cfal 8ab0f49ec4 Fix nested XHTTP SNI and Vision TLS framing (#254) ...

* fix(xhttp): suppress inherited SNI inside the carrier

Retain the hop identity for certificate verification while restoring the absent default wire SNI for inner protocols. Extend the TLS identity matrix through the XHTTP builder to cover omitted, null, and explicit SNI.

* fix(vision): keep the initial prefix in one TLS record

Floor configured Vision client TLS buffers at 21 bytes so peers receive the UUID and first frame header together. Preserve ordinary TLS limits and cover tiny buffers with record-level assertions, UDP exchanges, and sing-box/Xray peer tests.

* fix(tls): drain deferred KeyUpdate replies before Vision writes

Materialize pending KeyUpdate replies before draining TLS output so they cannot fragment the initial Vision prefix. Preserve queued application data and fatal alerts after session failure, with framing and backpressure regressions.

* refactor(tls): clarify identity and Vision regression tests

Replace positional identity-path flags with a test-local enum, use the existing message shutdown helper, and document the XHTTP inner SNI boundary. Preserve test coverage and production behavior.

* ci: pin Xray test peers to 26.10.31

Replace the unavailable release download with the latest release and its verified checksum. Align source-built peers and fixture version checks with the same release.

2026-11-01 00:32:17 +08:00

..

workflows

Fix nested XHTTP SNI and Vision TLS framing (#254)

2026-11-01 00:32:17 +08:00

require-tests.sh

Expand test coverage and fix the protocol bugs it exposed (#212)

2026-10-23 06:18:10 -04:00