cryptnode 0.1.1__1-py3-none-win_amd64.whl

cryptnode/control.py

@@ -0,0 +1,66 @@
+"""Bounded requests to the CryptPortal role-separated control channel."""
+
+from __future__ import annotations
+
+import json
+from typing import Any, Dict
+from urllib import request
+
+from .models import NodeError, Profile
+
+
+SCHEMA = "cryptportal.control/v1"
+MAX_RESPONSE = 2 * 1024 * 1024
+
+
+def _get(profile: Profile, path: str) -> bytes:
+    origin = "http://%s:13200" % profile.local_addr
+    call = request.Request(origin + path, headers={"Host": "%s:13200" % profile.local_addr}, method="GET")
+    try:
+        opener = request.build_opener(request.ProxyHandler({}))
+        with opener.open(call, timeout=5) as response:
+            data = response.read(MAX_RESPONSE + 1)
+            if response.status != 200 or len(data) > MAX_RESPONSE:
+                raise NodeError("control_response", "portal control response is invalid")
+            return data
+    except (OSError, ValueError) as exc:
+        raise NodeError("control_unavailable", "portal control channel is unavailable") from exc
+
+
+def _json(profile: Profile, path: str) -> Dict[str, Any]:
+    try:
+        value = json.loads(_get(profile, path).decode("utf-8"))
+    except (UnicodeError, ValueError):
+        raise NodeError("control_response", "portal control JSON is invalid") from None
+    if not isinstance(value, dict) or value.get("schema") != SCHEMA:
+        raise NodeError("control_response", "portal control schema is invalid")
+    return value
+
+
+def check_identity(profile: Profile) -> Dict[str, Any]:
+    info = _json(profile, "/v1/info")
+    if (info.get("portal_id") != profile.portal_id
+            or info.get("portal_name") != profile.portal_name
+            or info.get("role") != "cryptnode" or info.get("pair_id") != profile.pair_id):
+        raise NodeError("portal_identity", "portal identity or current key pair differs")
+    return info
+
+
+def node_state(profile: Profile) -> Dict[str, Any]:
+    check_identity(profile)
+    state = _json(profile, "/v1/nodes/%02d" % profile.node_id)
+    if (type(state.get("configured")) is not bool or type(state.get("enabled")) is not bool
+            or state.get("anchor_port") != profile.anchor_port
+            or type(state.get("anchor_in_use")) is not bool
+            or not isinstance(state.get("config_etag"), str)):
+        raise NodeError("control_response", "portal node policy is invalid")
+    return state
+
+
+def node_config(profile: Profile) -> bytes:
+    check_identity(profile)
+    from .config import validate_frpc_document
+    data = _get(profile, "/v1/nodes/%02d/config" % profile.node_id)
+    validate_frpc_document(data, profile)
+    return data
+

cryptnode/diagnostics.py

@@ -0,0 +1,53 @@
+"""Read-only, credential-free product diagnostics."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import shutil
+import time
+from typing import Any, Dict
+
+from .models import Profile
+from .paths import profile_dir
+
+
+def runtime_state(root: Path, profile: Profile) -> Dict[str, Any]:
+    path = profile_dir(root, profile.portal_id) / "runtime.json"
+    if path.is_symlink() or not path.is_file() or path.stat().st_size > 8192:
+        return {"state": "unknown", "reason": "no current Host readback"}
+    try:
+        row = json.loads(path.read_text(encoding="utf-8"))
+        if row.get("portal_id") != profile.portal_id or row.get("node_id") != profile.node_id:
+            raise ValueError("identity")
+        if row.get("checked_at", 0) < time.time() - 300:
+            return {"state": "stale", "last": row.get("state", "unknown")}
+        return {"state": row.get("state", "unknown"), "reason": row.get("error", ""),
+                "checked_at": row.get("checked_at"), "log_warning": row.get("log_warning", False),
+                "portal_configured": row.get("portal_configured"),
+                "portal_enabled": row.get("portal_enabled")}
+    except (OSError, TypeError, ValueError, json.JSONDecodeError):
+        return {"state": "unknown", "reason": "invalid Host readback"}
+
+
+def doctor(root: Path, profile: Profile) -> Dict[str, Any]:
+    directory = profile_dir(root, profile.portal_id)
+    result: Dict[str, Any] = {"portal_id": profile.portal_id, "node_id": profile.node_id,
+                              "runtime": runtime_state(root, profile), "issues": []}
+    if result["runtime"].get("log_warning"):
+        result["issues"].append("product log write failed; active tunnels were kept running")
+    try:
+        from .host import validate_profile
+        validate_profile(directory, profile)
+    except PermissionError:
+        result["issues"].append("certificate content is restricted to the runtime administrator")
+    except Exception as exc:
+        result["issues"].append("Profile validation failed: %s" % type(exc).__name__)
+    try:
+        free = shutil.disk_usage(str(root)).free
+        result["free_bytes"] = free
+        if free < 512 * 1024 * 1024:
+            result["issues"].append("low disk space; retained logs will not be evicted early")
+    except OSError:
+        result["issues"].append("disk capacity could not be read")
+    return result

cryptnode/frp.py

@@ -0,0 +1,18 @@
+"""Private FRP client launch and exact configuration preflight."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from .config import validate_frpc_document
+from .models import Profile
+from .processes import Child, resource_binary
+from .security import assert_private_file
+
+
+def start_core(directory: Path, profile: Profile) -> Child:
+    config_path = directory / "node.toml"
+    assert_private_file(directory / "certs" / "frp-token")
+    validate_frpc_document(config_path.read_bytes(), profile)
+    return Child([str(resource_binary("crnode-core")), "-c", str(config_path)], directory, "core")
+

cryptnode/host.py

@@ -0,0 +1,202 @@
+"""One long-lived supervisor per Portal Profile, with no mapping-sync loop."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import signal
+import sys
+import time
+from typing import Optional
+
+from .certificates import validate_client_cert
+from .config import validate_frpc_document
+from .control import node_config, node_state
+from .frp import start_core
+from .logs import prune_expired
+from .models import NodeError, Profile
+from .paths import profile_dir, read_profile
+from .processes import Child, require_ports
+from .security import assert_private_file, atomic_write
+from .tls import render_policy, start_tunnel
+
+
+def validate_profile(directory: Path, profile: Profile) -> None:
+    certs = directory / "certs"
+    for name in ("cert.pem", "key.pem", "ca.pem", "frp-token"):
+        assert_private_file(certs / name)
+    validate_client_cert((certs / "cert.pem").read_bytes(), (certs / "key.pem").read_bytes(),
+                         (certs / "ca.pem").read_bytes(), profile.created_at)
+    from .certificates import certificate_sha256
+    if certificate_sha256((certs / "cert.pem").read_bytes()) != profile.own_cert_sha256:
+        raise NodeError("profile_identity", "Profile certificate fingerprint differs")
+    for duty in ("control", "data"):
+        path = directory / (duty + ".conf")
+        if path.is_symlink() or path.read_text(encoding="utf-8") != render_policy(profile, duty):
+            raise NodeError("tls_policy", "Profile stunnel policy differs")
+    config = directory / "node.toml"
+    if config.exists():
+        if config.is_symlink():
+            raise NodeError("config_invalid", "node.toml cannot be a symbolic link")
+        validate_frpc_document(config.read_bytes(), profile)
+
+
+class PortalHost:
+    def __init__(self, directory: Path, profile: Profile):
+        self.directory = directory
+        self.profile = profile
+        self.control: Optional[Child] = None
+        self.data: Optional[Child] = None
+        self.core: Optional[Child] = None
+        self.stopping = False
+        self.state = "starting"
+        self.error = ""
+        self.last_check = 0.0
+        self.next_check = 0.0
+        self.failures = 0
+        self.log_warning = False
+        self.portal_configured = None
+        self.portal_enabled = None
+
+    def _record(self) -> None:
+        payload = {"portal_id": self.profile.portal_id, "node_id": self.profile.node_id,
+                   "state": self.state, "error": self.error,
+                   "log_warning": self.log_warning or any(
+                       child.log_error for child in (self.control, self.data, self.core) if child is not None),
+                   "portal_configured": self.portal_configured,
+                   "portal_enabled": self.portal_enabled,
+                   "control_pid": self.control.process.pid if self.control and self.control.poll() is None else None,
+                   "data_pid": self.data.process.pid if self.data and self.data.poll() is None else None,
+                   "core_pid": self.core.process.pid if self.core and self.core.poll() is None else None,
+                   "checked_at": int(time.time())}
+        try:
+            atomic_write(self.directory / "runtime.json",
+                         (json.dumps(payload, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8"),
+                         public_read=True, parent_public_read=True)
+        except (OSError, NodeError):
+            # A full disk or broken log/state destination must not restart a live tunnel.
+            pass
+
+    def _stop_data(self) -> None:
+        for attr in ("core", "data"):
+            child = getattr(self, attr)
+            if child is not None:
+                self.log_warning = self.log_warning or child.log_error
+                child.stop()
+                setattr(self, attr, None)
+
+    def _start_data(self) -> None:
+        require_ports(self.profile, (13201, 13202))
+        config = node_config(self.profile)
+        path = self.directory / "node.toml"
+        previous = path.read_bytes() if path.is_file() and not path.is_symlink() else None
+        atomic_write(path, config, parent_public_read=True)
+        try:
+            self.data = start_tunnel(self.directory, self.profile, "data")
+            self.core = start_core(self.directory, self.profile)
+        except Exception:
+            self._stop_data()
+            if previous is None:
+                path.unlink(missing_ok=True)
+            else:
+                atomic_write(path, previous, parent_public_read=True)
+            raise
+
+    def _probe(self) -> None:
+        state = node_state(self.profile)
+        self.portal_configured = state["configured"]
+        self.portal_enabled = state["enabled"]
+        if not state["configured"] or not state["enabled"]:
+            self._stop_data()
+            self.state = "suspended_by_portal"
+            self.error = "unconfigured" if not state["configured"] else "disabled"
+            return
+        if self.core is None:
+            if state["anchor_in_use"]:
+                raise NodeError("anchor_in_use", "hN/00 is occupied before startup")
+            validate_profile(self.directory, self.profile)
+            self._start_data()
+        self.state = "running"
+        self.error = ""
+
+    def run(self) -> int:
+        validate_profile(self.directory, self.profile)
+        require_ports(self.profile, (13200,))
+        self.control = start_tunnel(self.directory, self.profile, "control")
+        try:
+            while not self.stopping:
+                if (self.directory / "stop-request").exists():
+                    self.stopping = True
+                    break
+                now = time.monotonic()
+                if self.control.poll() is not None:
+                    self._stop_data()
+                    raise NodeError("control_exit", "control tunnel exited")
+                if self.core is not None and self.core.poll() is not None:
+                    self._stop_data()
+                    self.state = "recovering"
+                    self.error = "private core exited"
+                    self.failures += 1
+                    self.next_check = now + min(300, 5 * (2 ** min(self.failures, 6)))
+                if self.data is not None and self.data.poll() is not None:
+                    self._stop_data()
+                    self.state = "recovering"
+                    self.error = "data tunnel exited"
+                    self.failures += 1
+                    self.next_check = now + min(300, 5 * (2 ** min(self.failures, 6)))
+                if now >= self.next_check:
+                    try:
+                        self._probe()
+                        self.failures = 0
+                        self.next_check = now + 120
+                    except NodeError as exc:
+                        # An unknown control state must never tear down a live FRP session.
+                        self.error = exc.code
+                        self.state = "running_unknown" if self.core is not None else "waiting_for_portal"
+                        self.failures += 1
+                        self.next_check = now + min(300, 5 * (2 ** min(self.failures, 6)))
+                    self.last_check = now
+                    prune_expired(self.directory / "logs")
+                    self._record()
+                time.sleep(0.25)
+        finally:
+            self._stop_data()
+            if self.control is not None:
+                self.log_warning = self.log_warning or self.control.log_error
+                self.control.stop()
+                self.control = None
+            self.state = "stopped"
+            self._record()
+        return 0
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(prog="crnode-host")
+    parser.add_argument("--portal-id", type=int, required=True)
+    parser.add_argument("--install-dir", type=Path, required=True)
+    parser.add_argument("--validate", action="store_true")
+    args = parser.parse_args(argv)
+    directory = profile_dir(args.install_dir, args.portal_id)
+    profile = read_profile(directory)
+    if args.validate:
+        try:
+            validate_profile(directory, profile)
+            return 0
+        except (OSError, NodeError) as exc:
+            print("crnode-host: %s" % exc, file=sys.stderr)
+            return 78
+    host = PortalHost(directory, profile)
+    def stop(_number, _frame):
+        host.stopping = True
+    signal.signal(signal.SIGTERM, stop)
+    signal.signal(signal.SIGINT, stop)
+    try:
+        return host.run()
+    except (OSError, NodeError) as exc:
+        print("crnode-host: %s" % exc, file=sys.stderr)
+        return 78
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

cryptnode/lifecycle.py

@@ -0,0 +1,307 @@
+"""Deploy, load/rotate, unload and cleanup with an exact Profile preimage."""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import shutil
+import sys
+import time
+import uuid
+import io
+import zipfile
+from typing import Optional
+
+from .bundles import MAX_ARCHIVE, MAX_MEMBER, tomllib, validate_bundle
+from .control import node_config, node_state
+from .models import ClientBundle, NodeError, Profile
+from .paths import (active_root, checked_absolute, default_root, pointer_path,
+                    profile_dir, profile_json, profiles)
+from .security import atomic_write, require_administrator, secure_directory, trusted_runtime_account
+from .tls import render_policy, start_tunnel
+
+
+def _manager():
+    if os.name == "nt":
+        from . import windows
+        return windows
+    from . import ubuntu
+    return ubuntu
+
+
+def _runtime_identity():
+    if os.name == "nt":
+        return None
+    return trusted_runtime_account()
+
+
+def _grant_owner(path: Path, account) -> None:
+    if account is not None:
+        os.chown(path, account.pw_uid, account.pw_gid)
+
+
+def _grant_tree(path: Path, account) -> None:
+    if account is None:
+        return
+    for directory, subdirs, filenames in os.walk(path, followlinks=False):
+        current = Path(directory)
+        if current.is_symlink():
+            raise NodeError("path_link", "Profile contains a symbolic link")
+        _grant_owner(current, account)
+        current.chmod(0o700)
+        for name in filenames:
+            item = current / name
+            if item.is_symlink():
+                raise NodeError("path_link", "Profile contains a symbolic link")
+            _grant_owner(item, account)
+            item.chmod(0o600 if current.name == "certs" else 0o640)
+
+
+def _installation(root: Path) -> dict:
+    marker = root / "installation.json"
+    if marker.is_symlink() or not marker.is_file():
+        raise NodeError("not_deployed", "CryptNode has not been deployed")
+    try:
+        value = json.loads(marker.read_text(encoding="utf-8"))
+        if value.get("schema") != "cryptnode.installation/v1" or value.get("root") != str(root):
+            raise ValueError("installation")
+        return value
+    except (OSError, TypeError, ValueError):
+        raise NodeError("not_deployed", "CryptNode installation marker is invalid") from None
+
+
+def deploy(install_dir: Optional[Path] = None) -> Path:
+    if install_dir is None:
+        raise NodeError("install_dir", "请显式指定安装目录：crnode deploy <安装目录>")
+    if os.name != "nt":
+        require_administrator()
+    account = _runtime_identity()
+    root = checked_absolute(install_dir)
+    pointer = pointer_path()
+    if pointer.exists() or pointer.is_symlink():
+        if pointer.is_symlink() or not pointer.is_file():
+            raise NodeError("path_link", "安装目录指针不是普通文件")
+        previous = checked_absolute(Path(pointer.read_text(encoding="utf-8").strip()))
+        if previous != root:
+            raise NodeError("already_deployed", "已经部署到 %s；不能切换安装目录" % previous)
+        _installation(root)
+        if not (root / "portals").is_dir():
+            raise NodeError("not_deployed", "已部署目录不完整")
+        return root
+    if root.exists() and not (root / "installation.json").exists() and any(root.iterdir()):
+        raise NodeError("install_dir", "安装目录包含其他文件")
+    if (root / "installation.json").exists():
+        _installation(root)
+    marker = {"schema": "cryptnode.installation/v1", "root": str(root),
+              "python": str(Path(sys.executable).absolute())}
+    # No secrets or SYSTEM task are created by deploy. ACL protection starts at load.
+    root.mkdir(parents=True, exist_ok=True)
+    (root / "portals").mkdir(exist_ok=True)
+    (root / "installation.json").write_text(
+        json.dumps(marker, sort_keys=True, separators=(",", ":")) + "\n", encoding="utf-8")
+    checked_absolute(pointer)
+    pointer.parent.mkdir(parents=True, exist_ok=True)
+    pointer.write_text(str(root) + "\n", encoding="utf-8")
+    _grant_owner(root, account)
+    _grant_owner(root / "portals", account)
+    if os.name != "nt":
+        pointer.parent.chmod(0o755)
+        pointer.chmod(0o644)
+    return root
+
+
+def _read_zip(path: Path) -> ClientBundle:
+    try:
+        if not path.exists():
+            raise NodeError("bundle_missing", "钥匙包路径不存在：%s" % path)
+        if path.is_symlink() or not path.is_file():
+            raise NodeError("bundle_path", "钥匙包路径不是文件：%s" % path)
+        if path.stat().st_size > MAX_ARCHIVE:
+            raise NodeError("bundle_size", "钥匙包超过大小限制")
+        data = path.read_bytes()
+    except PermissionError:
+        raise NodeError("bundle_access", "没有权限读取钥匙包：%s" % path) from None
+    except FileNotFoundError:
+        raise NodeError("bundle_missing", "钥匙包路径不存在：%s" % path) from None
+    # Identify an incompatible role before the strict member-set parser, without
+    # extracting files or relaxing any bundle validation.
+    try:
+        with zipfile.ZipFile(io.BytesIO(data)) as archive:
+            info = archive.getinfo("manifest.toml")
+            if info.file_size <= MAX_MEMBER:
+                manifest = tomllib.loads(archive.read(info).decode("utf-8"))
+                if manifest.get("role") not in (None, "cryptnode") or manifest.get("side") not in (None, "client"):
+                    raise NodeError("bundle_role", "请选择 CryptNode 客户端钥匙包；不能使用 CryptLink 或服务端钥匙包")
+    except (KeyError, ValueError, UnicodeError, zipfile.BadZipFile, RuntimeError):
+        pass
+    return validate_bundle(data)
+
+
+def _candidate(bundle: ClientBundle, node_id: int) -> Profile:
+    identity = bundle.identity
+    if type(node_id) is not int or not 1 <= node_id <= 99:
+        raise NodeError("node_id", "node_id must be 01..99")
+    return Profile(identity.portal_id, identity.portal_name, node_id, identity.access_host,
+                   identity.port_base, identity.pair_id, identity.created_at,
+                   identity.own_cert_sha256, identity.peer_cert_sha256)
+
+
+def _stage_profile(stage: Path, profile: Profile, bundle: ClientBundle, account) -> None:
+    secure_directory(stage, public_read=True)
+    secure_directory(stage / "certs")
+    secure_directory(stage / "logs")
+    for name in ("cert.pem", "key.pem", "ca.pem", "frp-token"):
+        atomic_write(stage / "certs" / name, bundle.files[name], secret=True)
+    atomic_write(stage / "portal.json", profile_json(profile),
+                 public_read=True, parent_public_read=True)
+    for duty in ("control", "data"):
+        atomic_write(stage / (duty + ".conf"), render_policy(profile, duty).encode("utf-8"),
+                     parent_public_read=True)
+    _grant_tree(stage, account)
+
+
+def _get_initial_config(stage: Path, profile: Profile) -> tuple:
+    from .processes import require_ports
+    require_ports(profile, (13200, 13201, 13202))
+    tunnel = start_tunnel(stage, profile, "control")
+    try:
+        state = node_state(profile)
+        if not state["configured"]:
+            raise NodeError("node_unconfigured", "node_id is not preconfigured in the portal")
+        if state["anchor_in_use"]:
+            raise NodeError("anchor_in_use", "hN/00 is occupied before load")
+        config = node_config(profile)
+        return state, config
+    finally:
+        tunnel.stop()
+
+
+def _wait_host(directory: Path, profile: Profile, *, timeout: float = 30.0) -> str:
+    deadline = time.monotonic() + timeout
+    marker = directory / "runtime.json"
+    while time.monotonic() < deadline:
+        if marker.is_file() and not marker.is_symlink():
+            try:
+                row = json.loads(marker.read_text(encoding="utf-8"))
+                if (row.get("portal_id") == profile.portal_id
+                        and row.get("node_id") == profile.node_id
+                        and row.get("checked_at", 0) >= time.time() - timeout - 5
+                        and row.get("state") in ("running", "suspended_by_portal")):
+                    return row["state"]
+            except (OSError, TypeError, ValueError):
+                pass
+        time.sleep(0.25)
+    raise NodeError("host_readback", "等待运行实例的新安全状态超时；请运行 crnode doctor <门户> 查看原因")
+
+
+def load(node_id: int, bundle_path: Path, root: Optional[Path] = None) -> Profile:
+    require_administrator()
+    account = _runtime_identity()
+    root = checked_absolute(root or active_root())
+    _installation(root)
+    bundle_path = Path(os.path.abspath(bundle_path))
+    bundle = _read_zip(bundle_path)
+    profile = _candidate(bundle, node_id)
+    others = tuple(profiles(root))
+    current = next((item for item in others if item.portal_id == profile.portal_id), None)
+    if any(item.portal_name == profile.portal_name and item.portal_id != profile.portal_id for item in others):
+        raise NodeError("portal_ambiguous", "portal name belongs to another Profile")
+    if current is not None:
+        if current.node_id != node_id or current.portal_name != profile.portal_name:
+            raise NodeError("profile_identity", "rotation cannot change node_id or portal name")
+        if current.pair_id == profile.pair_id:
+            certs = profile_dir(root, profile.portal_id) / "certs"
+            if current != profile or any(
+                    (certs / name).is_symlink() or not (certs / name).is_file()
+                    or (certs / name).read_bytes() != bundle.files[name]
+                    for name in ("cert.pem", "key.pem", "ca.pem", "frp-token")):
+                raise NodeError("pair_conflict", "current pair_id differs from client.zip")
+            return current
+    secure_directory(root, public_read=True)
+    secure_directory(root / "portals", public_read=True)
+    secure_directory(root / ".staging")
+    manager = _manager()
+    target = profile_dir(root, profile.portal_id)
+    staging = root / ".staging"
+    nonce = uuid.uuid4().hex
+    stage = staging / nonce / target.name
+    backup = staging / ("backup-" + nonce) / target.name
+    old_active = False
+    committed = False
+    try:
+        if current is not None:
+            old_active = manager.status(current)["active"] == "true"
+            manager.perform(root, current, "stop")
+        _stage_profile(stage, profile, bundle, account)
+        if current is not None:
+            previous_logs = target / "logs"
+            if previous_logs.is_symlink():
+                raise NodeError("path_link", "old portal logs are linked")
+            if previous_logs.is_dir():
+                for entry in previous_logs.iterdir():
+                    if entry.is_symlink() or not entry.is_file():
+                        raise NodeError("path_link", "old portal log entry is unsafe")
+                    shutil.copy2(entry, stage / "logs" / entry.name)
+        _state, config = _get_initial_config(stage, profile)
+        atomic_write(stage / "node.toml", config, parent_public_read=True)
+        _grant_tree(stage, account)
+        if current is not None:
+            secure_directory(backup.parent)
+            target.rename(backup)
+        stage.rename(target)
+        committed = True
+        manager.install(root, profile)
+        manager.perform(root, profile, "start")
+        _wait_host(target, profile)
+        if current is not None:
+            shutil.rmtree(backup)
+        return profile
+    except Exception:
+        if committed:
+            try:
+                manager.remove(root, profile)
+            except Exception:
+                pass
+            if target.exists():
+                shutil.rmtree(target)
+            if current is not None and backup.exists():
+                backup.rename(target)
+                try:
+                    manager.install(root, current)
+                    if old_active:
+                        manager.perform(root, current, "start")
+                except Exception as exc:
+                    raise NodeError("rollback_unconfirmed", "old Portal Profile restored but service recovery failed") from exc
+        elif current is not None and old_active:
+            manager.perform(root, current, "start")
+        raise
+    finally:
+        for parent in (stage.parent, backup.parent):
+            if parent.exists():
+                shutil.rmtree(parent)
+
+
+def unload(profile: Profile, root: Optional[Path] = None) -> None:
+    require_administrator()
+    root = checked_absolute(root or active_root())
+    _installation(root)
+    target = profile_dir(root, profile.portal_id)
+    if not target.is_dir() or target.is_symlink():
+        raise NodeError("profile_invalid", "Portal Profile path is unsafe")
+    _manager().remove(root, profile)
+    shutil.rmtree(target)
+
+
+def cleanup(root: Optional[Path] = None) -> None:
+    require_administrator()
+    root = checked_absolute(root or active_root())
+    _installation(root)
+    for profile in tuple(profiles(root)):
+        unload(profile, root)
+    if root.is_symlink():
+        raise NodeError("path_link", "CryptNode install_dir is a symbolic link")
+    shutil.rmtree(root)
+    pointer = pointer_path()
+    if pointer.is_file() and pointer.read_text(encoding="utf-8").strip() == str(root):
+        pointer.unlink()