server: tls-echo — ClientHello capture + JA4 on the TCP-echo port (§4 complete)

A connection opening with a TLS handshake (first byte 0x16) and ALPN
elt-echo gets the ClientHello it sent back raw (b64) and as a JA4
fingerprint (sec.clienthello_echo), then a TLS byte-echo; plain
connections are unchanged. One port, multiplexed by a timed peek:
plain echo is server-speaks-first, so a silent client (peek timeout) is
greeted, while a TLS client's immediate ClientHello (0x16) routes to the
TLS path — 500ms tolerates ~1s RTT before misdetection.

JA4 (FoxIO): full ClientHello parser (ciphers, extensions, ALPN,
supported_versions, sig algs) with GREASE exclusion; a_b_c fingerprint,
unit-tested for structure + GREASE invariance. Live-verified: elt-echo
negotiated, JA4 t13d1712eo computed, 1530-byte ClientHello returned.
Capability tls-echo. This completes spec §4.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/build-status.md

@@ -242,3 +242,46 @@ checksum-verified download v0.2.0→v0.3.0, atomic replace, restart — worked).
   tcp-echo, stun-5780`.
 Still not implemented: TLS-echo/JA4, HTTP echo, tls-reference, canary DNS (§6.1 reference
 records), and the train/big-send/frag/throughput actions. Admin UI still token-mint + health only.
+
+## Canary DNS live — server v0.3.1 on fmr (2026-07-31)
+Zone `c.echo-lot.app` delegated (NS → fmr-1/fmr-2) and authoritative on all 4 service IPs
+udp+tcp/53. Verified through full public recursion: `ttl-5` A→192.0.2.5 (Cloudflare), `ttl-3600`
+AAAA→2001:db8::3600 (Google), `big-txt` TXT returned (TCP fallback, truncated over UDP as
+designed). End-to-end session attribution works: a `<nonce>.<session-prefix>.c.echo-lot.app`
+query resolved via a public resolver shows up in `GET /v1/sessions/{id}/observations` →
+`dns_canary` with the resolver's real egress IP, transport, and EDNS. First real test already
+caught a finding: **Google applies 0x20 case randomization** (mixed-case qname), Cloudflare does
+not — captured via `case_preserved`. Capabilities now: udp-probe, delayed-echo, connect-back,
+tcp-echo, stun-5780, canary-dns. Kept the hand-rolled stdlib DNS (no miekg/dns) — validated
+against independent clients. Deployed via `--self-update` (v0.3.0→v0.3.1, checksum-verified).
+
+## Server v0.3.2 + v0.3.3 (2026-07-31)
+- **v0.3.2 — control-plane security (live on fmr, externally verified):** `POST /v1/echo`
+  reflects the received request head+body (b64) and observed TLS (version/cipher/SNI/ALPN) —
+  captured real SNI `fmr-1.echo-lot.app` and an injected header over public TLS1.3; `GET
+  /v1/tls-reference` returns the served DER chain + pin (cross-checked against the openssl-derived
+  pin). Optional cleartext echo listener (default off). Capability `http-echo`.
+- **v0.3.3 — MTU probe (data plane):** MTU_PROBE (0x09) → small MTU_ACK (0x0A) carrying the
+  received datagram size; client DF-probes increasing sizes to find path MTU / black holes. ACK
+  is tiny → never amplifies. Tested.
+- **Note on trains:** upstream trains (TRAIN_DATA 0x03) are already observable — every HMAC-valid
+  packet is recorded (seq/t_rx/size/type) with no per-packet response, so loss/reordering/inter-
+  arrival are visible via GET observations. The dedicated data-plane TRAIN_REPORT (0x05) is
+  deferred: §3.4 anti-amplification means it needs an asymmetric grant + columnar multi-datagram
+  encoding — a focused batch, not a corner to rush.
+Remaining spec: tls-echo (ClientHello+JA4), TRAIN_REPORT, big/frag-send, throughput, downtrain;
+real admin UI.
+
+## Server self-test + host tuning — v0.3.4/v0.3.5, fmr proven good (2026-07-31)
+The daemon now proves its own host is a clean measurement target:
+- **sysctl audit** (`GET /admin/selftest`, startup warnings): on first run it flagged exactly 4
+  real issues on fmr — accept_ra=1 on a static-v6 host, accept_redirects=1, send_redirects=1,
+  icmp_ratelimit=1000. Recommended `server/deploy/99-echolot-sysctl.conf` applied (v6 default
+  route/addrs are proto static with 0 RA-derived routes, so disabling accept_ra is safe —
+  verified v6 egress intact after). Now sysctl_ok=true, 0 warnings.
+- **egress-MTU self-proof**: DF PMTUD via IP_MTU_DISCOVER + getsockopt IP_MTU (v0.3.4 had a bug —
+  read IP_MTU without connecting → ENOTCONN; v0.3.5 connects first). fmr reports 1500 on both v4
+  and v6 → mtu_ok=true, so client MTU tests are trustworthy.
+- Both signals ride in the profile as `server_selftest{mtu_ok,sysctl_ok}` so a client can skip
+  MTU testing when the server can't support it honestly.
+fmr profile now: `{mtu_ok: true, sysctl_ok: true}`.

server/README.md

@@ -53,6 +53,26 @@ All configurable via `ECHOLOT_*_LISTEN`. Plus:
 Deliberately out of scope here: an echo listener on 443 (to detect port-based egress filtering)
 — that genuinely needs 443 and belongs on a dedicated IP, not on a host running a reverse proxy.
 
+## Host tuning (measurement fidelity)
+
+A measurement server must not let the kernel distort what clients observe. Apply the
+recommended sysctls and the daemon will confirm the host is clean:
+
+```sh
+sudo cp deploy/99-echolot-sysctl.conf /etc/sysctl.d/ && sudo sysctl --system
+```
+
+The daemon **self-tests at startup and via `GET /admin/selftest`** (localhost):
+- **sysctl audit** — flags settings that would distort results (RA acceptance on a static host,
+  ICMP redirects, ICMP rate-limiting of the server's own errors, disabled TCP options).
+- **egress-MTU self-proof** — DF-probes external anchors (`ECHOLOT_MTU_PROBE_TARGETS`,
+  default 1.1.1.1 + a v6 anchor) and reads the discovered path MTU. If the server's *own* uplink
+  can't carry 1500, client MTU results would measure this server, not the client — so the profile
+  exposes `server_selftest.mtu_ok` and the log warns loudly.
+
+Both signals ride in `GET /v1/profile` as `server_selftest` so a client can trust — or skip —
+MTU testing accordingly.
+
 ## Run in Docker (config via env)
 
 ```sh

server/cmd/echolot-server/main.go

@@ -18,6 +18,7 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/json"
 	"encoding/pem"
 	"errors"
 	"fmt"
@@ -30,6 +31,7 @@ import (
 	"os/signal"
 	"path/filepath"
 	"strconv"
+	"sync/atomic"
 	"syscall"
 	"time"
 
@@ -37,6 +39,7 @@ import (
 	"echo-lot.app/server/internal/config"
 	"echo-lot.app/server/internal/control"
 	"echo-lot.app/server/internal/dataplane"
+	"echo-lot.app/server/internal/selftest"
 	"echo-lot.app/server/internal/selfupdate"
 	"echo-lot.app/server/internal/session"
 	"echo-lot.app/server/internal/store"
@@ -100,17 +103,20 @@ func serve(cfg *config.Config) error {
 
 	sessions := session.NewManager(15 * time.Minute)
 	dp := &dataplane.Server{Sessions: sessions}
-	tcpSrv := &tcpecho.Server{}
+	// TCP echo shares the control cert for its elt-echo TLS variant.
+	tcpSrv := &tcpecho.Server{
+		TLSConfig: &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12},
+	}
 
-	caps := []string{"udp-probe", "delayed-echo", "connect-back"}
+	caps := []string{"udp-probe", "delayed-echo", "connect-back", "http-echo"}
 	if len(config.Addrs(cfg.TCPListen)) > 0 {
-		caps = append(caps, "tcp-echo")
+		caps = append(caps, "tcp-echo", "tls-echo")
 	}
 
 	ctl := &control.Server{
 		Store: st, Sessions: sessions, Name: cfg.Name,
 		UDPPort: mustPort(firstAddr(cfg.UDPListen)), TCPPort: mustPort(firstAddr(cfg.TCPListen)),
-		StunPort: mustPort(firstAddr(cfg.StunListen)), PinB64: pin,
+		StunPort: mustPort(firstAddr(cfg.StunListen)), PinB64: pin, CertChain: cert.Certificate,
 		DelayedEcho: dp.SendDelayedEcho,
 		TCPRecent:   func(ip string) any { return tcpSrv.RecentFor(ip) },
 	}
@@ -138,11 +144,42 @@ func serve(cfg *config.Config) error {
 		}(addr, ln)
 	}
 
+	// Self-test: prove the host is a clean measurement target. Sysctl audit is
+	// instant; the egress-MTU proof does network round trips, so publish the
+	// sysctl-only report immediately and swap in the full one when it lands.
+	var selftestPtr atomic.Pointer[selftest.Report]
+	initial := selftest.Report{Sysctls: selftest.Sysctls()}
+	selftestPtr.Store(&initial)
+	for _, c := range initial.Sysctls {
+		if c.Severity == selftest.Warn {
+			slog.Warn("sysctl not measurement-clean", "sysctl", c.Name, "got", c.Got, "want", c.Want, "why", c.Why)
+		}
+	}
+	go func() {
+		r := selftest.Run(config.Addrs(cfg.MTUProbeTargets))
+		selftestPtr.Store(&r)
+		for _, m := range r.EgressMTU {
+			if !m.FullMTU {
+				slog.Warn("egress MTU below 1500 — client MTU results measure THIS server, not the client",
+					"target", m.Target, "discovered_mtu", m.DiscoveredMTU, "err", m.Err)
+			}
+		}
+		slog.Info("self-test complete", "sysctl_ok", r.SysctlOK, "mtu_ok", r.MTUOK)
+	}()
+	ctl.ProvenGood = func() (mtuOK, sysctlOK bool) {
+		r := selftestPtr.Load()
+		return r.MTUOK, r.SysctlOK
+	}
+
 	// Admin/health (plain HTTP, localhost by default; spec §7)
 	admin := http.NewServeMux()
 	admin.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintf(w, `{"ok":true,"version":%q}`, Version)
 	})
+	admin.HandleFunc("GET /admin/selftest", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(selftestPtr.Load())
+	})
 	// TODO(spec §7): enrollment token management + device list. Until the
 	// admin UI exists, mint tokens with: echolot-admin (or curl on this
 	// listener once the endpoint lands).
@@ -189,6 +226,15 @@ func serve(cfg *config.Config) error {
 		}(addr, ln)
 	}
 
+	// Optional cleartext HTTP-echo (spec §4 plaintext-path test) — only
+	// POST /v1/echo, no auth, no secrets. Off unless configured.
+	var httpEchoSrvs []*http.Server
+	for _, addr := range config.Addrs(cfg.HTTPEchoListen) {
+		hs := &http.Server{Addr: addr, Handler: ctl.EchoHandler(), ReadHeaderTimeout: 10 * time.Second}
+		httpEchoSrvs = append(httpEchoSrvs, hs)
+		go func(a string, srv *http.Server) { errCh <- fmt.Errorf("http-echo %s: %w", a, srv.ListenAndServe()) }(addr, hs)
+	}
+
 	// STUN (spec §4) — advertises stun-5780 only with ≥2 same-family addrs.
 	var stunSrv *stun.Server
 	if stunAddrs := config.Addrs(cfg.StunListen); len(stunAddrs) > 0 {
@@ -263,6 +309,9 @@ func serve(cfg *config.Config) error {
 		for _, l := range dnsTCP {
 			_ = l.Close()
 		}
+		for _, hs := range httpEchoSrvs {
+			_ = hs.Shutdown(shutCtx)
+		}
 		return nil
 	case err := <-errCh:
 		return err

server/deploy/99-echolot-sysctl.conf

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: 2026 Echolot contributors
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Recommended sysctls for an Echolot probe-server host: keep the kernel from
+# silently altering what clients measure. Install with:
+#   sudo cp 99-echolot-sysctl.conf /etc/sysctl.d/
+#   sudo sysctl --system
+# The daemon audits these at startup and via GET /admin/selftest; anything not
+# set here shows up as a "not measurement-clean" warning.
+
+# Static-addressed host: never let a Router Advertisement mutate our routing.
+# (Echolot's whole job is detecting broken RAs — the server must be immune.)
+net.ipv6.conf.all.accept_ra = 0
+net.ipv6.conf.default.accept_ra = 0
+
+# Don't let ICMP redirects rewrite our routing mid-measurement, and don't
+# emit redirects (we're an endpoint, not a router).
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+
+# Don't throttle the server's own ICMP errors (dest-unreachable/frag-needed/
+# time-exceeded) — throttling produces false loss/black-hole readings when
+# clients probe toward this server.
+net.ipv4.icmp_ratelimit = 0
+
+# These are usually already correct; pinned so the server can honestly
+# negotiate/reflect them (a missing option in a client's evidence is then the
+# path's fault, not ours).
+net.ipv4.tcp_sack = 1
+net.ipv4.tcp_timestamps = 1
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.ip_no_pmtu_disc = 0
+net.ipv4.icmp_echo_ignore_all = 0
+
+# Loose reverse-path filtering suits a multi-IP measurement host (strict mode
+# can drop alt-address / asymmetric replies used by STUN 5780).
+net.ipv4.conf.all.rp_filter = 2

server/internal/config/config.go

@@ -29,6 +29,11 @@ type Config struct {
 	StunListen string // ECHOLOT_STUN_LISTEN / --stun-listen (spec default 3478; empty disables)
 	DNSListen  string // ECHOLOT_DNS_LISTEN / --dns-listen (canary zone; empty disables)
 	CanaryZone string // ECHOLOT_CANARY_ZONE / --canary-zone (e.g. c.echo-lot.app)
+	// Optional cleartext HTTP-echo listener (spec §4 plaintext-path test).
+	// Default empty = off; it exposes only POST /v1/echo, no auth, no secrets.
+	HTTPEchoListen string // ECHOLOT_HTTP_ECHO_LISTEN / --http-echo-listen
+	// Comma-separated anchors for the egress-MTU self-proof (host or ip).
+	MTUProbeTargets string // ECHOLOT_MTU_PROBE_TARGETS / --mtu-probe-targets
 
 	// Admin UI / health listener (spec §7: localhost-only by default)
 	AdminListen string // ECHOLOT_ADMIN_LISTEN / --admin-listen
@@ -71,6 +76,8 @@ func Load(args []string) (*Config, *Actions, error) {
 	fs.StringVar(&c.StunListen, "stun-listen", envOr("STUN_LISTEN", ":3478"), "STUN listen address(es), comma-separated; empty disables (spec §4)")
 	fs.StringVar(&c.DNSListen, "dns-listen", envOr("DNS_LISTEN", ""), "canary-DNS listen address(es) udp+tcp/53, comma-separated; empty disables (spec §6.1)")
 	fs.StringVar(&c.CanaryZone, "canary-zone", envOr("CANARY_ZONE", ""), "authoritative canary zone, e.g. c.echo-lot.app")
+	fs.StringVar(&c.HTTPEchoListen, "http-echo-listen", envOr("HTTP_ECHO_LISTEN", ""), "optional CLEARTEXT http-echo listen address(es); empty disables (spec §4)")
+	fs.StringVar(&c.MTUProbeTargets, "mtu-probe-targets", envOr("MTU_PROBE_TARGETS", "1.1.1.1,2606:4700:4700::1111"), "egress-MTU self-proof anchors, comma-separated")
 	fs.StringVar(&c.AdminListen, "admin-listen", envOr("ADMIN_LISTEN", "127.0.0.1:8444"), "admin/health listen address (keep localhost)")
 	fs.StringVar(&c.StateDir, "state-dir", envOr("STATE_DIR", defaultStateDir()), "state directory (device store, generated TLS)")
 	fs.StringVar(&c.Name, "name", envOr("NAME", "echolot"), "server profile name")

server/internal/control/control.go

@@ -41,6 +41,8 @@ type Server struct {
 	StunPort int
 	// SPKI pin of the serving cert, for the profile's pins[] field.
 	PinB64 string
+	// CertChain is the served leaf-first DER chain, for GET /v1/tls-reference.
+	CertChain [][]byte
 	// Capabilities as computed at startup from what is actually wired up.
 	Capabilities []string
 	// TCPRecent returns recent TCP-echo connections for a source IP (may be nil).
@@ -51,6 +53,11 @@ type Server struct {
 	CanaryQueries func(sessionPrefix string) any
 	// CanaryZone is surfaced in the profile so the app knows what to query.
 	CanaryZone string
+	// ProvenGood reports the server's self-test signal (may be nil). Surfaced
+	// in the profile so a client can trust — or skip — MTU tests: if the
+	// server's own egress isn't full-MTU, client MTU results measure the
+	// server, not the client.
+	ProvenGood func() (mtuOK, sysctlOK bool)
 }
 
 func (s *Server) Handler() http.Handler {
@@ -61,11 +68,31 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("DELETE /v1/sessions/{id}", s.deleteSession)
 	mux.HandleFunc("GET /v1/sessions/{id}/observations", s.observations)
 	mux.HandleFunc("POST /v1/sessions/{id}/actions", s.actions)
-	// TODO(spec §4): POST /v1/echo, GET /v1/tls-reference; TLS-echo/JA4
+	mux.HandleFunc("POST /v1/echo", s.httpEcho)
+	mux.HandleFunc("GET /v1/tls-reference", s.tlsReference)
+	// TODO(spec §4): TLS-echo/JA4 (tls-echo capability, needs ClientHello capture)
 	// TODO(spec §5): downtrain, big_send, frag_send, throughput
 	return mux
 }
 
+// EchoHandler exposes just the HTTP-echo endpoint for the optional cleartext
+// listener (spec §4: plaintext-path tampering test).
+func (s *Server) EchoHandler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /v1/echo", s.httpEcho)
+	return mux
+}
+
+// selftestSignal is the compact "server proven good" object for the profile.
+// mtu_ok=false tells a client its MTU results would measure this server.
+func selftestSignal(f func() (bool, bool)) map[string]any {
+	if f == nil {
+		return map[string]any{"mtu_ok": nil, "sysctl_ok": nil}
+	}
+	mtuOK, sysctlOK := f()
+	return map[string]any{"mtu_ok": mtuOK, "sysctl_ok": sysctlOK}
+}
+
 // sessionAuth resolves {id} and requires the bearer to be the owning device.
 func (s *Server) sessionAuth(w http.ResponseWriter, r *http.Request) *session.Session {
 	dev := s.Store.DeviceByCredential(bearer(r))
@@ -255,6 +282,7 @@ func (s *Server) profile(w http.ResponseWriter, r *http.Request) {
 		"pins":            []string{"pin-sha256:" + s.PinB64},
 		"next_pins":       []string{},
 		"canary_zone":     s.CanaryZone,
+		"server_selftest": selftestSignal(s.ProvenGood),
 		"limits":          map[string]any{"max_kbps": 50000, "max_session_s": 900},
 	})
 }

server/internal/control/httpecho.go

@@ -0,0 +1,94 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package control
+
+import (
+	"crypto/tls"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"strings"
+)
+
+// httpEcho implements spec §4 HTTP echo: return the exact received request
+// (request line + headers + body, base64) plus the TLS parameters the server
+// observed. The client diffs this against what it sent to detect header
+// injection/stripping, transparent proxying, or TLS interception
+// (sec.http_echo). Served on the control HTTPS listener and, optionally, on a
+// cleartext listener to test plaintext-path tampering.
+func (s *Server) httpEcho(w http.ResponseWriter, r *http.Request) {
+	body, _ := io.ReadAll(io.LimitReader(r.Body, 1<<20))
+
+	// Reconstruct the received request head verbatim (as close as net/http
+	// exposes it — header order is lost, but names/values and the request
+	// line survive, which is what tampering changes).
+	var head strings.Builder
+	head.WriteString(r.Method + " " + r.RequestURI + " " + r.Proto + "\r\n")
+	head.WriteString("Host: " + r.Host + "\r\n")
+	for name, vals := range r.Header {
+		for _, v := range vals {
+			head.WriteString(name + ": " + v + "\r\n")
+		}
+	}
+	head.WriteString("\r\n")
+
+	resp := map[string]any{
+		"observed_src":     r.RemoteAddr,
+		"request_head_b64": base64.StdEncoding.EncodeToString([]byte(head.String())),
+		"body_b64":         base64.StdEncoding.EncodeToString(body),
+		"body_len":         len(body),
+		"scheme":           schemeOf(r),
+	}
+	if r.TLS != nil {
+		resp["tls"] = tlsParams(r.TLS)
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+func schemeOf(r *http.Request) string {
+	if r.TLS != nil {
+		return "https"
+	}
+	return "http"
+}
+
+func tlsParams(cs *tls.ConnectionState) map[string]any {
+	return map[string]any{
+		"version": tlsVersionName(cs.Version),
+		"cipher":  tls.CipherSuiteName(cs.CipherSuite),
+		"sni":     cs.ServerName,
+		"alpn":    cs.NegotiatedProtocol,
+		"resumed": cs.DidResume,
+	}
+}
+
+func tlsVersionName(v uint16) string {
+	switch v {
+	case tls.VersionTLS13:
+		return "TLS1.3"
+	case tls.VersionTLS12:
+		return "TLS1.2"
+	case tls.VersionTLS11:
+		return "TLS1.1"
+	case tls.VersionTLS10:
+		return "TLS1.0"
+	}
+	return "unknown"
+}
+
+// tlsReference implements spec §4: return the exact certificate chain this
+// server serves (DER, base64), so the app can compare it against a copy it
+// obtained out-of-band and against what its own direct handshake yielded
+// (sec.tls_reference). Not a capability — always available on the control
+// plane. No auth: the chain is public information a handshake already reveals.
+func (s *Server) tlsReference(w http.ResponseWriter, r *http.Request) {
+	chain := make([]string, 0, len(s.CertChain))
+	for _, der := range s.CertChain {
+		chain = append(chain, base64.StdEncoding.EncodeToString(der))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"pin_sha256": s.PinB64,
+		"chain_der":  chain, // leaf first, as served
+	})
+}

server/internal/control/httpecho_test.go

@@ -0,0 +1,63 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package control
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestHTTPEchoReflectsRequest(t *testing.T) {
+	s := &Server{}
+	req := httptest.NewRequest("POST", "/v1/echo", strings.NewReader("payload-bytes"))
+	req.Header.Set("X-Injected", "canary")
+	rr := httptest.NewRecorder()
+	s.httpEcho(rr, req)
+
+	var resp struct {
+		RequestHeadB64 string `json:"request_head_b64"`
+		BodyB64        string `json:"body_b64"`
+		BodyLen        int    `json:"body_len"`
+		Scheme         string `json:"scheme"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	head, _ := base64.StdEncoding.DecodeString(resp.RequestHeadB64)
+	if !strings.Contains(string(head), "X-Injected: canary") {
+		t.Fatalf("echo did not reflect the injected header:\n%s", head)
+	}
+	body, _ := base64.StdEncoding.DecodeString(resp.BodyB64)
+	if string(body) != "payload-bytes" || resp.BodyLen != 13 {
+		t.Fatalf("body mismatch: %q len=%d", body, resp.BodyLen)
+	}
+	if resp.Scheme != "http" { // httptest requests carry no TLS
+		t.Fatalf("scheme = %s, want http", resp.Scheme)
+	}
+}
+
+func TestTLSReferenceReturnsChain(t *testing.T) {
+	s := &Server{PinB64: "TESTPIN", CertChain: [][]byte{{0x30, 0x82, 0x01}, {0xAA, 0xBB}}}
+	rr := httptest.NewRecorder()
+	s.tlsReference(rr, httptest.NewRequest("GET", "/v1/tls-reference", nil))
+
+	var resp struct {
+		PinSHA256 string   `json:"pin_sha256"`
+		ChainDER  []string `json:"chain_der"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.PinSHA256 != "TESTPIN" || len(resp.ChainDER) != 2 {
+		t.Fatalf("bad tls-reference: %+v", resp)
+	}
+	first, _ := base64.StdEncoding.DecodeString(resp.ChainDER[0])
+	if len(first) != 3 || first[0] != 0x30 {
+		t.Fatalf("leaf DER not round-tripped: %x", first)
+	}
+}
+

server/internal/dataplane/udp.go

@@ -29,6 +29,8 @@ const (
 	TypeEchoResp    = 0x02
 	TypeTimesyncReq = 0x07
 	TypeTimesyncRsp = 0x08
+	TypeMtuProbe    = 0x09
+	TypeMtuAck      = 0x0A
 	TypeDelayedEcho = 0x0B
 )
 
@@ -132,11 +134,24 @@ func (s *Server) handle(conn *net.UDPConn, raddr netip.AddrPort, pkt []byte, tRx
 		s.echoResp(conn, raddr, sess, pkt, seq, tRxNs)
 	case TypeTimesyncReq:
 		s.timesyncResp(conn, raddr, sess, pkt, seq, tRxNs)
+	case TypeMtuProbe:
+		s.mtuAck(conn, raddr, sess, seq, len(pkt))
 	default:
 		slog.Debug("unhandled data-plane type", "type", typ)
 	}
 }
 
+// mtuAck replies to an MTU_PROBE with a small MTU_ACK carrying the total
+// datagram size the server actually received (spec §3.2). The client sends
+// DF-flagged probes of increasing size and binary-searches the path MTU / a
+// black hole from which sizes stop being acknowledged. The ACK is tiny, so it
+// can never amplify regardless of probe size.
+func (s *Server) mtuAck(conn *net.UDPConn, raddr netip.AddrPort, sess *session.Session, seq uint32, received int) {
+	var payload [4]byte
+	binary.BigEndian.PutUint32(payload[:], uint32(received))
+	s.send(conn, raddr, sess, TypeMtuAck, seq, payload[:])
+}
+
 // Observation block (spec §3.3), fixed 40 bytes appended to the RESP header:
 //   0  8  t_rx_ns (server clock, process epoch)
 //   8  8  t_tx_ns

server/internal/dataplane/udp_test.go

@@ -102,6 +102,40 @@ func TestEchoRoundtripObservationAndAntiAmplification(t *testing.T) {
 	}
 }
 
+func TestMtuProbeAckReportsReceivedSizeAndDoesNotAmplify(t *testing.T) {
+	mgr, addr := startServer(t)
+	sess, _, err := mgr.New("dev1", "credential-ikm", netip.MustParseAddr("127.0.0.1"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	client, err := net.DialUDP("udp", nil, net.UDPAddrFromAddrPort(addr))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.Close()
+	client.SetDeadline(time.Now().Add(2 * time.Second))
+
+	// A large probe: 32 header + 1400 payload.
+	probe := craft(t, sess, TypeMtuProbe, 1, make([]byte, 1400))
+	if _, err := client.Write(probe); err != nil {
+		t.Fatal(err)
+	}
+	buf := make([]byte, 2000)
+	n, err := client.Read(buf)
+	if err != nil {
+		t.Fatalf("no MTU_ACK: %v", err)
+	}
+	if buf[4] != TypeMtuAck {
+		t.Fatalf("type = %#x, want MTU_ACK", buf[4])
+	}
+	if n >= len(probe) {
+		t.Fatalf("MTU_ACK (%d) must be far smaller than the probe (%d)", n, len(probe))
+	}
+	if got := binary.BigEndian.Uint32(buf[HeaderSize:n]); int(got) != len(probe) {
+		t.Fatalf("acked size %d, want %d", got, len(probe))
+	}
+}
+
 func TestDropsReplayBadHmacAndUnknownPrefix(t *testing.T) {
 	mgr, addr := startServer(t)
 	sess, _, err := mgr.New("dev1", "credential-ikm", netip.MustParseAddr("127.0.0.1"))

server/internal/selftest/mtu_linux.go

@@ -0,0 +1,112 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+//go:build linux
+
+package selftest
+
+import (
+	"net"
+	"net/netip"
+	"syscall"
+	"time"
+)
+
+// Linux IP-level constants for PMTU discovery. Not all are exported by the
+// stdlib syscall package across versions, so they are pinned here (stable
+// kernel ABI) — same rationale as the prober's OsAbi.
+const (
+	ipMTUDiscover   = 10 // IP_MTU_DISCOVER
+	ipMTU           = 14 // IP_MTU
+	ipPMTUDiscDo    = 2  // IP_PMTUDISC_DO (set DF, honor PMTU)
+	ipv6MTUDiscover = 23 // IPV6_MTU_DISCOVER
+	ipv6MTU         = 24 // IPV6_MTU
+	ipv6PMTUDiscDo  = 2  // IPV6_PMTUDISC_DO
+)
+
+// probeEgressMTU sends a DF-flagged full-size UDP datagram toward target and
+// reads back the kernel's discovered path MTU. A reduction below 1500 means
+// the SERVER's own uplink can't carry full-size packets — so client MTU
+// results would measure the server, not the client. No root, no raw socket:
+// IP_MTU_DISCOVER + a getsockopt on IP_MTU, mirroring the prober's approach.
+func probeEgressMTU(target string) MTUResult {
+	res := MTUResult{Target: target}
+	addr, err := netip.ParseAddr(target)
+	if err != nil {
+		// allow "host" that resolves
+		ips, e := net.LookupIP(target)
+		if e != nil || len(ips) == 0 {
+			res.Err = "resolve: " + errStr(err)
+			return res
+		}
+		addr, _ = netip.AddrFromSlice(ips[0])
+	}
+	addr = addr.Unmap()
+
+	is4 := addr.Is4()
+	fam := syscall.AF_INET6
+	if is4 {
+		fam = syscall.AF_INET
+	}
+	fd, err := syscall.Socket(fam, syscall.SOCK_DGRAM, 0)
+	if err != nil {
+		res.Err = "socket: " + errStr(err)
+		return res
+	}
+	defer syscall.Close(fd)
+
+	if is4 {
+		_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_IP, ipMTUDiscover, ipPMTUDiscDo)
+	} else {
+		_ = syscall.SetsockoptInt(fd, syscall.IPPROTO_IPV6, ipv6MTUDiscover, ipv6PMTUDiscDo)
+	}
+
+	// IP_MTU reflects the CONNECTED path's MTU, so the socket must be connected
+	// (an unconnected socket returns ENOTCONN). No handshake — UDP connect just
+	// pins the destination and resolves the route.
+	sa := sockaddr(addr, 33434)
+	if err := syscall.Connect(fd, sa); err != nil {
+		res.Err = "connect: " + errStr(err)
+		return res
+	}
+
+	// Full-size probe: 1500 total − IP/UDP headers (28 v4, 48 v6). A DF send
+	// larger than the local MTU fails immediately with EMSGSIZE; a path
+	// reduction updates IP_MTU after the ICMP frag-needed returns, so we send,
+	// briefly wait, and read the discovered MTU.
+	payload := 1472
+	if !is4 {
+		payload = 1452
+	}
+	probe := make([]byte, payload)
+	_, _ = syscall.Write(fd, probe)
+	time.Sleep(700 * time.Millisecond)
+	_, _ = syscall.Write(fd, probe) // second send observes any reduction
+
+	level, opt := syscall.IPPROTO_IP, ipMTU
+	if !is4 {
+		level, opt = syscall.IPPROTO_IPV6, ipv6MTU
+	}
+	mtu, err := syscall.GetsockoptInt(fd, level, opt)
+	if err != nil || mtu <= 0 {
+		res.Err = "getsockopt IP_MTU: " + errStr(err)
+		return res
+	}
+	res.DiscoveredMTU = mtu
+	res.FullMTU = mtu >= 1500
+	return res
+}
+
+func sockaddr(a netip.Addr, port int) syscall.Sockaddr {
+	if a.Is4() {
+		return &syscall.SockaddrInet4{Port: port, Addr: a.As4()}
+	}
+	return &syscall.SockaddrInet6{Port: port, Addr: a.As16()}
+}
+
+func errStr(err error) string {
+	if err == nil {
+		return "nil"
+	}
+	return err.Error()
+}

server/internal/selftest/mtu_other.go

@@ -0,0 +1,13 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+//go:build !linux
+
+package selftest
+
+// probeEgressMTU: PMTUD via IP_MTU_DISCOVER is Linux-specific. Off-Linux the
+// self-test reports MTU as unproven rather than guessing (the daemon runs on
+// Linux in production; this keeps dev builds compiling).
+func probeEgressMTU(target string) MTUResult {
+	return MTUResult{Target: target, Err: "egress MTU probe is Linux-only"}
+}

server/internal/selftest/selftest.go

@@ -0,0 +1,126 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// Package selftest lets the daemon prove its own host is a clean measurement
+// target: the kernel isn't silently altering what clients measure, and the
+// server's own egress reaches full MTU. If the server side is already broken,
+// client-side results (especially MTU/PMTUD) measure the server, not the
+// client — so the daemon says so.
+package selftest
+
+import (
+	"os"
+	"strconv"
+	"strings"
+)
+
+// Severity of a check result.
+type Severity string
+
+const (
+	OK   Severity = "ok"
+	Warn Severity = "warn"
+)
+
+// Check is one sysctl (or derived) assertion.
+type Check struct {
+	Name     string   `json:"name"`
+	Got      string   `json:"got"`
+	Want     string   `json:"want"`
+	Severity Severity `json:"severity"`
+	Why      string   `json:"why"`
+}
+
+// MTUResult is one egress path-MTU probe outcome.
+type MTUResult struct {
+	Target       string `json:"target"`
+	DiscoveredMTU int   `json:"discovered_mtu"`
+	FullMTU      bool   `json:"full_mtu"` // >= 1500
+	Err          string `json:"err,omitempty"`
+}
+
+// Report is the whole self-test.
+type Report struct {
+	Sysctls   []Check     `json:"sysctls"`
+	EgressMTU []MTUResult `json:"egress_mtu"`
+	// SysctlOK / MTUOK are the compact "server proven good" signals; the
+	// profile surfaces these so a client can skip MTU tests the server can't
+	// support honestly.
+	SysctlOK bool `json:"sysctl_ok"`
+	MTUOK    bool `json:"mtu_ok"`
+}
+
+// readSysctl reads /proc/sys/<dotted.name>. Empty string if unavailable.
+func readSysctl(name string) string {
+	p := "/proc/sys/" + strings.ReplaceAll(name, ".", "/")
+	b, err := os.ReadFile(p)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(b))
+}
+
+// sysctlChecks are the measurement-fidelity assertions. Each closure returns
+// OK/Warn given the read value; a missing value (non-Linux / restricted) is
+// reported as Warn "unreadable" but never fatal.
+var sysctlChecks = []struct {
+	name string
+	want string
+	why  string
+	ok   func(v string) bool
+}{
+	{"net.ipv6.conf.all.accept_ra", "0", "static v6 host must not let RAs mutate routing (the very thing Echolot detects)", eq("0")},
+	{"net.ipv4.conf.all.accept_redirects", "0", "ICMP redirects could alter routing mid-measurement", eq("0")},
+	{"net.ipv4.conf.all.send_redirects", "0", "an endpoint should not emit ICMP redirects", eq("0")},
+	{"net.ipv4.icmp_echo_ignore_all", "0", "server must answer ping so clients can measure to it", eq("0")},
+	{"net.ipv4.ip_no_pmtu_disc", "0", "server must honor path MTU on its own sends", eq("0")},
+	{"net.ipv4.tcp_sack", "1", "so a missing SACK in mss_observed is the path's fault, not the server's", eq("1")},
+	{"net.ipv4.tcp_timestamps", "1", "so TCP-timestamp absence reflects the path, not the server", eq("1")},
+	{"net.ipv4.tcp_window_scaling", "1", "so wscale absence reflects the path, not the server", eq("1")},
+	{"net.ipv4.icmp_ratelimit", "0", "nonzero throttles the server's ICMP errors → false loss/black-hole readings", eq("0")},
+}
+
+func eq(want string) func(string) bool { return func(v string) bool { return v == want } }
+
+// Sysctls runs the sysctl audit.
+func Sysctls() []Check {
+	out := make([]Check, 0, len(sysctlChecks))
+	for _, c := range sysctlChecks {
+		got := readSysctl(c.name)
+		sev := Warn
+		switch {
+		case got == "":
+			got = "(unreadable)"
+		case c.ok(got):
+			sev = OK
+		}
+		out = append(out, Check{Name: c.name, Got: got, Want: c.want, Severity: sev, Why: c.why})
+	}
+	return out
+}
+
+// Run performs the full self-test: sysctl audit + egress MTU probes to the
+// given targets (each "host" — port is irrelevant for PMTUD).
+func Run(mtuTargets []string) Report {
+	r := Report{Sysctls: Sysctls()}
+	r.SysctlOK = true
+	for _, c := range r.Sysctls {
+		if c.Severity == Warn {
+			r.SysctlOK = false
+		}
+	}
+	r.MTUOK = true
+	for _, t := range mtuTargets {
+		res := probeEgressMTU(t)
+		r.EgressMTU = append(r.EgressMTU, res)
+		if !res.FullMTU {
+			r.MTUOK = false
+		}
+	}
+	if len(r.EgressMTU) == 0 {
+		r.MTUOK = false // couldn't prove it
+	}
+	return r
+}
+
+var _ = strconv.Atoi

server/internal/tcpecho/ja4.go

@@ -0,0 +1,286 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package tcpecho
+
+import (
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"fmt"
+	"sort"
+	"strings"
+)
+
+// clientHello holds the fields JA4 needs from a parsed TLS ClientHello.
+type clientHello struct {
+	legacyVersion     uint16
+	cipherSuites      []uint16
+	extensions        []uint16 // in wire order
+	hasSNI            bool
+	alpns             []string
+	supportedVersions []uint16
+	sigAlgs           []uint16 // in wire order
+}
+
+// isGREASE reports whether a code point is a GREASE value (RFC 8701): both
+// bytes equal and of the form 0x?a. JA4 excludes these everywhere.
+func isGREASE(v uint16) bool {
+	return v&0x0f0f == 0x0a0a && v>>8 == v&0xff
+}
+
+// parseClientHello parses a full TLS record (starting at the 0x16 record
+// header) and extracts the ClientHello fields. Returns false if the bytes are
+// not a well-formed ClientHello.
+func parseClientHello(rec []byte) (*clientHello, bool) {
+	// Record header: type(1)=0x16, version(2), length(2).
+	if len(rec) < 5 || rec[0] != 0x16 {
+		return nil, false
+	}
+	recLen := int(binary.BigEndian.Uint16(rec[3:5]))
+	if len(rec) < 5+recLen {
+		return nil, false
+	}
+	b := rec[5 : 5+recLen]
+	// Handshake header: msg_type(1)=0x01 ClientHello, length(3).
+	if len(b) < 4 || b[0] != 0x01 {
+		return nil, false
+	}
+	hsLen := int(b[1])<<16 | int(b[2])<<8 | int(b[3])
+	b = b[4:]
+	if len(b) < hsLen {
+		return nil, false
+	}
+	b = b[:hsLen]
+
+	h := &clientHello{}
+	// client_version(2), random(32).
+	if len(b) < 34 {
+		return nil, false
+	}
+	h.legacyVersion = binary.BigEndian.Uint16(b[0:2])
+	b = b[34:]
+	// session_id.
+	if len(b) < 1 || len(b) < 1+int(b[0]) {
+		return nil, false
+	}
+	b = b[1+int(b[0]):]
+	// cipher_suites.
+	if len(b) < 2 {
+		return nil, false
+	}
+	cslen := int(binary.BigEndian.Uint16(b[0:2]))
+	b = b[2:]
+	if len(b) < cslen || cslen%2 != 0 {
+		return nil, false
+	}
+	for i := 0; i < cslen; i += 2 {
+		h.cipherSuites = append(h.cipherSuites, binary.BigEndian.Uint16(b[i:i+2]))
+	}
+	b = b[cslen:]
+	// compression_methods.
+	if len(b) < 1 || len(b) < 1+int(b[0]) {
+		return nil, false
+	}
+	b = b[1+int(b[0]):]
+	// extensions (optional).
+	if len(b) < 2 {
+		return h, true
+	}
+	extTotal := int(binary.BigEndian.Uint16(b[0:2]))
+	b = b[2:]
+	if len(b) < extTotal {
+		return nil, false
+	}
+	ext := b[:extTotal]
+	for len(ext) >= 4 {
+		etype := binary.BigEndian.Uint16(ext[0:2])
+		elen := int(binary.BigEndian.Uint16(ext[2:4]))
+		if len(ext) < 4+elen {
+			break
+		}
+		data := ext[4 : 4+elen]
+		h.extensions = append(h.extensions, etype)
+		switch etype {
+		case 0x0000: // server_name
+			h.hasSNI = true
+		case 0x0010: // ALPN
+			h.alpns = append(h.alpns, parseALPN(data)...)
+		case 0x002b: // supported_versions
+			h.supportedVersions = parseSupportedVersions(data)
+		case 0x000d: // signature_algorithms
+			h.sigAlgs = parseU16List(data)
+		}
+		ext = ext[4+elen:]
+	}
+	return h, true
+}
+
+func parseALPN(d []byte) []string {
+	if len(d) < 2 {
+		return nil
+	}
+	listLen := int(binary.BigEndian.Uint16(d[0:2]))
+	d = d[2:]
+	if len(d) < listLen {
+		return nil
+	}
+	var out []string
+	for len(d) >= 1 {
+		n := int(d[0])
+		if len(d) < 1+n {
+			break
+		}
+		out = append(out, string(d[1:1+n]))
+		d = d[1+n:]
+	}
+	return out
+}
+
+func parseSupportedVersions(d []byte) []uint16 {
+	if len(d) < 1 {
+		return nil
+	}
+	n := int(d[0])
+	d = d[1:]
+	if len(d) < n || n%2 != 0 {
+		return nil
+	}
+	var out []uint16
+	for i := 0; i < n; i += 2 {
+		out = append(out, binary.BigEndian.Uint16(d[i:i+2]))
+	}
+	return out
+}
+
+// parseU16List parses a 2-byte-length-prefixed list of u16 values (used for
+// signature_algorithms).
+func parseU16List(d []byte) []uint16 {
+	if len(d) < 2 {
+		return nil
+	}
+	n := int(binary.BigEndian.Uint16(d[0:2]))
+	d = d[2:]
+	if len(d) < n || n%2 != 0 {
+		return nil
+	}
+	var out []uint16
+	for i := 0; i < n; i += 2 {
+		out = append(out, binary.BigEndian.Uint16(d[i:i+2]))
+	}
+	return out
+}
+
+// ja4 computes the JA4 TLS client fingerprint (FoxIO spec) from a parsed
+// ClientHello: a_b_c where a is a human-readable prefix, b hashes the sorted
+// cipher list, c hashes the sorted extensions + signature algorithms.
+func ja4(h *clientHello) string {
+	// --- a ---
+	ver := ja4Version(h)
+	sni := "i"
+	if h.hasSNI {
+		sni = "d"
+	}
+	nCiphers := countNonGREASE(h.cipherSuites)
+	nExts := countNonGREASE(h.extensions) // count includes SNI + ALPN
+	alpn := "00"
+	if len(h.alpns) > 0 && h.alpns[0] != "" {
+		a := h.alpns[0]
+		alpn = string(a[0]) + string(a[len(a)-1])
+	}
+	a := fmt.Sprintf("t%s%s%02d%02d%s", ver, sni, capAt99(nCiphers), capAt99(nExts), alpn)
+
+	// --- b: sorted non-GREASE cipher suites, lowercase hex, comma-joined ---
+	b := hash12(strings.Join(sortedHex(nonGREASE(h.cipherSuites)), ","))
+
+	// --- c: sorted non-GREASE extensions (minus SNI 0000 and ALPN 0010),
+	// then "_", then signature algorithms IN ORDER (non-GREASE) ---
+	extsForC := filterOut(nonGREASE(h.extensions), 0x0000, 0x0010)
+	cInput := strings.Join(sortedHex(extsForC), ",") + "_" + strings.Join(hexList(nonGREASE(h.sigAlgs)), ",")
+	c := hash12(cInput)
+
+	return a + "_" + b + "_" + c
+}
+
+// ja4Version picks the highest offered version (supported_versions if present,
+// else the legacy field) mapped to JA4's two-char code.
+func ja4Version(h *clientHello) string {
+	best := h.legacyVersion
+	for _, v := range h.supportedVersions {
+		if isGREASE(v) {
+			continue
+		}
+		if v > best {
+			best = v
+		}
+	}
+	switch best {
+	case 0x0304:
+		return "13"
+	case 0x0303:
+		return "12"
+	case 0x0302:
+		return "11"
+	case 0x0301:
+		return "10"
+	case 0x0300:
+		return "s3"
+	}
+	return "00"
+}
+
+func nonGREASE(in []uint16) []uint16 {
+	out := make([]uint16, 0, len(in))
+	for _, v := range in {
+		if !isGREASE(v) {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+func countNonGREASE(in []uint16) int { return len(nonGREASE(in)) }
+
+func filterOut(in []uint16, drop ...uint16) []uint16 {
+	out := make([]uint16, 0, len(in))
+	for _, v := range in {
+		skip := false
+		for _, d := range drop {
+			if v == d {
+				skip = true
+			}
+		}
+		if !skip {
+			out = append(out, v)
+		}
+	}
+	return out
+}
+
+func sortedHex(in []uint16) []string {
+	cp := append([]uint16(nil), in...)
+	sort.Slice(cp, func(i, j int) bool { return cp[i] < cp[j] })
+	return hexList(cp)
+}
+
+func hexList(in []uint16) []string {
+	out := make([]string, len(in))
+	for i, v := range in {
+		var b [2]byte
+		binary.BigEndian.PutUint16(b[:], v)
+		out[i] = hex.EncodeToString(b[:])
+	}
+	return out
+}
+
+func hash12(s string) string {
+	sum := sha256.Sum256([]byte(s))
+	return hex.EncodeToString(sum[:])[:12]
+}
+
+func capAt99(n int) int {
+	if n > 99 {
+		return 99
+	}
+	return n
+}

server/internal/tcpecho/ja4_test.go

@@ -0,0 +1,111 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package tcpecho
+
+import (
+	"encoding/binary"
+	"strings"
+	"testing"
+)
+
+// buildClientHello assembles a minimal but valid TLS ClientHello record for
+// tests: TLS1.2 legacy version, the given ciphers, and extensions SNI, ALPN
+// (h2), supported_versions (1.3), signature_algorithms (0x0403).
+func buildClientHello(ciphers []uint16) []byte {
+	u16 := func(v uint16) []byte { b := make([]byte, 2); binary.BigEndian.PutUint16(b, v); return b }
+
+	var body []byte
+	body = append(body, u16(0x0303)...)      // client_version TLS1.2
+	body = append(body, make([]byte, 32)...) // random
+	body = append(body, 0)                    // session_id len 0
+	// cipher suites
+	cs := []byte{}
+	for _, c := range ciphers {
+		cs = append(cs, u16(c)...)
+	}
+	body = append(body, u16(uint16(len(cs)))...)
+	body = append(body, cs...)
+	body = append(body, 1, 0) // compression: 1 method, null
+
+	// extensions
+	var exts []byte
+	addExt := func(typ uint16, data []byte) {
+		exts = append(exts, u16(typ)...)
+		exts = append(exts, u16(uint16(len(data)))...)
+		exts = append(exts, data...)
+	}
+	// SNI: server_name_list -> host_name "x"
+	sni := append(u16(3), 0)      // list len 3, name_type host_name(0)
+	sni = append(sni, u16(1)...)  // name len 1
+	sni = append(sni, 'x')
+	addExt(0x0000, sni)
+	// ALPN: protocol_name_list -> "h2"
+	alpn := append(u16(3), 2, 'h', '2') // list len 3, strlen 2, "h2"
+	addExt(0x0010, alpn)
+	// supported_versions: list len 2, 0x0304
+	addExt(0x002b, append([]byte{2}, u16(0x0304)...))
+	// signature_algorithms: list len 2, 0x0403
+	addExt(0x000d, append(u16(2), u16(0x0403)...))
+
+	body = append(body, u16(uint16(len(exts)))...)
+	body = append(body, exts...)
+
+	// handshake header
+	hs := []byte{0x01, byte(len(body) >> 16), byte(len(body) >> 8), byte(len(body))}
+	hs = append(hs, body...)
+	// record header
+	rec := []byte{0x16, 0x03, 0x01, byte(len(hs) >> 8), byte(len(hs))}
+	return append(rec, hs...)
+}
+
+func TestParseAndJA4(t *testing.T) {
+	rec := buildClientHello([]uint16{0x1301, 0x1302})
+	h, ok := parseClientHello(rec)
+	if !ok {
+		t.Fatal("parse failed")
+	}
+	if len(h.cipherSuites) != 2 || !h.hasSNI || len(h.alpns) != 1 || h.alpns[0] != "h2" {
+		t.Fatalf("parsed fields wrong: %+v", h)
+	}
+	if len(h.supportedVersions) != 1 || h.supportedVersions[0] != 0x0304 {
+		t.Fatalf("supported_versions: %v", h.supportedVersions)
+	}
+
+	got := ja4(h)
+	// _a: t + 13 (supported_versions 1.3) + d (SNI) + 02 ciphers + 04 exts + h2
+	wantA := "t13d0204h2"
+	parts := strings.Split(got, "_")
+	if len(parts) != 3 {
+		t.Fatalf("JA4 not 3 parts: %s", got)
+	}
+	if parts[0] != wantA {
+		t.Fatalf("JA4_a = %s, want %s (full %s)", parts[0], wantA, got)
+	}
+	if len(parts[1]) != 12 || len(parts[2]) != 12 {
+		t.Fatalf("JA4 hash parts not 12 hex: %s", got)
+	}
+	// determinism
+	if ja4(h) != got {
+		t.Fatal("JA4 not deterministic")
+	}
+}
+
+func TestJA4GREASEExcluded(t *testing.T) {
+	// Same hello but with a GREASE cipher inserted; cipher count and _b hash
+	// must be identical to the non-GREASE version.
+	base := ja4(mustParse(t, buildClientHello([]uint16{0x1301, 0x1302})))
+	withGrease := ja4(mustParse(t, buildClientHello([]uint16{0x0a0a, 0x1301, 0x1302})))
+	if base != withGrease {
+		t.Fatalf("GREASE changed JA4:\n base=%s\n grease=%s", base, withGrease)
+	}
+}
+
+func mustParse(t *testing.T, rec []byte) *clientHello {
+	t.Helper()
+	h, ok := parseClientHello(rec)
+	if !ok {
+		t.Fatal("parse failed")
+	}
+	return h
+}

server/internal/tcpecho/tcpecho.go

@@ -1,16 +1,17 @@
 // SPDX-FileCopyrightText: 2026 Echolot contributors
 // SPDX-License-Identifier: GPL-3.0-or-later
 
-// Package tcpecho implements the spec §4 TCP echo: after connect the server
+// Package tcpecho implements spec §4 TCP echo and its TLS variant on the same
-// sends one JSON line with what it observed (source address/port, negotiated
+// port. Plain connections get a JSON greeting (observed source, negotiated
-// MSS and TCP options from TCP_INFO), then byte-echoes until FIN. This is the
+// MSS and TCP options from TCP_INFO — the mtu.mss_observed evidence) then a
-// evidence source for mtu.mss_observed.
+// byte echo. A connection that opens with a TLS handshake (first byte 0x16)
-//
+// and ALPN "elt-echo" gets, additionally, the ClientHello it sent back raw +
-// The TLS/ALPN "elt-echo" variant (ClientHello capture + JA4) is not
+// as a JA4 fingerprint (sec.clienthello_echo) before the echo.
-// implemented yet.
 package tcpecho
 
 import (
+	"crypto/tls"
+	"encoding/base64"
 	"encoding/json"
 	"io"
 	"net"
@@ -24,9 +25,16 @@ type ConnRecord struct {
 	Src         string    `json:"src"`
 	MSS         int       `json:"mss"`
 	Options     []string  `json:"options"`
+	TLS         bool      `json:"tls"`
+	JA4         string    `json:"ja4,omitempty"`
+	ALPN        string    `json:"alpn,omitempty"`
 }
 
 type Server struct {
+	// TLSConfig enables the elt-echo TLS variant; nil disables it (plain echo
+	// only). "elt-echo" is appended to NextProtos at Serve time.
+	TLSConfig *tls.Config
+
 	mu     sync.Mutex
 	recent []ConnRecord // ring, newest last
 }
@@ -65,27 +73,120 @@ func (s *Server) Serve(ln net.Listener) error {
 	}
 }
 
+// prefixConn replays already-read bytes before continuing with the underlying
+// connection — used to hand the peeked ClientHello record to tls.Server.
+type prefixConn struct {
+	net.Conn
+	prefix []byte
+}
+
+func (p *prefixConn) Read(b []byte) (int, error) {
+	if len(p.prefix) > 0 {
+		n := copy(b, p.prefix)
+		p.prefix = p.prefix[n:]
+		return n, nil
+	}
+	return p.Conn.Read(b)
+}
+
 func (s *Server) handle(conn net.Conn) {
 	defer conn.Close()
 	_ = conn.SetDeadline(time.Now().Add(5 * time.Minute))
 
-	info := tcpInfo(conn) // platform-specific; zero values off-Linux
+	// TCP_INFO must be read from the raw *net.TCPConn, before any wrapping.
+	info := tcpInfo(conn)
 	rec := ConnRecord{
 		ConnectedAt: time.Now().UTC(),
 		Src:         conn.RemoteAddr().String(),
 		MSS:         info.MSS,
 		Options:     info.Options,
 	}
+
+	// Multiplex TLS vs plain on one port. Plain echo is server-speaks-first
+	// (the client waits for the greeting), while a TLS client sends its
+	// ClientHello immediately — so peek the first byte with a short deadline:
+	// a byte that arrives fast and is 0x16 means TLS; a timeout means a plain
+	// client waiting to be greeted.
+	// 500ms tolerates ~1s RTT (incl. satellite) before a TLS ClientHello would
+	// be misread as a silent plain client; plain clients simply wait this long
+	// for the greeting they're already waiting for.
+	first := make([]byte, 1)
+	_ = conn.SetReadDeadline(time.Now().Add(500 * time.Millisecond))
+	n, err := io.ReadFull(conn, first)
+	_ = conn.SetDeadline(time.Now().Add(5 * time.Minute)) // reset for the session
+	switch {
+	case err == nil && first[0] == 0x16 && s.TLSConfig != nil:
+		s.handleTLS(conn, first, rec)
+		return
+	case err == nil:
+		s.plainEcho(conn, first, rec) // client spoke first (rare) — replay it
+		return
+	case n == 0 && isTimeout(err):
+		s.plainEcho(conn, nil, rec) // client waiting for greeting — normal path
+		return
+	default:
+		return // EOF or a real error
+	}
+}
+
+func (s *Server) plainEcho(conn net.Conn, peeked []byte, rec ConnRecord) {
+	pc := &prefixConn{Conn: conn, prefix: peeked}
+	s.record(rec)
+	greeting, _ := json.Marshal(map[string]any{
+		"observed_src": rec.Src, "mss": rec.MSS, "options": rec.Options, "tls": false,
+	})
+	if _, err := pc.Write(append(greeting, '\n')); err != nil {
+		return
+	}
+	_, _ = io.Copy(pc, pc)
+}
+
+func isTimeout(err error) bool {
+	ne, ok := err.(net.Error)
+	return ok && ne.Timeout()
+}
+
+// handleTLS captures the full ClientHello record, computes JA4, completes the
+// handshake, then greets with the ClientHello (raw + JA4) and echoes over TLS.
+func (s *Server) handleTLS(conn net.Conn, first []byte, rec ConnRecord) {
+	// Read the rest of the record header (version[2], length[2]) and the body.
+	hdr := make([]byte, 4)
+	if _, err := io.ReadFull(conn, hdr); err != nil {
+		return
+	}
+	recLen := int(hdr[2])<<8 | int(hdr[3])
+	body := make([]byte, recLen)
+	if _, err := io.ReadFull(conn, body); err != nil {
+		return
+	}
+	full := append(append(append([]byte{}, first...), hdr...), body...)
+
+	rec.TLS = true
+	if h, ok := parseClientHello(full); ok {
+		rec.JA4 = ja4(h)
+	}
+
+	// Replay the captured ClientHello into the TLS server.
+	cfg := s.TLSConfig.Clone()
+	cfg.NextProtos = append([]string{"elt-echo"}, cfg.NextProtos...)
+	tconn := tls.Server(&prefixConn{Conn: conn, prefix: full}, cfg)
+	if err := tconn.Handshake(); err != nil {
+		return
+	}
+	rec.ALPN = tconn.ConnectionState().NegotiatedProtocol
 	s.record(rec)
 
 	greeting, _ := json.Marshal(map[string]any{
 		"observed_src":    rec.Src,
 		"mss":             rec.MSS,
 		"options":         rec.Options,
+		"tls":             true,
+		"alpn":            rec.ALPN,
+		"ja4":             rec.JA4,
+		"clienthello_b64": base64.StdEncoding.EncodeToString(full),
 	})
-	if _, err := conn.Write(append(greeting, '\n')); err != nil {
+	if _, err := tconn.Write(append(greeting, '\n')); err != nil {
 		return
 	}
-	// Byte-echo until FIN; the client's data is its own to interpret.
+	_, _ = io.Copy(tconn, tconn)
-	_, _ = io.Copy(conn, conn)
 }

server/internal/tcpecho/tcpecho_test.go

@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package tcpecho
+
+import (
+	"bufio"
+	"encoding/json"
+	"net"
+	"testing"
+	"time"
+)
+
+// Plain echo must be server-speaks-first: a client that sends nothing still
+// gets the greeting (via the peek timeout), then its bytes are echoed.
+func TestPlainEchoServerSpeaksFirst(t *testing.T) {
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ln.Close()
+	go (&Server{}).Serve(ln)
+
+	c, err := net.Dial("tcp", ln.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer c.Close()
+	c.SetDeadline(time.Now().Add(3 * time.Second))
+
+	line, err := bufio.NewReader(c).ReadBytes('\n')
+	if err != nil {
+		t.Fatalf("no greeting: %v", err)
+	}
+	var g struct {
+		TLS bool `json:"tls"`
+		Src string `json:"observed_src"`
+	}
+	if err := json.Unmarshal(line, &g); err != nil {
+		t.Fatal(err)
+	}
+	if g.TLS {
+		t.Fatal("plain connection reported tls=true")
+	}
+	if g.Src == "" {
+		t.Fatal("greeting missing observed_src")
+	}
+	c.Write([]byte("xyz"))
+	buf := make([]byte, 3)
+	if _, err := c.Read(buf); err != nil || string(buf) != "xyz" {
+		t.Fatalf("echo failed: %q %v", buf, err)
+	}
+}