summaryrefslogtreecommitdiff
path: root/src/lib
Commit message (Collapse)AuthorAgeFilesLines
* lib: Fix build against OpenSSL 4.1Dimitri Staessens31 hours2-6/+22
| | | | | | | | | | | X509_get_subject_name() and X509_NAME_ENTRY_get_data() return const pointers in OpenSSL >= 4.1. ASN1_STRING_length() is deprecated in 4.1 in favour of ASN1_STRING_get_length(), which returns size_t rather than int. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Add support for NIST curve hybrid KEMsDimitri Staessens31 hours2-31/+37
| | | | | | | | OpenSSL 3.5 supports SecP256r1MLKEM768 and SecP384r1MLKEM1024 pairing ML-KEM with a NIST curve. These were not supported yet by O7s. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Improve hybrid KEX supportDimitri Staessens31 hours5-249/+194
| | | | | | | | | | | | | | | | | | | | The algorithm was inferred from the key length. That will not always work as SecP256r1MLKEM768 private key is 2432 bytes, exactly like an X25519MLKEM768 one. Raw OAP kex payloads now lead with the algorithm NID in network byte order, so a peer reads the algorithm from the wire instead of guessing it from the payload length. Test if the KEX is hybrid KEM with kex_nid_is_hybrid() based on the NID range. The configured algorithm is passed to the raw key loaders. The public key loader imports the key to validate it, so a corrupt or mismatched file is reported at load time. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* ipcpd: Assign random MAC on ETH poa with loopbackDimitri Staessens31 hours1-0/+24
| | | | | | | | | | | | | | | The loopback has an all-zero MAC, so two PoAs on a loopback receive their own frames and a PoA refuses its own FLOW_REQ, failing the flow with ECONNREFUSED. The shim IPCP didn't have this problem because it ignored requests for names not registered locally (shim-data). The PoA has no "local" name registry, it uses the unicast IPCP's directory (DHT) via IRMd query requests. This fixes the issue by generating a random locally administered MAC on the loopback device. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Update FRCT loss recoveryDimitri Staessens31 hours8-327/+918
| | | | | | | Some more stability fixes in FRCT. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* ipcpd: Use capacity queue estimation for mb-ecnDimitri Staessens31 hours10-43/+1411
| | | | | | | | | | | The mb-ecn algorithm was using rbuff queue depths in packets to mark, but sockets in the poa component report capacity in bytes. The tx rings are now adaptive to block on queuing delay instead of when full to prevent buffer bloat, controllable via fccntl (FLOWSTXQDLY and FLOWGTXQDLY). Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Replace shim IPCPs with points of attachmentDimitri Staessens31 hours17-142/+6686
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Removes the UDP and Ethernet shim IPCPs. The unicast and broadcast IPCPs can now directly attach to a "legacy" socket. We adopt Saltzer's Point-of-Attachment terminology, also advocated in Day's "Patterns in Network Architecture". The "poa" component manages these PoA's with one management thread, one link monitoring thread and one thread per attached point. For Ethernet PoA's the irm connect and enroll can resolve the destination IPCP or Layer name with a broadcast name query over the attached PoAs (first reply wins). UDP PoA's require a destination IP address or FQDN. attach to a local endpoint (required both server and client side): irm ipcp poa attach name a udp 10.0.0.1 irm ipcp poa attach name a udp 10.0.0.1:3435 irm ipcp poa attach name a udp [::1]:3435 irm ipcp poa attach name a eth dev eth0 irm ipcp poa attach name a eth dev eth0 ethertype 0xA000 release a PoA (refused while it carries a flow): irm ipcp poa detach name a udp 10.0.0.1:3435 irm ipcp poa detach name a eth eth0 list an IPCP's PoAs: irm ipcp poa list name a connect to a peer, by name or at an address: irm ipcp connect name b dst a irm ipcp connect name b dst a eth irm ipcp connect name b dst a eth dev eth0 irm ipcp connect name b dst a udp 10.0.0.1:3435 irm ipcp connect name b dst a udp peer.example.com:3435 disconnect by peer name, no address: irm ipcp disconnect name b dst a irm ipcp disconnect name b dst a component mgmt enroll has the same shape as connect: irm ipcp enroll name b layer lr autobind irm ipcp enroll name b layer lr autobind eth dev eth0 irm ipcp enroll name b layer lr autobind udp 10.0.0.1:3435 the IRMd config file attaches PoAs and names peers the same way: udp = [ "10.0.0.1", "10.0.0.1:3436" ] eth = [ "eth0", {dev="eth1", ethertype=0xA007} ] enrol={dst="LAN", eth={dev="eth0"}} conn=[{dst="lan3", eth={}}, {dst="lan4", udp="10.0.0.1:3435"}] Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Make crypt contexts thread-safeDimitri Staessens31 hours4-81/+292
| | | | | | | | | Moves the per-packet EVP context to a thread-local state. Now refuses a security config with -ENOTSUP without supported crypto backend (OpenSSL). Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix FRCT stall under packet lossDimitri Staessens2026-08-031-15/+37
| | | | | | | | | | | | | | | | | A stream flow over a lossy path could block completely with the send window pegged at RQ_SIZE. Fixed not sending the tail loss probe (TLP) when the window was closed. Fixed SACK emission when the window edge and block count remain unchanged. A lost fast retransmit keeps SND_FAST_RXM set. Clear the flag once the slot ages past its own RTO. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* ipcpd: Add flow overshoot protection to mb-ecnDimitri Staessens2026-07-222-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | The ECN marks were the only source of congestion information, and going into congestion collapse (dropping a lot of ECN packets and causing loss of signal) was unrecoverable. The sender's slow-start ramp clock now tracks a measured RTT to avoid overshooting into congestion collapse on the previously fixed (14ms) doubling on long-delay (e.g. 100ms) links. The flow allocator now carries a periodic heartbeat/ack to keep RTT estimates up-to-date. The heartbeat also serves as a congestion collapse detector: consecutive heartbeat losses will go into loss recovery, halving the window and pausing Additive Increase until the path is clear. The DT component now has a max_rtt config parameter that serves as a hint for the layer RTT to optimize slow-start for low-latency networks. These two mechanisms follow TCP, however only during slow start up to the first ECN signal and to recover from a total collapse until the ECN signal returns. MB-ECN is still fully RTT-independent in the AI/PD region. A shorter RTT path will just reach its equal fair share faster than a longer RTT path. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* ipcpd: Rework congestion avoidanceDimitri Staessens2026-07-192-12/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Congestion avoidance is a property of the layer, orthogonal to ARQ and to flow control: FRCP retransmits and lets the peer pace the sender, per flow, end-to-end; the IPCP paces path aggregates. Each signal means one thing: a loss triggers a retransmission, a mark means congestion, the peer window means a slow receiver. Every flow is paced by the same rate law whatever its QoS, so a greedy raw sender shares a bottleneck fairly with a reliable stream. The unit of control is the (destination address, QoS cube) aggregate: all flows toward that destination share one controller and one rate; a start-time fair-queuing pacer divides the rate across them by deadline instead of blocking the send path, and a new flow rides the aggregate's estimates at its current rate, with no probing of its own. Slow start runs once per aggregate. The congestion signal is a multi-bit magnitude: forwarders mark packets with their standing queue depth, MAX-combined across hops, so a packet carries the deepest queue on its path. The receiver feeds back a time-integral mean over a window that adapts to the flow's byte rate, measuring a slow flow with the same fidelity as a fast one. The sender runs AIMD scaled by elapsed wall-clock time, which makes the steady-state allocation RTT-independent. The PCI gains one byte: the path capacity as a quarter-log2 code. Forwarders estimate their egress rate from busy-period drain and MIN-stamp the byte, the receiver returns the window minimum with its feedback, and the sender scales its rate floor and additive slope to the bottleneck (C / 32). A deep cut implies a backlogged bottleneck and a backlogged bottleneck advertises its capacity, so the scaled floor is live exactly when recovery needs it: the probe heals a halving in seconds at any link rate, and the floor bounds the deepest hole to a factor 32 below the bottleneck. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Whitespace cleanup in dev and frctDimitri Staessens2026-07-192-11/+21
| | | | | Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix crypt_test without crypto backendDimitri Staessens2026-07-191-0/+8
| | | | | | | | | Creating a context without OpenSSL fails (returns NULL) after adding the key rotation logic (requires HKDF). Assert instead that context creation returns NULL without OpenSSL. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix locking on flow readDimitri Staessens2026-07-081-9/+13
| | | | | | | | | | Reading a deallocated flow could cause an assert on a negative id. The raw-flow path now holds proc.lock across flow_rx_spb rather than dropping it first, and the FRCT loop no longer releases and reacquires the lock on every iteration. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Prefer writers on the proc flow lockDimitri Staessens2026-07-081-4/+18
| | | | | | | | | | FRCT readers hold proc.lock in a rdlock loop and could starve a pending flow accept waiting for the wrlock. Initialise the lock with the writer-nonrecursive kind on Linux with glibc, so writers are not indefinitely delayed. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Clean up on cancelled blocking readDimitri Staessens2026-07-082-4/+20
| | | | | | | | | Cancelling a thread that was blocked in ssm_rbuff_read_b/write_b didn't clean up the n_users reference. If it was in flow_rx_one it didn't unlock the process lock. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Separate rekey replay from epoch conflictDimitri Staessens2026-07-083-16/+42
| | | | | | | | | | | | | keyrot_rekey() treated any re-key attempt against a live epoch (current or previous) the same way, whether the offered root key matched the live one (a replay) or was genuinely different (a conflict). Compare the offered key against the live batch's root and return -EREPLAY for a match, keeping -1/-ECRYPT for an actual conflict, so callers can handle replayed re-keys distinctly from real ones. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Harden crypto unit testsDimitri Staessens2026-07-083-5/+103
| | | | | | | | | | | | | | Stop the non-OpenSSL runners from masking a real failure as SKIP by only downgrading to SKIP if they passed. Fix a stray call that ran test_kex_dhe_wrong_algo in the skip branch. Fix double free + free of an uninitialised pointer in test_store_add. Test that a KDF- less derive must fail. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Reject re-key to a live epochDimitri Staessens2026-07-082-12/+177
| | | | | | | | A re-key epoch arrives from the peer, so we need to reject duplicates to avoid two batches sharing a wire epoch with different keys. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* build: Fix OpenSSL version check for PQCDimitri Staessens2026-07-086-8/+7
| | | | | | | | | ML-KEM, ML-DSA and SLH-DSA all landed in OpenSSL 3.5.0, not 3.4.0. ML-KEM+ML-DSA and SLH-DSA can be disabled by DISABLE_ML / DISABLE_SLH. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* build: Make re-key watermark configurableDimitri Staessens2026-06-292-51/+8
| | | | | | | | | | KEY_REKEY_WM_CHECK_BITS now controls the watermark check, once per 2^n flow writes (FLOW_WM_CHECK in dev.c). Now the configuration check (check watermark < outstanding packets) is contained in lib.cmake instead of assuming the value of FLOW_WM_CHECK. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Wipe unpacked session key after copyDimitri Staessens2026-06-291-0/+4
| | | | | | | | | | Zeroize the symmetric key in the unpacked IRM message once it has been copied into the crypt context, in both flow__irm_result_des and flow_rekey__irm_result_des, so key material does not linger in the protobuf buffer until it is freed. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Bound crc_check against short packetsDimitri Staessens2026-06-291-2/+8
| | | | | | | | | Reject a packet shorter than head_skip + CRCLEN before computing the CRC, instead of hashing over an underflowed length when the buffer is too small to hold the trailer. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* irmd: Complete bidirectional flow re-keyingDimitri Staessens2026-06-293-20/+59
| | | | | | | | | | | | | | | | | | Extend re-key delivery beyond the locally-initiated watermark path: Handle peer-initiated re-key requests, allowing one request and one response per flow at a time. The client side wins if both ends try to re-key at the same time. Caches the peer certificate to support cert-less authenticated/signed re-keys. After a rekey, the initiator promotes first (timer) and starts sending under the new key. The responder observes the new key (peer_synced) and then the responder promotes. The responder will self-decide to use the new keys if it exhausted the older set in the case where it never sees the peer (unidirectional flow). Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Add constant-time comparison helperDimitri Staessens2026-06-291-0/+19
| | | | | | | | | Add a function crypt_ct_cmp() that wraps CRYPTO_memcmp (OpenSSL) with a volatile-loop fallback, for comparing authentication tags without leaking timing. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Group sec_config authentication fieldsDimitri Staessens2026-06-292-13/+13
| | | | | | | | | Nest the flat req_auth and cacert members of struct sec_config into a sub-struct a { req; cacert; }, keeping the authentication settings together. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Harden OpenSSL crypto backendDimitri Staessens2026-06-292-69/+99
| | | | | | | | | | | | | | | This contains a few improvements and fixes in the OpenSSL backed. We now zeroize shared secrets with OPENSSL_clear_free. The i2d_PUBKEY output is bound against CRYPT_KEY_BUFSZ. We now return NULL rather than silently falling back to SHA-256 when a digest is unknown. FILE handles are now closed via pthread cleanup so a cancelled thread cannot leak them. The DHE kex tests now set the KDF NID explicitly, since the SHA-256 fallback is gone. Also refactors the PEM string loaders to clean up some code duplication. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Loop getrandom on short reads and EINTRDimitri Staessens2026-06-291-1/+17
| | | | | | | | | The getrandom() function may return fewer bytes than requested or fail with EINTR. Loop until the buffer is filled, retrying on EINTR, instead of trusting a single call to fill the buffer completely. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Add MurmurHash3 hash_mix64 for hash tablesDimitri Staessens2026-06-292-0/+50
| | | | | | | | | Adds a (non-cryptographic) MurmurHash3 fmix64 finalizer for hashing an integer key to a table index, replacing the MD5-based bucket hashing in the pft. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* irmd: Deliver flow re-keyingDimitri Staessens2026-06-295-104/+388
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Re-key each encrypted flow's batch root periodically so a long-lived flow never exhausts or over-uses a single root. The IRMd re-runs the OAP exchange with the peer IRMd over the flow-update relay. The per-flow re-keying state is tracked in the registry (reg_flow). A re-key delivers one root seed from the OAP exchange. keyrot immediately HKDF-expands it into 128 node keys (KR_NODES_SZ = 128 × 32 B) and wipes the root. Then each of the 128 node keys is itself a root → HKDF-expanded into 64 (2^KEY_NODE_BITS) leaf keys, forked per direction; each leaf key is the actual AEAD key, good for 2^20 packets (the low counter bits are its nonce/seq). If the number of keys runs low, a re-key will be triggered (KEY_REKEY_WATERMARK). The rekey is signalled out of band to the application. The rbuff ACL is generalized into a flags word, so an RB_REKEY bit rides alongside the access RB_RD/RB_WR and FLOWDOWN/FLOWPEER bits. The RD and WR bits are revised ditching the fcntl historical weirdness. The seed is pulled via flow_read/flow_write, installed with crypt_rekey(). TX holds the old epoch until the peer is observed on the new one (or a grace deadline elapses), promoted from both the read and write paths so a recv-mostly flow still advances. Also fix the FLOW_ACCEPT and FLOW_ALLOC handlers, which on a key-buffer allocation failure returned from inside the cleanup-push region: that leaked the reply message and skipped both the stack-key scrub and the cleanup pop. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* ipcpd: Add flow-update relayDimitri Staessens2026-06-294-0/+110
| | | | | | | | | | | | This adds an ipcp_flow_update() call to relay opaque messages between the two IRMds (carried by FLOW_IRM_UPDATE messages), which passes it back up to the peer IRMd via ipcp_flow_update_arr(). The broadcast layer does not implement this. Needed for periodic re-keying of encrypted flows via OAP. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Harden symmetric-key rotationDimitri Staessens2026-06-2911-523/+2737
| | | | | | | | | | | | | | | | | | Flow crypto signalled rotation with a single phase-parity bit, so a loss burst that hid an even number of rotations went unnoticed and wedged the flow for good. Each packet now carries a small cleartext selector naming its key directly, so a receiver that falls behind recovers on the next packet instead of getting stuck. The selector also serves as the AEAD nonce and is authenticated as associated data (AAD). Key rotation moves into a new backend-agnostic keyrot module that rotates sub-keys to bound AEAD usage while preserving forward secrecy. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* irmd: Fail OAP config load on read errorsDimitri Staessens2026-06-291-3/+8
| | | | | | | | | | | load_sec_config_file() treated any fopen() failure as an absent config and silently disabled encryption. file_exists() similarly lumped non-ENOENT stat() errors in with "present". Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* irmd: Reject OAP peer crt with unusable CNDimitri Staessens2026-06-292-39/+92
| | | | | | | Added checks for CN > NAME_SIZE. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* irmd: Add issuer and digest pinning to OAPDimitri Staessens2026-06-295-6/+316
| | | | | | | | | | | | | | | | | | | A peer certificate that verifies against the CA store could have been issued by any trusted CA, and a peer could pick any supported digest for its signature. Tighten the authentication contract with two local policies. cacert= pins the issuing CA: a peer certificate, if presented, must chain through the pinned CA. Whether a certificate is mandatory at all remains controlled by auth= alone. digest= now also pins the signature digest: a classical peer must sign with the locally configured digest, and may not omit the digest NID to fall back to the key's default digest. PQC signatures (ML-DSA, SLH-DSA) have an intrinsic digest and may be NID_undef. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* irmd: Specify peer authentication contractDimitri Staessens2026-06-292-10/+294
| | | | | | | | | | | | | | | | | | | | | | OAP accepted requests and responses without a certificate even when the peer was expected to authenticate. An on-path attacker could strip the certificate and signature from a flow allocation response and substitute its own key exchange, silently downgrading the handshake to unauthenticated. Add an auth=required|optional policy to enc.conf, enforced per role: a client config requires the server to present a valid certificate, a server config requires the same from the client. Default is required for client side (https), optional server side. The client side default can be changed via OAP_CLIENT_AUTH_DEFAULT for testing. Replace the bare 'none' keyword with encryption=none, which disables encryption only: the digest and the authentication policy are kept, so authenticated but unencrypted flows can be configured. Configs using bare 'none' are now rejected. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix SSM reclaim-orphans testDimitri Staessens2026-06-291-1/+9
| | | | | | | | Age the simulated-leaked blocks via alloc_ts so the aged-reclaim triggers in the test. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Reclaim aged leaked ssm pool blocksDimitri Staessens2026-06-032-8/+34
| | | | | | | | | | | The reclaim_pid_from_sc() function reaped any block allocated with refcount from a dead PID, but cross-process hand-offs can leave a block briefly allocated by the producer while a live consumer still holds it. This skips reclaim within SSM_POOL_RECLAIM_AGE_S (default 60s) so in-flight hand-offs survive a producer crash. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix overflow in ssm_flow_set_notifyDimitri Staessens2026-06-031-5/+13
| | | | | | | | | | ssm_flow_set_notify wrote past the fqueue because of a missing bound check, corrupting adjacent memory under burst. Drop redundant FLOW_PKT when full and reserve the last slot for control events so they aren't starved by data-plane traffic. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Send stream FIN in the windowDimitri Staessens2026-06-011-0/+16
| | | | | | | | The stream FIN was not gated on the flow control window, potentially causing a seqno overrun if the windows was full. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix missing newlines in hash.cDimitri Staessens2026-06-011-0/+2
| | | | | Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix FRCT seqno leak on rxm alloc failureDimitri Staessens2026-06-011-41/+50
| | | | | | | | | | | | | | The seqno was committed before calling rxm_arm, whose malloc could fail and silently leave the seqno without a retransmission entry. None of the recovery paths (RTO timer, RACK, SACK-driven, NACK-driven) can repair a slot with NULL rxm, so the gap persists until the receiver's keepalive marks the flow dead. This fix splits rxm_arm into rxm_alloc plus rxm_arm (post-state install). sack_rxm_snd follows the same alloc-then-arm shape. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix double pool_remove on tx-path failureDimitri Staessens2026-06-011-6/+10
| | | | | | | | | | | | | | | | The flow_tx_spb function consumed the spb on every failure path via ssm_pool_remove, while its caller ipcp_flow_write left the spb to its caller on early outs, causing ssm_pool_remove to be called twice. In Debug builds this aborts at the old_ref == 0 check. This aligns flow_tx_spb with np1_flow_write and dt_write_packet: spb consumed on success, retained on failure. External callers already release on failure, so no caller-side changes outside of dev.c are needed. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix mixed declarations in hash.cDimitri Staessens2026-05-271-3/+4
| | | | | | | | The contexts are not declared at the top of the function anymore after addition of the CRC8/CRC16 variants (no implementation in libgcrypt). Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Add FIN and receive-side linger for msg deallocDimitri Staessens2026-05-222-18/+72
| | | | | | | | | | | | | | | | | | | qos_msg flows had no end-of-stream signal: a deallocating sender relied on the peer's inactivity timers (~30 s) to notice. Worse, the dealloc-linger path was bugged: a receiver that called flow_dealloc would stop draining its rx_rb while the peer's tail retransmits kept arriving. Peer retransmitted into a black hole until its own dealloc fired, and the whole shutdown stretched takes t_a time. Generalizes frcti_stream_fin_snd to frcti_fin_snd; for msg mode emit a FRCT_FIN-only control packet with the FIN seqno boundary in pci->ackno. Receiver-side frcti_rcv latches rcv_fin_seen and stores the boundary on FRCT_FIN-without-DATA. Fix comment on the FRCT flags. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Allow up to two TLPs per recovery episodeDimitri Staessens2026-05-221-8/+22
| | | | | | | | | | | RFC 8985 §7.3 permits up to two tail loss probes before falling back to RTO. Previously FRCP allowed exactly one TLP per episode, making tail-loss recovery dependent on a successful first probe; if that probe was lost the sender fell straight to slow RTO with exponential backoff. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Further align FRCP with TCP RFCsDimitri Staessens2026-05-221-43/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Only the HoL slot retransmits on RTO; non-HoL slots defer and rely on SACK/RACK fast-rxm for recovery. Matches RFC 6298 §5.4 + RFC 8985 §3 and Linux tcp_retransmit_skb(head, 1). Eliminates the spurious-RTO storm where ~50-66% of retransmits arrived as duplicates at the peer. Co-fixes for three latent state-machine bugs that the previous spurious-retx mask was hiding: - recovery_enter: seal recovery_high at the false→true edge only (RFC 6582 §3.2). Previously extended on every gap-SACK, which trapped the sender in NewReno indefinitely once any cum-ACK fell behind the moving recovery_high. - rtt_sample_eligible: drop the in_recovery super-gate. Karn at the per-slot SND_RTX|SND_TLP level is already correct (matches Linux). - rxm_due defer interval: use base RTO, not rto<<rto_mul. Inheriting HoL's backoff parked deferred slots tens of seconds in the future. Bring RACK reorder-window scaling into RFC 8985 §7.2 compliance: reo_wnd_mult widens at most once per RTT, gated via a srtt-elapsed check in reo_wnd_on_dsack. Stat refactor for clearer attribution: rename rxm_snd → rxm_rto (now RTO-driven sends only), add rxm_nack and rxm_due_defer, split rxm_rcv into total FRCT_RXM arrivals and rxm_dup_rcv (duplicates). Expose rx/tx ring queue depths as RIB stats. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Set a timeout on FRCT control packetsDimitri Staessens2026-05-222-17/+130
| | | | | | | | | | | | | Time out frct_tx for control packets at 250us so a full tx ring cannot stall the timer wheel (and with it KA, TLP, RXM fires). DATA frames (fresh, RXM, TLP, FIN) keep blocking - dropping them would lose recovery progress. Add inact_drop, drf_rebase, rq_released, tlp_snd, sdu_snd_alloc, sdu_snd_tx, sdu_sole, rxm_tx_dead, and per-type tx_drop counters. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Add tail loss probe (TLP) to FRCPDimitri Staessens2026-05-221-21/+162
| | | | | | | | | | | | | | | | | | | | | | | | The previous bugfixes that fixed a false-positive inactivity timer check unmasked the need for the tail loss probe (TLP) to quickly recover from loss of the HoL. When the sender finishes its app data with packets still inflight, RACK fast-rxm cannot fire (no ACK arrives), pre-DRF NACK is gated on rcv_cr.inact, and rto_mul climbs into seconds before the next RXM fire — recv-side deadline expires first. This adds the RFC 8985 §7.2 TLP: PTO = 2*SRTT + max_ack_delay (t_a), capped by the HoL slot's current RTO deadline. Probe fires from frcti_snd and after frcti_ack_rcv; per §7.3 at most one TLP per recovery episode, tracked via tlp_high_seq. On fire, re-emit HoL via fast_rxm_send and hand off to RTO — no PTO self re-arm. A new SND_TLP slot flag is Karn-skipped for RTT sampling, cleared by RTO retransmit or NACK-driven fast-rxm, and clears rto_mul on its TLP-ACK (rto_mul carries no CC meaning in FRCP). Also caps MAX_RTO_MUL at 8 instead of 20. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
* lib: Fix underrun in activity timerDimitri Staessens2026-05-221-22/+50
| | | | | | | | | | | The inactivity timers are updated under rdlock with atomics on the time stamp. Inactivity is measured by comparison between the act stamp against the thread's own current time (now_ns). A different thread could already have updated the act stamp, causing undderun in the signed comparison and causing a false-positive on the inactive test. Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks> Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-01 13:53:48 +0000