ouroboros, branch be

lib: Reject peer keys of another algorithm

2026-08-31T06:31:46Z

The openssl_dhe_derive() function decoded the peer public key from the wire with d2i_PUBKEY() and handed it straight to EVP_PKEY_derive_set_peer(). A peer offering a key of a type other than the one negotiated was only caught inside OpenSSL. This aborts in OpenSSL debug builds, which tripped integration. Now we check the decoded key type against the type of the local key pair first. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix build against OpenSSL 4.1

2026-08-31T06:31:46Z

X509_get_subject_name() and X509_NAME_ENTRY_get_data() return const pointers in OpenSSL >= 4.1. ASN1_STRING_length() is deprecated in 4.1 in favour of ASN1_STRING_get_length(), which returns size_t rather than int. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Add support for NIST curve hybrid KEMs

2026-08-31T06:31:46Z

OpenSSL 3.5 supports SecP256r1MLKEM768 and SecP384r1MLKEM1024 pairing ML-KEM with a NIST curve. These were not supported yet by O7s. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Improve hybrid KEX support

2026-08-31T06:31:46Z

The algorithm was inferred from the key length. That will not always work as SecP256r1MLKEM768 private key is 2432 bytes, exactly like an X25519MLKEM768 one. Raw OAP kex payloads now lead with the algorithm NID in network byte order, so a peer reads the algorithm from the wire instead of guessing it from the payload length. Test if the KEX is hybrid KEM with kex_nid_is_hybrid() based on the NID range. The configured algorithm is passed to the raw key loaders. The public key loader imports the key to validate it, so a corrupt or mismatched file is reported at load time. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Reject client encap without configured KEX

2026-08-31T06:31:46Z

A client asking for client-side encapsulation against a server that has no kex= configured left scfg->x.str NULL, crashing the handshake inside strstr(). Client encapsulation decapsulates with the server's configured static key, so a server without the configured key exchange cannot serve the request. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

ipcpd: Assign random MAC on ETH poa with loopback

2026-08-31T06:31:46Z

The loopback has an all-zero MAC, so two PoAs on a loopback receive their own frames and a PoA refuses its own FLOW_REQ, failing the flow with ECONNREFUSED. The shim IPCP didn't have this problem because it ignored requests for names not registered locally (shim-data). The PoA has no "local" name registry, it uses the unicast IPCP's directory (DHT) via IRMd query requests. This fixes the issue by generating a random locally administered MAC on the loopback device. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

tools: Fix oftp on OS X

2026-08-31T06:31:46Z

Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Update FRCT loss recovery

2026-08-31T06:31:46Z

Some more stability fixes in FRCT. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

ipcpd: Use capacity queue estimation for mb-ecn

2026-08-31T06:31:45Z

The mb-ecn algorithm was using rbuff queue depths in packets to mark, but sockets in the poa component report capacity in bytes. The tx rings are now adaptive to block on queuing delay instead of when full to prevent buffer bloat, controllable via fccntl (FLOWSTXQDLY and FLOWGTXQDLY). Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Replace shim IPCPs with points of attachment

2026-08-31T06:31:45Z

Removes the UDP and Ethernet shim IPCPs. The unicast and broadcast IPCPs can now directly attach to a "legacy" socket. We adopt Saltzer's Point-of-Attachment terminology, also advocated in Day's "Patterns in Network Architecture". The "poa" component manages these PoA's with one management thread, one link monitoring thread and one thread per attached point. For Ethernet PoA's the irm connect and enroll can resolve the destination IPCP or Layer name with a broadcast name query over the attached PoAs (first reply wins). UDP PoA's require a destination IP address or FQDN. attach to a local endpoint (required both server and client side): irm ipcp poa attach name a udp 10.0.0.1 irm ipcp poa attach name a udp 10.0.0.1:3435 irm ipcp poa attach name a udp [::1]:3435 irm ipcp poa attach name a eth dev eth0 irm ipcp poa attach name a eth dev eth0 ethertype 0xA000 release a PoA (refused while it carries a flow): irm ipcp poa detach name a udp 10.0.0.1:3435 irm ipcp poa detach name a eth eth0 list an IPCP's PoAs: irm ipcp poa list name a connect to a peer, by name or at an address: irm ipcp connect name b dst a irm ipcp connect name b dst a eth irm ipcp connect name b dst a eth dev eth0 irm ipcp connect name b dst a udp 10.0.0.1:3435 irm ipcp connect name b dst a udp peer.example.com:3435 disconnect by peer name, no address: irm ipcp disconnect name b dst a irm ipcp disconnect name b dst a component mgmt enroll has the same shape as connect: irm ipcp enroll name b layer lr autobind irm ipcp enroll name b layer lr autobind eth dev eth0 irm ipcp enroll name b layer lr autobind udp 10.0.0.1:3435 the IRMd config file attaches PoAs and names peers the same way: udp = [ "10.0.0.1", "10.0.0.1:3436" ] eth = [ "eth0", {dev="eth1", ethertype=0xA007} ] enrol={dst="LAN", eth={dev="eth0"}} conn=[{dst="lan3", eth={}}, {dst="lan4", udp="10.0.0.1:3435"}] Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders