ouroboros/cmake, branch be

ipcpd: Minimize ipcpd-eth send buffer

2026-07-08T09:02:24+00:00

The eth send buffer needs to block quickly so we can mark congestion correctly in the upper layer buffers. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

build: Fix OpenSSL version check for PQC

2026-07-08T09:02:12+00:00

ML-KEM, ML-DSA and SLH-DSA all landed in OpenSSL 3.5.0, not 3.4.0. ML-KEM+ML-DSA and SLH-DSA can be disabled by DISABLE_ML / DISABLE_SLH. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

build: Make re-key watermark configurable

2026-06-29T06:33:00+00:00

KEY_REKEY_WM_CHECK_BITS now controls the watermark check, once per 2^n flow writes (FLOW_WM_CHECK in dev.c). Now the configuration check (check watermark < outstanding packets) is contained in lib.cmake instead of assuming the value of FLOW_WM_CHECK. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Deliver flow re-keying

2026-06-29T06:32:58+00:00

Re-key each encrypted flow's batch root periodically so a long-lived flow never exhausts or over-uses a single root. The IRMd re-runs the OAP exchange with the peer IRMd over the flow-update relay. The per-flow re-keying state is tracked in the registry (reg_flow). A re-key delivers one root seed from the OAP exchange. keyrot immediately HKDF-expands it into 128 node keys (KR_NODES_SZ = 128 × 32 B) and wipes the root. Then each of the 128 node keys is itself a root → HKDF-expanded into 64 (2^KEY_NODE_BITS) leaf keys, forked per direction; each leaf key is the actual AEAD key, good for 2^20 packets (the low counter bits are its nonce/seq). If the number of keys runs low, a re-key will be triggered (KEY_REKEY_WATERMARK). The rekey is signalled out of band to the application. The rbuff ACL is generalized into a flags word, so an RB_REKEY bit rides alongside the access RB_RD/RB_WR and FLOWDOWN/FLOWPEER bits. The RD and WR bits are revised ditching the fcntl historical weirdness. The seed is pulled via flow_read/flow_write, installed with crypt_rekey(). TX holds the old epoch until the peer is observed on the new one (or a grace deadline elapses), promoted from both the read and write paths so a recv-mostly flow still advances. Also fix the FLOW_ACCEPT and FLOW_ALLOC handlers, which on a key-buffer allocation failure returned from inside the cleanup-push region: that leaked the reply message and skipped both the stack-key scrub and the cleanup pop. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Harden symmetric-key rotation

2026-06-29T06:32:58+00:00

Flow crypto signalled rotation with a single phase-parity bit, so a loss burst that hid an even number of rotations went unnoticed and wedged the flow for good. Each packet now carries a small cleartext selector naming its key directly, so a receiver that falls behind recovers on the next packet instead of getting stuck. The selector also serves as the AEAD nonce and is authenticated as associated data (AAD). Key rotation moves into a new backend-agnostic keyrot module that rotates sub-keys to bound AEAD usage while preserving forward secrecy. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Bound the OAP replay cache

2026-06-29T06:32:58+00:00

Replace the linked-list cache with three timestamp-generation hash buckets, each capped at OAP_REPLAY_MAX entries. A bucket is an open-addressed hash set whose slots count as live only while slot.gen equals the bucket generation, so a stale bucket clears in O(1) by bumping its generation instead of being scanned and pruned. On overflow the cache fails closed - it rejects the header rather than evicting the oldest entry. Under flood, dropping a genuine entry would let that header be replayed, so refusing new entries is the safer degradation than evict-oldest (fail-open) behaviour. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Specify peer authentication contract

2026-06-29T06:32:58+00:00

OAP accepted requests and responses without a certificate even when the peer was expected to authenticate. An on-path attacker could strip the certificate and signature from a flow allocation response and substitute its own key exchange, silently downgrading the handshake to unauthenticated. Add an auth=required|optional policy to enc.conf, enforced per role: a client config requires the server to present a valid certificate, a server config requires the same from the client. Default is required for client side (https), optional server side. The client side default can be changed via OAP_CLIENT_AUTH_DEFAULT for testing. Replace the bare 'none' keyword with encryption=none, which disables encryption only: the digest and the authentication policy are kept, so authenticated but unencrypted flows can be configured. Configs using bare 'none' are now rejected. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Reclaim aged leaked ssm pool blocks

2026-06-03T06:02:34+00:00

The reclaim_pid_from_sc() function reaped any block allocated with refcount from a dead PID, but cross-process hand-offs can leave a block briefly allocated by the producer while a live consumer still holds it. This skips reclaim within SSM_POOL_RECLAIM_AGE_S (default 60s) so in-flight hand-offs survive a producer crash. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Decouple rbuff size from RQ size

2026-06-03T06:02:23+00:00

The rbuff size was at one point coupled to RQ size for debugging, reverting. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

ipcpd: Fully gate fa/dt RIB ops on IPCP_FLOW_STATS

2026-05-27T13:55:08+00:00

The previous shape registered no-op _rib_read / _rib_readdir / _rib_getattr handlers when IPCP_FLOW_STATS was off, and there was a bug where *buf was not set in the no-op causing free on an uninitialized pointer. IPCP_FLOW_STATS was referenced by config.h.in but the declaration was lost during the CMake refactor. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders