3 Commits

Include renames

Author	SHA1	Message	Date
mrambossekandClaude Opus 5	7e1015c211	server: §3.4 asymmetric grants + downtrain and big_send actions ... The grant is the keystone that makes server->client sends safe: created only by an authenticated control-plane action, bound at creation to the session's OBSERVED data-plane source (so it can never be aimed at a third party), and bounded by bytes, average rate and expiry. Sends stop the moment the budget runs out, so a buggy action cannot become a flood. Two granted actions on top of it: - downtrain: N packets at a given size/interval toward the client, with seq + send-timestamp in the payload — downstream loss/reorder/jitter, which an upstream-only train cannot measure. - big_send: one datagram per requested size, echoing the intended size in the payload — downstream MTU / black-hole evidence the client cannot produce for itself (only the far end can emit a large packet toward it). Tests cover the security properties: no grant without a verified destination, client requests clamped to server limits, byte budget stops sending exactly, expiry refuses, and the rate ceiling throttles a burst. Capabilities gain downtrain + big-send. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-01 10:09:13 +02:00
mrambossekandClaude Opus 5	7b676e666e	server: STUN, TCP echo, observations API, delayed-echo + connect-back actions ... - stun: RFC 5389 binding responder + RFC 5780 attributes (OTHER-ADDRESS, RESPONSE-ORIGIN, CHANGE-REQUEST) on a primary/alt-port socket grid per address; advertises stun-5780 with >=2 same-family addrs, else stun-basic. Unmodified framing for tooling interop. Tested. - tcpecho: JSON greeting with observed src + TCP_INFO MSS/options (Linux getsockopt; zeroed elsewhere via build tags), then byte echo. - session: per-packet UDP observations + connect-back results, ByID lookup. - control: GET /v1/sessions/{id}/observations, POST .../actions (delayed_echo → DELAYED_ECHO at the observed data-plane source; connect_back → dial the control-plane source, record connected/refused/ timeout+rtt). Capabilities computed from what is actually wired. - config/main: comma-separated STUN listeners; all planes bind explicit addresses; graceful shutdown of the new listeners. Full flow smoke-tested; go test green (stun binding/change-port, dataplane wire format). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-31 19:53:36 +02:00
mrambossekandClaude Opus 5	8a80026d49	server: Go skeleton — control plane, UDP data plane, Docker + systemd modes ... Pure stdlib. Implements the spec's core: enrollment (single-use tokens), profile (SPKI pin, only real capabilities advertised), sessions with the §2.4 HKDF-SHA256 key schedule; UDP data plane with the 32-byte ELT1 header, 4-byte HMAC gate, 1024-wide anti-replay window, ECHO_RESP with observation block, TIMESYNC, and the §3.4 anti-amplification cap. Wire format has tests (roundtrip + silent-drop cases); enroll→profile→session smoke-tested live. Modes: container (autodetect /.dockerenv|/run/.containerenv|cgroup, or --docker/ECHOLOT_DOCKER=1; config via ECHOLOT_* env; distroless image; network_mode host required — Docker NAT would falsify observed sources) and native (--install-systemd/--uninstall-systemd with a hardened unit, opt-in --self-update from Gitea releases; refused in containers). CI: tests on any server/ push; server-v* tags build+push the image to the Gitea registry and attach linux amd64/arm64 binaries + SHA256SUMS to a release — the artifact self-update consumes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-30 13:09:08 +02:00