lib: Move encryption control from QoS to name

This removes the flow encryption option (cypher_s) from the qosspec.

The configuration file is configured in the security options (default
/etc/ouroboros/security/). For this poc, encryption can be disabled
client or server side by putting an enc.cfg file. If that file is
present in the client folder, the client will require encryption. If
that file is present on the server side, the server will require
encryption and reject non-encrypted flows.

Encryption is now configured outside of any application control.

Example: /etc/ouroboros/security/client/oping/enc.cfg exists:

irmd(II): Encryption enabled for oping.
irmd(DB): File /etc/ouroboros/security/client/oping/crt.pem does not exist.
irmd(II): No security info for oping.
irmd(DB): Generated ephemeral keys for 87474.
irmd/oap(PP): OAP_HDR [caf203681d997941 @ 2025-09-02 17:08:05 (UTC) ] -->
irmd/oap(PP):   Certificate: <none>
irmd/oap(PP):   Ephemeral Public Key: [91 bytes]
irmd/oap(PP):   Data: <none>
irmd/oap(PP):   Signature: <none>

Example: /etc/ouroboros/security/client/oping/enc.cfg does not exist:

irmd(II): Allocating flow for 87506 to oping.
irmd(DB): File /etc/ouroboros/security/client/oping/enc.cfg does not exist.
irmd(DB): File /etc/ouroboros/security/client/oping/crt.pem does not exist.
irmd(II): No security info for oping.
irmd/oap(PP): OAP_HDR [e84bb9d7c3d9c002 @ 2025-09-02 17:08:30 (UTC) ] -->
irmd/oap(PP):   Certificate: <none>
irmd/oap(PP):   Ephemeral Public Key: <none>
irmd/oap(PP):   Data: <none>
irmd/oap(PP):   Signature: <none>

Example: /etc/ouroboros/security/server/oping/enc.cfg exists:

irmd(II): Flow request arrived for oping.
irmd(DB): IPCP 88112 accepting flow 7 for oping.
irmd(II): Encryption enabled for oping.
irmd(DB): File /etc/ouroboros/security/server/oping/crt.pem does not exist.
irmd(II): No security info for oping.
irmd/oap(PP): OAP_HDR [3c717b3f31dff8df @ 2025-09-02 17:13:06 (UTC) ] <--
irmd/oap(PP):   Certificate: <none>
irmd/oap(PP):   Ephemeral Public Key: <none>
irmd/oap(PP):   Data: <none>
irmd/oap(PP):   Signature: <none>
irmd(WW): Encryption required but no key provided.

The server side will pass the ECRYPT to the client:
$ oping -l
Ouroboros ping server started.
Failed to accept flow: -1008

$ oping -n oping -c 1
Failed to allocate flow: -1008.

Encryption on flows can now be changed at runtime without needing to
touch/reconfigure/restart the process.

Note: The ECRYPT result is passed on via the flow allocator responses
through the IPCP (discovered/fixed some endianness issues), but the
reason for rejecting the flow can be considered N+1 information... We
may move that information up into the OAP header at some point.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

4 files changed, 19 insertions, 10 deletions

diff --git a/src/tools/irm/irm_name_create.c b/src/tools/irm/irm_name_create.c
index f363ac3e..22341d2e 100644
--- a/src/tools/irm/irm_name_create.c
+++ b/src/tools/irm/irm_name_create.c
@@ -51,8 +51,10 @@
 
 #define RR    "round-robin"
 #define SPILL "spillover"
+#define SENC  "<security_dir>/server/<name>/enc.cfg"
 #define SCRT  "<security_dir>/server/<name>/crt.pem"
 #define SKEY  "<security_dir>/server/<name>/key.pem"
+#define CENC  "<security_dir>/client/<name>/enc.cfg"
 #define CCRT  "<security_dir>/client/<name>/crt.pem"
 #define CKEY  "<security_dir>/client/<name>/key.pem"
 
@@ -61,8 +63,10 @@ static void usage(void)
         printf("Usage: irm name create\n"
                "                <name>. max %d chars.\n"
                "                [lb LB_POLICY], default: %s\n"
+               "                [sencpath <path>, default: " SENC "]\n"
                "                [scrtpath <path>, default: " SCRT "]\n"
                "                [skeypath <path>, default: " SKEY "]\n"
+               "                [cencpath <path>, default: " CENC "]\n"
                "                [ccrtpath <path>, default: " CCRT "]\n"
                "                [ckeypath <path>, default: " CKEY "]\n"
                "\n"
@@ -101,8 +105,10 @@ int do_create_name(int     argc,
 {
         struct name_info info = {};
         char * name = NULL;
+        char * sencpath = NULL;
         char * scrtpath = NULL;
         char * skeypath = NULL;
+        char * cencpath = NULL;
         char * ccrtpath = NULL;
         char * ckeypath = NULL;
         char * lb_pol = RR;
@@ -113,10 +119,14 @@ int do_create_name(int     argc,
         while (argc > 0) {
                 if (matches(*argv, "lb") == 0) {
                         lb_pol = *(argv + 1);
+                } else if (matches(*argv, "sencpath") == 0) {
+                        sencpath = *(argv + 1);
                 } else if (matches(*argv, "scrtpath") == 0) {
                         scrtpath = *(argv + 1);
                 } else if (matches(*argv, "skeypath") == 0) {
                         skeypath = *(argv + 1);
+                } else if (matches(*argv, "cencpath") == 0) {
+                        cencpath = *(argv + 1);
                 } else if (matches(*argv, "ccrtpath") == 0) {
                         ccrtpath = *(argv + 1);
                 } else if (matches(*argv, "ckeypath") == 0) {
@@ -141,12 +151,18 @@ int do_create_name(int     argc,
 
         strcpy(info.name, name);
 
+        if (sencpath != NULL && cp_chk_path(info.s.enc, sencpath) < 0)
+                goto fail;
+
         if (scrtpath != NULL && cp_chk_path(info.s.crt, scrtpath) < 0)
                 goto fail;
 
         if (skeypath != NULL && cp_chk_path(info.s.key, skeypath) < 0)
                 goto fail;
 
+        if (cencpath != NULL && cp_chk_path(info.c.enc, cencpath) < 0)
+                goto fail;
+
         if (ccrtpath != NULL && cp_chk_path(info.c.crt, ccrtpath) < 0)
                 goto fail;
 
diff --git a/src/tools/oping/oping.c b/src/tools/oping/oping.c
index ed3529e5..87c1ee18 100644
--- a/src/tools/oping/oping.c
+++ b/src/tools/oping/oping.c
@@ -77,7 +77,7 @@
 "  -d, --duration          Duration of the test (default 1s)\n"              \
 "  -i, --interval          Interval (default 1000ms)\n"                      \
 "  -n, --server-name       Name of the oping server\n"                       \
-"  -q, --qos               QoS (raw, raw_crypt, best, video, voice, data)\n" \
+"  -q, --qos               QoS (raw, best, video, voice, data)\n" \
 "  -s, --size              Payload size (B, default 64)\n"                   \
 "  -Q, --quiet             Only print final statistics\n"                    \
 "  -D, --timeofday         Print time of day before each line\n"             \
@@ -244,8 +244,6 @@ int main(int     argc,
                         client.qs = qos_voice;
                 else if (strcmp(qos, "data") == 0)
                         client.qs = qos_data;
-                else if (strcmp(qos, "raw_crypt") == 0)
-                        client.qs = qos_raw_crypt;
                 else
                         printf("Unknown QoS cube, defaulting to raw.\n");
         }
diff --git a/src/tools/oping/oping_server.c b/src/tools/oping/oping_server.c
index 3adce244..c1d5e6e5 100644
--- a/src/tools/oping/oping_server.c
+++ b/src/tools/oping/oping_server.c
@@ -140,8 +140,8 @@ void * accept_thread(void * o)
         while (true) {
                 fd = flow_accept(&qs, NULL);
                 if (fd < 0) {
-                        printf("Failed to accept flow.\n");
-                        break;
+                        printf("Failed to accept flow: %d \n", fd);
+                        continue;
                 }
 
                 printf("New flow %d.\n", fd);
diff --git a/src/tools/ovpn/ovpn.c b/src/tools/ovpn/ovpn.c
index 5333ff40..b25e3ea2 100644
--- a/src/tools/ovpn/ovpn.c
+++ b/src/tools/ovpn/ovpn.c
@@ -68,7 +68,6 @@ static void usage(void)
                "server to connect to\n"
                "  -i, --ip                  IP address to give to TUN device\n"
                "  -m, --mask                Subnet mask to give to TUN device\n"
-               "  -C, --crypt               AES encryption (default: off)\n"
                "\n"
                "      --help                Display this help text and exit\n");
 }
@@ -194,7 +193,6 @@ int main(int     argc,
                 {{"ip",    required_argument, NULL, 'i'},
                  {"mask",  required_argument, NULL, 'm'},
                  {"name",  required_argument, NULL, 'n'},
-                 {"crypt", no_argument,       NULL, 'C'},
                  {"help",  no_argument,       NULL, 'h'},
                  {NULL,    0,                 NULL, 0}
                 };
@@ -231,9 +229,6 @@ int main(int     argc,
                 case 'n':
                         name = optarg;
                         break;
-                case 'C':
-                        qs = qos_raw_crypt;
-                        break;
                 case 'h':
                         usage();
                         exit(EXIT_SUCCESS);