server: upstream trains, observed TTL/DSCP/ECN, rate limits, action ids

Types 0x03/0x04/0x05 land with a bounded columnar train buffer (head kept,
truncation declared) and grant-free multi-part reports - a report row is
smaller than the packet it answers, so $3.4 holds without a grant. The
read loop now collects TTL/TOS cmsgs on Linux, replacing the 0xFF stubs in
the observation block with what the kernel saw; downtrain gained a dscp
parameter, so DSCP survival is measurable in both directions.

Rate limiting ($2.5) exists now: per-credential AND per-source buckets,
429 on the control plane, silent drop on the data plane after the HMAC
gate and before the replay window. UDP ceilings default above the largest
legitimate run - a limit that clips a real measurement produces a
confidently wrong number.

Every granted packet carries its action_id at payload[8:16]; overlapping
actions were unattributable before. Canary DNS logs now honor the stated
24h privacy default. /admin/enroll-tokens answers the spec's JSON shape.
protocol_version 1.0.1 (additive).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This commit is contained in:

mrambossek

2026-08-02 13:04:54 +02:00

co-authored by

Claude Opus 5

parent f6849f8e6a

commit 8118e213ae

26 changed files with 1390 additions and 61 deletions

									
										server/internal/session/session.go
									
		+3
		
												View File
												
				@@ -42,6 +42,9 @@ type Session struct {

					connectBack []ConnectBackResult

					throughput  []ThroughputReport

					upstream    UpstreamCounter

					// Upstream trains (spec §3.2), buffered apart from udpObs — see train.go for why the

					// flat ring must not be the only home of a 5000-packet train.

					trains []*Train

				}

				const obsCap = 4096