ouroboros/src/lib/ssm, branch be

irmd: Deliver flow re-keying

2026-06-29T06:32:58+00:00

Re-key each encrypted flow's batch root periodically so a long-lived flow never exhausts or over-uses a single root. The IRMd re-runs the OAP exchange with the peer IRMd over the flow-update relay. The per-flow re-keying state is tracked in the registry (reg_flow). A re-key delivers one root seed from the OAP exchange. keyrot immediately HKDF-expands it into 128 node keys (KR_NODES_SZ = 128 × 32 B) and wipes the root. Then each of the 128 node keys is itself a root → HKDF-expanded into 64 (2^KEY_NODE_BITS) leaf keys, forked per direction; each leaf key is the actual AEAD key, good for 2^20 packets (the low counter bits are its nonce/seq). If the number of keys runs low, a re-key will be triggered (KEY_REKEY_WATERMARK). The rekey is signalled out of band to the application. The rbuff ACL is generalized into a flags word, so an RB_REKEY bit rides alongside the access RB_RD/RB_WR and FLOWDOWN/FLOWPEER bits. The RD and WR bits are revised ditching the fcntl historical weirdness. The seed is pulled via flow_read/flow_write, installed with crypt_rekey(). TX holds the old epoch until the peer is observed on the new one (or a grace deadline elapses), promoted from both the read and write paths so a recv-mostly flow still advances. Also fix the FLOW_ACCEPT and FLOW_ALLOC handlers, which on a key-buffer allocation failure returned from inside the cleanup-push region: that leaked the reply message and skipped both the stack-key scrub and the cleanup pop. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix SSM reclaim-orphans test

2026-06-29T06:32:55+00:00

Age the simulated-leaked blocks via alloc_ts so the aged-reclaim triggers in the test. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Reclaim aged leaked ssm pool blocks

2026-06-03T06:02:34+00:00

The reclaim_pid_from_sc() function reaped any block allocated with refcount from a dead PID, but cross-process hand-offs can leave a block briefly allocated by the producer while a live consumer still holds it. This skips reclaim within SSM_POOL_RECLAIM_AGE_S (default 60s) so in-flight hand-offs survive a producer crash. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix overflow in ssm_flow_set_notify

2026-06-03T06:02:34+00:00

ssm_flow_set_notify wrote past the fqueue because of a missing bound check, corrupting adjacent memory under burst. Drop redundant FLOW_PKT when full and reserve the last slot for control events so they aren't starved by data-plane traffic. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Use push/pop for ssm_pk_buff ops

2026-05-20T06:17:06+00:00

Renames the allocation for head/tail to push/pop instead of alloc/release as it's simpler and shorter. Took this approach insted of adopting the kernel's push/pull/put/trim. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

build: Remove deprecated cmake options

2026-05-20T06:17:06+00:00

RXM_BUFFER_ON_HEAP and SSM_POOL_BLOCKS were no longer used. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Use const for ssm_pk_buff getters

2026-05-20T06:17:06+00:00

Mark ssm_pk_buff_get_off, _head, _tail, and _len as taking a const struct ssm_pk_buff *. Cast through the flex array in _head and _tail since the buffer view they return remains mutable. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Rename PROG_* config to PROC_*

2026-05-20T06:17:06+00:00

Per-process flow / fd / fqueue limits are properties of a process, not a program; align the naming. Mechanical rename of PROG_MAX_FLOWS, PROG_RES_FDS, and PROG_MAX_FQUEUES to PROC_*. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

include: Centralise atomic helpers in atomics.h

2026-05-20T06:17:05+00:00

Moves the atomics macros that were defined between eth and ssm_pool to their own header. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix pool_sharding_test

2026-05-20T06:17:05+00:00

The test was not correctly taking the correct size class. Moved the select_size_class to the common header so tests can use it. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders