fix: build errors in ostp-guard, ostp-daemon, ostp-installer
- Make check_analysis_tools() public in ostp-guard - Fix PWSTR type in ostp-installer (use windows::core::PWSTR) - Remove unused imports (Context, Foundation, fileapi, minwindef) Build artifacts in dist/: - Linux x64: ostp-server (9.2 MB), oncp-master (4.8 MB) - Windows x64: ostp-client.exe (1.64 MB), ostp-daemon.exe (0.53 MB), ostp-installer.exe (0.37 MB)
This commit is contained in:
110
dist/linux-amd64/DEPLOY.md
vendored
110
dist/linux-amd64/DEPLOY.md
vendored
@@ -1,110 +0,0 @@
|
|||||||
# OSTP Linux Deployment Package
|
|
||||||
|
|
||||||
## Contents
|
|
||||||
|
|
||||||
- **ostp-server** (4.0 MB) - Stealth VPN Server Binary
|
|
||||||
- **oncp-master** (4.7 MB) - CDN Control Plane Binary
|
|
||||||
- **install.sh** - Automated installation script
|
|
||||||
- **README.md** - Complete deployment guide
|
|
||||||
- **SHA256SUMS** - Binary checksums for verification
|
|
||||||
- **ostp-server.service** - Systemd service file
|
|
||||||
- **oncp-master.service** - Systemd service file
|
|
||||||
- **server.json.example** - Server configuration template
|
|
||||||
- **server-enrollment.json.example** - Auto-enrollment config template
|
|
||||||
|
|
||||||
## Quick Start
|
|
||||||
|
|
||||||
### 1. Verify Checksums
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sha256sum -c SHA256SUMS
|
|
||||||
```
|
|
||||||
|
|
||||||
### 2. Run Installation Script
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo bash install.sh
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3. Configure Server
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Generate PSK
|
|
||||||
ostp-server gen-key
|
|
||||||
|
|
||||||
# Edit config
|
|
||||||
sudo nano /etc/ostp/server.json
|
|
||||||
# Replace PSK with generated key
|
|
||||||
|
|
||||||
# Start service
|
|
||||||
sudo systemctl enable ostp-server
|
|
||||||
sudo systemctl start ostp-server
|
|
||||||
sudo systemctl status ostp-server
|
|
||||||
```
|
|
||||||
|
|
||||||
## System Requirements
|
|
||||||
|
|
||||||
- **OS**: Debian 13+ / Ubuntu 24.04+ / RHEL 9+
|
|
||||||
- **Architecture**: x86_64
|
|
||||||
- **glibc**: 2.41+
|
|
||||||
- **Libraries**: libssl3, libcrypto3
|
|
||||||
- **Privileges**: Root/sudo required
|
|
||||||
|
|
||||||
## Build Information
|
|
||||||
|
|
||||||
- **Date**: January 2, 2026
|
|
||||||
- **Rust Version**: 1.85.0
|
|
||||||
- **Target**: x86_64-unknown-linux-gnu
|
|
||||||
- **glibc**: 2.41 (Debian Trixie)
|
|
||||||
- **Profile**: Release (optimized)
|
|
||||||
|
|
||||||
## Features
|
|
||||||
|
|
||||||
### ostp-server
|
|
||||||
- ✅ AEAD encryption (ChaCha20-Poly1305)
|
|
||||||
- ✅ X25519 key exchange
|
|
||||||
- ✅ TLS mimicry
|
|
||||||
- ✅ Anti-DPI protection
|
|
||||||
- ✅ UDP-over-TCP framing
|
|
||||||
- ✅ Silent PSK validation
|
|
||||||
- ✅ Anti-debugging protection
|
|
||||||
- ✅ Auto-enrollment to CDN
|
|
||||||
|
|
||||||
### oncp-master
|
|
||||||
- ✅ REST API for node management
|
|
||||||
- ✅ Node enrollment system (Pending→Approved→Active)
|
|
||||||
- ✅ CDN steering by country code
|
|
||||||
- ✅ User billing and quota tracking
|
|
||||||
- ✅ Dynamic SNI management
|
|
||||||
- ✅ Real-time dashboard CLI
|
|
||||||
- ✅ Network statistics
|
|
||||||
- ✅ SQLite backend
|
|
||||||
|
|
||||||
## Deployment Scenarios
|
|
||||||
|
|
||||||
### Standalone Server
|
|
||||||
Use `server.json.example` - manual PSK configuration
|
|
||||||
|
|
||||||
### CDN Network Node
|
|
||||||
Use `server-enrollment.json.example` - automatic enrollment with master node
|
|
||||||
|
|
||||||
## Security Considerations
|
|
||||||
|
|
||||||
1. **PSK Protection**: Keep PSKs secure, never commit to version control
|
|
||||||
2. **Firewall**: Restrict master node API to known IPs
|
|
||||||
3. **TLS**: Use reverse proxy for API TLS termination
|
|
||||||
4. **Updates**: Keep binaries updated for security patches
|
|
||||||
5. **Monitoring**: Use systemd logs and `oncp-master dashboard`
|
|
||||||
|
|
||||||
## Documentation
|
|
||||||
|
|
||||||
Full documentation in [README.md](README.md)
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- **GitHub**: https://github.com/ospab/ospab.network
|
|
||||||
- **Issues**: https://github.com/ospab/ospab.network/issues
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Note**: ostp-server requires root privileges for TUN device creation and port binding. Anti-debugging protection (ostp-guard) is enabled in release builds.
|
|
||||||
388
dist/linux-amd64/README.md
vendored
388
dist/linux-amd64/README.md
vendored
@@ -1,388 +0,0 @@
|
|||||||
# OSTP Linux Server Binaries
|
|
||||||
|
|
||||||
## Binaries
|
|
||||||
|
|
||||||
- **ostp-server** (4.0 MB) - OSTP Stealth VPN Server
|
|
||||||
- **oncp-master** (4.7 MB) - CDN Control Plane Master Node
|
|
||||||
|
|
||||||
## System Requirements
|
|
||||||
|
|
||||||
- **OS**: Linux x86_64 (Debian 13+ / Ubuntu 24.04+ / RHEL 9+)
|
|
||||||
- **glibc**: 2.41+ (built on Debian Trixie)
|
|
||||||
- **Libraries**: libssl3, libcrypto3
|
|
||||||
- **Privileges**: Root/sudo required for:
|
|
||||||
- Binding to privileged ports (< 1024)
|
|
||||||
- TUN device creation
|
|
||||||
- System DNS modification
|
|
||||||
|
|
||||||
## Installation
|
|
||||||
|
|
||||||
### 1. Install System Dependencies
|
|
||||||
|
|
||||||
**Debian/Ubuntu:**
|
|
||||||
```bash
|
|
||||||
sudo apt update
|
|
||||||
sudo apt install -y libssl3 openssl ca-certificates
|
|
||||||
```
|
|
||||||
|
|
||||||
**RHEL/Rocky/AlmaLinux:**
|
|
||||||
```bash
|
|
||||||
sudo dnf install -y openssl-libs openssl ca-certificates
|
|
||||||
```
|
|
||||||
|
|
||||||
### 2. Deploy Binaries
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Copy binaries
|
|
||||||
sudo cp ostp-server oncp-master /usr/local/bin/
|
|
||||||
sudo chmod +x /usr/local/bin/{ostp-server,oncp-master}
|
|
||||||
|
|
||||||
# Verify
|
|
||||||
ostp-server --version
|
|
||||||
oncp-master --version
|
|
||||||
```
|
|
||||||
|
|
||||||
## ostp-server Setup
|
|
||||||
|
|
||||||
### Generate PSK
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ostp-server gen-key
|
|
||||||
```
|
|
||||||
|
|
||||||
Save the output securely - this is your Pre-Shared Key.
|
|
||||||
|
|
||||||
### Configuration File
|
|
||||||
|
|
||||||
Create `/etc/ostp/server.json`:
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"listen": "0.0.0.0:8443",
|
|
||||||
"psk": "YOUR_64_CHAR_HEX_PSK_HERE",
|
|
||||||
"max_connections": 1024,
|
|
||||||
"log_level": "info"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### Node Enrollment (Optional)
|
|
||||||
|
|
||||||
For automatic CDN registration:
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"listen": "0.0.0.0:8443",
|
|
||||||
"psk": "AUTO",
|
|
||||||
"master_node_url": "https://master.ospab.internal:8080",
|
|
||||||
"node_name": "node-us-west-1",
|
|
||||||
"hardware_id": "unique-hardware-id",
|
|
||||||
"region": "us-west",
|
|
||||||
"country_code": "US",
|
|
||||||
"max_connections": 1024,
|
|
||||||
"log_level": "info"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
When `psk: "AUTO"`, the server will:
|
|
||||||
1. Submit enrollment request to master node
|
|
||||||
2. Display Node ID
|
|
||||||
3. Wait for administrator approval
|
|
||||||
4. Update config with approved PSK
|
|
||||||
|
|
||||||
### Systemd Service
|
|
||||||
|
|
||||||
Create `/etc/systemd/system/ostp-server.service`:
|
|
||||||
|
|
||||||
```ini
|
|
||||||
[Unit]
|
|
||||||
Description=OSTP Stealth VPN Server
|
|
||||||
After=network-online.target
|
|
||||||
Wants=network-online.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
User=root
|
|
||||||
ExecStart=/usr/local/bin/ostp-server -c /etc/ostp/server.json
|
|
||||||
Restart=on-failure
|
|
||||||
RestartSec=10s
|
|
||||||
LimitNOFILE=65536
|
|
||||||
|
|
||||||
# Security hardening
|
|
||||||
NoNewPrivileges=true
|
|
||||||
PrivateTmp=true
|
|
||||||
ProtectSystem=strict
|
|
||||||
ProtectHome=true
|
|
||||||
ReadWritePaths=/etc/ostp
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
```
|
|
||||||
|
|
||||||
Enable and start:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo systemctl daemon-reload
|
|
||||||
sudo systemctl enable ostp-server
|
|
||||||
sudo systemctl start ostp-server
|
|
||||||
sudo systemctl status ostp-server
|
|
||||||
```
|
|
||||||
|
|
||||||
## oncp-master Setup
|
|
||||||
|
|
||||||
### Initialize Database
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Create data directory
|
|
||||||
sudo mkdir -p /var/lib/oncp
|
|
||||||
cd /var/lib/oncp
|
|
||||||
|
|
||||||
# Initialize (creates oncp.db)
|
|
||||||
oncp-master stats
|
|
||||||
```
|
|
||||||
|
|
||||||
### Configuration
|
|
||||||
|
|
||||||
Create `/etc/oncp/config.env`:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ONCP_DATABASE=/var/lib/oncp/oncp.db
|
|
||||||
ONCP_LISTEN=0.0.0.0:8080
|
|
||||||
RUST_LOG=info
|
|
||||||
```
|
|
||||||
|
|
||||||
### Run API Server
|
|
||||||
|
|
||||||
```bash
|
|
||||||
oncp-master serve --listen 0.0.0.0:8080
|
|
||||||
```
|
|
||||||
|
|
||||||
### Systemd Service
|
|
||||||
|
|
||||||
Create `/etc/systemd/system/oncp-master.service`:
|
|
||||||
|
|
||||||
```ini
|
|
||||||
[Unit]
|
|
||||||
Description=ONCP Master Node - CDN Control Plane
|
|
||||||
After=network-online.target
|
|
||||||
Wants=network-online.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
User=oncp
|
|
||||||
Group=oncp
|
|
||||||
WorkingDirectory=/var/lib/oncp
|
|
||||||
EnvironmentFile=/etc/oncp/config.env
|
|
||||||
ExecStart=/usr/local/bin/oncp-master serve --listen 0.0.0.0:8080 --database /var/lib/oncp/oncp.db
|
|
||||||
Restart=on-failure
|
|
||||||
RestartSec=10s
|
|
||||||
|
|
||||||
# Security hardening
|
|
||||||
NoNewPrivileges=true
|
|
||||||
PrivateTmp=true
|
|
||||||
ProtectSystem=strict
|
|
||||||
ProtectHome=true
|
|
||||||
ReadWritePaths=/var/lib/oncp
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
```
|
|
||||||
|
|
||||||
Create user and start:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo useradd -r -s /bin/false oncp
|
|
||||||
sudo chown -R oncp:oncp /var/lib/oncp
|
|
||||||
sudo systemctl daemon-reload
|
|
||||||
sudo systemctl enable oncp-master
|
|
||||||
sudo systemctl start oncp-master
|
|
||||||
sudo systemctl status oncp-master
|
|
||||||
```
|
|
||||||
|
|
||||||
## Node Enrollment Workflow
|
|
||||||
|
|
||||||
### On Master Node:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# List pending enrollment requests
|
|
||||||
oncp-master node pending
|
|
||||||
|
|
||||||
# Approve node (generates PSK)
|
|
||||||
oncp-master node approve <NODE_ID>
|
|
||||||
|
|
||||||
# Copy the generated PSK
|
|
||||||
```
|
|
||||||
|
|
||||||
### On Server Node:
|
|
||||||
|
|
||||||
Update `/etc/ostp/server.json` with approved PSK:
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"listen": "0.0.0.0:8443",
|
|
||||||
"psk": "APPROVED_PSK_FROM_MASTER_HERE",
|
|
||||||
"master_node_url": "https://master.ospab.internal:8080",
|
|
||||||
...
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
Restart server:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo systemctl restart ostp-server
|
|
||||||
```
|
|
||||||
|
|
||||||
## Management Commands
|
|
||||||
|
|
||||||
### oncp-master CLI
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Dashboard (live monitoring)
|
|
||||||
oncp-master dashboard
|
|
||||||
|
|
||||||
# Node management
|
|
||||||
oncp-master node list
|
|
||||||
oncp-master node add -n "node-1" -a "1.2.3.4:8443" -c US
|
|
||||||
oncp-master node pending
|
|
||||||
oncp-master node approve <NODE_ID>
|
|
||||||
oncp-master node reject <NODE_ID>
|
|
||||||
|
|
||||||
# User management
|
|
||||||
oncp-master user list
|
|
||||||
oncp-master user create -q 100 -d 30
|
|
||||||
oncp-master user config <USER_UUID>
|
|
||||||
|
|
||||||
# SNI management
|
|
||||||
oncp-master sni list
|
|
||||||
oncp-master sni add cloudflare.com -c US
|
|
||||||
oncp-master sni block example.com
|
|
||||||
|
|
||||||
# Statistics
|
|
||||||
oncp-master stats
|
|
||||||
```
|
|
||||||
|
|
||||||
### ostp-server CLI
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Generate PSK
|
|
||||||
ostp-server gen-key
|
|
||||||
|
|
||||||
# Run with config
|
|
||||||
ostp-server -c /etc/ostp/server.json
|
|
||||||
|
|
||||||
# Run with CLI args
|
|
||||||
ostp-server -l 0.0.0.0:8443 -p <PSK_HEX>
|
|
||||||
```
|
|
||||||
|
|
||||||
## API Endpoints
|
|
||||||
|
|
||||||
Master Node REST API (default port 8080):
|
|
||||||
|
|
||||||
- `GET /health` - Health check
|
|
||||||
- `GET /api/v1/nodes` - List nodes
|
|
||||||
- `POST /api/v1/nodes` - Register node
|
|
||||||
- `POST /api/v1/nodes/:id/checkin` - Node heartbeat
|
|
||||||
- `GET /api/v1/nodes/best?country=US&limit=3` - CDN steering
|
|
||||||
- `POST /api/v1/enrollment/request` - Submit enrollment
|
|
||||||
- `GET /api/v1/enrollment/pending` - List pending
|
|
||||||
- `POST /api/v1/enrollment/:id/approve` - Approve node
|
|
||||||
- `GET /api/v1/users` - List users
|
|
||||||
- `POST /api/v1/users` - Create user
|
|
||||||
- `GET /api/v1/sni` - List SNIs
|
|
||||||
- `POST /api/v1/sni` - Update SNI
|
|
||||||
- `GET /api/v1/stats` - Network statistics
|
|
||||||
|
|
||||||
## Firewall Configuration
|
|
||||||
|
|
||||||
### ostp-server (Server Node)
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Allow OSTP port
|
|
||||||
sudo ufw allow 8443/tcp comment 'OSTP Server'
|
|
||||||
|
|
||||||
# Allow outbound to master node
|
|
||||||
sudo ufw allow out 8080/tcp comment 'ONCP Master'
|
|
||||||
```
|
|
||||||
|
|
||||||
### oncp-master (Master Node)
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Allow API access
|
|
||||||
sudo ufw allow 8080/tcp comment 'ONCP API'
|
|
||||||
|
|
||||||
# Restrict to server IPs only (recommended)
|
|
||||||
sudo ufw allow from <SERVER_IP> to any port 8080 proto tcp
|
|
||||||
```
|
|
||||||
|
|
||||||
## Logs
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# ostp-server logs
|
|
||||||
sudo journalctl -u ostp-server -f
|
|
||||||
|
|
||||||
# oncp-master logs
|
|
||||||
sudo journalctl -u oncp-master -f
|
|
||||||
```
|
|
||||||
|
|
||||||
## Troubleshooting
|
|
||||||
|
|
||||||
### Check Binary Compatibility
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ldd ostp-server
|
|
||||||
ldd oncp-master
|
|
||||||
```
|
|
||||||
|
|
||||||
If you see "not found" errors, install missing libraries.
|
|
||||||
|
|
||||||
### Check glibc Version
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ldd --version
|
|
||||||
```
|
|
||||||
|
|
||||||
Required: glibc 2.41+ (Debian 13+ / Ubuntu 24.04+)
|
|
||||||
|
|
||||||
For older distributions, build from source:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
cargo build -p ostp-server -p oncp-master --release --target x86_64-unknown-linux-musl
|
|
||||||
```
|
|
||||||
|
|
||||||
### Permission Errors
|
|
||||||
|
|
||||||
Ensure running as root or with appropriate capabilities:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo setcap cap_net_bind_service,cap_net_admin+ep /usr/local/bin/ostp-server
|
|
||||||
```
|
|
||||||
|
|
||||||
### Network Connectivity
|
|
||||||
|
|
||||||
Test master node API:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
curl http://localhost:8080/health
|
|
||||||
```
|
|
||||||
|
|
||||||
Expected: `{"status":"ok","version":"0.1.0","nodes_online":0}`
|
|
||||||
|
|
||||||
## Security Notes
|
|
||||||
|
|
||||||
1. **PSK Protection**: Never commit PSKs to version control
|
|
||||||
2. **TLS**: Use reverse proxy (nginx/caddy) for TLS termination on API
|
|
||||||
3. **Firewall**: Restrict master node API to known server IPs
|
|
||||||
4. **Updates**: Keep binaries updated for security patches
|
|
||||||
5. **Monitoring**: Use `oncp-master dashboard` for network health
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- GitHub: https://github.com/ospab/ospab.network
|
|
||||||
- Issues: https://github.com/ospab/ospab.network/issues
|
|
||||||
|
|
||||||
## Build Info
|
|
||||||
|
|
||||||
- **Built**: January 2, 2026
|
|
||||||
- **Rust**: 1.85.0
|
|
||||||
- **Target**: x86_64-unknown-linux-gnu
|
|
||||||
- **glibc**: 2.41 (Debian Trixie)
|
|
||||||
- **Profile**: Release (optimized)
|
|
||||||
2
dist/linux-amd64/SHA256SUMS
vendored
2
dist/linux-amd64/SHA256SUMS
vendored
@@ -1,2 +0,0 @@
|
|||||||
0987a1c45eb117f1bc447654a891755667276f76f032f7d1644318e913380f4a ostp-server
|
|
||||||
20f6418335e52873ab5c60afcb6468eaf2edd42d0c4174caf6875257fb643e16 oncp-master
|
|
||||||
107
dist/linux-amd64/install.sh
vendored
107
dist/linux-amd64/install.sh
vendored
@@ -1,107 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
echo "========================================"
|
|
||||||
echo " OSTP Server Installation Script"
|
|
||||||
echo "========================================"
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
# Check for root
|
|
||||||
if [ "$EUID" -ne 0 ]; then
|
|
||||||
echo "❌ Please run as root or with sudo"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Detect distro
|
|
||||||
if [ -f /etc/os-release ]; then
|
|
||||||
. /etc/os-release
|
|
||||||
OS=$ID
|
|
||||||
VERSION=$VERSION_ID
|
|
||||||
else
|
|
||||||
echo "❌ Cannot detect Linux distribution"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "✓ Detected: $PRETTY_NAME"
|
|
||||||
|
|
||||||
# Install dependencies
|
|
||||||
echo ""
|
|
||||||
echo "📦 Installing dependencies..."
|
|
||||||
case $OS in
|
|
||||||
debian|ubuntu)
|
|
||||||
apt update
|
|
||||||
apt install -y libssl3 openssl ca-certificates
|
|
||||||
;;
|
|
||||||
rhel|rocky|almalinux|centos)
|
|
||||||
dnf install -y openssl-libs openssl ca-certificates
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo "⚠️ Unknown distribution. Please install libssl3 manually."
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
# Create directories
|
|
||||||
echo ""
|
|
||||||
echo "📁 Creating directories..."
|
|
||||||
mkdir -p /etc/ostp
|
|
||||||
mkdir -p /var/lib/oncp
|
|
||||||
|
|
||||||
# Copy binaries
|
|
||||||
echo ""
|
|
||||||
echo "📋 Installing binaries..."
|
|
||||||
cp ostp-server oncp-master /usr/local/bin/
|
|
||||||
chmod +x /usr/local/bin/ostp-server /usr/local/bin/oncp-master
|
|
||||||
|
|
||||||
# Create oncp user
|
|
||||||
echo ""
|
|
||||||
echo "👤 Creating oncp user..."
|
|
||||||
if ! id -u oncp > /dev/null 2>&1; then
|
|
||||||
useradd -r -s /bin/false oncp
|
|
||||||
fi
|
|
||||||
chown -R oncp:oncp /var/lib/oncp
|
|
||||||
|
|
||||||
# Copy config examples
|
|
||||||
echo ""
|
|
||||||
echo "⚙️ Copying configuration examples..."
|
|
||||||
if [ ! -f /etc/ostp/server.json ]; then
|
|
||||||
cp server.json.example /etc/ostp/server.json
|
|
||||||
echo " Created /etc/ostp/server.json"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Copy systemd services
|
|
||||||
echo ""
|
|
||||||
echo "🔧 Installing systemd services..."
|
|
||||||
cp ostp-server.service /etc/systemd/system/
|
|
||||||
cp oncp-master.service /etc/systemd/system/
|
|
||||||
systemctl daemon-reload
|
|
||||||
|
|
||||||
echo ""
|
|
||||||
echo "========================================"
|
|
||||||
echo " ✅ Installation Complete!"
|
|
||||||
echo "========================================"
|
|
||||||
echo ""
|
|
||||||
echo "📝 Next steps:"
|
|
||||||
echo ""
|
|
||||||
echo "1. Generate PSK:"
|
|
||||||
echo " ostp-server gen-key"
|
|
||||||
echo ""
|
|
||||||
echo "2. Edit config:"
|
|
||||||
echo " nano /etc/ostp/server.json"
|
|
||||||
echo " (Replace PSK with generated key)"
|
|
||||||
echo ""
|
|
||||||
echo "3. Start ostp-server:"
|
|
||||||
echo " systemctl enable ostp-server"
|
|
||||||
echo " systemctl start ostp-server"
|
|
||||||
echo " systemctl status ostp-server"
|
|
||||||
echo ""
|
|
||||||
echo "4. (Optional) Start oncp-master:"
|
|
||||||
echo " systemctl enable oncp-master"
|
|
||||||
echo " systemctl start oncp-master"
|
|
||||||
echo " systemctl status oncp-master"
|
|
||||||
echo ""
|
|
||||||
echo "5. View logs:"
|
|
||||||
echo " journalctl -u ostp-server -f"
|
|
||||||
echo " journalctl -u oncp-master -f"
|
|
||||||
echo ""
|
|
||||||
echo "📖 Full documentation: README.md"
|
|
||||||
echo ""
|
|
||||||
23
dist/linux-amd64/oncp-master.service
vendored
23
dist/linux-amd64/oncp-master.service
vendored
@@ -1,23 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=ONCP Master Node - CDN Control Plane
|
|
||||||
After=network-online.target
|
|
||||||
Wants=network-online.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
User=oncp
|
|
||||||
Group=oncp
|
|
||||||
WorkingDirectory=/var/lib/oncp
|
|
||||||
ExecStart=/usr/local/bin/oncp-master serve --listen 0.0.0.0:8080 --database /var/lib/oncp/oncp.db --log-level info
|
|
||||||
Restart=on-failure
|
|
||||||
RestartSec=10s
|
|
||||||
|
|
||||||
# Security hardening
|
|
||||||
NoNewPrivileges=true
|
|
||||||
PrivateTmp=true
|
|
||||||
ProtectSystem=strict
|
|
||||||
ProtectHome=true
|
|
||||||
ReadWritePaths=/var/lib/oncp
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
23
dist/linux-amd64/ostp-server.service
vendored
23
dist/linux-amd64/ostp-server.service
vendored
@@ -1,23 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=OSTP Stealth VPN Server
|
|
||||||
After=network-online.target
|
|
||||||
Wants=network-online.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Type=simple
|
|
||||||
User=root
|
|
||||||
WorkingDirectory=/etc/ostp
|
|
||||||
ExecStart=/usr/local/bin/ostp-server -c /etc/ostp/server.json
|
|
||||||
Restart=on-failure
|
|
||||||
RestartSec=10s
|
|
||||||
LimitNOFILE=65536
|
|
||||||
|
|
||||||
# Security hardening
|
|
||||||
NoNewPrivileges=true
|
|
||||||
PrivateTmp=true
|
|
||||||
ProtectSystem=strict
|
|
||||||
ProtectHome=true
|
|
||||||
ReadWritePaths=/etc/ostp
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
11
dist/linux-amd64/server-enrollment.json.example
vendored
11
dist/linux-amd64/server-enrollment.json.example
vendored
@@ -1,11 +0,0 @@
|
|||||||
{
|
|
||||||
"listen": "0.0.0.0:8443",
|
|
||||||
"psk": "AUTO",
|
|
||||||
"master_node_url": "http://master.ospab.internal:8080",
|
|
||||||
"node_name": "ostp-node-1",
|
|
||||||
"hardware_id": "server-unique-id",
|
|
||||||
"region": "us-west",
|
|
||||||
"country_code": "US",
|
|
||||||
"max_connections": 1024,
|
|
||||||
"log_level": "info"
|
|
||||||
}
|
|
||||||
6
dist/linux-amd64/server.json.example
vendored
6
dist/linux-amd64/server.json.example
vendored
@@ -1,6 +0,0 @@
|
|||||||
{
|
|
||||||
"listen": "0.0.0.0:8443",
|
|
||||||
"psk": "REPLACE_WITH_GENERATED_PSK_FROM_gen-key_COMMAND",
|
|
||||||
"max_connections": 1024,
|
|
||||||
"log_level": "info"
|
|
||||||
}
|
|
||||||
Binary file not shown.
Binary file not shown.
BIN
dist/ostp-linux-amd64.zip
vendored
BIN
dist/ostp-linux-amd64.zip
vendored
Binary file not shown.
BIN
dist/ostp-windows-amd64.zip
vendored
BIN
dist/ostp-windows-amd64.zip
vendored
Binary file not shown.
220
dist/windows-amd64/README.md
vendored
220
dist/windows-amd64/README.md
vendored
@@ -1,220 +0,0 @@
|
|||||||
# OSTP Windows Binaries
|
|
||||||
|
|
||||||
## Contents
|
|
||||||
|
|
||||||
- **ostp-server.exe** (3.52 MB) - OSTP Stealth VPN Server
|
|
||||||
- **oncp-master.exe** (4.02 MB) - CDN Control Plane Master Node
|
|
||||||
- **SHA256SUMS.txt** - Binary checksums
|
|
||||||
|
|
||||||
## System Requirements
|
|
||||||
|
|
||||||
- **OS**: Windows 10/11 (x64)
|
|
||||||
- **Privileges**: Administrator required for TUN device and system DNS
|
|
||||||
|
|
||||||
## Installation
|
|
||||||
|
|
||||||
### 1. Verify Checksums
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
Get-FileHash ostp-server.exe -Algorithm SHA256
|
|
||||||
Get-FileHash oncp-master.exe -Algorithm SHA256
|
|
||||||
```
|
|
||||||
|
|
||||||
Compare with values in `SHA256SUMS.txt`
|
|
||||||
|
|
||||||
### 2. Place Binaries
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
# Create directory
|
|
||||||
New-Item -Path "C:\Program Files\OSTP" -ItemType Directory -Force
|
|
||||||
|
|
||||||
# Copy binaries
|
|
||||||
Copy-Item ostp-server.exe,oncp-master.exe "C:\Program Files\OSTP\"
|
|
||||||
|
|
||||||
# Add to PATH (optional)
|
|
||||||
[Environment]::SetEnvironmentVariable("Path", $env:Path + ";C:\Program Files\OSTP", "Machine")
|
|
||||||
```
|
|
||||||
|
|
||||||
## ostp-server Usage
|
|
||||||
|
|
||||||
### Generate PSK
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
ostp-server.exe gen-key
|
|
||||||
```
|
|
||||||
|
|
||||||
### Create Configuration
|
|
||||||
|
|
||||||
Create `C:\Program Files\OSTP\server.json`:
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"listen": "0.0.0.0:8443",
|
|
||||||
"psk": "YOUR_64_CHAR_HEX_PSK_HERE",
|
|
||||||
"max_connections": 1024,
|
|
||||||
"log_level": "info"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
### Run Server
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
# Run directly (Administrator required)
|
|
||||||
ostp-server.exe -c "C:\Program Files\OSTP\server.json"
|
|
||||||
|
|
||||||
# Or with CLI args
|
|
||||||
ostp-server.exe -l 0.0.0.0:8443 -p YOUR_PSK_HEX
|
|
||||||
```
|
|
||||||
|
|
||||||
### Install as Windows Service
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
# Using NSSM (Non-Sucking Service Manager)
|
|
||||||
nssm install OSTP-Server "C:\Program Files\OSTP\ostp-server.exe" -c "C:\Program Files\OSTP\server.json"
|
|
||||||
nssm set OSTP-Server AppDirectory "C:\Program Files\OSTP"
|
|
||||||
nssm set OSTP-Server DisplayName "OSTP Stealth VPN Server"
|
|
||||||
nssm set OSTP-Server Description "OSTP stealth transport protocol server"
|
|
||||||
nssm set OSTP-Server Start SERVICE_AUTO_START
|
|
||||||
|
|
||||||
# Start service
|
|
||||||
nssm start OSTP-Server
|
|
||||||
|
|
||||||
# Check status
|
|
||||||
nssm status OSTP-Server
|
|
||||||
```
|
|
||||||
|
|
||||||
Download NSSM: https://nssm.cc/download
|
|
||||||
|
|
||||||
## oncp-master Usage
|
|
||||||
|
|
||||||
### Initialize Database
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
# Create data directory
|
|
||||||
New-Item -Path "C:\ProgramData\ONCP" -ItemType Directory -Force
|
|
||||||
cd "C:\ProgramData\ONCP"
|
|
||||||
|
|
||||||
# Initialize database
|
|
||||||
oncp-master.exe stats
|
|
||||||
```
|
|
||||||
|
|
||||||
### Run API Server
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
oncp-master.exe serve --listen 0.0.0.0:8080 --database "C:\ProgramData\ONCP\oncp.db"
|
|
||||||
```
|
|
||||||
|
|
||||||
### Management Commands
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
# Dashboard
|
|
||||||
oncp-master.exe dashboard
|
|
||||||
|
|
||||||
# Node management
|
|
||||||
oncp-master.exe node list
|
|
||||||
oncp-master.exe node pending
|
|
||||||
oncp-master.exe node approve <NODE_ID>
|
|
||||||
|
|
||||||
# User management
|
|
||||||
oncp-master.exe user create -q 100 -d 30
|
|
||||||
oncp-master.exe user list
|
|
||||||
|
|
||||||
# SNI management
|
|
||||||
oncp-master.exe sni list
|
|
||||||
oncp-master.exe sni add cloudflare.com -c US
|
|
||||||
```
|
|
||||||
|
|
||||||
### Install as Windows Service
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
nssm install ONCP-Master "C:\Program Files\OSTP\oncp-master.exe" serve --listen 0.0.0.0:8080 --database "C:\ProgramData\ONCP\oncp.db"
|
|
||||||
nssm set ONCP-Master AppDirectory "C:\ProgramData\ONCP"
|
|
||||||
nssm set ONCP-Master DisplayName "ONCP Master Node"
|
|
||||||
nssm set ONCP-Master Start SERVICE_AUTO_START
|
|
||||||
|
|
||||||
nssm start ONCP-Master
|
|
||||||
```
|
|
||||||
|
|
||||||
## Firewall Configuration
|
|
||||||
|
|
||||||
```powershell
|
|
||||||
# Allow OSTP server port
|
|
||||||
New-NetFirewallRule -DisplayName "OSTP Server" -Direction Inbound -LocalPort 8443 -Protocol TCP -Action Allow
|
|
||||||
|
|
||||||
# Allow ONCP API port
|
|
||||||
New-NetFirewallRule -DisplayName "ONCP Master API" -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow
|
|
||||||
```
|
|
||||||
|
|
||||||
## Features
|
|
||||||
|
|
||||||
### ostp-server.exe
|
|
||||||
- ✅ AEAD encryption (ChaCha20-Poly1305)
|
|
||||||
- ✅ X25519 key exchange
|
|
||||||
- ✅ TLS mimicry
|
|
||||||
- ✅ UDP-over-TCP framing
|
|
||||||
- ✅ Silent PSK validation
|
|
||||||
- ✅ Anti-debugging protection (ostp-guard)
|
|
||||||
- ✅ Auto-enrollment to CDN
|
|
||||||
|
|
||||||
### oncp-master.exe
|
|
||||||
- ✅ REST API for node/user management
|
|
||||||
- ✅ Node enrollment system
|
|
||||||
- ✅ CDN steering by country
|
|
||||||
- ✅ Real-time dashboard
|
|
||||||
- ✅ SQLite backend
|
|
||||||
|
|
||||||
## Logging
|
|
||||||
|
|
||||||
View logs using:
|
|
||||||
- Event Viewer (if running as service)
|
|
||||||
- Console output (if running directly)
|
|
||||||
- Set `RUST_LOG=debug` environment variable for verbose logging
|
|
||||||
|
|
||||||
## Troubleshooting
|
|
||||||
|
|
||||||
### "Access Denied" Error
|
|
||||||
|
|
||||||
Run PowerShell as Administrator:
|
|
||||||
```powershell
|
|
||||||
Start-Process powershell -Verb RunAs
|
|
||||||
```
|
|
||||||
|
|
||||||
### Port Already in Use
|
|
||||||
|
|
||||||
Check what's using the port:
|
|
||||||
```powershell
|
|
||||||
Get-NetTCPConnection -LocalPort 8443
|
|
||||||
```
|
|
||||||
|
|
||||||
### Binary Signature Warning
|
|
||||||
|
|
||||||
Windows may show SmartScreen warning. Click "More info" → "Run anyway"
|
|
||||||
|
|
||||||
Or bypass with:
|
|
||||||
```powershell
|
|
||||||
Unblock-File ostp-server.exe
|
|
||||||
Unblock-File oncp-master.exe
|
|
||||||
```
|
|
||||||
|
|
||||||
## Build Information
|
|
||||||
|
|
||||||
- **Date**: January 2, 2026
|
|
||||||
- **Rust Version**: 1.85.0
|
|
||||||
- **Target**: x86_64-pc-windows-msvc
|
|
||||||
- **Profile**: Release (optimized)
|
|
||||||
|
|
||||||
## Security Notes
|
|
||||||
|
|
||||||
1. **PSK Protection**: Never share or commit PSKs
|
|
||||||
2. **Admin Rights**: Required for TUN/TAP and system operations
|
|
||||||
3. **Firewall**: Configure Windows Firewall rules
|
|
||||||
4. **Updates**: Keep binaries updated
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- **GitHub**: https://github.com/ospab/ospab.network
|
|
||||||
- **Issues**: https://github.com/ospab/ospab.network/issues
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Note**: Anti-debugging protection (ostp-guard) is active in release builds. Running under debugger will cause immediate exit.
|
|
||||||
2
dist/windows-amd64/SHA256SUMS.txt
vendored
2
dist/windows-amd64/SHA256SUMS.txt
vendored
@@ -1,2 +0,0 @@
|
|||||||
ce4d83f11534bef16008e4064b13f883124948af4773fa78e94da54ededa2bd2 ostp-server.exe
|
|
||||||
2238e11fe7293c6211b32ee1883b6d9edf2b58618afd053904ea12d600f15641 oncp-master.exe
|
|
||||||
BIN
dist/windows-amd64/oncp-master.exe
vendored
BIN
dist/windows-amd64/oncp-master.exe
vendored
Binary file not shown.
BIN
dist/windows-amd64/ostp-server.exe
vendored
BIN
dist/windows-amd64/ostp-server.exe
vendored
Binary file not shown.
BIN
dist/windows-x64/ostp-client.exe
vendored
Normal file
BIN
dist/windows-x64/ostp-client.exe
vendored
Normal file
Binary file not shown.
BIN
dist/windows-x64/ostp-daemon.exe
vendored
Normal file
BIN
dist/windows-x64/ostp-daemon.exe
vendored
Normal file
Binary file not shown.
BIN
dist/windows-x64/ostp-installer.exe
vendored
Normal file
BIN
dist/windows-x64/ostp-installer.exe
vendored
Normal file
Binary file not shown.
@@ -24,7 +24,7 @@ pub fn is_virtual_machine() -> bool {
|
|||||||
}
|
}
|
||||||
|
|
||||||
/// HIGH: Check for reverse engineering tools in memory
|
/// HIGH: Check for reverse engineering tools in memory
|
||||||
fn check_analysis_tools() -> bool {
|
pub fn check_analysis_tools() -> bool {
|
||||||
#[cfg(unix)]
|
#[cfg(unix)]
|
||||||
{
|
{
|
||||||
if let Ok(output) = std::process::Command::new("ps")
|
if let Ok(output) = std::process::Command::new("ps")
|
||||||
|
|||||||
@@ -8,7 +8,7 @@
|
|||||||
|
|
||||||
#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
|
#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
|
||||||
|
|
||||||
use anyhow::{Context, Result};
|
use anyhow::Result;
|
||||||
use std::path::PathBuf;
|
use std::path::PathBuf;
|
||||||
|
|
||||||
mod wizard;
|
mod wizard;
|
||||||
|
|||||||
@@ -55,7 +55,7 @@ pub fn install_service() -> Result<()> {
|
|||||||
// Set description
|
// Set description
|
||||||
let description_wide = to_wide_string(description);
|
let description_wide = to_wide_string(description);
|
||||||
let mut service_desc = SERVICE_DESCRIPTIONW {
|
let mut service_desc = SERVICE_DESCRIPTIONW {
|
||||||
lpDescription: PWSTR(description_wide.as_ptr() as *mut _),
|
lpDescription: windows::core::PWSTR(description_wide.as_ptr() as *mut _),
|
||||||
};
|
};
|
||||||
|
|
||||||
ChangeServiceConfig2W(
|
ChangeServiceConfig2W(
|
||||||
|
|||||||
Reference in New Issue
Block a user