From b229eeb674daf4a35cdd3c45208a11d15b7e9757 Mon Sep 17 00:00:00 2001 From: mrambossek Date: Fri, 31 Jul 2026 21:01:19 +0200 Subject: [PATCH] =?UTF-8?q?build-status:=20tls-echo/JA4=20live=20on=20fmr?= =?UTF-8?q?=20=E2=80=94=20spec=20=C2=A74=20complete?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cross-client verified (openssl vs python ssl yield distinct JA4s). Co-Authored-By: Claude Opus 5 --- docs/build-status.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/build-status.md b/docs/build-status.md index ee77965..86b0c83 100644 --- a/docs/build-status.md +++ b/docs/build-status.md @@ -285,3 +285,17 @@ The daemon now proves its own host is a clean measurement target: - Both signals ride in the profile as `server_selftest{mtu_ok,sysctl_ok}` so a client can skip MTU testing when the server can't support it honestly. fmr profile now: `{mtu_ok: true, sysctl_ok: true}`. + +## Server v0.3.6 — tls-echo / JA4: spec §4 COMPLETE (2026-07-31) +The elt-echo TLS variant runs on the TCP-echo port (8441), multiplexed by a timed 0x16 peek +(plain echo stays server-speaks-first; a TLS ClientHello routes to the TLS path). It captures +the full ClientHello, returns it raw (b64) + as a JA4 fingerprint (FoxIO), then TLS byte-echoes — +the sec.clienthello_echo evidence. Hand-rolled ClientHello parser (ciphers/exts/ALPN/ +supported_versions/sig-algs, GREASE-excluded), unit-tested. **Cross-client verified on fmr**: +openssl → t13d3013eo (30 ciphers), python ssl → t13d1712eo (17) — different stacks, different +fingerprints, correct _a structure both. Capability tls-echo. + +Spec §4 (TCP/TLS/HTTP/STUN) is now fully implemented. Server capabilities: udp-probe, +delayed-echo, connect-back, http-echo, tcp-echo, tls-echo, stun-5780, canary-dns. +Remaining spec: §5 heavy actions (downtrain/big_send/frag_send/throughput) + the TRAIN_REPORT +retrieval path — all gated on the anti-amplification grant machinery (§3.4) — and a real admin UI.