fix: use git fetch <branch> + checkout -B FETCH_HEAD for reliable branch switching

install_linux.sh: support DEPLOY_BRANCH env var for non-main branch deployment
Usage: sudo DEPLOY_BRANCH=debug-logging bash install_linux.sh
2026-07-08 19:37:07 +08:00 · 2026-07-08 19:32:39 +08:00 · 2026-07-08 19:14:48 +08:00 · 2026-07-08 12:23:50 +08:00 · 2026-07-08 12:16:15 +08:00 · 2026-07-08 12:00:07 +08:00
15 changed files with 352 additions and 63 deletions
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { RouterLink, RouterView, useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
+import { ref, onMounted } from 'vue'
 import { useAuthStore } from '@/stores/auth'
 import { toggleLocale } from '@/i18n'
 import logo from '@/assets/logo.svg'
@@ -9,6 +10,20 @@ const router = useRouter()
 const authStore = useAuthStore()
 const { t, locale } = useI18n()

+const versionInfo = ref<{ commit: string; commitTime: string } | null>(null)
+
+onMounted(async () => {
+  try {
+    const res = await fetch('/api/version')
+    if (res.ok) {
+      const data = await res.json()
+      versionInfo.value = { commit: data.commit, commitTime: data.commit_time }
+    }
+  } catch {
+    // 版本信息获取失败时静默处理，footer 仅显示版权
+  }
+})
+
 function handleLogout() {
  authStore.logout()
  router.push('/')
@@ -16,7 +31,6 @@ function handleLogout() {

 const navLinks = [
  { to: '/', label: 'nav.home' },
-  { to: '/about', label: 'nav.about' },
 ]
 </script>

@@ -39,6 +53,17 @@ const navLinks = [
          >
            {{ t(link.label) }}
          </RouterLink>
+          <a
+            href="https://github.com/wuwenfengmi1998/lmvpn_server"
+            target="_blank"
+            rel="noopener noreferrer"
+            class="flex items-center gap-1.5 px-3 py-1.5 rounded-md text-sm font-medium transition-colors hover:bg-sky-500/40"
+          >
+            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" class="w-4 h-4">
+              <path d="M12 .5C5.37.5 0 5.78 0 12.292c0 5.211 3.438 9.63 8.205 11.188.6.111.82-.254.82-.567 0-.28-.01-1.022-.015-2.005-3.338.711-4.042-1.582-4.042-1.582-.546-1.361-1.335-1.725-1.335-1.725-1.087-.731.084-.716.084-.716 1.205.082 1.838 1.215 1.838 1.215 1.07 1.803 2.809 1.282 3.495.981.108-.763.417-1.282.76-1.577-2.665-.295-5.466-1.309-5.466-5.827 0-1.287.465-2.339 1.235-3.164-.135-.298-.54-1.497.105-3.121 0 0 1.005-.316 3.3 1.209.96-.262 1.98-.392 3-.398 1.02.006 2.04.136 3 .398 2.28-1.525 3.285-1.209 3.285-1.209.645 1.624.24 2.823.12 3.121.765.825 1.23 1.877 1.23 3.164 0 4.53-2.805 5.527-5.475 5.817.42.354.81 1.077.81 2.182 0 1.578-.015 2.846-.015 3.229 0 .315.21.687.825.57C20.565 21.917 24 17.495 24 12.292 24 5.78 18.627.5 12 .5z" />
+            </svg>
+            GitHub
+          </a>
          <template v-if="authStore.isLoggedIn">
            <RouterLink
              to="/profile"
@@ -95,6 +120,9 @@ const navLinks = [
    <footer class="bg-slate-800 text-slate-400 py-6 text-center text-sm">
      <div class="max-w-6xl mx-auto px-4">
        <p>&copy; {{ new Date().getFullYear() }} LmVPN. All rights reserved.</p>
+        <p v-if="versionInfo" class="mt-1 text-slate-500">
+          {{ t('footer.lastCommit') }}: {{ versionInfo.commitTime }} · {{ versionInfo.commit }}
+        </p>
      </div>
    </footer>
  </div>
@@ -10,17 +10,27 @@ const { t } = useI18n()
    <WelcomeItem>
      <template #icon>
        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-          <path stroke-linecap="round" stroke-linejoin="round" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z" />
+          <path stroke-linecap="round" stroke-linejoin="round" d="M13 10V3L4 14h7v7l9-11h-7z" />
        </svg>
      </template>
-      <template #heading>{{ t('home.secureTunnel') }}</template>
-      {{ t('home.secureTunnelDesc') }}
+      <template #heading>{{ t('home.tunnel') }}</template>
+      {{ t('home.tunnelDesc') }}
    </WelcomeItem>

    <WelcomeItem>
      <template #icon>
        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-          <path stroke-linecap="round" stroke-linejoin="round" d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
+          <path stroke-linecap="round" stroke-linejoin="round" d="M12 4.354a4 4 0 110 5.292M15 21H3v-1a6 6 0 0112 0v1zm0 0h6v-1a6 6 0 00-9-5.197M13 7a4 4 0 11-8 0 4 4 0 018 0z" />
+        </svg>
+      </template>
+      <template #heading>{{ t('home.userManage') }}</template>
+      {{ t('home.userManageDesc') }}
+    </WelcomeItem>
+
+    <WelcomeItem>
+      <template #icon>
+        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path stroke-linecap="round" stroke-linejoin="round" d="M12 18h.01M8 21h8a2 2 0 002-2V5a2 2 0 00-2-2H8a2 2 0 00-2 2v14a2 2 0 002 2z" />
        </svg>
      </template>
      <template #heading>{{ t('home.multiDevice') }}</template>
@@ -30,22 +40,51 @@ const { t } = useI18n()
    <WelcomeItem>
      <template #icon>
        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-          <path stroke-linecap="round" stroke-linejoin="round" d="M7 12l3-3 3 3 4-4M8 21l4-4 4 4M3 4h18M4 4h16v12a1 1 0 01-1 1H5a1 1 0 01-1-1V4z" />
+          <path stroke-linecap="round" stroke-linejoin="round" d="M21 12a9 9 0 11-18 0 9 9 0 0118 0zM3.6 9h16.8M3.6 15h16.8M11.5 3a17 17 0 000 18M12.5 3a17 17 0 010 18" />
        </svg>
      </template>
-      <template #heading>{{ t('home.trafficMonitor') }}</template>
-      {{ t('home.trafficMonitorDesc') }}
+      <template #heading>{{ t('home.dualStack') }}</template>
+      {{ t('home.dualStackDesc') }}
    </WelcomeItem>

    <WelcomeItem>
      <template #icon>
        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
-          <path stroke-linecap="round" stroke-linejoin="round" d="M10.325 4.317c.426-1.756 2.924-1.756 3.35 0a1.724 1.724 0 002.573 1.066c1.543-.94 3.31.826 2.37 2.37a1.724 1.724 0 001.066 2.573c1.756.426 1.756 2.924 0 3.35a1.724 1.724 0 00-1.066 2.573c.94 1.543-.826 3.31-2.37 2.37a1.724 1.724 0 00-2.573 1.066c-.426 1.756-2.924 1.756-3.35 0a1.724 1.724 0 00-2.573-1.066c-1.543.94-3.31-.826-2.37-2.37a1.724 1.724 0 00-1.066-2.573c-1.756-.426-1.756-2.924 0-3.35a1.724 1.724 0 001.066-2.573c-.94-1.543.826-3.31 2.37-2.37.996.608 2.296.07 2.572-1.065z" />
-          <circle cx="12" cy="12" r="3" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
+          <path stroke-linecap="round" stroke-linejoin="round" d="M17.657 16.657L13.414 20.9a2 2 0 01-2.827 0l-4.244-4.243a8 8 0 1111.314 0zM15 11a3 3 0 11-6 0 3 3 0 016 0z" />
        </svg>
      </template>
-      <template #heading>{{ t('home.easyConfig') }}</template>
-      {{ t('home.easyConfigDesc') }}
+      <template #heading>{{ t('home.reservation') }}</template>
+      {{ t('home.reservationDesc') }}
+    </WelcomeItem>
+
+    <WelcomeItem>
+      <template #icon>
+        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path stroke-linecap="round" stroke-linejoin="round" d="M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z" />
+        </svg>
+      </template>
+      <template #heading>{{ t('home.traffic') }}</template>
+      {{ t('home.trafficDesc') }}
+    </WelcomeItem>
+
+    <WelcomeItem>
+      <template #icon>
+        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path stroke-linecap="round" stroke-linejoin="round" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
+        </svg>
+      </template>
+      <template #heading>{{ t('home.session') }}</template>
+      {{ t('home.sessionDesc') }}
+    </WelcomeItem>
+
+    <WelcomeItem>
+      <template #icon>
+        <svg xmlns="http://www.w3.org/2000/svg" class="w-6 h-6" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path stroke-linecap="round" stroke-linejoin="round" d="M8 9l3 3-3 3m5 0h3M5 20h14a2 2 0 002-2V6a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z" />
+        </svg>
+      </template>
+      <template #heading>{{ t('home.deploy') }}</template>
+      {{ t('home.deployDesc') }}
    </WelcomeItem>
  </div>
 </template>
@@ -62,7 +62,7 @@ export default {
  about: {
    title: 'About LmVPN',
    description:
-      'LmVPN is a lightweight VPN tunnel management system built with Go + Vue 3. It supports multiple VPN protocols and provides secure and reliable point-to-point and point-to-site networking solutions.',
+      'LmVPN is a lightweight Layer-3 VPN system built on WebSocket tunnels and TUN virtual NICs using Go + Vue 3. It supports multi-user management, IPv4/IPv6 dual-stack, static IP reservations, and traffic statistics for point-to-point and point-to-site networking.',
  },
  admin: {
    title: 'Admin Dashboard',
@@ -149,19 +149,35 @@ export default {
    selectUserAndIp: 'Please select a user and fill in at least one IP address',
    confirmDeleteReservation: 'Delete this reservation?',
  },
+  footer: {
+    lastCommit: 'Last commit',
+  },
  home: {
-    tagline: 'Secure, fast, and reliable VPN tunnel management system',
-    secureTunnel: 'Secure Tunnel',
-    secureTunnelDesc:
-      'Based on WireGuard/OpenVPN protocols with end-to-end encryption to keep your data safe.',
-    multiDevice: 'Multi-Device Support',
+    tagline:
+      'A lightweight Layer-3 VPN tunnel management system built on WebSocket and TUN virtual NICs',
+    tunnel: 'WebSocket Tunnel',
+    tunnelDesc:
+      'Layer-3 tunnel over WebSocket and TUN virtual NICs, with WSS/TLS transport security via reverse proxy.',
+    userManage: 'Multi-User Management',
+    userManageDesc:
+      'Admin and user roles with full user CRUD, enable/disable, and password changes, plus self-protection rules.',
+    multiDevice: 'Multi-Device Concurrent',
    multiDeviceDesc:
-      'Connect multiple devices simultaneously — phones, computers, and routers all supported.',
-    trafficMonitor: 'Traffic Monitoring',
-    trafficMonitorDesc:
-      'Real-time traffic statistics and bandwidth analysis to stay on top of network usage.',
-    easyConfig: 'Easy Configuration',
-    easyConfigDesc:
-      'One-click deployment with auto-configuration — no advanced networking knowledge required.',
+      'Up to 3 concurrent connections per user with automatic tunnel IP assignment.',
+    dualStack: 'IPv4/IPv6 Dual-Stack',
+    dualStackDesc:
+      'Supports both IPv4 and IPv6 subnets with NAT dual-stack forwarding and anti-spoofing.',
+    reservation: 'Static IP Reservation',
+    reservationDesc:
+      'Reserve fixed IPv4/IPv6 addresses per user with automatic subnet and uniqueness validation.',
+    traffic: 'Traffic Statistics',
+    trafficDesc:
+      'Real-time online device and traffic statistics with daily aggregated records.',
+    session: 'Session Management',
+    sessionDesc:
+      'JWT token sessions with self-revocation and admin force-logout, with cascading invalidation.',
+    deploy: 'One-Click Deploy & Diagnostics',
+    deployDesc:
+      'One-click Linux deployment script with a built-in system environment diagnostics panel.',
  },
 }
@@ -62,7 +62,7 @@ export default {
  about: {
    title: '关于 LmVPN',
    description:
-      'LmVPN 是一款轻量级 VPN 隧道管理系统，采用 Go + Vue 3 技术栈构建。支持多种 VPN 协议，提供安全可靠的点对点与点对站点网络连接方案。',
+      'LmVPN 是一款基于 WebSocket 隧道与 TUN 虚拟网卡的轻量级三层 VPN 系统，采用 Go + Vue 3 构建。支持多用户管理、IPv4/IPv6 双栈、静态 IP 预留与流量统计，提供点对点与点对站点网络连接方案。',
  },
  admin: {
    title: '管理后台',
@@ -148,16 +148,30 @@ export default {
    selectUserAndIp: '请选择用户并至少填写一个 IP 地址',
    confirmDeleteReservation: '确认删除该预留？',
  },
+  footer: {
+    lastCommit: '最后提交',
+  },
  home: {
-    tagline: '安全、快速、可靠的 VPN 隧道管理系统',
-    secureTunnel: '安全隧道',
-    secureTunnelDesc:
-      '基于 WireGuard/OpenVPN 协议，端到端加密传输，保障数据安全无泄漏。',
-    multiDevice: '多设备支持',
-    multiDeviceDesc: '同时连接多台设备，手机、电脑、路由器全平台覆盖。',
-    trafficMonitor: '流量监控',
-    trafficMonitorDesc: '实时流量统计与带宽分析，随时掌握网络使用状况。',
-    easyConfig: '简易配置',
-    easyConfigDesc: '一键部署、自动配置，无需复杂网络知识即可上线。',
+    tagline: '基于 WebSocket 与 TUN 虚拟网卡的轻量级三层 VPN 隧道管理系统',
+    tunnel: 'WebSocket 隧道',
+    tunnelDesc:
+      '基于 WebSocket 与 TUN 虚拟网卡的三层隧道，经反向代理提供 WSS/TLS 传输安全。',
+    userManage: '多用户管理',
+    userManageDesc:
+      '管理员与普通角色，支持用户增删改、启用禁用与改密，内置自保护规则。',
+    multiDevice: '多设备并发',
+    multiDeviceDesc: '每用户最多 3 个并发连接，自动分配隧道 IP 地址。',
+    dualStack: 'IPv4/IPv6 双栈',
+    dualStackDesc: '同时支持 IPv4 与 IPv6 子网，NAT 双栈转发与源地址反欺骗。',
+    reservation: '静态 IP 预留',
+    reservationDesc:
+      '按用户预留固定 IPv4/IPv6 地址，自动校验子网合法性与唯一性。',
+    traffic: '流量统计',
+    trafficDesc: '实时统计在线设备与流量，按日聚合记录网络使用状况。',
+    session: '会话管理',
+    sessionDesc:
+      'JWT 令牌会话，支持自行注销与管理员强制下线，状态变更级联失效。',
+    deploy: '一键部署与诊断',
+    deployDesc: 'Linux 一键脚本部署，内置系统环境检测面板快速定位问题。',
  },
 }
@@ -47,9 +47,14 @@ const router = createRouter({
  ],
 })

-router.beforeEach((to, from, next) => {
+router.beforeEach(async (to, from, next) => {
  const authStore = useAuthStore()

+  // 已登录但用户信息未加载(如刷新页面后),先获取用户信息
+  if (authStore.isLoggedIn && !authStore.user) {
+    await authStore.fetchUser()
+  }
+
  if (to.meta.requiresAuth && !authStore.isLoggedIn) {
    next({ name: 'login' })
  } else if (to.meta.adminOnly && authStore.user?.role !== 'admin') {
@@ -14,9 +14,13 @@ if [ "$(id -u)" -ne 0 ]; then
    exit 1
 fi

-echo ">>> 拉取最新代码（强制覆盖本地修改）..."
-git fetch origin
-git reset --hard origin/main
+# 部署分支（默认 main，调试时可改为其他分支如 debug-logging）
+DEPLOY_BRANCH="${DEPLOY_BRANCH:-main}"
+
+echo ">>> 拉取最新代码（分支: $DEPLOY_BRANCH，强制覆盖本地修改）..."
+git fetch origin "$DEPLOY_BRANCH"
+git checkout -B "$DEPLOY_BRANCH" FETCH_HEAD
+echo ">>> 当前 commit: $(git rev-parse --short HEAD) $(git log -1 --format=%s)"

 echo ">>> 安装前端依赖并构建..."
 cd frontend
@@ -25,7 +29,11 @@ npm run build
 cd ..

 echo ">>> 编译 Go 后端..."
-go build -o lmvpn .
+VERSION=$(git describe --tags --always 2>/dev/null || echo "dev")
+COMMIT=$(git rev-parse --short HEAD)
+COMMIT_TIME=$(git log -1 --format=%cI)
+BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+go build -ldflags "-X lmvpn/internal/version.Version=$VERSION -X lmvpn/internal/version.Commit=$COMMIT -X lmvpn/internal/version.CommitTime=$COMMIT_TIME -X lmvpn/internal/version.BuildTime=$BUILD_TIME" -o lmvpn .

 echo ">>> 创建 lmvpn 系统用户..."
 if ! id lmvpn &>/dev/null; then
@@ -0,0 +1,25 @@
+package handler
+
+import (
+	"net/http"
+
+	"lmvpn/internal/version"
+
+	"github.com/gin-gonic/gin"
+)
+
+type versionResponse struct {
+	Version    string `json:"version"`
+	Commit     string `json:"commit"`
+	CommitTime string `json:"commit_time"`
+	BuildTime  string `json:"build_time"`
+}
+
+func GetVersion(c *gin.Context) {
+	c.JSON(http.StatusOK, versionResponse{
+		Version:    version.Version,
+		Commit:     version.Commit,
+		CommitTime: version.CommitTime,
+		BuildTime:  version.BuildTime,
+	})
+}
@@ -15,6 +15,7 @@ func Setup(r *gin.Engine) {
 	r.GET("/ws", vpn.HandleWS)

 	r.POST("/api/login", middleware.LoginRateLimit(), handler.Login)
+	r.GET("/api/version", handler.GetVersion)

 	auth := r.Group("/api")
 	auth.Use(middleware.AuthMiddleware())
@@ -0,0 +1,8 @@
+package version
+
+var (
+	Version    = "dev"
+	Commit     = "unknown"
+	CommitTime = "unknown"
+	BuildTime  = "unknown"
+)
@@ -31,14 +31,16 @@ var upgrader = websocket.Upgrader{

 func HandleWS(c *gin.Context) {
 	tokenStr := c.Query("token")
+	clientIP := c.ClientIP()

 	conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
 	if err != nil {
-		log.Printf("WebSocket 升级失败: %v", err)
+		log.Printf("[WS] upgrade failed clientIP=%s err=%v", clientIP, err)
 		return
 	}

 	if tokenStr != "" {
+		log.Printf("[WS] upgrade clientIP=%s auth=jwt", clientIP)
 		claims, err := middleware.ParseToken(tokenStr)
 		if err != nil {
 			sendJSON(conn, authResponse{Type: "auth_err", Message: "令牌无效或已过期"})
@@ -55,9 +57,10 @@ func HandleWS(c *gin.Context) {
 		return
 	}

-	user, err := authenticate(conn, db.DB, c.ClientIP())
+	log.Printf("[WS] upgrade clientIP=%s auth=password", clientIP)
+	user, err := authenticate(conn, db.DB, clientIP)
 	if err != nil {
-		log.Printf("认证读取失败: %v", err)
+		log.Printf("[WS] auth read failed clientIP=%s err=%v", clientIP, err)
 		conn.Close()
 		return
 	}
@@ -155,10 +155,13 @@ func (s *VpnService) ApplySettings(settings model.VpnSetting, reservations4, res
 	s.mu.Unlock()

 	go s.serveTUN()
-	log.Printf("VPN 服务已启动: tun=%s subnet=%s server=%s", tun.Name(), ipNet.String(), serverIP.String())
+	go s.startStatsLogger()
+	log.Printf("[TUN] created name=%s mtu=%d", tun.Name(), settings.MTU)
+	log.Printf("[TUN] ipv4 addr=%s/%d subnet=%s server=%s", serverIP.String(), prefix, ipNet.String(), serverIP.String())
 	if ipNet6 != nil {
-		log.Printf("  IPv6: subnet=%s server=%s", ipNet6.String(), serverIP6.String())
+		log.Printf("[TUN] ipv6 addr=%s/%d subnet=%s server=%s", serverIP6.String(), prefix6, ipNet6.String(), serverIP6.String())
 	}
+	log.Printf("[VPN] started c2c=%v bufSize=%d", settings.AllowClientToClient, settings.MTU+64)
 	return nil
 }

@@ -174,17 +177,49 @@ func (s *VpnService) serveTUN() {
 	for {
 		n, err := tun.Iface.Read(packet)
 		if err != nil {
-			log.Printf("TUN 读取结束: %v", err)
+			log.Printf("[TUN-RX] read ended: %v", err)
 			close(done)
 			return
 		}
 		if n < 1 {
 			continue
 		}
-		targets := switchx.RouteFromTUN(packet[:n])
-		for _, t := range targets {
-			_ = t.WritePacket(packet[:n])
+		pkt := packet[:n]
+		srcIP, destIP, ok := parseIPAddrs(pkt)
+		if ok {
+			log.Printf("[TUN-RX] size=%d proto=%s src=%s dst=%s", n, protoName(pkt), srcIP, destIP)
+		} else {
+			log.Printf("[TUN-RX] size=%d parse=fail", n)
 		}
+		iterStart := time.Now()
+		targets := switchx.RouteFromTUN(pkt)
+		for _, t := range targets {
+			_ = t.WritePacket(pkt)
+		}
+		if iterDur := time.Since(iterStart); iterDur > 10*time.Millisecond {
+			log.Printf("[TUN-RX] slow write iterMs=%d targets=%d size=%d", iterDur.Milliseconds(), len(targets), n)
+		}
+	}
+}
+
+func (s *VpnService) startStatsLogger() {
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+	var lastRx, lastTx int64
+	for range ticker.C {
+		if !s.Running() {
+			return
+		}
+		rx, tx := s.TotalLiveTraffic()
+		rxRate := rx - lastRx
+		txRate := tx - lastTx
+		s.mu.RLock()
+		n := len(s.clients)
+		s.mu.RUnlock()
+		log.Printf("[STATS] clients=%d totalRx=%d totalTx=%d intervalRx=%d(%dB/s) intervalTx=%d(%dB/s)",
+			n, rx, tx, rxRate, rxRate/10, txRate, txRate/10)
+		lastRx = rx
+		lastTx = tx
 	}
 }

@@ -210,7 +245,7 @@ func (s *VpnService) Stop() error {
 			<-done
 		}
 	}
-	log.Printf("VPN 服务已停止")
+	log.Printf("[VPN] stopped")
 	return nil
 }

@@ -242,9 +277,15 @@ func (s *VpnService) WriteToTUN(packet []byte) error {
 	tun := s.tun
 	s.mu.RUnlock()
 	if tun == nil {
+		log.Printf("[TUN-TX] size=%d ok=false err=TUN not ready", len(packet))
 		return errors.New("TUN 未就绪")
 	}
 	_, err := tun.Iface.Write(packet)
+	if err != nil {
+		log.Printf("[TUN-TX] size=%d ok=false err=%v", len(packet), err)
+	} else {
+		log.Printf("[TUN-TX] size=%d ok=true", len(packet))
+	}
 	return err
 }

@@ -1,6 +1,7 @@
 package vpn

 import (
+	"log"
 	"net"
 	"sync"

@@ -106,6 +107,16 @@ func parseIPAddrs(packet []byte) (src, dest net.IP, ok bool) {
 	return nil, nil, false
 }

+func protoName(packet []byte) string {
+	if waterutil.IsIPv4(packet) {
+		return "IPv4"
+	}
+	if waterutil.IsIPv6(packet) {
+		return "IPv6"
+	}
+	return "unknown"
+}
+
 func (s *PacketSwitch) allowC2C() bool {
 	s.mu.RLock()
 	v := s.allowClientToClient
@@ -116,43 +127,67 @@ func (s *PacketSwitch) allowC2C() bool {
 func (s *PacketSwitch) RouteFromClient(src SwitchConn, packet []byte) []SwitchConn {
 	srcIP, dest, ok := parseIPAddrs(packet)
 	if !ok {
+		log.Printf("[ROUTE] client->? parse failed size=%d", len(packet))
 		return nil
 	}
+	proto := protoName(packet)
 	// anti-spoof: enforce assigned source IP by version
 	if srcIP != nil {
 		if srcIP.To4() != nil {
 			if !srcIP.Equal(src.AssignedIP()) {
+				log.Printf("[ROUTE] anti-spoof drop src=%s expected=%s dst=%s proto=%s size=%d",
+					srcIP, src.AssignedIP(), dest, proto, len(packet))
 				return nil
 			}
 		} else {
 			assigned6 := src.AssignedIP6()
 			if assigned6 == nil || !srcIP.Equal(assigned6) {
+				log.Printf("[ROUTE] anti-spoof drop src=%s expected=%s dst=%s proto=%s size=%d",
+					srcIP, assigned6, dest, proto, len(packet))
 				return nil
 			}
 		}
 	}
 	if dest.IsGlobalUnicast() {
 		if c := s.findByIP(dest); c != nil && s.allowC2C() {
+			log.Printf("[ROUTE] client->relay src=%s dst=%s proto=%s size=%d",
+				src.AssignedIP(), dest, proto, len(packet))
 			return []SwitchConn{c}
 		}
+		log.Printf("[ROUTE] client->tun src=%s dst=%s proto=%s size=%d",
+			src.AssignedIP(), dest, proto, len(packet))
 		return nil
 	}
 	if s.allowC2C() {
-		return s.allExcept(src)
+		targets := s.allExcept(src)
+		log.Printf("[ROUTE] client->broadcast src=%s dst=%s proto=%s size=%d targets=%d",
+			src.AssignedIP(), dest, proto, len(packet), len(targets))
+		return targets
 	}
+	log.Printf("[ROUTE] client->drop(broadcast,c2c off) src=%s dst=%s proto=%s size=%d",
+		src.AssignedIP(), dest, proto, len(packet))
 	return nil
 }

 func (s *PacketSwitch) RouteFromTUN(packet []byte) []SwitchConn {
 	_, dest, ok := parseIPAddrs(packet)
 	if !ok {
+		log.Printf("[ROUTE] TUN->? parse failed size=%d", len(packet))
 		return nil
 	}
+	proto := protoName(packet)
 	if dest.IsGlobalUnicast() {
 		if c := s.findByIP(dest); c != nil {
+			log.Printf("[ROUTE] TUN->client dst=%s proto=%s size=%d found=true",
+				dest, proto, len(packet))
 			return []SwitchConn{c}
 		}
+		log.Printf("[ROUTE] TUN->client dst=%s proto=%s size=%d found=false",
+			dest, proto, len(packet))
 		return nil
 	}
-	return s.allExcept(nil)
+	targets := s.allExcept(nil)
+	log.Printf("[ROUTE] TUN->broadcast dst=%s proto=%s size=%d targets=%d",
+		dest, proto, len(packet), len(targets))
+	return targets
 }
@@ -4,6 +4,7 @@ package vpn

 import (
 	"fmt"
+	"log"
 	"net"
 )

@@ -32,5 +33,11 @@ func (t *TUNInterface) AddSubnetRoute(subnet *net.IPNet) error {
 }

 func (t *TUNInterface) SetMTU(mtu int) error {
-	return execCmd("ifconfig", t.Name(), "mtu", fmt.Sprintf("%d", mtu))
+	err := execCmd("ifconfig", t.Name(), "mtu", fmt.Sprintf("%d", mtu))
+	if err != nil {
+		log.Printf("[TUN] set MTU dev=%s mtu=%d ok=false err=%v", t.Name(), mtu, err)
+	} else {
+		log.Printf("[TUN] set MTU dev=%s mtu=%d ok=true", t.Name(), mtu)
+	}
+	return err
 }
@@ -4,6 +4,7 @@ package vpn

 import (
 	"fmt"
+	"log"
 	"net"
 )

@@ -28,5 +29,11 @@ func (t *TUNInterface) AddSubnetRoute(subnet *net.IPNet) error {
 }

 func (t *TUNInterface) SetMTU(mtu int) error {
-	return execCmd("ip", "link", "set", "dev", t.Name(), "mtu", fmt.Sprintf("%d", mtu))
+	err := execCmd("ip", "link", "set", "dev", t.Name(), "mtu", fmt.Sprintf("%d", mtu))
+	if err != nil {
+		log.Printf("[TUN] set MTU dev=%s mtu=%d ok=false err=%v", t.Name(), mtu, err)
+	} else {
+		log.Printf("[TUN] set MTU dev=%s mtu=%d ok=true", t.Name(), mtu)
+	}
+	return err
 }
@@ -41,22 +41,42 @@ type tunnelConn struct {
 	ready       atomic.Bool
 	rxBytes     atomic.Int64
 	txBytes     atomic.Int64
+	rxPkts      atomic.Int64
+	txPkts      atomic.Int64
 }

 func (c *tunnelConn) AssignedIP() net.IP  { return c.assignedIP }
 func (c *tunnelConn) AssignedIP6() net.IP { return c.assignedIP6 }

+func (c *tunnelConn) label() string {
+	s := "user=" + c.user.Username + " ip=" + c.assignedIP.String()
+	if c.assignedIP6 != nil {
+		s += " ip6=" + c.assignedIP6.String()
+	}
+	return s
+}
+
 func (c *tunnelConn) WritePacket(data []byte) error {
 	if !c.ready.Load() || len(data) == 0 {
 		return nil
 	}
+	lockStart := time.Now()
 	c.writeMu.Lock()
+	lockWait := time.Since(lockStart)
 	defer c.writeMu.Unlock()
 	c.conn.SetWriteDeadline(time.Now().Add(writeTimeout))
-	if err := c.conn.WriteMessage(websocket.BinaryMessage, data); err != nil {
+	writeStart := time.Now()
+	err := c.conn.WriteMessage(websocket.BinaryMessage, data)
+	writeDur := time.Since(writeStart)
+	if err != nil {
+		log.Printf("[WS-TX] %s size=%d lockWaitMs=%d writeMs=%d ok=false err=%v",
+			c.label(), len(data), lockWait.Milliseconds(), writeDur.Milliseconds(), err)
 		return err
 	}
 	c.txBytes.Add(int64(len(data)))
+	c.txPkts.Add(1)
+	log.Printf("[WS-TX] %s size=%d lockWaitMs=%d writeMs=%d ok=true",
+		c.label(), len(data), lockWait.Milliseconds(), writeDur.Milliseconds())
 	return nil
 }

@@ -150,13 +170,13 @@ func runTunnel(conn *websocket.Conn, user *model.User) {
 		initMsg.ServerIP6 = VPN.ServerIP6().String()
 	}
 	if err := tc.writeControl(initMsg); err != nil {
-		log.Printf("用户 %s 发送 init 失败: %v", user.Username, err)
+		log.Printf("[CONN] init failed %s err=%v", tc.label(), err)
 		return
 	}

-	log.Printf("用户 %s 已连接，分配 IP %s", user.Username, ip4.String())
+	log.Printf("[CONN] init sent %s mtu=%d prefix=%d server=%s", tc.label(), settings.MTU, VPN.Prefix(), VPN.ServerIP().String())
 	if ip6 != nil {
-		log.Printf("  IPv6: %s", ip6.String())
+		log.Printf("[CONN] init6 sent %s ip6=%s prefix6=%d server6=%s", tc.label(), ip6.String(), VPN.Prefix6(), VPN.ServerIP6().String())
 	}

 	conn.SetReadLimit(maxMessageSize)
@@ -170,12 +190,32 @@ func runTunnel(conn *websocket.Conn, user *model.User) {
 			tc.writeMu.Lock()
 			if err := conn.WriteControl(websocket.PingMessage, nil, time.Now().Add(writeTimeout)); err != nil {
 				tc.writeMu.Unlock()
+				log.Printf("[PING] failed %s err=%v", tc.label(), err)
 				return
 			}
 			tc.writeMu.Unlock()
 		}
 	}()

+	go func() {
+		ticker := time.NewTicker(10 * time.Second)
+		defer ticker.Stop()
+		var lastRx, lastTx int64
+		for range ticker.C {
+			if !tc.ready.Load() {
+				return
+			}
+			rx := tc.rxBytes.Load()
+			tx := tc.txBytes.Load()
+			rxRate := rx - lastRx
+			txRate := tx - lastTx
+			log.Printf("[CONN] stats %s rxBytes=%d txBytes=%d rxRate=%dB/s txRate=%dB/s rxPkts=%d txPkts=%d",
+				tc.label(), rx, tx, rxRate/10, txRate/10, tc.rxPkts.Load(), tc.txPkts.Load())
+			lastRx = rx
+			lastTx = tx
+		}
+	}()
+
 	conn.SetPongHandler(func(string) error {
 		conn.SetReadDeadline(time.Now().Add(readTimeout))
 		return nil
@@ -184,7 +224,10 @@ func runTunnel(conn *websocket.Conn, user *model.User) {
 	for {
 		messageType, data, err := conn.ReadMessage()
 		if err != nil {
-			log.Printf("用户 %s 断开连接: %v", user.Username, err)
+			duration := time.Since(tc.connectedAt)
+			log.Printf("[CONN] disconnected %s duration=%s rxBytes=%d txBytes=%d rxPkts=%d txPkts=%d err=%v",
+				tc.label(), duration.Round(time.Second), tc.rxBytes.Load(), tc.txBytes.Load(),
+				tc.rxPkts.Load(), tc.txPkts.Load(), err)
 			return
 		}

@@ -196,7 +239,7 @@ func runTunnel(conn *websocket.Conn, user *model.User) {
 			if msg.Type == "ready" && !tc.ready.Load() {
 				tc.ready.Store(true)
 				conn.SetReadDeadline(time.Now().Add(readTimeout))
-				log.Printf("用户 %s 就绪 (IP %s)", user.Username, ip4.String())
+				log.Printf("[CONN] ready %s", tc.label())
 			}
 			continue
 		}
@@ -207,7 +250,7 @@ func runTunnel(conn *websocket.Conn, user *model.User) {

 		if !tc.ready.Load() {
 			if time.Now().After(readyDeadline) {
-				log.Printf("用户 %s 等待 ready 超时", user.Username)
+				log.Printf("[CONN] ready timeout %s", tc.label())
 				return
 			}
 			conn.SetReadDeadline(readyDeadline)
@@ -215,11 +258,20 @@ func runTunnel(conn *websocket.Conn, user *model.User) {
 		}

 		tc.rxBytes.Add(int64(len(data)))
+		tc.rxPkts.Add(1)
+
+		srcIP, destIP, ok := parseIPAddrs(data)
+		if ok {
+			log.Printf("[WS-RX] %s size=%d proto=%s src=%s dst=%s",
+				tc.label(), len(data), protoName(data), srcIP, destIP)
+		} else {
+			log.Printf("[WS-RX] %s size=%d parse=fail", tc.label(), len(data))
+		}

 		targets := VPN.RouteFromClient(tc, data)
 		if len(targets) == 0 {
 			if err := VPN.WriteToTUN(data); err != nil {
-				log.Printf("用户 %s 写入 TUN 失败: %v", user.Username, err)
+				log.Printf("[WS-RX] %s action=tun err=%v size=%d", tc.label(), err, len(data))
 			}
 			continue
 		}
Author	SHA1	Message	Date
kevin	5d08dffa39	fix: use git fetch <branch> + checkout -B FETCH_HEAD for reliable branch switching	2026-07-08 19:37:07 +08:00
kevin	1dce2bb99d	install_linux.sh: support DEPLOY_BRANCH env var for non-main branch deployment Usage: sudo DEPLOY_BRANCH=debug-logging bash install_linux.sh	2026-07-08 19:32:39 +08:00
kevin	616d30bc08	add debug logging for VPN packet flow diagnosis Add comprehensive console logging at key data path points: - [TUN-RX]: per-packet TUN read (size, proto, src/dst IP, slow write detection) - [TUN-TX]: per-packet TUN write (size, success/error) - [WS-RX]: per-packet WebSocket read from client (size, proto, src/dst IP) - [WS-TX]: per-packet WebSocket write to client (size, lockWaitMs, writeMs) - [ROUTE]: routing decisions (TUN->client, client->tun, client->relay, anti-spoof) - [CONN]: connection lifecycle (init, ready, stats every 10s, disconnect with final stats) - [STATS]: global traffic stats every 10s (clients, rx/tx bytes and rates) - [PING]: WebSocket ping failures - [WS]: WebSocket upgrade with client IP and auth method - [TUN]: MTU set confirmation, VPN start/stop environment info	2026-07-08 19:14:48 +08:00
kevin	3306fc7ee4	修改前端内容	2026-07-08 12:23:50 +08:00
kevin	cbe7aeca81	修改前端内容	2026-07-08 12:16:15 +08:00
kevin	170df5f457	fix: 刷新 /admin 被错误跳转到 /profile 路由守卫在 user 信息未加载时判断权限，刷新后 token 从 localStorage 恢复但 user 为 null，导致 adminOnly 守卫误判 role !== 'admin' 而跳转。改为在已登录但 user 为 null 时先 await fetchUser() 加载用户信息再判断。	2026-07-08 12:00:07 +08:00