mrambossekandClaude Opus 5 38fb73c34e server: HTTP echo + TLS reference (control-plane security measurements) ...

- POST /v1/echo: returns the received request head + body (base64) and the
  observed TLS parameters (version, cipher, SNI, ALPN, resumed). The client
  diffs against what it sent to detect header injection/stripping,
  transparent proxying, or TLS interception (sec.http_echo). http-echo
  added to the capability set.
- GET /v1/tls-reference: the served leaf-first DER chain + pin, so the app
  can compare an out-of-band copy against its own handshake (sec.tls_reference).
  Always available, no auth — public handshake info.
- Optional CLEARTEXT http-echo listener (ECHOLOT_HTTP_ECHO_LISTEN, default
  off) exposing only /v1/echo for the plaintext-path tampering test.

Live-smoke-tested (HTTPS echo reflected an injected header + observed
TLS1.3; cleartext variant reports tls:none); httptest unit tests added.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-07-31 20:34:03 +02:00

..

control.go

server: HTTP echo + TLS reference (control-plane security measurements)

2026-07-31 20:34:03 +02:00

httpecho_test.go

server: HTTP echo + TLS reference (control-plane security measurements)

2026-07-31 20:34:03 +02:00

httpecho.go

server: HTTP echo + TLS reference (control-plane security measurements)

2026-07-31 20:34:03 +02:00