feat: secure dav access

Author: zengyufei

Cargo.lock

@@ -18,7 +18,7 @@ unused-async = "warn"
 
 [package]
 name = "ii"
-version = "0.3.2"
+version = "0.3.3"
 edition.workspace = true
 rust-version.workspace = true
 license.workspace = true
@@ -52,6 +52,7 @@ tar = { version = "0.4", default-features = false }
 tempfile = "3"
 time = { version = "0.3", default-features = false, features = ["formatting", "macros", "std"] }
 tokio = { version = "1", features = ["fs", "io-std", "io-util", "macros", "net", "rt", "signal", "time"] }
+tokio-rustls = { version = "0.26", default-features = false }
 tokio-util = { version = "0.7", features = ["io"] }
 toml = "1.0"
 tracing = "0.1"

Cargo.toml

@@ -158,11 +158,14 @@ ii web .\shared --upload --path .\uploads
 # Mount a directory in a file manager; writable by default
 ii dav .\shared
 ii dav .\shared --read-only
+ii dav .\shared --port 8443 --username alice --password secret --tls --domain dav.example.com --cert D:\certs\fullchain.pem --key D:\certs\privkey.pem
 ```
 
 `ii send --web` serves a download page for one file or folder. `ii web` displays an nginx-style directory listing and serves the current directory when no directory is given. `--upload` enables multi-file uploads only; their default destination is `./ii/` under the startup directory, while `--path <dir>` selects another directory. `ii dav` reads and writes its served directory directly, not the web upload directory.
 
-`--port 8080` fixes the port, `--bind ::` listens on IPv6 only, and bare `--token` generates a path token while `--token <value>` uses the supplied token. These services have no account authentication and are for short-lived, trusted LAN use only.
+`ii dav --username <username> --password <password>` enables HTTP Basic Auth; both options are required together. `--password` is visible in shell history and process listings, so use it only where that is acceptable. `--tls` enables HTTPS. Without `--cert` and `--key`, ii generates a self-signed certificate valid only for the running process, which clients must explicitly trust. For public access, use a trusted PEM certificate or terminate HTTPS in a reverse proxy and bind `ii dav` to `127.0.0.1`. Without `--tls`, Basic Auth credentials travel in clear text.
+
+`--port 8080` fixes the port, `--bind ::` listens on IPv6 only, and bare `--token` generates a path token while `--token <value>` uses the supplied token. A path token is not account authentication.
 
 ### LAN Discovery
 

README.en.md

@@ -158,11 +158,14 @@ ii web .\shared --upload --path .\uploads
 # 用系统文件管理器挂载目录；默认可读写
 ii dav .\shared
 ii dav .\shared --read-only
+ii dav .\shared --port 8443 --username alice --password secret --tls --domain dav.example.com --cert D:\certs\fullchain.pem --key D:\certs\privkey.pem
 ```
 
 `ii send --web` 为单个文件或目录提供下载页。`ii web` 显示 nginx 风格目录列表，省略目录时服务当前目录；`--upload` 才开放多文件上传，默认写入启动目录的 `./ii/`，`--path <dir>` 可改为指定目录。`ii dav` 直接读写所服务目录，不使用网页上传目录。
 
-`--port 8080` 固定端口，`--bind ::` 只监听 IPv6；裸 `--token` 生成路径令牌，`--token <value>` 使用指定令牌。它们都没有账号鉴权，只适合临时可信局域网。
+`ii dav --username <username> --password <password>` 启用 HTTP Basic Auth，两个参数必须同时提供。`--password` 会出现在 shell 历史和进程列表中，只适合你明确接受这一风险的场景。`--tls` 开启 HTTPS；未提供 `--cert` 与 `--key` 时生成仅当前进程有效的自签证书，客户端必须手动信任。公网请使用受信任 PEM 证书，或让 HTTPS 反向代理终止 TLS 并将 `ii dav` 绑定到 `127.0.0.1`。未启用 `--tls` 时，Basic Auth 凭据会以明文传输。
+
+`--port 8080` 固定端口，`--bind ::` 只监听 IPv6；裸 `--token` 生成路径令牌，`--token <value>` 使用指定令牌。路径 token 不是账号鉴权。
 
 ### 局域网发现
 

README.md

@@ -12,7 +12,7 @@
 ii help [<command>]
 ii send [<path>...] [--name <name>] [--include <glob>] [--exclude <glob>] [--rate <bytes/s>] [--json] [-t] [-c] [-o <path>] [--web [--port <port>] [--bind <ip>] [--token [<value>]] [--upload] [--path <path>] | --s3 | --r2 | --azure | --webdav | --ftp | --sftp] [--profile <name>] [-d] [-p] [--local] [--relay <url> [-k]] [--no-relay]
 ii web [<目录>] [--port <port>] [--bind <ip>] [--token [<value>]] [--upload] [--path <目录>]
-ii dav [<目录>] [--port <port>] [--bind <ip>] [--token [<value>]] [--read-only]
+ii dav [<目录>] [--port <port>] [--bind <ip>] [--token [<value>]] [--read-only] [--username <username> --password <password>] [--tls [--domain <name>] [--cert <path> --key <path>]]
 ii webrtc [--port <port>] [--bind <ip>] [--token [<value>]]
 ii tunnel -s <target-host:port> [--relay <url> [-k]]
 ii tunnel -c <ticket> [--listen <ip:port>]
@@ -232,9 +232,14 @@ ii web .\shared --port 8080 --token A1b2C3d4E5f6G7h8 --upload --path .\uploads
 ii dav
 ii dav .\shared --port 8080 --bind 192.168.1.20 --token A1b2C3d4E5f6G7h8
 ii dav .\shared --read-only
+ii dav .\shared --port 8443 --username alice --password secret --tls --domain dav.example.com --cert .\fullchain.pem --key .\privkey.pem
 ```
 
-`ii dav` 把当前目录或指定目录作为局域网 WebDAV 根目录，默认可读写；支持 `OPTIONS`、`PROPFIND`、`GET`、`HEAD`、Range、`PUT`、`MKCOL`、`DELETE`、`MOVE`、`COPY`、`LOCK`、`UNLOCK`，上传支持 `Content-Length`、chunked body 和 `100-continue`。`--read-only` 禁止所有改写。`--token` 是 URL 路径令牌，不是账户认证；服务默认无 TLS 和 Basic Auth，只适合可信局域网。
+`ii dav` 把当前目录或指定目录作为 WebDAV 根目录，默认可读写；支持 `OPTIONS`、`PROPFIND`、`GET`、`HEAD`、Range、`PUT`、`MKCOL`、`DELETE`、`MOVE`、`COPY`、`LOCK`、`UNLOCK`，上传支持 `Content-Length`、chunked body 和 `100-continue`。`--read-only` 禁止所有改写。`--token` 是 URL 路径令牌，不是账户认证。
+
+`--username <username>` 与 `--password <password>` 必须成对提供，启用所有 DAV 方法的 HTTP Basic Auth。用户名不能为空，且不能包含 `:`、CR 或 LF；密码不能为空，且不能包含 CR 或 LF。`--password` 会进入 shell 历史和进程列表。
+
+`--tls` 开启 HTTPS。没有 `--cert` 与 `--key` 时，`ii` 仅为当前进程生成自签证书；客户端必须手动信任。`--domain` 指定证书 DNS 名称和输出 URL；只允许与 `--tls` 同用。已有 PEM 完整证书链和私钥时，成对提供 `--cert`、`--key`；它们也要求 `--tls`。对公网提供服务时必须使用 TLS：可由 `ii dav --tls` 直接终止，或由 HTTPS 反向代理终止并把 `ii dav` 绑定到 `127.0.0.1`。明文 HTTP 下 Basic Auth 凭据可被窃听。
 
 ## `ii discover`
 

ii.md

@@ -8,9 +8,15 @@ pub(super) fn parse(args: Vec<String>) -> Result<DavArgs, ParseAction> {
             Some(("port", value)) => out.web_port = Some(parse_port("--port", value)?),
             Some(("bind", value)) => out.web_bind = Some(parse_bind("--bind", value)?),
             Some(("token", value)) => out.web_token = Some(value.to_string()),
+            Some(("username", value)) => out.username = Some(value.to_string()),
+            Some(("password", value)) => out.password = Some(value.to_string()),
+            Some(("domain", value)) => out.domain = Some(parse_tls_domain(value)?),
+            Some(("cert", value)) => out.cert = Some(PathBuf::from(value)),
+            Some(("key", value)) => out.key = Some(PathBuf::from(value)),
             Some(("read-only", _)) => {
                 return Err(ParseAction::error("--read-only does not take a value"));
             }
+            Some(("tls", _)) => return Err(ParseAction::error("--tls does not take a value")),
             Some((flag, _)) => {
                 return Err(ParseAction::error(format!("unknown option `--{flag}`")));
             }
@@ -20,6 +26,12 @@ pub(super) fn parse(args: Vec<String>) -> Result<DavArgs, ParseAction> {
                 "--bind" => out.web_bind = Some(parse_bind("--bind", &iter.value("--bind")?)?),
                 "--token" => out.web_token = Some(web_token(&mut iter)),
                 "--read-only" => out.read_only = true,
+                "--username" => out.username = Some(iter.value("--username")?),
+                "--password" => out.password = Some(iter.value("--password")?),
+                "--tls" => out.tls = true,
+                "--domain" => out.domain = Some(parse_tls_domain(&iter.value("--domain")?)?),
+                "--cert" => out.cert = Some(PathBuf::from(iter.value("--cert")?)),
+                "--key" => out.key = Some(PathBuf::from(iter.value("--key")?)),
                 _ if arg.starts_with('-') => {
                     return Err(ParseAction::error(format!("unknown option `{arg}`")));
                 }
@@ -37,5 +49,35 @@ pub(super) fn parse(args: Vec<String>) -> Result<DavArgs, ParseAction> {
             "--token must contain 16 to 128 ASCII letters, digits, '-' or '_'",
         ));
     }
+    if out.username.is_some() != out.password.is_some() {
+        return Err(ParseAction::error(
+            "--username and --password must be provided together",
+        ));
+    }
+    if let Some(username) = out.username.as_deref()
+        && (username.is_empty() || username.contains([':', '\r', '\n']))
+    {
+        return Err(ParseAction::error(
+            "--username must not be empty or contain ':', CR, or LF",
+        ));
+    }
+    if let Some(password) = out.password.as_deref()
+        && (password.is_empty() || password.contains(['\r', '\n']))
+    {
+        return Err(ParseAction::error(
+            "--password must not be empty or contain CR or LF",
+        ));
+    }
+    if out.domain.is_some() && !out.tls {
+        return Err(ParseAction::error("--domain requires --tls"));
+    }
+    if (out.cert.is_some() || out.key.is_some()) && !out.tls {
+        return Err(ParseAction::error("--cert and --key require --tls"));
+    }
+    if out.cert.is_some() != out.key.is_some() {
+        return Err(ParseAction::error(
+            "--cert and --key must be provided together",
+        ));
+    }
     Ok(out)
 }

src/cli/dav.rs

@@ -5,7 +5,7 @@ Usage:
   ii help [command]
   ii send [options] [path...]
   ii web [directory] [--port <port>] [--bind <ip>] [--token [value]] [--upload] [--path <dir>]
-  ii dav [directory] [--port <port>] [--bind <ip>] [--token [value]] [--read-only]
+  ii dav [directory] [--port <port>] [--bind <ip>] [--token [value]] [--read-only] [--username <username> --password <password>] [--tls [--domain <name>] [--cert <path> --key <path>]]
   ii webrtc [--port <port>] [--bind <ip>] [--token [value]]
   ii tunnel (-s <target-host:port> | -c <ticket>) [--listen <ip:port>] [--relay <url> [-k]]
   ii recv [options] <ticket>
@@ -113,13 +113,19 @@ Options:
 
 pub(crate) const DAV_HELP: &str = "\
 Usage:
-  ii dav [directory] [--port <port>] [--bind <ip>] [--token [value]] [--read-only]
+  ii dav [directory] [--port <port>] [--bind <ip>] [--token [value]] [--read-only] [--username <username> --password <password>] [--tls [--domain <name>] [--cert <path> --key <path>]]
 
 Options:
   --port <port>
   --bind <ip>
   --token [value]
   --read-only
+  --username <username>  HTTP Basic Auth username; requires --password
+  --password <password>  HTTP Basic Auth password; requires --username
+  --tls                  Enable HTTPS with an ii-generated self-signed certificate
+  --domain <name>        TLS DNS name used for the advertised URL and self-signed certificate
+  --cert <path>          PEM certificate chain; replaces the generated certificate
+  --key <path>           PEM private key; requires --cert
 ";
 
 pub(crate) const DISCOVER_HELP: &str = "\

src/cli/help.rs

@@ -908,4 +908,52 @@ mod tests {
             _ => panic!("expected dav command"),
         }
     }
+
+    #[test]
+    fn dav_accepts_basic_auth_and_tls_options() {
+        let cli = Cli::parse_from([
+            "ii",
+            "dav",
+            "share",
+            "--username",
+            "alice",
+            "--password=secret",
+            "--tls",
+            "--domain",
+            "dav.example.com",
+            "--cert",
+            "fullchain.pem",
+            "--key",
+            "privkey.pem",
+        ]);
+        match cli.command {
+            Command::Dav(args) => {
+                assert_eq!(args.username.as_deref(), Some("alice"));
+                assert_eq!(args.password.as_deref(), Some("secret"));
+                assert!(args.tls);
+                assert_eq!(args.domain.as_deref(), Some("dav.example.com"));
+                assert_eq!(args.cert, Some(PathBuf::from("fullchain.pem")));
+                assert_eq!(args.key, Some(PathBuf::from("privkey.pem")));
+            }
+            _ => panic!("expected dav command"),
+        }
+
+        for args in [
+            vec!["ii", "dav", "--username", "alice"],
+            vec!["ii", "dav", "--password", "secret"],
+            vec!["ii", "dav", "--domain", "dav.example.com"],
+            vec!["ii", "dav", "--tls", "--cert", "fullchain.pem"],
+            vec![
+                "ii",
+                "dav",
+                "--tls",
+                "--username",
+                "",
+                "--password",
+                "secret",
+            ],
+        ] {
+            assert!(parse_args(args).is_err());
+        }
+    }
 }

src/cli/mod.rs

@@ -79,6 +79,12 @@ pub struct DavArgs {
     pub web_bind: Option<IpAddr>,
     pub web_token: Option<String>,
     pub read_only: bool,
+    pub username: Option<String>,
+    pub password: Option<String>,
+    pub tls: bool,
+    pub domain: Option<String>,
+    pub cert: Option<PathBuf>,
+    pub key: Option<PathBuf>,
 }
 
 #[derive(Debug, Clone)]

src/command.rs

@@ -6,6 +6,7 @@ use logging::LogFilter;
 #[cfg(test)]
 pub(crate) use server::build_server_config;
 pub use server::run;
+pub(crate) use server::tls_server_config;
 #[cfg(test)]
 use server::{advertised_urls, load_tls_server_config};