ykxmz 1.5.0：修复手表端 TLS 证书校验 + MTU 修复网络稳定性

被控端 - 修复 MTU 问题：夹 MSS + 路径 MTU 探测（公网可用率 48% -> 100%） - 复用 HTTP 连接（免掉每次新建 TLS 的 30% 握手失败） - 每分钟回头找局域网，自动切回快 400 倍的路径 - 画面心跳帧：静止时省流量，客户端仍知道流是活的 - 锁屏时给出可操作的提示手表端 - 内置 GTS Root R4 / GlobalSign Root CA，修 SSLHandshakeException - 连接错误翻译成人话（证书/时间/解析/超时分别提示） - 经中转连上后用服务器报的地址刷新已配对记录 - 新增局域网连接页面、服务器延迟检测服务器端 - 支持 chunked 请求体（修每 16 秒一次的连接错乱与大面积 502） - 网络调优脚本 net-tune.sh（开机自动应用） - 管理页：批量删除、网络体检、下载区 - 隧道改 HTTP/2 + 双连接文档 - 许可协议 / 安装前必读 / 安装后须知（作者：小麦子）
2026-10-18 16:00:43 +00:00 · 2026-10-06 19:01:05 +08:00
commit b62ac865ea
3195 changed files with 203292 additions and 0 deletions
@@ -0,0 +1,150 @@
+# -*- coding: utf-8 -*-
+"""验证管理页的登录流程。
+
+流程：GET / -> 登录页（无数据）-> POST /admin/login 密码 -> 拿 Cookie
+      -> 带 Cookie 访问 / 和 /v1/admin/devices 应该能进
+      -> 密码错 -> 回登录页且带错误提示
+"""
+from __future__ import annotations
+
+import http.cookiejar
+import json
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+
+# Cloudflare 的 Browser Integrity Check 会拦 Python 默认 UA
+# （返回 403 + error code 1010），所以请求都要带上这个。
+_UA = {"User-Agent": "LanRemote/1.4.0"}
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "_build"))
+
+info = json.loads((ROOT / "_build" / "relay_info.json").read_text(
+    encoding="utf-8"))
+URL = info["url"]
+PASSWORD = "120830"
+
+passed = 0
+failed = 0
+
+
+def check(name, ok, detail=""):
+    global passed, failed
+    if ok:
+        passed += 1
+        print("  [PASS] " + name)
+    else:
+        failed += 1
+        print("  [FAIL] " + name + "  " + str(detail))
+
+
+def main() -> int:
+    print(f"中转地址: {URL}")
+    print()
+
+    jar = http.cookiejar.CookieJar()
+    opener = urllib.request.build_opener(
+        urllib.request.HTTPCookieProcessor(jar))
+
+    print("一、没登录时")
+    try:
+        _req = urllib.request.Request(URL + "/", headers=_UA)
+        with opener.open(_req, timeout=30) as resp:
+            body = resp.read().decode("utf-8", "replace")
+            status = resp.status
+    except urllib.error.HTTPError as exc:
+        status = exc.code
+        body = exc.read().decode("utf-8", "replace")
+    check("管理页返回 200（给登录页而不是错误）", status == 200, status)
+    check("看到的是登录页", "管理密码" in body or "登录" in body,
+          body[:80])
+    check("登录前不泄露设备信息", "配对码" not in body, "泄露了")
+
+    # 管理接口没登录
+    try:
+        _req = urllib.request.Request(URL + "/v1/admin/devices", headers=_UA)
+        with opener.open(_req, timeout=20) as resp:
+            status2 = resp.status
+    except urllib.error.HTTPError as exc:
+        status2 = exc.code
+    check("管理接口没登录被拒", status2 == 401, status2)
+
+    print()
+    print("二、密码错")
+    data = urllib.parse.urlencode({"password": "000000"}).encode()
+    req = urllib.request.Request(URL + "/admin/login", data=data, method="POST", headers=_UA)
+    req.add_header("Content-Type", "application/x-www-form-urlencoded")
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            bad_status = resp.status
+            bad_body = resp.read().decode("utf-8", "replace")
+    except urllib.error.HTTPError as exc:
+        bad_status = exc.code
+        bad_body = exc.read().decode("utf-8", "replace")
+    check("错密码被拒（重定向回登录页）", bad_status in (200, 302, 303),
+          bad_status)
+    check("错密码后没种 Cookie", len(jar) == 0, f"{len(jar)} 个 cookie")
+
+    print()
+    print("三、密码对")
+    data = urllib.parse.urlencode({"password": PASSWORD}).encode()
+    req = urllib.request.Request(URL + "/admin/login", data=data, method="POST", headers=_UA)
+    req.add_header("Content-Type", "application/x-www-form-urlencoded")
+    with opener.open(req, timeout=30) as resp:
+        login_status = resp.status
+        resp.read()
+    check("登录返回重定向", login_status in (200, 302), login_status)
+    cookies = [c.name for c in jar]
+    check("种下了 lr_admin Cookie", "lr_admin" in cookies, str(cookies))
+
+    print()
+    print("四、登录后")
+    with opener.open(urllib.request.Request(URL + "/", headers=_UA), timeout=30) as resp:
+        body = resp.read().decode("utf-8", "replace")
+        status = resp.status
+    check("能打开管理页", status == 200, status)
+    check("看到的是后台而不是登录页",
+          "配对码" in body or "登记设备" in body, body[:80])
+    check("页面上有退出登录", "退出" in body or "logout" in body.lower(), "")
+
+    with opener.open(urllib.request.Request(URL + "/v1/admin/devices", headers=_UA), timeout=30) as resp:
+        snap = json.loads(resp.read())
+    check("管理接口能拿到设备列表", snap.get("ok") is True, str(snap)[:80])
+
+    print()
+    print("五、退出登录")
+    try:
+        with opener.open(urllib.request.Request(URL + "/admin/logout", headers=_UA), timeout=30) as resp:
+            resp.read()
+    except urllib.error.HTTPError:
+        pass
+    try:
+        with opener.open(urllib.request.Request(URL + "/v1/admin/devices", headers=_UA), timeout=20) as resp:
+            after = resp.status
+    except urllib.error.HTTPError as exc:
+        after = exc.code
+    check("退出后管理接口又被拒", after == 401, after)
+
+    print()
+    print("六、脚本通道（X-Admin 头仍可用）")
+    req = urllib.request.Request(URL + "/v1/admin/devices", headers=_UA)
+    req.add_header("X-Admin", PASSWORD)
+    try:
+        with urllib.request.urlopen(req, timeout=20) as resp:
+            ok = resp.status
+    except urllib.error.HTTPError as exc:
+        ok = exc.code
+    check("X-Admin 传密码也能用（方便脚本）", ok == 200, ok)
+
+    print()
+    print("=" * 60)
+    print(f"通过 {passed} 项，失败 {failed} 项")
+    return 0 if failed == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())