feat: add FTP server and FTPS support

Author: zengyufei

CHANGELOG.en.md

@@ -2,6 +2,13 @@
 
 All notable changes to `ii` are documented here. The default Chinese version is [CHANGELOG.md](CHANGELOG.md).
 
+## 0.3.8 - 2026-08-08
+
+### Added
+
+- Added the `ii ftp [directory]` FTP server: it shares the current directory by default with active-only mode, anonymous login, 100 control connections, and all file operations enabled. It supports credentials, one shared rate limit, a connection limit, individual operation permissions, and active plus passive mode when `--passive-ports` is supplied.
+- Added required explicit FTPS with `ii ftp --tls` and legacy implicit FTPS with `--implicit`, which defaults to port `990`; both accept temporary self-signed certificates or PEM `--cert` and `--key` files.
+
 ## 0.3.7 - 2026-08-07
 
 ### Added

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 本文件记录 `ii` 的重要变更。默认中文版本在这里，英文版本见 [CHANGELOG.en.md](CHANGELOG.en.md)。
 
+## 0.3.8 - 2026-08-08
+
+### 新增
+
+- 新增 `ii ftp [目录]` FTP 服务端：默认共享当前目录、仅主动模式、匿名登录、100 个控制连接和完整文件操作权限；支持账号密码、共享总限速、连接上限、独立操作权限，以及显式 `--passive-ports` 后的主动加被动模式。
+- `ii ftp --tls` 新增强制显式 FTPS；`--implicit` 新增传统隐式 FTPS，默认端口 `990`；两者支持临时自签证书或 `--cert`、`--key` PEM 证书。
+
 ## 0.3.7 - 2026-08-07
 
 ### 新增

Cargo.lock

@@ -1,6 +1,12 @@
 [workspace]
 members = ["gui"]
-exclude = ["vendor/iroh", "vendor/suppaftp"]
+exclude = [
+    "vendor/iroh",
+    "vendor/suppaftp",
+    "vendor/libunftp",
+    "vendor/unftp-core",
+    "vendor/unftp-sbe-fs",
+]
 resolver = "3"
 
 [workspace.package]
@@ -18,18 +24,21 @@ unused-async = "warn"
 
 [package]
 name = "ii"
-version = "0.3.7"
+version = "0.3.8"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
 
 [dependencies]
+async-trait = "0.1"
 anyhow = "1"
 attohttpc = { version = "0.31", default-features = false, features = ["tls-rustls-webpki-roots-ring"] }
 base64 = "0.22"
+bytes = "1"
 futures-util = "0.3"
 glob = "0.3.3"
 hmac = "0.12"
+libunftp = { path = "vendor/libunftp", default-features = false, features = ["ring"] }
 iroh = { path = "vendor/iroh/iroh", default-features = false, features = ["tls-ring", "unstable-net-report"] }
 iroh-relay = { path = "vendor/iroh/iroh-relay", default-features = false, features = ["server-minimal"] }
 md5 = { package = "md-5", version = "0.10" }
@@ -57,11 +66,11 @@ tokio-util = { version = "0.7", features = ["io"] }
 toml = "1.0"
 tracing = "0.1"
 url = { version = "2.5", features = ["serde"] }
+unftp-core = { path = "vendor/unftp-core" }
+unftp-sbe-fs = { path = "vendor/unftp-sbe-fs" }
 
 [dev-dependencies]
-libunftp = { version = "0.23.0", default-features = false, features = ["ring"] }
 serde_json = "1"
-unftp-sbe-fs = "0.4.0"
 
 [build-dependencies]
 winresource = "0.1"
@@ -74,6 +83,8 @@ panic = "abort"
 strip = true
 
 [patch.crates-io]
+unftp-core = { path = "vendor/unftp-core" }
+unftp-sbe-fs = { path = "vendor/unftp-sbe-fs" }
 iroh-base = { path = "vendor/iroh/iroh-base" }
 iroh-dns = { path = "vendor/iroh/iroh-dns" }
 iroh-relay = { path = "vendor/iroh/iroh-relay" }

Cargo.toml

@@ -24,7 +24,7 @@
 - Send files, folders, multiple paths, or piped data. Receives resume, skip matching MD5 files, and overwrite conflicts.
 - Compute local checksums, preserve single-file metadata, choose symlink behavior, and run FIFO queues or directory watches.
 - Use generic S3, Cloudflare R2, Azure Blob, WebDAV, FTP, or SFTP as optional backends, with cleanup after receiving.
-- It also provides LAN web sharing, WebDAV, browser transfer, TCP tunnels, and self-hosted relays.
+- It also provides LAN web sharing, WebDAV, an FTP server, browser transfer, TCP tunnels, and self-hosted relays.
 
 ## Common Use Cases
 
@@ -52,6 +52,13 @@
 - Use one working directory as a shared asset drive for tablets, phones, and computers.
 - Provide a temporary delivery directory that clients or colleagues can access as a network drive without installing `ii`.
 
+### `ii ftp`
+
+- Temporarily share one directory with legacy devices, printers, NAS appliances, or tools that support FTP only.
+- Use active mode by default; explicitly configure a passive port range when clients need passive mode behind NAT.
+- Combine upload, download, delete, rename, and directory-creation permissions for a temporary file service.
+- Keep the default port 21 with explicit TLS for FTPS-capable legacy clients; use `--implicit` and port 990 only for clients that require implicit FTPS.
+
 ### `ii socks5`
 
 - Provide a standard SOCKS5 proxy endpoint for browsers, downloaders, and command-line tools.
@@ -289,6 +296,33 @@ ii dav .\shared --port 8443 --username alice --password secret --tls --domain da
 
 `ii web --once` exits only after the first complete ordinary-file `GET 200`. HEAD, Range, directory pages, 404 responses, and uploads do not consume the one-shot lifetime, and `--once` conflicts with `--upload`.
 
+### FTP Server
+
+```powershell
+# Share the current directory; listens on 0.0.0.0:21 by default
+ii ftp
+
+# Select a directory, credentials, shared bandwidth, and connection limit
+ii ftp .\shared --port 2121 --username alice --password secret --rate 8MiB --max 20
+
+# Explicitly enable active and passive modes; advertise this PASV address and port range
+ii ftp .\shared --passive-host 192.168.1.20 --passive-ports 49152-49200
+
+# Disable individual operations
+ii ftp .\shared --upload false --delete false --rename false
+
+# Explicit FTPS: TLS is required for both control and data channels; without files ii generates a temporary self-signed certificate
+ii ftp .\shared --tls
+ii ftp .\shared --tls --cert D:\certs\fullchain.pem --key D:\certs\privkey.pem
+
+# Implicit FTPS: start TLS immediately after connecting; defaults to port 990
+ii ftp .\shared --tls --implicit
+```
+
+`ii ftp` shares the current directory or an existing directory. It defaults to anonymous login, 100 control connections, no rate limit, and allows uploads, downloads, deletion, renames, and directory creation. By default it is active-only and creates no passive data listener. Supplying `--passive-ports [start-end]` enables active and passive modes together; without a range it uses `49152-65535`, and `--passive-host` requires it. `--rate` caps the total shared bandwidth of every upload and download connection. `--delete false` blocks both file and directory deletion, while `--download false` blocks only `RETR`; directory listings and metadata remain available. `0.0.0.0` is bind-only; the terminal prints the primary LAN IPv4 FTP URL and `other:` interface URLs.
+
+`--tls` enables and requires FTPS. Its default is explicit mode: the client receives the plain FTP greeting and then sends `AUTH TLS`, and the default port remains 21. Without `--cert` and `--key`, `ii` generates a self-signed certificate for the current process and the client must accept it. Existing PEM certificate chains and private keys must be supplied together. `--implicit` requires `--tls`; it performs the TLS handshake immediately on connection and defaults to port 990 when `--port` is omitted. `--port 990` alone does not select implicit mode. `-k` is not an FTP server option.
+
 ### Lightweight LAN Services
 
 ```powershell

README.en.md

@@ -24,7 +24,7 @@
 - 发送文件、目录、多文件和管道数据；接收支持断点续传、同 MD5 跳过和冲突覆盖。
 - 支持发送端校验和、单文件 metadata 保留、符号链接策略、FIFO 队列和目录监视。
 - 可选通用 S3、Cloudflare R2、Azure Blob、WebDAV、FTP、SFTP 中转；传完可删除中转对象。
-- 另有局域网网页、WebDAV、浏览器直传、TCP 隧道和自建 relay。
+- 另有局域网网页、WebDAV、FTP 服务、浏览器直传、TCP 隧道和自建 relay。
 
 ## 典型使用场景
 
@@ -52,6 +52,13 @@
 - 作为跨设备素材盘，让平板、手机和电脑同时访问同一个工作目录。
 - 建立临时交付目录，客户或同事以网络盘方式取文件，不需要安装 `ii`。
 
+### `ii ftp`
+
+- 在旧设备、打印机、NAS 或只支持 FTP 的工具之间临时共享一个目录。
+- 默认只开放主动模式；需要兼容手机、浏览器插件或 NAT 后客户端时，显式配置被动端口范围。
+- 按上传、下载、删除、改名和建目录权限组合成临时文件站。
+- 对支持 FTPS 的旧客户端，用显式 TLS 保持默认 `21` 端口；只有需要传统隐式 FTPS 的客户端才使用 `--implicit` 和 `990` 端口。
+
 ### `ii socks5`
 
 - 给浏览器、下载器和命令行工具提供普通 SOCKS5 出口。
@@ -289,6 +296,33 @@ ii dav .\shared --port 8443 --username alice --password secret --tls --domain da
 
 `ii web --once` 只在第一次完整的普通文件 `GET 200` 后退出；HEAD、Range、目录页、404 和上传不会消耗这次机会，且不能和 `--upload` 同用。
 
+### FTP 服务
+
+```powershell
+# 共享当前目录，默认监听 0.0.0.0:21
+ii ftp
+
+# 指定目录、账号密码、总带宽和连接上限
+ii ftp .\shared --port 2121 --username alice --password secret --rate 8MiB --max 20
+
+# 显式开启主动和被动模式；PASV 返回指定地址和端口范围
+ii ftp .\shared --passive-host 192.168.1.20 --passive-ports 49152-49200
+
+# 关闭单项操作权限
+ii ftp .\shared --upload false --delete false --rename false
+
+# 显式 FTPS：控制和数据通道均强制 TLS；未给证书时生成临时自签证书
+ii ftp .\shared --tls
+ii ftp .\shared --tls --cert D:\certs\fullchain.pem --key D:\certs\privkey.pem
+
+# 隐式 FTPS：连接后立即 TLS 握手；未指定端口时使用 990
+ii ftp .\shared --tls --implicit
+```
+
+`ii ftp` 共享当前目录或一个已有目录。默认匿名登录、最大 100 个控制连接、不限速，允许上传、下载、删除、改名和新建目录。默认仅主动模式，不监听被动数据端口；提供 `--passive-ports [start-end]` 后主动和被动模式同时可用，未给范围使用 `49152-65535`，`--passive-host` 只能与它同用。`--rate` 限制全部上传和下载连接共享的总带宽；`--delete false` 同时禁用文件和目录删除，`--download false` 只禁用 `RETR`，目录浏览和元数据查询仍可用。`0.0.0.0` 仅是监听地址，终端会输出主 LAN IPv4 FTP 地址和 `other:` 网卡地址。
+
+`--tls` 开启并强制 FTPS：默认是显式模式，客户端在明文 FTP 欢迎语后发送 `AUTH TLS`，默认端口仍为 `21`。不提供 `--cert` 与 `--key` 时，服务只为当前进程生成自签证书，客户端需要自行接受该证书；已有 PEM 证书链和私钥时必须成对提供。`--implicit` 只能和 `--tls` 一起使用，客户端连接后立即进行 TLS 握手，未指定 `--port` 时使用 `990`。单独指定 `--port 990` 不会切换到隐式模式。`-k` 不是 FTP 服务端参数。
+
 ### 轻量局域网服务
 
 ```powershell

README.md

@@ -37,6 +37,10 @@ All measurements use `cargo build -p ii --release --locked` followed by UPX
 | Nine low-volume extensions: checksums, metadata, queue/watch, NAT probe, symlink policy, QUIC port, and `web --once` | 6,650,368 | 2,353,152 | -83,456 | `cargo test -p ii --locked` (146 tests), fmt check, diff check, `cargo bloat -p ii --release --crates -n 15`, standard `cargo build -p ii --release --locked`, UPX `5.1.0 --best --lzma`, `upx -t` |
 | Path diagnostics, relay selection, resumable web upload, and SOCKS5 | 6,727,168 | 2,377,728 | +24,576 | `cargo test -p ii --locked` (157 tests), fmt check, diff check, `cargo bloat -p ii --release --crates -n 15`, standard `cargo build -p ii --release --locked`, UPX `5.1.0 --best --lzma`, `upx -t` |
 | Twelve lightweight network services: HTTP/paste/drop/PAC/speed, proxy/forwarding, and diagnostics | 6,866,432 | 2,576,384 | +198,656 | `cargo test -p ii --locked` (172 tests), fmt check, diff check, packed CLI help smoke test, `cargo bloat -p ii --release --crates -n 15`, standard `cargo build -p ii --release --locked`, UPX `5.1.0 --best --lzma`, `upx -t` |
+| FTP server: active mode, optional passive ports, authentication, permissions, connection limit, and shared rate limit | 7,567,872 | 2,606,080 | +29,696 | `cargo test -p ii --locked -- --test-threads=1` (181 tests), fmt check, standard `cargo build -p ii --release --locked`, UPX `5.1.0 --best --lzma`, `upx -t`; local `cargo bloat -p ii --release --crates -n 20` exceeded 10 minutes without a report |
+| FTPS initial integration: explicit/implicit mode, self-signed or PEM certificate | 7,572,992 | 2,787,840 | +181,760 | `cargo test -p ii --locked -- --test-threads=1` (184 tests), fmt check, standard `cargo build -p ii --release --locked`, UPX `5.1.0 --best --lzma`, `upx -t` |
+| FTPS vendor pruning: remove unused mTLS, session cache, certificate-file parser and TLS option APIs | 7,484,416 | 2,572,288 | -215,552 | `cargo test -p ii --locked -- --test-threads=1` (184 tests), fmt check, standard `cargo build -p ii --release --locked`, UPX `5.1.0 --best --lzma`, `upx -t` |
+| FTPS final release after CLI future stack fix | 7,484,416 | 2,756,608 | +184,320 | `cargo fmt --all -- --check`, `git diff --check`, `cargo check -p ii --locked`, standard `cargo build -p ii --release --locked`, UPX `5.1.0 --best --lzma`, `upx -t`; packed `ii.exe version` and `ftp --help` smoke-tested |
 
 Equivalent release rebuilds have varied by up to `3,072` UPX bytes; the latest
 measurement is recorded with the pinned `5.1.0` packer.