REALITY.5 follow-up cleanups (MessageTooLarge/u24_len, pre-write signing-key, partial-record splice, group-29 test) - #88

Merged

vxfemboy merged 27 commits into

mainfrom

feat/reality-5-followup-cleanups

Jul 19, 2026

Commits on Jul 17, 2026

docs(reality.5b): design spec — byte-matching ServerHello emission + server key schedule (4588+X25519)
vxfemboy
committed
docs(reality.5b): implementation plan (3 tasks, subagent-driven)
vxfemboy
committed
feat(reality.5b): server_key_share — server-side KEX (ML-KEM Encapsulate + X25519, 4588/29)
vxfemboy
committed

Commits on Jul 18, 2026

feat(reality.5b): emit_server_hello — byte-matching ServerHello + server key schedule (round-trip proven)
vxfemboy
committed
fix(yip-utls): guard ServerHello body against u24 ceiling not u32::MAX (5b review)
vxfemboy
committed
feat(reality.5b): extract client ML-KEM ek from ClientHello (for group-4588 server KEX)
vxfemboy
committed
test(reality.5b): distinct x25519 in 0x001d vs 4588 tail proves non-conflated sourcing (5b review)
vxfemboy
committed
docs(reality.5c): design spec — encrypted server-flight emission + server-side stream
vxfemboy
committed
docs(reality.5c): drop suite arg from sign_certificate_verify (review)
vxfemboy
committed
docs(reality.5c): implementation plan (6 tasks, subagent-driven)
vxfemboy
committed
feat(reality.5c): expose server_hs_traffic on HandshakeKeys (server Finished base secret)
vxfemboy
committed
feat(reality.5c): record_seal_padded (TLS record padding); record_seal delegates
vxfemboy
committed
feat(reality.5c): sign_certificate_verify — signing mirror of the 4b verifier
vxfemboy
committed
feat(reality.5c): emit_server_flight — assemble+seal+frame the encrypted flight to record_lengths
vxfemboy
committed
refactor(reality.5c): role-agnostic RealityStream (egress/ingress) + client/server constructors
vxfemboy
committed
feat(reality.5c): serve — server flight + drain + stream; verify round-trip suite runs through 5c
vxfemboy
committed
fix(reality.5c): frame flight so Finished lands in the last record (client reads all records)
vxfemboy
committed
docs(reality.5d): design spec — wire hand-rolled server flight into the relay
vxfemboy
committed
docs(reality.5d): implementation plan (4 tasks, subagent-driven)
vxfemboy
committed
feat(reality.5d): extract group-4588 x25519 tail from ClientHello (for server-side hybrid DH)
vxfemboy
committed
refactor(reality.5d): genericize handle_connection pump over AsyncRead+AsyncWrite (accept RealityStream)
vxfemboy
committed
feat(reality.5d): serve hand-rolled 5b+5c flight on the authed path; drop BoringSSL forged acceptors
vxfemboy
committed
test(reality.5d): netns money test — verify=on client tunnels through the hand-rolled relay
vxfemboy
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

REALITY.5 follow-up cleanups (MessageTooLarge/u24_len, pre-write signing-key, partial-record splice, group-29 test) - #88

REALITY.5 follow-up cleanups (MessageTooLarge/u24_len, pre-write signing-key, partial-record splice, group-29 test)#88
vxfemboy merged 27 commits into
mainfrom
feat/reality-5-followup-cleanups

Commits on Jul 17, 2026

docs(reality.5b): design spec — byte-matching ServerHello emission + server key schedule (4588+X25519)

docs(reality.5b): implementation plan (3 tasks, subagent-driven)

feat(reality.5b): server_key_share — server-side KEX (ML-KEM Encapsulate + X25519, 4588/29)

Commits on Jul 18, 2026

feat(reality.5b): emit_server_hello — byte-matching ServerHello + server key schedule (round-trip proven)

fix(yip-utls): guard ServerHello body against u24 ceiling not u32::MAX (5b review)

feat(reality.5b): extract client ML-KEM ek from ClientHello (for group-4588 server KEX)

test(reality.5b): distinct x25519 in 0x001d vs 4588 tail proves non-conflated sourcing (5b review)

docs(reality.5c): design spec — encrypted server-flight emission + server-side stream

docs(reality.5c): drop suite arg from sign_certificate_verify (review)

docs(reality.5c): implementation plan (6 tasks, subagent-driven)

feat(reality.5c): expose server_hs_traffic on HandshakeKeys (server Finished base secret)

feat(reality.5c): record_seal_padded (TLS record padding); record_seal delegates

feat(reality.5c): sign_certificate_verify — signing mirror of the 4b verifier

feat(reality.5c): emit_server_flight — assemble+seal+frame the encrypted flight to record_lengths

refactor(reality.5c): role-agnostic RealityStream (egress/ingress) + client/server constructors

feat(reality.5c): serve — server flight + drain + stream; verify round-trip suite runs through 5c

fix(reality.5c): frame flight so Finished lands in the last record (client reads all records)

docs(reality.5d): design spec — wire hand-rolled server flight into the relay

docs(reality.5d): implementation plan (4 tasks, subagent-driven)

feat(reality.5d): extract group-4588 x25519 tail from ClientHello (for server-side hybrid DH)

refactor(reality.5d): genericize handle_connection pump over AsyncRead+AsyncWrite (accept RealityStream)

feat(reality.5d): serve hand-rolled 5b+5c flight on the authed path; drop BoringSSL forged acceptors

test(reality.5d): netns money test — verify=on client tunnels through the hand-rolled relay

Commits on Jul 19, 2026

refactor(yip-utls): Error::MessageTooLarge + u24_len helper (5c follow-up)

fix(yip-rendezvous): hoist CertVerify signing-key load pre-write; splice partial-record stalls (5d follow-ups)

test(reality.5d): group-29 dest authed e2e test; drop stale log-dump in netns wrong-pbk branch (follow-ups)

style(reality.5): rustfmt the follow-up cleanups (build-test fix)