fix: harden tunnel security and timeout handling

2026-10-10 11:19:50 +08:00 · 2026-05-23 14:17:04 +08:00
parent 74f7348529
commit 6447fda852
19 changed files with 571 additions and 92 deletions
@@ -221,6 +221,13 @@ pub async fn run(mut config: Config, servers: Vec<ServerEntry>) -> anyhow::Resul
            entry.tunnel_encryption_key.as_deref(),
        );
        if tunnel_security == crate::config::TunnelSecurity::NonTlsRequired {
+            if entry.aether_url.trim_start().starts_with("http://") {
+                warn!(
+                    server = %label,
+                    url = %entry.aether_url,
+                    "secure tunnel frame encryption starts after registration; deliver install and registration credentials over HTTPS or another trusted bootstrap channel"
+                );
+            }
            let key = entry
                .tunnel_encryption_key
                .as_deref()