cryptnode 0.1.1__1-py3-none-win_amd64.whl

cryptnode/__init__.py

@@ -0,0 +1,4 @@
+"""CryptNode public package identity."""
+
+__version__ = "0.1.1"
+

cryptnode/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+raise SystemExit(main())
+

cryptnode/bundles.py

@@ -0,0 +1,101 @@
+"""Bounded, exact CryptPortal client.zip parser; ZIP bytes never become paths."""
+
+from __future__ import annotations
+
+from datetime import datetime
+import hashlib
+import io
+from pathlib import PurePosixPath
+import re
+import stat
+from typing import Dict
+import zipfile
+
+try:
+    import tomllib
+except ImportError:
+    import tomli as tomllib
+
+from .certificates import certificate_sha256, validate_client_cert
+from .models import BundleIdentity, ClientBundle, NodeError
+
+
+MEMBERS = frozenset({"manifest.toml", "cert.pem", "key.pem", "ca.pem", "frp-token"})
+MAX_ARCHIVE = 4 * 1024 * 1024
+MAX_MEMBER = 1024 * 1024
+_PORTAL_NAME = re.compile(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\Z")
+_HOST = re.compile(r"(?=.{1,253}\Z)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\Z")
+_VISIBLE_ID = re.compile(r"[!-~]{1,128}\Z")
+_DIGEST = re.compile(r"[0-9a-f]{64}\Z")
+_TOKEN = re.compile(rb"[0-9a-f]{64}\n\Z")
+
+
+def validate_bundle(data: bytes) -> ClientBundle:
+    if len(data) > MAX_ARCHIVE:
+        raise NodeError("bundle_size", "client.zip exceeds the size limit")
+    try:
+        archive = zipfile.ZipFile(io.BytesIO(data), "r")
+        infos = archive.infolist()
+    except (zipfile.BadZipFile, OSError):
+        raise NodeError("bundle_format", "invalid client.zip") from None
+    names = [item.filename for item in infos]
+    if len(names) != len(set(names)) or set(names) != MEMBERS:
+        raise NodeError("bundle_members", "client.zip member set is invalid")
+    files: Dict[str, bytes] = {}
+    for info in infos:
+        path = PurePosixPath(info.filename)
+        mode = info.external_attr >> 16
+        required = 0o600 if info.filename in ("key.pem", "frp-token") else 0o644
+        if (path.is_absolute() or len(path.parts) != 1 or ".." in path.parts
+                or not stat.S_ISREG(mode) or stat.S_IMODE(mode) != required
+                or info.file_size > MAX_MEMBER or info.compress_size > MAX_MEMBER):
+            raise NodeError("bundle_member", "client.zip contains unsafe member")
+        try:
+            files[info.filename] = archive.read(info)
+        except (RuntimeError, zipfile.BadZipFile, OSError):
+            raise NodeError("bundle_member", "client.zip member cannot be read") from None
+    try:
+        manifest = tomllib.loads(files["manifest.toml"].decode("utf-8"))
+        keys = {"schema_version", "portal_id", "portal_name", "access_host", "port_base",
+                "role", "side", "pair_id", "created_at", "own_cert_sha256",
+                "peer_cert_sha256", "files"}
+        if set(manifest) != keys or manifest["schema_version"] != 1:
+            raise ValueError("manifest keys")
+        portal_id = manifest["portal_id"]
+        port_base = manifest["port_base"]
+        if (type(portal_id) is not int or not 1 <= portal_id <= 99
+                or type(port_base) is not int or not 1 <= port_base <= 65533
+                or manifest["role"] != "cryptnode" or manifest["side"] != "client"):
+            raise ValueError("identity")
+        portal_name = manifest["portal_name"]
+        access_host = manifest["access_host"]
+        pair_id = manifest["pair_id"]
+        created_at = manifest["created_at"]
+        if (not isinstance(portal_name, str) or not _PORTAL_NAME.fullmatch(portal_name)
+                or not isinstance(access_host, str) or not _HOST.fullmatch(access_host)
+                or not isinstance(pair_id, str) or not _VISIBLE_ID.fullmatch(pair_id)
+                or not isinstance(created_at, str)):
+            raise ValueError("identity text")
+        created = datetime.fromisoformat(created_at)
+        if created.tzinfo is None or created.utcoffset() is None:
+            raise ValueError("creation time")
+        if set(manifest["files"]) != MEMBERS - {"manifest.toml"}:
+            raise ValueError("file set")
+        for name, digest in manifest["files"].items():
+            if not isinstance(digest, str) or not _DIGEST.fullmatch(digest):
+                raise ValueError("digest format")
+            if hashlib.sha256(files[name]).hexdigest() != digest:
+                raise ValueError("digest")
+        own = manifest["own_cert_sha256"]
+        peer = manifest["peer_cert_sha256"]
+        if (not isinstance(own, str) or not isinstance(peer, str)
+                or not _DIGEST.fullmatch(peer) or own != certificate_sha256(files["cert.pem"])):
+            raise ValueError("fingerprint")
+        if not _TOKEN.fullmatch(files["frp-token"]):
+            raise ValueError("token")
+        validate_client_cert(files["cert.pem"], files["key.pem"], files["ca.pem"], created_at)
+    except (KeyError, TypeError, ValueError, UnicodeError, NodeError):
+        raise NodeError("bundle_invalid", "client.zip identity, digest or certificate is invalid") from None
+    return ClientBundle(BundleIdentity(portal_id, portal_name, access_host, port_base,
+                                      pair_id, created_at, own, peer), files)
+

cryptnode/certificates.py

@@ -0,0 +1,98 @@
+"""Strict, local cryptography checks for a current CryptPortal client pair."""
+
+from __future__ import annotations
+
+from datetime import datetime, timedelta, timezone
+import hashlib
+from pathlib import Path
+import socket
+import ssl
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import padding, rsa
+from cryptography.x509.oid import ExtendedKeyUsageOID
+
+from .models import NodeError
+
+
+def certificate_sha256(pem: bytes) -> str:
+    try:
+        certificate = x509.load_pem_x509_certificate(pem)
+    except (ValueError, TypeError):
+        raise NodeError("certificate_invalid", "invalid certificate PEM") from None
+    return hashlib.sha256(certificate.public_bytes(serialization.Encoding.DER)).hexdigest()
+
+
+def validate_client_cert(cert_pem: bytes, key_pem: bytes, ca_pem: bytes,
+                         created_at: str) -> None:
+    try:
+        cert = x509.load_pem_x509_certificate(cert_pem)
+        ca = x509.load_pem_x509_certificate(ca_pem)
+        key = serialization.load_pem_private_key(key_pem, password=None)
+        created = datetime.fromisoformat(created_at)
+        if created.tzinfo is None or created.utcoffset() is None:
+            raise ValueError("naive creation time")
+        expected_before = created.astimezone(timezone.utc) - timedelta(hours=24)
+        expected_after = datetime(9999, 12, 31, 23, 59, 59, tzinfo=timezone.utc)
+        if cert.issuer != ca.subject or ca.issuer != ca.subject:
+            raise ValueError("issuer")
+        if (cert.not_valid_before_utc != expected_before or cert.not_valid_after_utc != expected_after
+                or ca.not_valid_before_utc != expected_before or ca.not_valid_after_utc != expected_after):
+            raise ValueError("certificate time")
+        for item in (cert, ca):
+            if item.signature_hash_algorithm.name != "sha256":
+                raise ValueError("signature")
+            public = item.public_key()
+            if not isinstance(public, rsa.RSAPublicKey) or public.key_size != 2048:
+                raise ValueError("RSA key")
+        if not isinstance(key, rsa.RSAPrivateKey) or key.key_size != 2048:
+            raise ValueError("private RSA key")
+        if key_pem.count(b"-----BEGIN PRIVATE KEY-----") != 1 or b"ENCRYPTED" in key_pem:
+            raise ValueError("PKCS#8")
+        if (key.public_key().public_bytes(serialization.Encoding.DER,
+                                          serialization.PublicFormat.SubjectPublicKeyInfo)
+                != cert.public_key().public_bytes(serialization.Encoding.DER,
+                                                   serialization.PublicFormat.SubjectPublicKeyInfo)):
+            raise ValueError("key mismatch")
+        ca.public_key().verify(ca.signature, ca.tbs_certificate_bytes,
+                               padding.PKCS1v15(), hashes.SHA256())
+        ca.public_key().verify(cert.signature, cert.tbs_certificate_bytes,
+                               padding.PKCS1v15(), hashes.SHA256())
+        if not ca.extensions.get_extension_for_class(x509.BasicConstraints).value.ca:
+            raise ValueError("CA")
+        if cert.extensions.get_extension_for_class(x509.BasicConstraints).value.ca:
+            raise ValueError("client CA")
+        usages = cert.extensions.get_extension_for_class(x509.ExtendedKeyUsage).value
+        if set(usages) != {ExtendedKeyUsageOID.CLIENT_AUTH}:
+            raise ValueError("client usage")
+        if cert.public_key().key_size != 2048:
+            raise ValueError("certificate key size")
+    except (ValueError, TypeError, KeyError, x509.ExtensionNotFound):
+        raise NodeError("certificate_invalid", "client certificate, chain, key or time is invalid") from None
+
+
+def validate_peer_tls(directory: Path, access_host: str, port: int, fingerprint: str) -> None:
+    """Check live server identity and exact peer fingerprint before first binding."""
+    certs = directory / "certs"
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    context.verify_mode = ssl.CERT_REQUIRED
+    context.check_hostname = True
+    context.load_verify_locations(cafile=str(certs / "ca.pem"))
+    context.minimum_version = ssl.TLSVersion.TLSv1_2
+    context.maximum_version = ssl.TLSVersion.TLSv1_3
+    context.set_ciphers("ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256")
+    context.options |= ssl.OP_NO_COMPRESSION
+    if hasattr(ssl, "OP_NO_TICKET"):
+        context.options |= ssl.OP_NO_TICKET
+    if hasattr(ssl, "OP_NO_RENEGOTIATION"):
+        context.options |= ssl.OP_NO_RENEGOTIATION
+    context.load_cert_chain(str(certs / "cert.pem"), str(certs / "key.pem"))
+    try:
+        with socket.create_connection((access_host, port), timeout=5) as raw:
+            with context.wrap_socket(raw, server_hostname="node.crypt") as secure:
+                peer = secure.getpeercert(binary_form=True)
+                if hashlib.sha256(peer).hexdigest() != fingerprint:
+                    raise NodeError("peer_fingerprint", "portal server certificate differs from client.zip")
+    except (OSError, ssl.SSLError) as exc:
+        raise NodeError("peer_tls", "portal TLS identity is unavailable or invalid") from exc

cryptnode/cli.py

@@ -0,0 +1,334 @@
+"""The public crnode command; private kernel names stay out of normal output."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+from typing import Any, Dict, List
+import unicodedata
+
+from . import __version__
+from .diagnostics import doctor, runtime_state
+from .lifecycle import _wait_host, cleanup, deploy, load, unload
+from .models import NodeError, Profile
+from .paths import active_root, profile_dir, profiles, select_profile
+from .security import is_administrator, require_administrator
+
+
+MUTATING = {"load", "unload", "cleanup", "start", "stop", "restart",
+            "enable", "disable", "addtask", "rmtask"}
+
+
+class _ArgumentParser(argparse.ArgumentParser):
+    def error(self, message):
+        raise NodeError("arguments", "参数不完整或无效：%s；请运行 crnode --help 查看用法" % message)
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = _ArgumentParser(prog="crnode", description="CryptNode 多门户客户端；门户参数使用名称或门户 ID，不是节点编号")
+    parser.add_argument("--version", action="store_true", help="显示版本")
+    parser.add_argument("--json", action="store_true", help="输出机器格式 JSON")
+    commands = parser.add_subparsers(dest="command", title="命令")
+    deploy_parser = commands.add_parser("deploy", help="初始化明确指定的安装目录")
+    deploy_parser.add_argument("install_dir", type=Path)
+    load_parser = commands.add_parser("load", help="加载 CryptNode 客户端钥匙包并保留源文件")
+    load_parser.add_argument("node_id", help="两位节点编号 01–99")
+    load_parser.add_argument("bundle", type=Path, help="钥匙包路径")
+    for name, help_text in (("unload", "卸载门户"), ("show", "查看门户"), ("start", "启动"),
+                            ("stop", "停止"), ("restart", "重启"), ("enable", "启用开机启动"),
+                            ("disable", "禁用开机启动"), ("addtask", "注册计划任务"), ("rmtask", "删除计划任务")):
+        item = commands.add_parser(name, help=help_text)
+        item.add_argument("portal", help="门户名称或门户 ID（不是节点编号）")
+    for name, help_text in (("list", "列出门户"), ("status", "查看状态"), ("doctor", "诊断")):
+        item = commands.add_parser(name, help=help_text)
+        if name != "list":
+            item.add_argument("portal", nargs="?", help="门户名称或门户 ID")
+        if name == "status":
+            item.add_argument("--verbose", action="store_true", help="显示详细状态")
+    commands.add_parser("pwd", help="显示已部署目录")
+    commands.add_parser("cleanup", help="停止并清理产品资料")
+    for item in commands.choices.values():
+        item.add_argument("--json", action="store_true", default=argparse.SUPPRESS, help="输出机器格式 JSON")
+    return parser
+
+
+_LABELS = {"portal_name": "门户", "portal_id": "门户 ID", "node_id": "节点编号", "state": "状态",
+           "system_active": "系统运行", "system_enabled": "开机启动", "portal_configured": "云端已配置",
+           "portal_enabled": "云端已启用", "pair_id_short": "配对", "key_fingerprint": "证书指纹",
+           "created_at": "创建时间", "profile_path": "门户目录", "access_host": "接入主机",
+           "port_base": "起始端口", "runtime": "运行诊断", "issues": "诊断问题", "free_bytes": "磁盘可用字节",
+           "reason": "原因", "last": "上次状态", "checked_at": "检查时间", "log_warning": "日志写入告警",
+           "path": "安装目录", "message": "结果", "version": "版本"}
+_VALUES = {"true": "是", "false": "否", "unknown": "未知", "access_limited": "权限受限",
+           "running": "运行中", "stopped": "已停止", "starting": "启动中", "stale": "状态回读已过期",
+           "suspended_by_portal": "云端暂停", "waiting_for_portal": "等待云端", "running_unknown": "运行中，云端状态未知",
+           "recovering": "恢复中", "failed": "失败", "task_missing": "计划任务不存在", "unit_missing": "系统实例不存在"}
+_ISSUES = {"product log write failed; active tunnels were kept running": "产品日志写入失败；既有隧道保持运行",
+           "certificate content is restricted to the runtime administrator": "证书内容仅管理员可读；当前权限不足，未判定隧道故障",
+           "low disk space; retained logs will not be evicted early": "磁盘空间不足；保留期内日志不会提前删除",
+           "disk capacity could not be read": "无法读取磁盘容量",
+           "no current Host readback": "尚无当前运行状态回读", "invalid Host readback": "运行状态回读无效"}
+_ERRORS = {
+    "install_dir": "安装目录必须是有效的绝对路径，不能是盘符根目录", "install_dir_access": "没有权限读取安装目录或目录指针",
+    "not_deployed": "尚未部署或部署资料无效；请执行 crnode deploy <安装目录>",
+    "portal_selection": "未找到唯一门户；请用门户名称或门户 ID（不是节点编号），可运行 crnode list 查看",
+    "node_id": "节点编号必须是两位数字 01–99", "portal_id": "门户 ID 必须在 1–99 之间",
+    "bundle_format": "钥匙包不是有效的 ZIP 文件", "bundle_members": "钥匙包文件集合不符合 CryptNode 格式",
+    "bundle_member": "钥匙包包含无效或不可读成员", "bundle_invalid": "钥匙包身份、摘要或证书校验失败",
+    "bundle_size": "钥匙包超过大小限制", "certificate_invalid": "客户端证书、证书链、私钥或有效期无效",
+    "peer_fingerprint": "门户服务端证书指纹不匹配或无效", "peer_tls": "门户 TLS 身份不可用或无效",
+    "task_missing": "计划任务不存在；请由管理员运行 crnode addtask <门户>",
+    "unit_missing": "系统运行实例不存在", "windows_only": "此命令仅支持 Windows",
+    "task_failed": "计划任务操作失败", "task_readback": "计划任务状态无法确认或与请求不符",
+    "path_link": "路径不是安全的普通文件或目录", "profile_invalid": "门户资料缺失或无效",
+    "profile_identity": "门户身份或证书摘要不一致", "portal_identity": "云端返回的门户身份不一致",
+    "profile_ambiguous": "存在重复门户名称", "portal_ambiguous": "门户名称属于另一门户",
+    "pair_conflict": "现有配对与钥匙包不一致", "anchor_in_use": "节点编号的管理锚点已被占用",
+    "node_unconfigured": "云端尚未配置该节点编号", "host_readback": "运行实例未达到安全状态",
+    "rollback_unconfirmed": "旧门户资料已恢复，但运行状态恢复失败；请检查门户状态",
+    "acl_failed": "无法设置产品资料访问权限", "file_unsafe": "私密文件缺失或权限不安全",
+    "tls_policy": "stunnel 配置偏离固定策略", "control_response": "云端控制响应无效",
+    "control_unavailable": "云端控制服务暂不可用", "runtime_python": "需要可信的 Python 运行环境",
+    "runtime_user": "需要可信的部署管理员身份", "port_conflict": "本地所需端口被占用",
+    "kernel_missing": "产品内核文件缺失", "kernel_start": "产品内核启动失败", "kernel_exit": "产品内核提前退出",
+    "kernel_timeout": "产品内核监听超时", "job_object": "无法建立或绑定受控进程树", "host_start": "运行实例启动失败",
+}
+
+
+def _chinese(value):
+    if value is None:
+        return "未知"
+    if isinstance(value, bool):
+        return "是" if value else "否"
+    if isinstance(value, str):
+        if value.startswith("Profile validation failed:"):
+            return "门户资料验证失败；请检查证书权限和配置"
+        return _VALUES.get(value, _ISSUES.get(value, value))
+    return str(value)
+
+
+def _emit(value: Any, as_json: bool = False) -> None:
+    if as_json:
+        print(json.dumps(value, sort_keys=True, ensure_ascii=False, separators=(",", ":")))
+    elif isinstance(value, list):
+        if not value:
+            print("暂无门户或诊断问题")
+        for row in value:
+            _emit(row)
+    elif isinstance(value, dict):
+        keys = [key for key in ("portal_name", "portal_id", "node_id") if key in value]
+        keys += [key for key in value if key not in keys]
+        for key in keys:
+            item = value[key]
+            print("%s：%s" % (_LABELS.get(key, key), "" if isinstance(item, (dict, list)) else
+                              (_chinese(item)[:16] + "…" if key == "key_fingerprint" else _chinese(item))))
+            if isinstance(item, (dict, list)):
+                _emit(item)
+    else:
+        print(_chinese(value))
+
+
+def _display_width(value: str) -> int:
+    return sum(0 if unicodedata.combining(char) else
+               2 if unicodedata.east_asian_width(char) in ("F", "W") else 1
+               for char in value)
+
+
+def _emit_list(rows: List[Dict[str, Any]], root: Path) -> None:
+    print("安装目录：%s" % root)
+    if not rows:
+        print("暂无门户")
+        return
+    headers = ("门户名称", "门户 ID", "节点 ID", "运行状态", "开机自启")
+    values = [tuple(str(row[key]) if key in ("portal_name", "portal_id", "node_id")
+                    else _chinese(row.get(key))
+                    for key in ("portal_name", "portal_id", "node_id", "state", "system_enabled"))
+              for row in rows]
+    widths = [max(_display_width(header), *(_display_width(row[index]) for row in values))
+              for index, header in enumerate(headers)]
+
+    def line(cells):
+        return " | ".join(cell + " " * (width - _display_width(cell))
+                          for cell, width in zip(cells, widths)).rstrip()
+
+    print(line(headers))
+    print("-+-".join("-" * width for width in widths))
+    for row in values:
+        print(line(row))
+
+
+def _manager():
+    if os.name == "nt":
+        from . import windows
+        return windows
+    from . import ubuntu
+    return ubuntu
+
+
+def _row(root: Path, profile: Profile) -> Dict[str, Any]:
+    manager = _manager()
+    try:
+        managed = manager.status(profile)
+    except (OSError, NodeError):
+        managed = {"exists": "unknown", "active": "unknown", "enabled": "unknown"}
+    runtime = runtime_state(root, profile)
+    state = ("task_missing" if os.name == "nt" else "unit_missing") if managed["exists"] == "false" else runtime["state"]
+    return {"portal_id": profile.portal_id, "portal_name": profile.portal_name,
+            "node_id": "%02d" % profile.node_id, "pair_id_short": profile.pair_id[:12],
+            "key_fingerprint": profile.own_cert_sha256, "created_at": profile.created_at,
+            "portal_configured": runtime.get("portal_configured"),
+            "portal_enabled": runtime.get("portal_enabled"),
+            "system_enabled": managed["enabled"], "system_active": managed["active"],
+            "state": state}
+
+
+def _clear_runtime_readback(root: Path, profile: Profile) -> None:
+    marker = profile_dir(root, profile.portal_id) / "runtime.json"
+    if marker.is_symlink():
+        raise NodeError("path_link", "Host readback cannot be a symbolic link")
+    marker.unlink(missing_ok=True)
+
+
+def _sudo_linux(arguments: List[str]) -> int:
+    """Re-enter the same virtual environment in the current terminal."""
+    interpreter = Path(sys.executable).absolute()
+    if sys.prefix == sys.base_prefix or Path(sys.prefix).stat().st_uid != os.geteuid():
+        raise NodeError("runtime_python", "需要部署用户自有的可信虚拟环境")
+    if Path(sys.prefix).stat().st_mode & 0o002:
+        raise NodeError("runtime_python", "虚拟环境不能允许所有用户写入")
+    if shutil.which("sudo") is None:
+        raise NodeError("sudo_unavailable", "未找到 sudo；请安装并配置 sudo 后重试")
+    return subprocess.run(["sudo", "--", str(interpreter), "-m", "cryptnode", *arguments],
+                          check=False).returncode
+
+
+def _execute(args) -> Any:
+    command = args.command
+    if command == "deploy":
+        return {"path": str(deploy(args.install_dir)), "message": "部署完成"}
+    root = active_root()
+    if command == "pwd":
+        return {"path": str(root)}
+    if command == "load":
+        if not (len(args.node_id) == 2 and args.node_id.isdecimal()):
+            raise NodeError("node_id", "node_id must be a two-digit number 01..99")
+        profile = load(int(args.node_id), args.bundle, root)
+        return {"portal_name": profile.portal_name, "portal_id": profile.portal_id, "node_id": "%02d" % profile.node_id,
+                "state": runtime_state(root, profile)["state"]}
+    if command == "cleanup":
+        cleanup(root)
+        return {"message": "产品资料已清理"}
+    if command in ("list", "status", "doctor") and getattr(args, "portal", None) is None:
+        rows = tuple(profiles(root))
+        if command == "doctor":
+            return [dict(doctor(root, item), portal_name=item.portal_name) for item in rows]
+        return [_row(root, item) for item in rows]
+    profile = select_profile(root, args.portal)
+    if command == "show":
+        result = _row(root, profile)
+        result["profile_path"] = str(profile_dir(root, profile.portal_id))
+        result["access_host"] = profile.access_host
+        result["port_base"] = profile.port_base
+        return result
+    if command == "status":
+        return _row(root, profile)
+    if command == "doctor":
+        return dict(doctor(root, profile), portal_name=profile.portal_name)
+    if command == "unload":
+        unload(profile, root)
+        return {"portal_name": profile.portal_name, "portal_id": profile.portal_id, "node_id": "%02d" % profile.node_id, "message": "门户已卸载"}
+    manager = _manager()
+    if command == "addtask":
+        require_administrator()
+        if os.name != "nt":
+            raise NodeError("windows_only", "addtask is available only on Windows")
+        from .host import validate_profile
+        validate_profile(profile_dir(root, profile.portal_id), profile)
+        if manager.status(profile)["active"] != "true":
+            _clear_runtime_readback(root, profile)
+        manager.install(root, profile)
+        manager.perform(root, profile, "start")
+        _wait_host(profile_dir(root, profile.portal_id), profile)
+        return _row(root, profile)
+    if command == "rmtask":
+        require_administrator()
+        if os.name != "nt":
+            raise NodeError("windows_only", "rmtask is available only on Windows")
+        manager.remove(root, profile)
+        return _row(root, profile)
+    if command in ("start", "stop", "restart", "enable", "disable"):
+        managed = manager.status(profile)
+        if managed["exists"] != "true":
+            raise NodeError("task_missing" if os.name == "nt" else "unit_missing",
+                            "CryptNode portal instance is missing")
+        if command == "start" and managed["active"] == "true":
+            return dict(_row(root, profile), message="实例已在运行")
+        require_administrator()
+        if os.name != "nt" and command in ("start", "restart"):
+            manager.reset_failed(profile)
+        if command == "restart" or (command == "start" and managed["active"] != "true"):
+            _clear_runtime_readback(root, profile)
+        manager.perform(root, profile, command)
+        if command in ("start", "restart"):
+            _wait_host(profile_dir(root, profile.portal_id), profile)
+        return _row(root, profile)
+    raise AssertionError("unreachable command")
+
+
+def main(argv=None) -> int:
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    as_json = "--json" in arguments
+    for stream in (sys.stdout, sys.stderr):
+        if hasattr(stream, "reconfigure"):
+            stream.reconfigure(encoding="utf-8")
+    try:
+        args = _parser().parse_args(arguments)
+        if args.version:
+            _emit({"version": __version__}, as_json)
+            return 0
+        if args.command is None:
+            raise NodeError("arguments", "请指定命令；运行 crnode --help 查看用法")
+        if args.command == "load":
+            args.bundle = Path(os.path.abspath(args.bundle))
+        if os.name != "nt" and not is_administrator() and (
+                args.command == "deploy" or args.command in MUTATING - {"start", "addtask", "rmtask"}):
+            return _sudo_linux(arguments)
+        if args.command in MUTATING and os.name == "nt":
+            require_administrator()
+        if os.name != "nt" and args.command == "start" and not is_administrator():
+            try:
+                result = _execute(args)
+            except NodeError as exc:
+                if exc.code != "administrator_required":
+                    raise
+                return _sudo_linux(arguments)
+        else:
+            result = _execute(args)
+        if args.command == "list" and not as_json:
+            _emit_list(result, active_root())
+        else:
+            _emit(result, as_json)
+        return 0
+    except KeyboardInterrupt:
+        message = "操作已中断"
+        if as_json:
+            print(json.dumps({"code": "interrupted", "message": message}, ensure_ascii=False,
+                             separators=(",", ":")), file=sys.stderr)
+        else:
+            print("crnode：%s [interrupted]" % message, file=sys.stderr)
+        return 130
+    except (NodeError, OSError, ValueError) as exc:
+        code = exc.code if isinstance(exc, NodeError) else "operation_failed"
+        message = str(exc)
+        if not any("\u4e00" <= char <= "\u9fff" for char in message):
+            message = _ERRORS.get(code, "配置校验失败" if code.startswith("config_") else "操作失败，请检查权限、路径及门户状态")
+        if as_json:
+            print(json.dumps({"code": code, "message": message}, ensure_ascii=False, separators=(",", ":")), file=sys.stderr)
+        else:
+            print("crnode：%s [%s]" % (message, code), file=sys.stderr)
+        return 78

cryptnode/config.py

@@ -0,0 +1,79 @@
+"""Validate the native, byte-preserved FRPC configuration from CryptPortal."""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Dict, Set
+
+try:
+    import tomllib
+except ImportError:
+    import tomli as tomllib
+
+from .models import NodeError, Profile
+
+
+_TEMPLATE = re.compile(r"\$\{|\{\{|\}\}|\.Envs|<%")
+
+
+def _walk(value: Any) -> None:
+    if isinstance(value, dict):
+        for key, child in value.items():
+            if not isinstance(key, str) or _TEMPLATE.search(key) or key == "includes":
+                raise NodeError("config_invalid", "FRPC configuration contains a dynamic field")
+            _walk(child)
+    elif isinstance(value, list):
+        for child in value:
+            _walk(child)
+    elif isinstance(value, str) and _TEMPLATE.search(value):
+        raise NodeError("config_invalid", "FRPC configuration contains a template")
+
+
+def validate_frpc_document(data: bytes, profile: Profile) -> Dict[str, Any]:
+    if len(data) > 2 * 1024 * 1024:
+        raise NodeError("config_size", "node.toml exceeds the size limit")
+    try:
+        root = tomllib.loads(data.decode("utf-8"))
+    except (UnicodeError, ValueError, tomllib.TOMLDecodeError):
+        raise NodeError("config_invalid", "node.toml is not UTF-8 TOML") from None
+    _walk(root)
+    addr = profile.local_addr
+    if root.get("serverAddr") != addr or root.get("serverPort") != 13201:
+        raise NodeError("config_endpoint", "FRPC data endpoint differs from the portal loopback address")
+    auth = root.get("auth")
+    source = auth.get("tokenSource") if isinstance(auth, dict) else None
+    token_file = source.get("file") if isinstance(source, dict) else None
+    if (not isinstance(auth, dict) or auth.get("method") != "token"
+            or not isinstance(source, dict) or source.get("type") != "file"
+            or not isinstance(token_file, dict) or token_file.get("path") != "certs/frp-token"):
+        raise NodeError("config_auth", "FRPC must read the current pair token from certs")
+    web = root.get("webServer")
+    if (not isinstance(web, dict) or web.get("addr") != addr
+            or type(web.get("port")) is not int or web["port"] != 13202
+            or "user" in web or "password" in web):
+        raise NodeError("config_management", "FRPC management must use the portal loopback endpoint")
+    proxies = root.get("proxies")
+    if not isinstance(proxies, list):
+        raise NodeError("config_proxies", "FRPC proxies must be explicit tables")
+    names: Set[str] = set()
+    ports: Set[int] = set()
+    anchors = []
+    for item in proxies:
+        if not isinstance(item, dict):
+            raise NodeError("config_proxy", "invalid FRPC proxy")
+        name = item.get("name")
+        port = item.get("remotePort")
+        if (not isinstance(name, str) or not name or name != name.strip()
+                or name in names or item.get("type") != "tcp"
+                or type(port) is not int or not 20000 <= port <= 29999
+                or port in ports or "loadBalancer" in item):
+            raise NodeError("config_proxy", "FRPC proxy name, type or port is invalid")
+        names.add(name)
+        ports.add(port)
+        if port == profile.anchor_port:
+            anchors.append(item)
+    if (len(anchors) != 1 or anchors[0].get("localIP") != addr
+            or anchors[0].get("localPort") != 13202):
+        raise NodeError("config_anchor", "hN/00 must target local FRPC management")
+    return root
+