chore: retarget upstream portal-tunnel v2.6.1 #110

Merged

ada merged 4 commits from chore/retarget-v2.6.1 into master

2026-10-08 18:20:33 +00:00

ada commented

2026-10-08 18:15:59 +00:00

Collaborator

Problem

Official upstream v2.6.1 clients fail registration against this relay with relay did not return canonical hostname. v2.6.1 keeps protocol 10 but makes canonical_hostname a required /sdk/register response field.

Change

Register identity-bound canonical hostnames <dns-label(name)>-<40-hex address>.<root>; return hostname and canonical_hostname; honor allow_canonical_fallback (older clients keep hostname_conflict); route SNI by either name; TCP/UDP addresses use the canonical name. sni_port is still returned for v2.5.0/v2.6.0 UDP clients.
/api/state and /api/policy/state leases carry address and canonical_hostname.
Apply access decisions to live raw TCP/UDP lease ports, as upstream v2.6.1 does.
Retarget metadata to v2.6.1 (protocol stays 10) and pin the v2.6.1 browser WASM asset by its published checksum.
Deliberately not ported (documented): IVNP revision bump (overlay not deployed), admin transport-policy 400 validation.

Validation

cargo fmt --check, cargo clippy --workspace --all-targets --locked -D warnings, cargo test --workspace --locked (220 passed; 14 new tests written failing first), scripts/test-container-image-tag.sh.
Local official-client runs: v2.6.1 registers and serves on both names; same-name v2.6.1 falls back to canonical; same-name v2.6.0 gets hostname_conflict; raw TCP over the canonical address and ban enforcement.

Risk

Names over 22 characters are now rejected for every client, matching upstream. Exact published image and public path are verified by the release live gate before promotion.

## Problem Official upstream v2.6.1 clients fail registration against this relay with `relay did not return canonical hostname`. v2.6.1 keeps protocol 10 but makes `canonical_hostname` a required `/sdk/register` response field. ## Change - Register identity-bound canonical hostnames `<dns-label(name)>-<40-hex address>.<root>`; return `hostname` and `canonical_hostname`; honor `allow_canonical_fallback` (older clients keep `hostname_conflict`); route SNI by either name; TCP/UDP addresses use the canonical name. `sni_port` is still returned for v2.5.0/v2.6.0 UDP clients. - `/api/state` and `/api/policy/state` leases carry `address` and `canonical_hostname`. - Apply access decisions to live raw TCP/UDP lease ports, as upstream v2.6.1 does. - Retarget metadata to v2.6.1 (protocol stays 10) and pin the v2.6.1 browser WASM asset by its published checksum. - Deliberately not ported (documented): IVNP revision bump (overlay not deployed), admin transport-policy 400 validation. ## Validation - `cargo fmt --check`, `cargo clippy --workspace --all-targets --locked -D warnings`, `cargo test --workspace --locked` (220 passed; 14 new tests written failing first), `scripts/test-container-image-tag.sh`. - Local official-client runs: v2.6.1 registers and serves on both names; same-name v2.6.1 falls back to canonical; same-name v2.6.0 gets `hostname_conflict`; raw TCP over the canonical address and ban enforcement. ## Risk Names over 22 characters are now rejected for every client, matching upstream. Exact published image and public path are verified by the release live gate before promotion.

ada added 4 commits

2026-10-08 18:15:59 +00:00

feat(leases): register identity-bound canonical hostnames 767fc9103b

Upstream v2.6.1 clients reject registration unless the relay returns a
canonical_hostname. Derive it as <dns-label(name)>-<40-hex address>.<root>
(loopback roots map to localhost), validate it when issuing a challenge,
and return both hostname and canonical_hostname from /sdk/register while
keeping sni_port for v2.5.0/v2.6.0 UDP clients.

When another identity holds the friendly alias, registrations that set
allow_canonical_fallback keep only the canonical hostname; older clients
still receive hostname_conflict. SNI routing matches the canonical
hostname first, TCP/UDP addresses use it, lease port reservations follow
the full service identity, and legacy ECH or hop routes may not claim a
canonical hostname bound to another address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(api): expose lease address and canonical hostname 469f073b27

Mirror the upstream v2.6.1 Lease shape in /api/state and
/api/policy/state: every lease carries address and canonical_hostname,
and hostname is empty when the lease registered with only its canonical
hostname. Policy leases inherit address from the lease instead of
serializing it separately. The legacy PascalCase lease views gain the
same fields.

The built-in landing page links the canonical hostname while showing
the friendly alias when present, matching the upstream directory, and
/tunnel/status recognizes either hostname.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(relay): stop raw TCP and UDP for non-routable identities 4a2bec0e81

Upstream v2.6.1 applies access decisions to live port transports: a
banned, denied, or unapproved identity keeps its lease ports bound but
bridges no new raw TCP connections and forwards no UDP datagrams in
either direction. Previously the Rust relay only checked routability
when admitting the reverse session or QUIC backhaul, so a ban did not
stop traffic on an already registered lease.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(release): retarget metadata to upstream v2.6.1

Rust CI / Format, lint, and test (pull_request) Successful in 3m3s

Details

Rust CI / Build and start linux/arm64 image (no push) (pull_request) Successful in 1m10s

Details

2be8bc6d21

Bump the workspace core to 2.6.1 (protocol stays 10), pin the v2.6.1
browser WASM asset by its published checksum (wasm_exec.js is
unchanged), and move the container tag fixtures to the new core while
rejecting the previous v2.6.0 core.

The support matrix now pins tag commit 80d6e370, separates source-level
v2.6.1 registration coverage from the earlier v2.6.0 client evidence,
and records what is deliberately not ported: the IVNP 4178bfef bump
(the Axis B fixture is still anchored to Go v2.6.0 and IVNP 2b4f760) and
the admin transport-policy 400 responses. It also notes that names over
22 characters are now rejected for every client, as upstream does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ada merged commit 6e4ff4dcf6 into master

2026-10-08 18:20:33 +00:00

ada deleted branch chore/retarget-v2.6.1

2026-10-08 18:20:34 +00:00

ada referenced this pull request from a commit

2026-10-08 18:20:36 +00:00

chore: retarget upstream portal-tunnel v2.6.1 (#110)