fix(nodes): persist the master mTLS credential atomically and stop silent reissue (#6195)

* fix: harden master mTLS credential persistence

* fix(mtls): validate and serialize credential persistence

---------

Co-authored-by: n0ctal <293235942+n0ctal@users.noreply.github.com>

internal/web/service/setting_mtls.go

@@ -1,17 +1,30 @@
 package service
 
 import (
+	"crypto/sha256"
+	"crypto/tls"
 	"crypto/x509"
+	"encoding/hex"
+	"encoding/pem"
+	"strings"
+	"sync"
 
+	"gorm.io/gorm"
+
+	"github.com/mhsanaei/3x-ui/v3/internal/database"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 	"github.com/mhsanaei/3x-ui/v3/internal/util/common"
 	"github.com/mhsanaei/3x-ui/v3/internal/util/crypto"
 )
 
+var masterClientCredentialMu sync.Mutex
+
 const (
 	settingNodeMtlsCaCert     = "nodeMtlsCaCertPem"
 	settingNodeMtlsCaKey      = "nodeMtlsCaKeyPem"
 	settingNodeMtlsClientCert = "nodeMtlsClientCertPem"
 	settingNodeMtlsClientKey  = "nodeMtlsClientKeyPem"
+	settingNodeMtlsClientPin  = "nodeMtlsClientCertSha256"
 	settingNodeMtlsClientCA   = "nodeMtlsClientCAPem"
 )
 
@@ -49,10 +62,26 @@ func (s *SettingService) EnsureNodeMtlsCA() (crypto.CertKeyPEM, error) {
 	return ca, nil
 }
 
+func clientCertSHA256FromPEM(certPEM []byte) (string, error) {
+	block, rest := pem.Decode(certPEM)
+	if block == nil || block.Type != "CERTIFICATE" || len(strings.TrimSpace(string(rest))) != 0 {
+		return "", common.NewError("client certificate is not valid PEM")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(cert.Raw)
+	return hex.EncodeToString(sum[:]), nil
+}
+
 // EnsureMasterClientCert returns the client certificate this panel presents when
 // calling its nodes over mTLS, issuing it from the node CA on first use and
 // reusing the stored pair thereafter.
 func (s *SettingService) EnsureMasterClientCert() (crypto.CertKeyPEM, error) {
+	masterClientCredentialMu.Lock()
+	defer masterClientCredentialMu.Unlock()
+
 	certPem, err := s.getString(settingNodeMtlsClientCert)
 	if err != nil {
 		return crypto.CertKeyPEM{}, err
@@ -61,7 +90,27 @@ func (s *SettingService) EnsureMasterClientCert() (crypto.CertKeyPEM, error) {
 	if err != nil {
 		return crypto.CertKeyPEM{}, err
 	}
+	storedPin, err := s.getString(settingNodeMtlsClientPin)
+	if err != nil {
+		return crypto.CertKeyPEM{}, err
+	}
+	storedPin = strings.ToLower(strings.TrimSpace(storedPin))
 	if certPem != "" && keyPem != "" {
+		if _, err := tls.X509KeyPair([]byte(certPem), []byte(keyPem)); err != nil {
+			return crypto.CertKeyPEM{}, common.NewError("stored master client certificate/key pair is invalid: ", err)
+		}
+		actualPin, err := clientCertSHA256FromPEM([]byte(certPem))
+		if err != nil {
+			return crypto.CertKeyPEM{}, err
+		}
+		if storedPin != "" && storedPin != actualPin {
+			return crypto.CertKeyPEM{}, common.NewError("stored master client certificate does not match nodeMtlsClientCertSha256; refusing to rotate")
+		}
+		if storedPin == "" {
+			if err := s.saveSetting(settingNodeMtlsClientPin, actualPin); err != nil {
+				return crypto.CertKeyPEM{}, err
+			}
+		}
 		return crypto.CertKeyPEM{CertPEM: []byte(certPem), KeyPEM: []byte(keyPem)}, nil
 	}
 	// Half a stored pair signals corrupted settings; reissuing would rotate the
@@ -77,15 +126,38 @@ func (s *SettingService) EnsureMasterClientCert() (crypto.CertKeyPEM, error) {
 	if err != nil {
 		return crypto.CertKeyPEM{}, err
 	}
-	if err := s.saveSetting(settingNodeMtlsClientCert, string(client.CertPEM)); err != nil {
+	pin, err := clientCertSHA256FromPEM(client.CertPEM)
+	if err != nil {
 		return crypto.CertKeyPEM{}, err
 	}
-	if err := s.saveSetting(settingNodeMtlsClientKey, string(client.KeyPEM)); err != nil {
+	if err := saveMasterClientCredential(client, pin); err != nil {
 		return crypto.CertKeyPEM{}, err
 	}
 	return client, nil
 }
 
+func saveMasterClientCredential(client crypto.CertKeyPEM, pin string) error {
+	values := map[string]string{
+		settingNodeMtlsClientCert: string(client.CertPEM),
+		settingNodeMtlsClientKey:  string(client.KeyPEM),
+		settingNodeMtlsClientPin:  pin,
+	}
+	return database.GetDB().Transaction(func(tx *gorm.DB) error {
+		for key, value := range values {
+			result := tx.Model(&model.Setting{}).Where("key = ?", key).Update("value", value)
+			if result.Error != nil {
+				return result.Error
+			}
+			if result.RowsAffected == 0 {
+				if err := tx.Create(&model.Setting{Key: key, Value: value}).Error; err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+}
+
 // NodeMtlsClientCAPool builds the trust pool used as the panel listener's
 // ClientCAs for incoming node-API client certificates. It returns (nil, nil)
 // when no trust CA is configured, so mTLS stays off and the listener behaves