fix(reality): reject donors with oversized certs (#6402) + name the cause in self-test

REALITY silently fails to complete its handshake when the donor's TLS Certificate
record exceeds ~8192 bytes (XTLS/Xray-core #6402) — big-CDN donors like
www.microsoft.com trip it, and the panel would accept the dest, bring REALITY up,
and leave every client unable to connect with nothing in the logs.

- Extend the existing live donor probe (validateRealityDestLive) to measure the
  cert record and reject an oversized donor with a clear message + suggestions.
- Make the connection self-test report a REALITY handshake failure as "проверьте
  донор (dest)" instead of the generic firewall hint, since a bare EOF/timeout on
  REALITY almost always means the dest.

Author: AppsGanin

internal/core/manager_connections.go

@@ -3,6 +3,7 @@ package core
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"log/slog"
 	"net"
@@ -264,12 +265,38 @@ func validateRealityDestLive(host string) error {
 		return invalid("донор %q недоступен по TLS 1.3 на :443 (%v)", host, err)
 	}
 	defer conn.Close()
-	if conn.(*tls.Conn).ConnectionState().NegotiatedProtocol != "h2" {
+	state := conn.(*tls.Conn).ConnectionState()
+	if state.NegotiatedProtocol != "h2" {
 		return invalid("донор %q не поддерживает HTTP/2 — выбери другой сайт", host)
 	}
+	if size := certRecordSize(state.PeerCertificates); size > realityCertLimit {
+		return invalid("сертификат донора %q слишком большой (%d Б) — REALITY-хендшейк не "+
+			"завершается на этой версии Xray, если запись сертификата больше %d Б (issue #6402). "+
+			"Выбери сайт с меньшим сертификатом, например www.cloudflare.com, www.apple.com или dl.google.com",
+			host, size, realityCertLimit)
+	}
 	return nil
 }
 
+// realityCertLimit is the TLS Certificate-record size above which REALITY's
+// handshake silently fails to complete on current Xray (XTLS/Xray-core #6402).
+// Big-CDN donors like www.microsoft.com (~8.3 KB chain) trip it; the panel would
+// otherwise accept the dest, bring REALITY up, and leave every client unable to
+// connect with nothing in the logs to explain why.
+const realityCertLimit = 8192
+
+// certRecordSize estimates the bytes of the donor's TLS Certificate handshake
+// message — the quantity #6402 caps. It's the sum of each cert's DER length plus
+// the per-entry framing (3-byte length prefix), close enough to the real record to
+// judge the limit without parsing raw handshake bytes.
+func certRecordSize(chain []*x509.Certificate) int {
+	total := 4 // certificate_request_context (1) + certificate_list length (3)
+	for _, c := range chain {
+		total += 3 + len(c.Raw) + 2 // cert length prefix + DER + empty extensions
+	}
+	return total
+}
+
 // ApplyConnections validates and persists the whole connection surface, then does
 // a SINGLE reconcile (and one nft hop refresh) — so a multi-field save restarts
 // Xray at most once instead of once per field. The reconcile is a no-op for the

internal/core/manager_connections_reality_test.go

@@ -0,0 +1,28 @@
+package core
+
+import (
+	"crypto/x509"
+	"testing"
+)
+
+// certRecordSize gates the REALITY donor against the #6402 cert-size limit, so its
+// arithmetic has to track the real TLS Certificate record closely enough that a
+// just-oversized donor (www.microsoft.com, ~8.3 KB) is rejected while a normal one
+// passes. Uses synthetic DER lengths — the framing math is what's under test.
+func TestCertRecordSize(t *testing.T) {
+	cert := func(derLen int) *x509.Certificate {
+		return &x509.Certificate{Raw: make([]byte, derLen)}
+	}
+
+	// A single ~4 KB leaf + ~1.5 KB intermediate stays comfortably under the limit.
+	small := []*x509.Certificate{cert(4000), cert(1500)}
+	if got := certRecordSize(small); got >= realityCertLimit {
+		t.Errorf("small chain size %d should be under the %d limit", got, realityCertLimit)
+	}
+
+	// A microsoft-sized chain (~8.2 KB of DER across two certs) must exceed it.
+	big := []*x509.Certificate{cert(5200), cert(3000)}
+	if got := certRecordSize(big); got <= realityCertLimit {
+		t.Errorf("oversized chain size %d should exceed the %d limit", got, realityCertLimit)
+	}
+}

internal/selftest/client_config_test.go

@@ -1,6 +1,7 @@
 package selftest
 
 import (
+	"context"
 	"encoding/json"
 	"strings"
 	"testing"
@@ -197,6 +198,23 @@ func TestRingBufferKeepsTail(t *testing.T) {
 	}
 }
 
+// A REALITY probe that dies with a bare EOF (donor handshake never completed) must
+// get the REALITY-specific hint about the dest, not the generic firewall line —
+// that's the difference between an operator fixing the donor and staring at "порт
+// закрыт".
+func TestExplainFailureRealityHint(t *testing.T) {
+	err := context.DeadlineExceeded
+	msg := explainFailure(model.ProtoReality, err, "some log with EOF here")
+	if !strings.Contains(msg, "REALITY") || !strings.Contains(msg, "донор") {
+		t.Errorf("REALITY EOF failure should name the donor/dest, got %q", msg)
+	}
+	// The same bare timeout on VLESS is a firewall/port problem, not a donor one.
+	vmsg := explainFailure(model.ProtoVLESS, err, "")
+	if strings.Contains(vmsg, "REALITY") {
+		t.Errorf("VLESS failure must not mention REALITY, got %q", vmsg)
+	}
+}
+
 func TestFirstXrayErrorPicksFailureLine(t *testing.T) {
 	log := "2026/07/12 10:00:00 [Info] starting\n" +
 		"2026/07/12 10:00:01 [Warning] failed to process outbound traffic: auth failed\n"

internal/selftest/selftest.go

@@ -118,7 +118,7 @@ func runOne(ctx context.Context, binPath string, spec protoSpec, set *model.Sett
 
 	ip, err := probeThrough(pctx, socksPort)
 	if err != nil {
-		res.Detail = explainFailure(err, stderr.text())
+		res.Detail = explainFailure(spec.key, err, stderr.text())
 		return res
 	}
 
@@ -230,17 +230,36 @@ func waitForPort(ctx context.Context, port int) error {
 
 // explainFailure turns a raw probe error into an operator-facing sentence, folding
 // in Xray's own stderr when it points at the real cause (bad auth, TLS mismatch).
-func explainFailure(probeErr error, xrayLog string) string {
+func explainFailure(proto string, probeErr error, xrayLog string) string {
 	if x := firstXrayError(xrayLog); x != "" {
 		return "трафик не проходит: " + x
 	}
+	// REALITY fails in a way that leaves no keyword-matched error line: the client
+	// just gets EOF because the donor handshake never completes (wrong/unreachable
+	// dest, or a donor cert too big for this Xray — issue #6402). A bare timeout on
+	// REALITY almost always means the dest, so name it instead of the generic hint.
+	if proto == model.ProtoReality && isHandshakeFailure(probeErr, xrayLog) {
+		return "трафик не проходит: REALITY-хендшейк не завершился — проверьте, что донор (dest) " +
+			"доступен, отдаёт TLS 1.3 и его сертификат не слишком большой (issue #6402)"
+	}
 	if strings.Contains(probeErr.Error(), context.DeadlineExceeded.Error()) ||
 		strings.Contains(probeErr.Error(), "timeout") {
 		return "трафик не проходит: истекло время ожидания ответа (порт закрыт снаружи, брандмауэр или неверные параметры)"
 	}
 	return "трафик не проходит: " + probeErr.Error()
 }
 
+// isHandshakeFailure reports whether the failure looks like a stalled TLS/REALITY
+// handshake — an EOF or a plain timeout with nothing else to go on — rather than a
+// clean error Xray already named.
+func isHandshakeFailure(probeErr error, xrayLog string) bool {
+	e := strings.ToLower(probeErr.Error())
+	if strings.Contains(e, "eof") || strings.Contains(strings.ToLower(xrayLog), "eof") {
+		return true
+	}
+	return strings.Contains(e, context.DeadlineExceeded.Error()) || strings.Contains(e, "timeout")
+}
+
 // firstXrayError extracts the first line of Xray output that reads like a failure,
 // so the UI can show "auth failed" instead of a generic timeout. Empty when the log
 // carries nothing actionable.