REALITY.5 follow-up cleanups (MessageTooLarge/u24_len, pre-write signing-key, partial-record splice, group-29 test)

.github/workflows/integration.yml

@@ -434,3 +434,34 @@ jobs:
             echo "::error::two UDP-blocked peers failed to tunnel via the REALITY relay under verify=on (ping failed, relay-forwarded stayed 0, a wrong pbk/relay key was wrongly accepted, or the client retry-stormed on a verify failure) — REALITY.4a/4b relay-dial regression"
             exit 1
           fi
+
+      - name: Run the REALITY.5d hand-rolled-flight verify=on money test under sudo
+        # REALITY.5d's headline money test: same topology and assertions as
+        # the 4a/4b relay-over-REALITY test above (verify=on tunnel;
+        # wrong-pbk fail-closed), but proving the relay's AUTHED path now
+        # hand-rolls the entire server flight (`tls_front::run_reality_conn`
+        # `Decision::Accept` — REALITY.5b `emit_server_hello` + REALITY.5c
+        # `emit_server_flight`/`serve`) instead of driving a BoringSSL
+        # `SslAcceptor`. A passing verify=on ping here proves the hand-rolled
+        # flight completed AND the client's REALITY.4b binding check
+        # verified against the relay's forged leaf; the wrong-pbk variant
+        # proves the relay still splices to `--reality-dest`
+        # pre-ServerHello-write (never entering the hand-rolled emit path)
+        # when the seal fails to open. See run-netns-reality-5d.sh for the
+        # full topology and assertion set. Same binary requirements as the
+        # 4a/4b test above (release yipd, debug yip-rendezvous-bin).
+        run: |
+          sudo bash bin/yipd/tests/run-netns-reality-5d.sh \
+            "$(pwd)/target/release/yipd" \
+            "$(pwd)/target/debug/yip-rendezvous" | tee /tmp/relay-reality-5d-money-test.log
+          # Honesty guard, same reasoning as the oracles above: this job
+          # always runs as sudo and always builds both binaries, so a SKIP
+          # here means the harness itself is broken.
+          if grep -q "^SKIP run-netns-reality-5d" /tmp/relay-reality-5d-money-test.log; then
+            echo "::error::REALITY.5d money test skipped — expected root + built yipd/yip-rendezvous binaries in this job"
+            exit 1
+          fi
+          if grep -q "\[FAIL\]" /tmp/relay-reality-5d-money-test.log; then
+            echo "::error::verify=on client failed to tunnel via the REALITY relay's hand-rolled 5b+5c authed flight (ping failed, relay-forwarded stayed 0, or a wrong pbk was wrongly accepted) — REALITY.5d wiring regression"
+            exit 1
+          fi

bin/yip-rendezvous/Cargo.toml

@@ -40,14 +40,13 @@ time = { version = "0.3", default-features = false, features = ["parsing", "macr
 # DER parsing, not the validate/verify/ring/aws-lc-rs signature-checking
 # features (this crate never chain-validates the forged/stolen certs).
 x509-parser = { version = "0.18.1", default-features = false }
-
-[dev-dependencies]
-# REALITY.4b Task 3 test-only: parses the SPKI DER `boring` hands back for a
-# presented leaf's public key, to compare it (as a SEC1 point) against
-# `yip_utls::auth::derive_cert_key`'s `public_sec1` — the leaf-pubkey-match
-# gate for `build_forged_acceptor_with_pkcs8`. Same version yip-utls already
-# depends on for the identical derivation; dev-only here so it adds no
-# footprint to the shipped binary.
+# REALITY.5d: loads the REALITY.4b shared-secret-derived ECDSA-P256 signing
+# key (`yip_utls::auth::derive_cert_key`'s PKCS#8 DER) on the authed
+# connection path (`tls_front::run_reality_conn`'s `Decision::Accept` branch)
+# to sign the hand-rolled `CertificateVerify`. Promoted from dev-dependency
+# (REALITY.4b Task 3 test-only use) now that it is also a production
+# dependency; same version yip-utls already depends on for the identical
+# derivation.
 p256 = { version = "0.13", features = ["ecdsa", "pkcs8"] }
 
 [lints]

bin/yip-rendezvous/src/conn.rs

@@ -79,9 +79,9 @@ const CLASSIFY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(3);
 /// anything else (a censor probe, a browser, garbage, silence) is
 /// transparently reverse-proxied to the decoy backend, so the relay looks
 /// like an ordinary web server to everyone but a real yip client.
-pub async fn handle_connection<S>(mut stream: tokio_boring::SslStream<S>, cfg: Arc<TlsFrontCfg>)
+pub async fn handle_connection<St>(mut stream: St, cfg: Arc<TlsFrontCfg>)
 where
-    S: AsyncRead + AsyncWrite + Unpin + Send,
+    St: AsyncRead + AsyncWrite + Unpin + Send,
 {
     let now_ms = u64::try_from(cfg.base.elapsed().as_millis()).unwrap_or(u64::MAX);
     // The relay is blind to the real TCP peer identity, and the TLS-only
@@ -143,14 +143,14 @@ where
 /// Read the first frame (up to CLASSIFY_TIMEOUT) and classify it. Returns
 /// `None` on idle-timeout/read-error (caller treats as decoy). All bytes read
 /// are accumulated in `buf` so they can be replayed to the decoy.
-async fn read_and_classify<S>(
-    stream: &mut tokio_boring::SslStream<S>,
+async fn read_and_classify<St>(
+    stream: &mut St,
     cfg: &TlsFrontCfg,
     buf: &mut Vec<u8>,
     now_ms: u64,
 ) -> Option<Classify>
 where
-    S: AsyncRead + AsyncWrite + Unpin + Send,
+    St: AsyncRead + AsyncWrite + Unpin + Send,
 {
     let deadline = tokio::time::sleep(CLASSIFY_TIMEOUT);
     tokio::pin!(deadline);
@@ -180,9 +180,9 @@ where
 
 /// Proxy this connection to the decoy backend: replay the buffered bytes, then
 /// splice bidirectionally. The decoy's own behavior/timing governs from here.
-async fn into_decoy<S>(mut stream: tokio_boring::SslStream<S>, cfg: &TlsFrontCfg, buffered: Vec<u8>)
+async fn into_decoy<St>(mut stream: St, cfg: &TlsFrontCfg, buffered: Vec<u8>)
 where
-    S: AsyncRead + AsyncWrite + Unpin + Send,
+    St: AsyncRead + AsyncWrite + Unpin + Send,
 {
     let Some(decoy_addr) = cfg.decoy else {
         // No decoy configured: minimal static fallback (documented weaker

bin/yip-rendezvous/src/conn_tunnel.rs

@@ -19,13 +19,9 @@ const CHANNEL_DEPTH: usize = 64;
 /// malformed frame is seen (fail-closed teardown). `prefix` carries any bytes
 /// already read past the first (Register) frame during classification — a
 /// pipelined second frame in the same TLS read must not be lost.
-pub async fn run_tunnel<S>(
-    mut stream: tokio_boring::SslStream<S>,
-    cfg: Arc<TlsFrontCfg>,
-    node: NodeId,
-    prefix: Vec<u8>,
-) where
-    S: AsyncRead + AsyncWrite + Unpin + Send,
+pub async fn run_tunnel<St>(mut stream: St, cfg: Arc<TlsFrontCfg>, node: NodeId, prefix: Vec<u8>)
+where
+    St: AsyncRead + AsyncWrite + Unpin + Send,
 {
     let (tx, mut rx) = mpsc::channel::<Vec<u8>>(CHANNEL_DEPTH);
     // Keep an identity handle so the exit-time removal below can tell