32-bit targets (MIPS, ARM32) 2026-05-17 21:14:07 +03:00
ospab 05583e189e feat: v0.2.0 — BBR congestion control, 0-RTT session resumption, management REST API, fallback server, multi-listener 
Architecture:
- BBR-inspired congestion controller (SlowStart/ProbeBandwidth/ProbeRTT phases)
- 0-RTT session resumption with anti-replay ticket validation
- Management REST API (axum): /api/users CRUD, /api/server/status, Bearer auth
- TCP fallback proxy for anti-DPI camouflage (nginx/caddy passthrough)
- Multi-listener: bind to multiple UDP addresses simultaneously
- Per-user traffic stats with atomic counters and limit enforcement

Code quality:
- Structured logging: 0 eprintln in server/core/client, all tracing::{info,debug,warn,error}
- 35 unit tests across congestion, resumption, relay, outbound, obfuscation
- Removed dead code: kex.rs, unused dependencies (async-trait, x25519-dalek, rand_distr)
- Modular server: api.rs, fallback.rs, outbound.rs, relay.rs extracted from monolithic lib.rs

CLI:
- --check: config validation
- --generate-key: secure key generation (hex/base64, batch)
- --links: share link generation from server config
- --init: fallback section in server template

Documentation:
- README rewritten with architecture diagram, API examples, CLI reference
- Wiki: Management-API (EN+RU), Configuration (EN+RU), Home (EN+RU) updated
 2026-05-17 21:05:44 +03:00
ospab f0a93b4161 perf: heavily tune UDP socket buffers via socket2 to support 10Gbps+ micro-burst resilience 2026-05-17 02:19:59 +03:00
ospab 1ebf01cc65 Initial public release: Ospab Stealth Transport Protocol v0.1.0 2026-05-14 21:41:54 +03:00