REALITY.5d: serve the hand-rolled flight on the relay's authed path (last of REALITY.5)

[vxfemboy]

REALITY.5d — wire the hand-rolled server flight into the relay

Stacked on #86 (REALITY.5c). Base is feat/reality-5c-server-flight-emit; review the 5d delta here, merge after #86. PR 4 of 4 — the LAST of REALITY.5 (#76), and the last anti-DPI item.

The relay's authed REALITY path now serves the dest-faithful hand-rolled flight it can build (5b ServerHello + 5c encrypted flight), replacing the BoringSSL SslAcceptor. After this, an authed connection to the relay is byte/length-indistinguishable from a genuine Chrome↔dest TLS 1.3 session end to end — closing the passive-DPI gap REALITY.3 explicitly left open for the authed path.

What's here (all yip-rendezvous)

• Parser — ClientHelloInfo.key_share_mlkem_x25519: the x25519 bundled in the client's group-4588 key_share entry (mlkem_ek(1184) ‖ x25519(32)), fail-closed. The authed path keys the 4588 hybrid DH against this (and the standalone 0x001d share for group 29) — correct-by-construction, not relying on the client reusing one ephemeral.
• Genericized pump — handle_connection + read_and_classify + into_decoy + run_tunnel now flow any AsyncRead+AsyncWrite+Unpin+Send stream, so a yip_utls::RealityStream runs through the same relay logic as an SslStream (the non-REALITY relay-Trojan path is unchanged).
• The authed-path rewrite (run_reality_conn's Decision::Accept): look up the captured template + fields for the SNI → forge the leaf (forge_leaf, SPKI = derive_cert_key(shared), natural size) → emit_server_hello (5b) and write it → serve the 5c flight under HANDSHAKE_TIMEOUT → pump the tunnel. The dead build_forged_acceptor* / CacheEntry.acceptor / RealityCertCache.key are removed.

The splice-vs-drop fail-safe boundary

Splicing forwards a pristine connection to the real dest (a prober sees a genuine site) — but only works before we've written our own bytes. So: every failure before the ServerHello write (no template, unsupported group, missing client share, forge/emit error, OS-rng failure) → splice; every failure after (serve error/timeout/IO) → drop (the client's 4b fallback covers it). The final review traced every early-return and confirmed the boundary holds in both directions.

Design decisions

• Natural forged leaf, no exact-length padding (your call): the passive DPI can't see the Certificate message size (it's inside the AEAD); a real dest's leaf carries SCTs that forge_leaf drops, so a forged flight is reliably smaller than dest's and fits the captured record budget. FlightTooLarge → splice is the fail-safe if it ever doesn't.
• OS-CSPRNG rng for the ServerHello (never seeded); serve bounded by HANDSHAKE_TIMEOUT (its CCS-drain is otherwise unbounded); anti-replay unchanged, runs before the branch.

The gate — a live end-to-end money test

bin/yipd/tests/run-netns-reality-5d.sh (ran under sudo, PASS): a real yipd client dialing reality://…&verify=on tunnels A→B through the relay whose authed path hand-rolls the flight — relay-forwarded=2106 packets (that counter is reachable only via the authed tunnel path, so >0 proves the 5b+5c+5d handshake completed and the 4b binding verified). A wrong-key client fails closed (0 packets, no retry-storm). The dest is a local openssl s_server -tls1_3 (hermetic). Wired into CI.

Scope / non-goals

• No client changes (4a/4b shipped), no anti-replay changes, no 5b/5c construction changes, no P256/P384+HRR (REALITY: P256/P384 server-side KEX + HelloRetryRequest support (evaluate whether it's worth it) #84 — such a group → splice), no dropping the boring dep (the relay-Trojan front + extract_fields still use it). yip_utls is untouched.

Follow-ups (non-blocking, from the final review)

• Hoist the CertVerify signing-key load above the ServerHello write (keeps all fallible steps on the splice side — its failure is currently unreachable).
• A group-29-dest test (the 4588 path is netns-covered; group-29 is functionally sound but untested).
• Exact-leaf-length padding (deferred by design) + the 5c cleanups (Error::MessageTooLarge, u24-helper extraction).

Final whole-branch review (opus): READY WITH FOLLOW-UPS — splice-vs-drop correct in both directions, no fail-open / no panic-on-input / no dangling reference, yip_utls untouched, forbid-unsafe / no as / no bare #[allow].

With this, REALITY.5 (5a/5b/5c/5d) is complete — the authed REALITY path is end-to-end dest-faithful.