| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
pkg_check_modules(FUSE ...) in fuse.cmake tells CMake's pkg-config
module to use FUSE as the variable prefix. pkg-config then populates
FUSE_PREFIX with the install prefix of libfuse (i.e., usr). This
overwrote the FUSE_PREFIX cache variable set to /tmp/ouroboros in
global.cmake.
IRMd was calling mkdir("/usr", 0777) on startup and rmdir("/usr") on
shutdown. The rmdir only fails because usr isn't empty — if it ever
were (e.g., in a minimal container), it would deleted /usr.
The fix renames the pkg-config prefix from FUSE to FUSE_PKG, so
pkg-config populates FUSE_PKG_PREFIX (harmless) instead of clobbering
FUSE_PREFIX.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This moves the build definitions back to src/ subdirectories
(CMakeLists.txt per component). Configuration and dependencies are
kept out of tree. Configuration options are bundled into cmake/config/
modules. Dependencies are grouped by component (system/, crypt/, eth/,
coverage/, etc.). It now consistently uses target-based commands
(target_include_directories, target_link_libraries) instead of global
include_directories(). Proper PRIVATE/PUBLIC visibility for executable
link libraries. CONFIG_OUROBOROS_DEBUG now properly set based on being
a valid debug config (not just checking the string name).
It also adds OuroborosTargets export for find_package() support and
CMake package config files (OuroborosConfig.cmake) for easier
integration with CMake projects.
The build logic now follows more idiomatic CMake practices with
configuration separated from target definitions.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The include headers and NIDs are different on macOS X. It also doesn't
have explicit_bzero.
The crypt.h includes are now guarded to work on OS X (trying to avoid
the includes by defining the OpenSSL mac header guard led to a whole
list of other issues).
The explicit zero'ing of buffers temporarily holding secrets has now
been abstracted in a crypt_secure_clear() function defaulting to
OpenSSL_cleanse, explicit_bzero (if present) or a best-effort option
using a volatile pointer.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
|
| |
|
|
|
|
|
|
|
| |
The crypt_test had a HAVE_OPENSSL guard missing and was trying to
execute tests that required OpenSSL without it being installed. The
SECMEM values need to be set by CMake without OpenSSL installed.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This adds initial support for runtime-configurable encryption and
post-quantum Key Encapsulation Mechanisms (KEMs) and authentication
(ML-DSA).
Supported key exchange algorithms:
ECDH: prime256v1, secp384r1, secp521r1, X25519, X448
Finite Field DH: ffdhe2048, ffdhe3072, ffdhe4096
ML-KEM (FIPS 203): ML-KEM-512, ML-KEM-768, ML-KEM-1024
Hybrid KEMs: X25519MLKEM768, X448MLKEM1024
Supported ciphers:
AEAD: aes-128-gcm, aes-192-gcm, aes-256-gcm, chacha20-poly1305
CTR: aes-128-ctr, aes-192-ctr, aes-256-ctr
Supported HKDFs:
sha256, sha384, sha512, sha3-256, sha3-384, sha3-512,
blake2b512, blake2s256
Supported Digests for DSA:
sha256, sha384, sha512, sha3-256, sha3-384, sha3-512,
blake2b512, blake2s256
PQC support requires OpenSSL 3.4.0+ and is detected automatically via
CMake. A DISABLE_PQC option allows building without PQC even when
available.
KEMs differ from traditional DH in that they require asymmetric roles:
one party encapsulates to the other's public key. This creates a
coordination problem during simultaneous reconnection attempts. The
kem_mode configuration parameter resolves this by pre-assigning roles:
kem_mode=server # Server encapsulates (1-RTT, full forward secrecy)
kem_mode=client # Client encapsulates (0-RTT, cached server key)
The enc.conf file format supports:
kex=<algorithm> # Key exchange algorithm
cipher=<algorithm> # Symmetric cipher
kdf=<KDF> # Key derivation function
digest=<digest> # Digest for DSA
kem_mode=<mode> # Server (default) or client
none # Disable encryption
The OAP protocol is extended to negotiate algorithms and exchange KEX
data. All KEX messages are signed using existing authentication
infrastructure for integrity and replay protection.
Tests are split into base and _pqc variants to handle conditional PQC
compilation (kex_test.c/kex_test_pqc.c, oap_test.c/oap_test_pqc.c).
Bumped minimum required OpenSSL version for encryption to 3.0
(required for HKDF API). 1.1.1 is long time EOL.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
|
| |
|
|
|
|
|
|
|
| |
This adds a 'make coverage' option to conveniently summarize test
coverage. If lcov is installed, it will also automatically generate
the HTML summary.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
|
|
|
This moves the CMake build logic out of the source tree and splits it
up into a more modular form. The tests now have a CMakeLists.txt file
in their respective source directory.
Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
|
