fix(irtt): treat blank HMAC keys as unauthenticated

README.md

@@ -76,3 +76,4 @@ config reflector
 Use `list files '/path/to/reflectors.csv'` instead of `option files 'none'` to
 combine CSV files with inline reflectors. Omitting `files` keeps the default CSV;
 UCI discards empty string options, so `option files ''` does not disable it.
+Absent or blank `irtt_hmac` values use unauthenticated IRTT sessions.

src/measurement/irtt.rs

@@ -119,7 +119,7 @@ impl IrttEngine {
                     TargetId::new(binding.stream.id.0.to_string()),
                     SocketAddr::new(binding.stream.peer, binding.port).to_string(),
                 );
-                if let Some(key) = &binding.hmac {
+                if let Some(key) = binding.hmac.as_ref().filter(|key| !key.trim().is_empty()) {
                     target.auth = TargetAuth::Override(irtt_client::Authentication::Hmac(
                         irtt_client::HmacKey::new(key.as_bytes().to_vec().into_boxed_slice()),
                     ));