ouroboros/src/lib, branch be

lib: Reclaim aged leaked ssm pool blocks

2026-06-03T06:02:34+00:00

The reclaim_pid_from_sc() function reaped any block allocated with refcount from a dead PID, but cross-process hand-offs can leave a block briefly allocated by the producer while a live consumer still holds it. This skips reclaim within SSM_POOL_RECLAIM_AGE_S (default 60s) so in-flight hand-offs survive a producer crash. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix overflow in ssm_flow_set_notify

2026-06-03T06:02:34+00:00

ssm_flow_set_notify wrote past the fqueue because of a missing bound check, corrupting adjacent memory under burst. Drop redundant FLOW_PKT when full and reserve the last slot for control events so they aren't starved by data-plane traffic. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Send stream FIN in the window

2026-06-01T05:43:48+00:00

The stream FIN was not gated on the flow control window, potentially causing a seqno overrun if the windows was full. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix missing newlines in hash.c

2026-06-01T05:43:48+00:00

Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix FRCT seqno leak on rxm alloc failure

2026-06-01T05:43:48+00:00

The seqno was committed before calling rxm_arm, whose malloc could fail and silently leave the seqno without a retransmission entry. None of the recovery paths (RTO timer, RACK, SACK-driven, NACK-driven) can repair a slot with NULL rxm, so the gap persists until the receiver's keepalive marks the flow dead. This fix splits rxm_arm into rxm_alloc plus rxm_arm (post-state install). sack_rxm_snd follows the same alloc-then-arm shape. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix double pool_remove on tx-path failure

2026-06-01T05:43:43+00:00

The flow_tx_spb function consumed the spb on every failure path via ssm_pool_remove, while its caller ipcp_flow_write left the spb to its caller on early outs, causing ssm_pool_remove to be called twice. In Debug builds this aborts at the old_ref == 0 check. This aligns flow_tx_spb with np1_flow_write and dt_write_packet: spb consumed on success, retained on failure. External callers already release on failure, so no caller-side changes outside of dev.c are needed. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix mixed declarations in hash.c

2026-05-27T13:54:57+00:00

The contexts are not declared at the top of the function anymore after addition of the CRC8/CRC16 variants (no implementation in libgcrypt). Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Add FIN and receive-side linger for msg dealloc

2026-05-22T06:13:50+00:00

qos_msg flows had no end-of-stream signal: a deallocating sender relied on the peer's inactivity timers (~30 s) to notice. Worse, the dealloc-linger path was bugged: a receiver that called flow_dealloc would stop draining its rx_rb while the peer's tail retransmits kept arriving. Peer retransmitted into a black hole until its own dealloc fired, and the whole shutdown stretched takes t_a time. Generalizes frcti_stream_fin_snd to frcti_fin_snd; for msg mode emit a FRCT_FIN-only control packet with the FIN seqno boundary in pci->ackno. Receiver-side frcti_rcv latches rcv_fin_seen and stores the boundary on FRCT_FIN-without-DATA. Fix comment on the FRCT flags. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Allow up to two TLPs per recovery episode

2026-05-22T06:13:50+00:00

RFC 8985 §7.3 permits up to two tail loss probes before falling back to RTO. Previously FRCP allowed exactly one TLP per episode, making tail-loss recovery dependent on a successful first probe; if that probe was lost the sender fell straight to slow RTO with exponential backoff. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Further align FRCP with TCP RFCs

2026-05-22T06:13:50+00:00

Only the HoL slot retransmits on RTO; non-HoL slots defer and rely on SACK/RACK fast-rxm for recovery. Matches RFC 6298 §5.4 + RFC 8985 §3 and Linux tcp_retransmit_skb(head, 1). Eliminates the spurious-RTO storm where ~50-66% of retransmits arrived as duplicates at the peer. Co-fixes for three latent state-machine bugs that the previous spurious-retx mask was hiding: - recovery_enter: seal recovery_high at the false→true edge only (RFC 6582 §3.2). Previously extended on every gap-SACK, which trapped the sender in NewReno indefinitely once any cum-ACK fell behind the moving recovery_high. - rtt_sample_eligible: drop the in_recovery super-gate. Karn at the per-slot SND_RTX|SND_TLP level is already correct (matches Linux). - rxm_due defer interval: use base RTO, not rto< Signed-off-by: Sander Vrijders