n0ctal bab39393f1 fix(nodes): validate every certificate in the node mTLS trust bundle (#6188) ...

* fix(nodes): validate every certificate in the node mTLS trust bundle

AppendCertsFromPEM reports success once a single certificate parses, so a
trust bundle whose later entries are damaged or truncated was accepted with
those entries silently absent from the pool. Parse and validate every PEM
block instead, and reject the bundle if any of them is malformed.

* fix(mtls): reject malformed certificate bundle layout

---------

Co-authored-by: n0ctal <293235942+n0ctal@users.noreply.github.com>

2026-08-15 21:31:31 +02:00

..

controller

feat(xray): browse geosite/geoip categories from routing rules (#6165)

2026-08-15 17:12:59 +02:00

entity

feat(sub): allow identity tokens on every subscription link (#5935)

2026-07-28 22:12:52 +02:00

global

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

job

fix(node): adopt a matching deployed inbound instead of recreating it (#6197)

2026-08-14 20:01:35 +02:00

locale

style: adopt golangci-lint v2 and resolve all findings

2026-06-27 15:42:22 +02:00

middleware

fix(web): tighten database restore body-cap exemption (#5609)

2026-06-28 15:00:55 +02:00

network

fix(web): report unexpected HTTP serve failures (#6210)

2026-08-14 19:40:53 +02:00

runtime

feat(inbounds): improve multi-node online attribution (#6164)

2026-08-15 17:40:35 +02:00

service

fix(nodes): validate every certificate in the node mTLS trust bundle (#6188)

2026-08-15 21:31:31 +02:00

session

refactor: focused service files, leaf subpackages, and an internal/ layout (#5167)

2026-06-10 15:19:22 +02:00

translation

fix(sub): serve a copy-only page when a subscription URL is opened in a browser (#6183)

2026-08-15 18:18:03 +02:00

websocket

fix(nodes): keep the credential-presence flag on the node heartbeat push

2026-07-28 17:38:46 +02:00

cadence_test.go

refactor(web): centralize background job cadences (#5269)

2026-06-14 22:50:24 +02:00

routes_contract_test.go

fix(api): authenticate GET /panel/api/openapi.json + pin the route registry to the router (#6133)

2026-07-29 08:00:05 +02:00

web_mtls_test.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

web_mtls.go

feat(node): node hardening — mTLS, hashed+zstd reconcile transport, per-node net metrics (#5382)

2026-06-16 12:19:33 +02:00

web.go

fix(web): report unexpected HTTP serve failures (#6210)

2026-08-14 19:40:53 +02:00