# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.4.4] - 2025-09-15

### Added
- **Advanced Logging with Logrotate**: Comprehensive logging system for all daemons
  - Added `/var/log/wssshd/wssshd.log` for main daemon logging with automatic rotation
  - Added `/var/log/wssshc/wssshc.log` for client daemon logging with automatic rotation
  - Configured logrotate with weekly rotation, 52-week retention, and automatic compression
  - Proper file permissions and ownership for security
  - HUP signal handling for log reopening after rotation

- **Init Script Logging Integration**: Enhanced init scripts to redirect output to log files
  - Modified `wssshd.init` to use `start-stop-daemon --output` for proper log redirection
  - Modified `wssshc.init` to redirect output to log files (already implemented)
  - Ensured correct PID storage while maintaining log redirection
  - Fallback mechanisms for different start-stop-daemon versions

- **Logrotate Configuration Files**: Professional log management configuration
  - `/etc/logrotate.d/wssshd` - Configuration for wssshd daemon logs
  - `/etc/logrotate.d/wssshc` - Configuration for wssshc client logs
  - Automatic post-rotation HUP signals to daemons
  - Proper error handling and missing file tolerance

### Changed
- **Service Management**: Init scripts now properly redirect stdout and stderr to log files
- **Log Management**: All daemon output is now captured in managed log files
- **System Integration**: Complete integration with Debian's logrotate system

### Technical Details
- **Log File Locations**:
  - wssshd: `/var/log/wssshd/wssshd.log`
  - wssshc: `/var/log/wssshc/wssshc.log`
  - Watchdog logs: `/var/log/wssshd/watchdog.log` and `/var/log/wssshc/watchdog.log`

- **Log Rotation Policy**:
  - Weekly rotation schedule
  - 52 weeks (1 year) retention period
  - Automatic gzip compression
  - Delayed compression for immediate access to recent logs
  - Proper file ownership (wssshd:wssshd, wssshc:wssshc)

- **Init Script Improvements**:
  - Used `start-stop-daemon --output` option for wssshd
  - Maintained backward compatibility with existing installations
  - Proper error handling for different start-stop-daemon versions

### Security
- **File Permissions**: Log files created with secure permissions (644)
- **User Isolation**: Proper user/group ownership for log files
- **Log Integrity**: Automatic log rotation prevents log file manipulation

## [1.4.3] - 2025-09-14

### Fixed
- **Debian Package Build System**: Comprehensive fixes for wsssh-server package building
  - Fixed Makefile syntax error in debian/rules by replacing here document with echo commands
  - Resolved "missing separator" error caused by tab characters in PyInstaller spec generation
  - Removed redundant debian/compat file causing debhelper compatibility conflicts
  - Added automatic directory creation in install target to prevent "No such file or directory" errors
  - Implemented binary reuse logic to avoid unnecessary rebuilds of wssshd binary
  - Enhanced build efficiency by copying existing binaries from dist/ directory when available

- **Build Script Improvements**: Enhanced --server-only option functionality
  - Fixed --server-only to automatically enable Debian package building
  - Updated build logic to properly build wsssh-server package when --server-only is used
  - Improved output messages to show wsssh-server package status
  - Added proper dependency checking and error reporting for Debian builds

### Technical Details
- **Makefile Fixes**: Replaced problematic here document with individual echo commands to avoid tab interpretation issues
- **Binary Reuse**: Added logic to check for existing wssshd binary and copy instead of rebuild
- **Directory Management**: Ensured all necessary directories are created before file installation
- **Debhelper Compatibility**: Removed conflicting compat file specification
- **Build Efficiency**: Reduced build times by reusing existing binaries when possible

### Changed
- **Build System**: --server-only option now properly builds wsssh-server Debian package
- **Package Building**: More robust error handling and directory creation
- **Binary Management**: Intelligent reuse of existing build artifacts

## [1.4.1] - 2025-09-13

### Added
- **Watchdog Scripts for High Availability**: Professional daemon monitoring and automatic restart
  - `wssshd-watchdog`: Comprehensive watchdog script for wssshd daemon
    - Monitors daemon process health every 30 seconds
    - Automatic restart on failure with configurable limits
    - Prevents restart loops with 5-restart limit per 5-minute window
    - Detailed logging to /var/log/wssshd/watchdog.log
    - Proper signal handling and cleanup
    - Integration with syslog for system monitoring
  - `wssshc-watchdog`: Watchdog script for wssshc client daemon
    - Identical functionality to wssshd-watchdog
    - Monitors wssshc process and restarts on failure
    - Logging to /var/log/wssshc/watchdog.log
    - Configurable restart limits and intervals

- **Enhanced Init Scripts**: Updated init scripts to use watchdog for daemon management
  - Modified `/etc/init.d/wssshd` to launch daemon through watchdog
  - Modified `/etc/init.d/wssshc` to launch client through watchdog
  - Proper watchdog PID file management
  - Enhanced status reporting showing both daemon and watchdog status
  - Seamless integration with existing service management

- **Professional Service Management**: Enterprise-grade daemon supervision
  - Automatic daemon restart on unexpected termination
  - Configurable monitoring intervals and restart policies
  - Comprehensive logging for troubleshooting and monitoring
  - Non-blocking watchdog operation that doesn't interfere with normal service
  - Proper resource cleanup and signal handling

### Changed
- **Init Script Architecture**: Init scripts now manage watchdog processes instead of daemons directly
- **Service Control**: Enhanced service status reporting with watchdog information
- **Process Management**: Improved process supervision with automatic recovery
- **Logging Integration**: Watchdog logs integrated with system syslog

### Technical Details
- **Watchdog Implementation**: Shell-based watchdog with robust error handling
  - Process health monitoring via PID file validation
  - Configurable check intervals (default: 30 seconds)
  - Restart limit enforcement to prevent infinite loops
  - Proper daemon user/group context preservation
  - Signal-based communication and cleanup

- **System Integration**: Complete integration with Debian init system
  - Watchdog scripts installed to /usr/sbin/
  - Proper file permissions and ownership
  - Integration with package postinst scripts
  - Automatic directory creation and permission setting

- **Configuration Management**: Watchdog behavior controlled via /etc/default files
  - START=yes/no control for service enablement
  - Additional configuration options for watchdog behavior
  - Backward compatibility with existing configurations

### Security
- **Process Isolation**: Watchdog runs with same user/group as monitored daemon
- **File Permissions**: Proper ownership and permissions for watchdog scripts
- **Logging Security**: Secure logging without exposing sensitive information
- **Resource Limits**: Built-in protections against restart loops and resource exhaustion

### Fixed
- **Service Reliability**: Automatic recovery from daemon crashes and failures
- **Process Monitoring**: Proper detection of daemon process termination
- **Resource Management**: Clean PID file management and process cleanup
- **Error Handling**: Robust error handling for various failure scenarios

## [1.4.0] - 2025-09-13

### Added
- **wsssh-server Debian Package**: Complete Debian package for wssshd daemon
  - PyInstaller binary packaging for standalone deployment
  - Comprehensive init script with wssshd user/group support
  - Automatic user/group creation during installation
  - Proper directory structure and permissions
  - Integration with Debian init system and rc2.d
  - /etc/default/wssshd configuration file
  - Professional postinst/postrm scripts for system integration

- **wssshd Man Page**: Complete manual page for wssshd daemon
  - Comprehensive command-line options documentation
  - Configuration file format and examples
  - Web interface usage instructions
  - Security considerations and best practices
  - Signal handling and troubleshooting information

- **Enhanced Build System**: Updated build.sh for wsssh-server package support
  - --server-only option builds only wssshd and wsssh-server package
  - Separate wsssh-server and wsssh-tools package building
  - Improved dependency checking for Python and Debian build tools
  - Better output formatting and package availability reporting

### Changed
- **Package Architecture**: Split into wsssh-server (daemon) and wsssh-tools (clients) packages
- **Build System**: Enhanced build.sh to support selective package building
- **Documentation**: Updated man pages and help text for new package structure

### Technical Details
- **Debian Packaging**: Professional multi-package Debian distribution
- **PyInstaller Integration**: Automated binary creation with dependency bundling
- **System Integration**: Complete init script and service management
- **Security**: Dedicated wssshd user/group with minimal privileges
- **Configuration**: Hierarchical configuration with /etc/default support

### Fixed
- **Package Separation**: Clean separation between server and client components
- **Build Dependencies**: Proper dependency checking and error reporting
- **Service Management**: Robust init script with proper error handling

## [1.3.4] - 2025-09-13

### Added
- **Enhanced WebSocket Connection Management**: Robust ping/pong frame handling and automatic reconnection
  - Fixed ping frame parsing in wsssh.c to properly handle WebSocket ping frames
  - Added automatic pong responses with correct payload echoing
  - Implemented WebSocket reconnection logic for both wsssh.c and wsscp.c
  - Added --interval option for configurable connection retry intervals
  - Smart timing: 1-second WebSocket reconnections vs 30-second initial connection retries

- **Connection Resilience Features**:
  - Automatic WebSocket reconnection during active tunnel operations
  - Configurable retry intervals with --interval option (default: 30 seconds)
  - Up to 3 reconnection attempts with proper error handling
  - Seamless tunnel recovery without disrupting active SSH/SCP sessions
  - Enhanced debug logging for connection state changes

### Changed
- **wsssh.c and wsscp.c Connection Handling**: Both tools now support automatic WebSocket reconnection
- **Ping Frame Processing**: Fixed parse_websocket_frame function to accept ping frames (0x89)
- **Reconnection Timing**: Fast 1-second intervals for WebSocket reconnections, configurable intervals for initial setup
- **Error Recovery**: Improved resilience to network interruptions and temporary disconnections

### Technical Details
- **WebSocket Protocol Compliance**: Proper ping/pong frame handling with RFC 6455 compliance
- **Reconnection Logic**: reconnect_websocket() function for seamless connection recovery
- **Configuration Options**: Added --interval parameter to both wsssh and wsscp
- **Backward Compatibility**: All existing functionality preserved, new features are additive
- **Cross-Tool Consistency**: Identical reconnection behavior between wsssh and wsscp

### Fixed
- **Ping Frame Parsing**: wsssh.c now correctly parses and responds to WebSocket ping frames
- **Connection Recovery**: Automatic reconnection when WebSocket connections are lost
- **Tunnel Stability**: Improved tunnel reliability during network interruptions

## [1.3.2] - 2025-09-13

### Added
- **wssshd Configuration File Support**: Added INI-formatted config file `/etc/wssshd.conf` for wssshd daemon
  - Default host, port, password, domain, web-port, web-host, and web-https settings
  - Command line arguments take precedence over config file values
  - System-wide configuration for server deployment
- **Enhanced wssshd Deployment**: wssshd now supports config file for easier system integration
  - Support for all daemon parameters in config file
  - Automatic config file detection at `/etc/wssshd.conf`
  - Improved server configuration management

### Changed
- **wssshd Parameter Handling**: Command line options override config file values, config file provides defaults
- **wssshd Configuration**: Added system-wide config file support for better deployment practices
- **Cross-Component Consistency**: All components now support config file configuration

### Technical Details
- **Config File Location**: `/etc/wssshd.conf` for system-wide wssshd configuration
- **Config File Format**: INI format with `[wssshd]` section
- **Implementation**: Added config file parsing to wssshd.py using configparser
- **Backward Compatibility**: All existing functionality preserved, config file is optional

## [1.3.2] - 2025-09-13

### Added
- **Enhanced Client Registration Management**: Improved wssshd client disconnection handling
  - Clients are marked as "disconnected" instead of immediately removed from registry
  - 30-second timeout before removing expired client registrations
  - Automatic cleanup of expired clients with periodic background task
  - Better resilience to temporary network disconnections

- **Improved Debug Message Clarity**: Enhanced debug output to distinguish between protocol levels
  - `[WebSocket]` prefix for WebSocket-level messages and events
  - `[TCP Tunnel]` prefix for TCP tunnel-level messages and events
  - Clear separation between close frame handling and tunnel operations
  - More detailed logging for connection state changes

### Changed
- **WebSocket Close Frame Handling**: Close frames no longer immediately terminate client registration
  - Close frames trigger reconnection rather than client removal
  - Client registration persists during temporary disconnections
  - Improved reliability for unstable network conditions

- **Debug Output Format**: Standardized debug message format across all components
  - Consistent prefix system for different protocol layers
  - Clear indication of message source and type
  - Better troubleshooting capabilities

### Technical Details
- **Client Registry Structure**: Enhanced client storage with status and timestamp tracking
  - `clients[client_id] = {'websocket': ws, 'last_seen': timestamp, 'status': 'active'|'disconnected'}`
  - Automatic status transitions based on connection state
  - Timestamp-based expiration for disconnected clients

- **Background Cleanup**: Asynchronous cleanup task running every 10 seconds
  - Removes clients disconnected for more than 30 seconds
  - Maintains registry cleanliness without affecting active connections
  - Non-blocking operation that doesn't interfere with normal processing

- **Web Interface Updates**: Enhanced client status display in web management interface
  - Shows client connection status (active/disconnected)
  - Displays last seen timestamp for disconnected clients
  - Improved API responses with detailed client information

### Security
- **Connection State Tracking**: Better monitoring of client connection states
- **Timeout-based Cleanup**: Prevents accumulation of stale client registrations
- **Maintained Security**: All existing security measures preserved during improvements

## [1.3.1] - 2025-09-13

### Added
- **wssshc Configuration File Support**: Extended INI-formatted config file `~/.config/wsssh/wssshc.conf` to include wssshc parameters
  - Default password, domain, server-ip, port, and id settings for wssshc
  - Command line arguments take precedence over config file values
  - Optional parameters become required only when not provided in config or command line
- **Enhanced wssshc Flexibility**: wssshc now supports config file defaults for all parameters
  - Support for both `server-ip` and `domain` config options (server-ip takes precedence)
  - Automatic fallback to config values when command line options are omitted
  - Improved user experience with optional command line parameters

### Changed
- **wssshc Parameter Handling**: Command line options override config file values, config file provides defaults
- **wssshc Error Messages**: Updated to reflect optional nature of parameters when config is available
- **Cross-Implementation Consistency**: Both Python and C versions of wssshc support identical config file format

### Technical Details
- **Config File Format**: Extended INI format with `[wssshc]` section for wssshc-specific parameters
- **Implementation**: Added config file parsing to both Python (configparser) and C (custom parser) versions
- **Backward Compatibility**: All existing functionality preserved, config file is optional

## [1.3.0] - 2025-09-13

### Added
- **Configuration File Support**: Added INI-formatted config file `~/.config/wsssh/wsssh.conf`
  - Default port and domain settings for wsssh and wsscp
  - Command line arguments take precedence over config file
  - Domain fallback to config when not specified in command line
  - Port fallback to config when not specified via -p/-P options
- **Enhanced CLI Flexibility**: Improved hostname parsing with config-based defaults
  - Support for `user@client` format using config domain
  - Support for `user@client.domain` format overriding config domain
  - Automatic port resolution: command line > config file > error

### Changed
- **Port Precedence**: Command line `-p`/`-P` options override config file port
- **Domain Precedence**: Command line domain specification overrides config domain
- **Error Handling**: Better error messages when port/domain cannot be determined

### Technical Details
- **Config File Format**: Simple INI format with `[default]` section
- **Cross-Implementation**: Consistent behavior between Python and C versions
- **Backward Compatibility**: All existing functionality preserved

## [1.2.0] - 2025-09-13

### Changed
- Improved quality and resolution of all logo and icon assets in the `logos/` directory
- Minor enhancements and optimizations to `wssshtools/wsssh.c` and `wssshtools/wssshc.c` implementations

### Added
- `clean` script for comprehensive cleanup of build artifacts (renamed from clean.sh for consistency)

## [1.1.0] - 2024-09-12

### Added
- **C Implementation**: Complete C version of all tools (`wssshtools/` directory)
  - `wssshc.c`: Lightweight C client for registration (280 lines)
  - `wsssh.c`: Native SSH wrapper with hostname parsing (378 lines)
  - `wsscp.c`: Native SCP wrapper with file transfer support (418 lines)
  - `configure.sh`: Automated build configuration script
  - `Makefile`: GNU Make build system with OpenSSL integration
- **Debian Packaging**: Professional Debian package creation
  - `debian/control`: Package metadata with proper dependencies
  - `debian/rules`: Debhelper build rules
  - `debian/changelog`: Package changelog
  - `debian/copyright`: Copyright and licensing information
  - `debian/compat`: Debhelper compatibility level
- **Simplified CLI**: Removed requirement to specify "ssh"/"scp" commands
  - `wsssh user@host` instead of `wsssh ssh user@host`
  - `wsscp source dest` instead of `wsscp scp source dest`
  - Backward compatibility maintained
- **Donation Integration**: Community support features
  - Web interface donation modal with PayPal and cryptocurrency options
  - Donation information in README and documentation
  - Copy-to-clipboard functionality for crypto addresses
- **Enhanced Build System**: Improved build.sh and clean.sh scripts
  - `--debian` flag for Debian package creation
  - Automatic C tool building when `wssshtools/` exists
  - Comprehensive cleanup of all build artifacts
- **Man Pages**: Comprehensive documentation for C tools
  - `wssshc(1)`: WebSocket SSH client registration
  - `wsssh(1)`: SSH wrapper with tunneling
  - `wsscp(1)`: SCP wrapper with tunneling
  - Professional troff-formatted manual pages
- **Web Interface Enhancements**: Professional admin panel improvements
  - Donation button in navigation bar
  - Responsive modal design
  - JavaScript copy-to-clipboard functionality

### Changed
- **Build System**: Enhanced build.sh to support C compilation and Debian packaging
- **Clean System**: Updated clean.sh to remove C build artifacts and Debian files
- **Documentation**: Comprehensive updates to README and DOCUMENTATION.md
- **Project Structure**: Added `wssshtools/` directory with complete C implementation
- **Git Management**: Added `.gitignore` for proper artifact exclusion
- **Licensing**: Added GPL-3.0 license headers to shell scripts and C implementations for consistency

### Technical Details
- **C Implementation**: Native code with OpenSSL for SSL/TLS WebSocket connections
- **Debian Integration**: Proper system packaging with dependencies (OpenSSL, GCC)
- **Cross-Compilation**: Support for building both Python and C versions
- **Certificate Management**: Improved SSL certificate handling in build process
- **Web Assets**: Enhanced HTML templates with donation modal and improved UX

### Security
- **OpenSSL Integration**: Proper SSL/TLS certificate validation in C implementation
- **Certificate Pinning**: Support for secure certificate management
- **Input Validation**: Enhanced argument parsing and validation

## [1.0.0] - 2024-09-12

### Added
- **Initial release** of WebSocket SSH tunneling system
- **wssshd**: WebSocket SSH Daemon for managing client connections and tunnel routing
- **wssshc**: WebSocket SSH Client for registering machines with the daemon
- **wsssh**: SSH command wrapper with automatic hostname parsing and tunnel establishment
- **wsscp**: SCP command wrapper with WebSocket tunneling support
- **Intelligent hostname parsing**: Support for `<CLIENT_ID>.<HOST>[:<PORT>]` format
- **Automatic port detection**: Priority-based port resolution (hostname suffix > command options > defaults)
- **SSL/TLS encryption**: Secure WebSocket communications with self-signed certificates
- **Client registration system**: Unique client identification and persistent connections
- **Build system**: Automated binary creation using PyInstaller
- **Cross-platform support**: Linux, macOS, and Windows compatibility
- **Comprehensive documentation**: README, installation guides, and usage examples

### Features
- **Drop-in SSH/SCP replacement**: Use `wsssh` and `wsscp` as direct replacements for standard commands
- **Multi-client routing**: Route connections to different registered clients based on hostname
- **Automatic tunnel management**: Dynamic local port allocation and tunnel lifecycle management
- **Debug mode**: Detailed logging for troubleshooting connections and tunnels
- **Reconnection logic**: Automatic reconnection for client registration

### Technical Details
- **WebSocket-based architecture**: Real-time bidirectional communication
- **Async I/O**: High-performance asynchronous operations using asyncio
- **Binary distribution**: Standalone executables with embedded dependencies
- **Certificate management**: Automatic SSL certificate generation and embedding
- **Protocol parsing**: SSH protocol inspection for user authentication routing

### Security
- **Encrypted communications**: All WebSocket traffic protected by SSL/TLS
- **Client authentication**: Unique identifier-based client verification
- **Secure tunneling**: Isolated tunnel sessions per connection

## [0.1.0] - 2024-09-11

### Added
- **Proof of concept** implementation
- Basic WebSocket SSH tunneling functionality
- Initial client-server architecture
- Command-line interface foundation
- SSL certificate generation
- Build system setup

### Changed
- Initial architecture design
- Basic protocol implementation

### Fixed
- Initial connection handling
- Basic error management

---

## Types of changes
- `Added` for new features
- `Changed` for changes in existing functionality
- `Deprecated` for soon-to-be removed features
- `Removed` for now removed features
- `Fixed` for any bug fixes
- `Security` in case of vulnerabilities

## Versioning
This project uses [Semantic Versioning](https://semver.org/).

Given a version number MAJOR.MINOR.PATCH, increment the:

- **MAJOR** version when you make incompatible API changes
- **MINOR** version when you add functionality in a backwards compatible manner
- **PATCH** version when you make backwards compatible bug fixes

Additional labels for pre-release and build metadata are available as extensions to the MAJOR.MINOR.PATCH format.

---

## Development Notes

### Upcoming Features (Roadmap)
- **Enhanced security**: Certificate pinning and mutual TLS authentication
- **Load balancing**: Multi-server daemon support with automatic failover
- **Performance optimization**: Connection pooling and multiplexing
- **GUI client**: Desktop application for easier management
- **REST API**: HTTP API for programmatic tunnel management
- **Container support**: Docker images and Kubernetes integration
- **Monitoring**: Metrics collection and health monitoring
- **Plugin system**: Extensible architecture for custom protocols

### Known Issues
- Self-signed certificate warnings in browsers/clients
- Limited Windows testing (primarily developed on Linux)
- No built-in rate limiting or DDoS protection
- Basic error handling (room for improvement)

### Contributing
Please see [CONTRIBUTING.md](CONTRIBUTING.md) for development guidelines and contribution procedures.