VTesse 2.0.0: userspace only — inbound forwards, ip=learn, default-route wait, TAP backend removed

.github/workflows/build.yml

@@ -64,11 +64,8 @@ jobs:
             CFLAGS="-O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer" \
             LDFLAGS="-fsanitize=address,undefined" test
 
-      - name: TAP-only build (LWIP=0)
-        run: make -j"$(nproc)" BUILD=build-tap LWIP=0 all
-
-      - name: Minimal lwIP build (SOCKS=0 UDP_RELAY=0 TAP=0) and its tests
-        run: make -j"$(nproc)" BUILD=build-min SOCKS=0 UDP_RELAY=0 TAP=0 test
+      - name: Minimal build (SOCKS=0 UDP_RELAY=0) and its tests
+        run: make -j"$(nproc)" BUILD=build-min SOCKS=0 UDP_RELAY=0 test
 
   # ------------------------------------------------------------------ cross
   build:
@@ -140,10 +137,10 @@ jobs:
       - name: Stage 2 acceptance (SOCKS5, port forwards)
         run: bench/bench.sh proxy-test
 
-      - name: TAP backend acceptance
-        run: bench/bench.sh tap-test
+      - name: Inbound forwards and ip=learn acceptance (#67, #68)
+        run: bench/bench.sh accept-test
 
-      - name: type tun acceptance (manual IPv4, lwIP and TAP)
+      - name: type tun acceptance (manual IPv4)
         run: bench/bench.sh tun-test
 
       - name: UDP relay acceptance (RTP from cameras)
@@ -152,6 +149,9 @@ jobs:
       - name: Failure scenarios (link loss, server restart, no option 121, lease renewal)
         run: bench/bench.sh fault-test
 
+      - name: Default-route wait before the start (#73)
+        run: bench/bench.sh route-wait-test
+
       - name: Server log
         if: always()
         run: docker logs vtesse-bench-server 2>&1 | tail -100 || true
@@ -231,7 +231,7 @@ jobs:
           apk=$(find artifacts -type f -name app-release.apk | head -1)
           [ -n "$apk" ] || { echo "::error::no signed release APK"; exit 1; }
           cp "$apk" release/vtesse-android.apk
-          cp scripts/vtesse-hook.sh scripts/vtesse-udhcpc.script scripts/S99vtesse scripts/vtesse.init release/
+          cp scripts/S99vtesse scripts/vtesse.init release/
           ls -l release
 
       # Only the head of main is published: a re-run of an older run, or a run that

CHANGELOG.md

@@ -6,6 +6,38 @@ from every push to `main`; this file is the change history. Versions after 1.12
 `MAJOR.MINOR.PATCH` (1.12 is followed by 1.12.1 or 1.13.0); the headings below keep the
 numbers as released.
 
+## 2.0.0 — 2026-10-22
+
+The userspace stack only: inbound access without a kernel interface, the TAP backend
+removed (#72). Incompatible: read the last points before updating a device.
+
+- Inbound forwards (#67): `accept=PORT[:IP:PORT]` / `--accept`, up to 4: the stack
+  listens on `PORT` of the tunnel address and relays each connection from the server to
+  a host socket, by default the same port on the address of the default-route interface
+  (the device's own LAN address, so its web interface asks for the password as on the
+  LAN). A closed or silent local port resets the connection; each connection is logged
+  and counted.
+- `ip=learn` / `--ip learn` for `type tun` (#68): the address is the destination of the
+  first unicast packet from the server, its source the peer; set before the packet
+  enters the stack, so a first SYN is accepted; a changed address after a reconnect
+  replaces the old one. `type ether` with `ip=learn` stops the client (exit code 2).
+- The service opens the device's web interface, ssh and RTSP to the server: `--install`
+  writes `accept=80`, `accept=22` and `accept=554` to a configuration without `accept`
+  lines, and a client started from the U-Boot environment (`fw_setenv vtesse`) without
+  `accept` lines opens the same ports. `accept=none` (or `--accept none`) turns them off.
+- The client always waits for a default route before it starts (#73), in every start
+  mode, with no time limit: one line when the wait starts and one per minute;
+  SIGINT/SIGTERM end it (exit code 0). It used to wait up to 60 s, only in the U-Boot
+  environment mode.
+- Removed (#72): the TAP backend (`--tap`, `--ifname`, `--hook`, refused with the reason, as
+  are `tap=`, `hook=` and `ifname=` lines in the configuration),
+  the `LWIP=0` and `TAP=0` build switches, the hook scripts `vtesse-hook.sh` and
+  `vtesse-udhcpc.script` (no longer in the release) and `--install --scripts`.
+- Updating a 1.x installation: `vtesse --install` removes the old hook scripts and adds
+  the `accept` lines; an `/etc/default/vtesse` with `ARGS="--tap ..."` is reported and
+  must be cleaned by hand, otherwise the service does not start. The service scripts no
+  longer load `tun`.
+
 ## 1.15.0 — 2026-10-18
 
 Settings in the U-Boot environment for helpdesk access (#64).

Makefile

@@ -1,9 +1,8 @@
 # VTesse build.
 #   make CROSS_COMPILE=mipsel-linux-musl- STATIC=1   cross compile, static binary
-#   make LWIP=0                                       TAP backend only (no stack, no proxy)
 #   make LWIP_PROFILE=medium                          lwIP memory profile: large (default),
 #                                                     medium (cameras, routers), small
-#   make SOCKS=0 UDP_RELAY=0 TAP=0                   leave out optional modules (default 1)
+#   make SOCKS=0 UDP_RELAY=0                         leave out optional modules (default 1)
 #   (use a separate BUILD=... directory per variant: objects are not rebuilt on a change)
 CROSS_COMPILE ?=
 ifneq ($(CROSS_COMPILE),)
@@ -28,22 +27,16 @@ LWIP_CFLAGS := -std=gnu99 -Wall -Wno-unused-parameter -Wno-address \
                -ffunction-sections -fdata-sections $(INCLUDES)
 LDFLAGS ?=
 BUILD   ?= build
-LWIP    ?= 1
 # lwIP memory profile (port/lwip/lwipopts.h): large (PCs, Android), medium (cameras,
 # routers), small
 LWIP_PROFILE ?= large
-# optional modules of the lwIP build (1 = in, 0 = out): SOCKS5 server, UDP relay,
-# TAP/TUN backend (kernel interface; Linux only)
+# optional modules (1 = in, 0 = out): SOCKS5 server, UDP relay. The TAP backend
+# (kernel interface) and LWIP=0 were removed in 2.0.0 (#72).
 SOCKS     ?= 1
 UDP_RELAY ?= 1
-TAP       ?= 1
 
-NETCORE_SRC := netcore/tunnel.c netcore/loop.c netcore/route.c
-ifeq ($(TAP),1)
-NETCORE_SRC += netcore/tapdev.c
-else
-BASE_CFLAGS += -DVTESSE_WITH_TAP=0
-endif
+NETCORE_SRC := netcore/tunnel.c netcore/loop.c netcore/route.c netcore/hostaddr.c \
+               netcore/stack.c netcore/proxy.c
 VTUN_SRC    := vtun/vtun_proto.c vtun/vtun_client.c
 LWIP_SRC    := $(addprefix $(LWIP_DIR)/src/core/, def.c inet_chksum.c init.c ip.c mem.c \
                  memp.c netif.c pbuf.c stats.c sys.c tcp.c tcp_in.c tcp_out.c timeouts.c udp.c) \
@@ -54,24 +47,17 @@ LWIP_PROFILE_NUM := $(if $(filter small,$(LWIP_PROFILE)),0,$(if $(filter medium,
 BASE_CFLAGS += -DVTESSE_LWIP_PROFILE=$(LWIP_PROFILE_NUM)
 LWIP_CFLAGS += -DVTESSE_LWIP_PROFILE=$(LWIP_PROFILE_NUM)
 
-ifeq ($(LWIP),1)
-NETCORE_SRC += netcore/stack.c netcore/proxy.c
 BASE_CFLAGS += -DNC_WITH_SOCKS=$(SOCKS)
 ifeq ($(UDP_RELAY),1)
 NETCORE_SRC += netcore/udprelay.c
 else
 BASE_CFLAGS += -DVTESSE_WITH_UDP_RELAY=0
 endif
 NETCORE_OBJ := $(NETCORE_SRC:%.c=$(BUILD)/%.o) $(LWIP_SRC:%.c=$(BUILD)/%.o)
-else
-BASE_CFLAGS += -DVTESSE_WITH_LWIP=0
-NETCORE_OBJ := $(NETCORE_SRC:%.c=$(BUILD)/%.o)
-endif
 VTUN_OBJ    := $(VTUN_SRC:%.c=$(BUILD)/%.o)
 
-# scripts/ built into the binary: the default hook and "vtesse --install" (#52)
-SCRIPTS    := scripts/vtesse-hook.sh scripts/vtesse-udhcpc.script scripts/S99vtesse \
-              scripts/vtesse.init scripts/vtesse.service
+# scripts/ built into the binary: the service scripts of "vtesse --install" (#52)
+SCRIPTS    := scripts/S99vtesse scripts/vtesse.init scripts/vtesse.service
 SCRIPTS_H  := $(BUILD)/gen/vtesse_scripts.h
 CLI_OBJ    := $(BUILD)/cli/vtesse_cli.o $(BUILD)/cli/install.o $(BUILD)/cli/env.o