3 Commits

Include renames

Author	SHA1	Message	Date
mrambossekandClaude Fable 5	ce1aaa332a	server: send granted traffic from the address the session actually used ... fmr binds two IPv4 addresses. connFor picked whichever socket of the right family came first in the bind list, so a downtrain for a session established on .150 went out from .151 — and every packet was dropped by the client's NAT, which has no mapping for that pair. tcpdump on the server showed all 50 leaving; the client saw none. Read as "100% downstream loss", which is the worst kind of wrong: a confident measurement of something that never happened. Sessions now record which of our own bound addresses received their traffic, and granted sends (and delayed echo) go back out through that socket. The fallback to a family match is kept for the case where nothing has been received yet, and the test pins both paths — a single-homed lab can never reproduce this. Also: the client-side halves of the same work — anonymizer (core-privacy), local run archive with retention (core-archive), upload client, and the app's settings and history screens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 10:45:43 +02:00
mrambossekandClaude Opus 5	1472a86508	server: tls-echo — ClientHello capture + JA4 on the TCP-echo port (§4 complete) ... A connection opening with a TLS handshake (first byte 0x16) and ALPN elt-echo gets the ClientHello it sent back raw (b64) and as a JA4 fingerprint (sec.clienthello_echo), then a TLS byte-echo; plain connections are unchanged. One port, multiplexed by a timed peek: plain echo is server-speaks-first, so a silent client (peek timeout) is greeted, while a TLS client's immediate ClientHello (0x16) routes to the TLS path — 500ms tolerates ~1s RTT before misdetection. JA4 (FoxIO): full ClientHello parser (ciphers, extensions, ALPN, supported_versions, sig algs) with GREASE exclusion; a_b_c fingerprint, unit-tested for structure + GREASE invariance. Live-verified: elt-echo negotiated, JA4 t13d1712eo computed, 1530-byte ClientHello returned. Capability tls-echo. This completes spec §4. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-31 20:59:44 +02:00
mrambossekandClaude Opus 5	7b676e666e	server: STUN, TCP echo, observations API, delayed-echo + connect-back actions ... - stun: RFC 5389 binding responder + RFC 5780 attributes (OTHER-ADDRESS, RESPONSE-ORIGIN, CHANGE-REQUEST) on a primary/alt-port socket grid per address; advertises stun-5780 with >=2 same-family addrs, else stun-basic. Unmodified framing for tooling interop. Tested. - tcpecho: JSON greeting with observed src + TCP_INFO MSS/options (Linux getsockopt; zeroed elsewhere via build tags), then byte echo. - session: per-packet UDP observations + connect-back results, ByID lookup. - control: GET /v1/sessions/{id}/observations, POST .../actions (delayed_echo → DELAYED_ECHO at the observed data-plane source; connect_back → dial the control-plane source, record connected/refused/ timeout+rtt). Capabilities computed from what is actually wired. - config/main: comma-separated STUN listeners; all planes bind explicit addresses; graceful shutdown of the new listeners. Full flow smoke-tested; go test green (stun binding/change-port, dataplane wire format). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-31 19:53:36 +02:00