ouroboros/src/lib/tests, branch testing

lib: Add support for NIST curve hybrid KEMs

2026-08-31T06:31:46Z

OpenSSL 3.5 supports SecP256r1MLKEM768 and SecP384r1MLKEM1024 pairing ML-KEM with a NIST curve. These were not supported yet by O7s. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Improve hybrid KEX support

2026-08-31T06:31:46Z

The algorithm was inferred from the key length. That will not always work as SecP256r1MLKEM768 private key is 2432 bytes, exactly like an X25519MLKEM768 one. Raw OAP kex payloads now lead with the algorithm NID in network byte order, so a peer reads the algorithm from the wire instead of guessing it from the payload length. Test if the KEX is hybrid KEM with kex_nid_is_hybrid() based on the NID range. The configured algorithm is passed to the raw key loaders. The public key loader imports the key to validate it, so a corrupt or mismatched file is reported at load time. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

ipcpd: Use capacity queue estimation for mb-ecn

2026-08-31T06:31:45Z

The mb-ecn algorithm was using rbuff queue depths in packets to mark, but sockets in the poa component report capacity in bytes. The tx rings are now adaptive to block on queuing delay instead of when full to prevent buffer bloat, controllable via fccntl (FLOWSTXQDLY and FLOWGTXQDLY). Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Replace shim IPCPs with points of attachment

2026-08-31T06:31:45Z

Removes the UDP and Ethernet shim IPCPs. The unicast and broadcast IPCPs can now directly attach to a "legacy" socket. We adopt Saltzer's Point-of-Attachment terminology, also advocated in Day's "Patterns in Network Architecture". The "poa" component manages these PoA's with one management thread, one link monitoring thread and one thread per attached point. For Ethernet PoA's the irm connect and enroll can resolve the destination IPCP or Layer name with a broadcast name query over the attached PoAs (first reply wins). UDP PoA's require a destination IP address or FQDN. attach to a local endpoint (required both server and client side): irm ipcp poa attach name a udp 10.0.0.1 irm ipcp poa attach name a udp 10.0.0.1:3435 irm ipcp poa attach name a udp [::1]:3435 irm ipcp poa attach name a eth dev eth0 irm ipcp poa attach name a eth dev eth0 ethertype 0xA000 release a PoA (refused while it carries a flow): irm ipcp poa detach name a udp 10.0.0.1:3435 irm ipcp poa detach name a eth eth0 list an IPCP's PoAs: irm ipcp poa list name a connect to a peer, by name or at an address: irm ipcp connect name b dst a irm ipcp connect name b dst a eth irm ipcp connect name b dst a eth dev eth0 irm ipcp connect name b dst a udp 10.0.0.1:3435 irm ipcp connect name b dst a udp peer.example.com:3435 disconnect by peer name, no address: irm ipcp disconnect name b dst a irm ipcp disconnect name b dst a component mgmt enroll has the same shape as connect: irm ipcp enroll name b layer lr autobind irm ipcp enroll name b layer lr autobind eth dev eth0 irm ipcp enroll name b layer lr autobind udp 10.0.0.1:3435 the IRMd config file attaches PoAs and names peers the same way: udp = [ "10.0.0.1", "10.0.0.1:3436" ] eth = [ "eth0", {dev="eth1", ethertype=0xA007} ] enrol={dst="LAN", eth={dev="eth0"}} conn=[{dst="lan3", eth={}}, {dst="lan4", udp="10.0.0.1:3435"}] Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Make crypt contexts thread-safe

2026-08-31T06:31:45Z

Moves the per-packet EVP context to a thread-local state. Now refuses a security config with -ENOTSUP without supported crypto backend (OpenSSL). Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Fix crypt_test without crypto backend

2026-07-19T09:44:35Z

Creating a context without OpenSSL fails (returns NULL) after adding the key rotation logic (requires HKDF). Assert instead that context creation returns NULL without OpenSSL. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Separate rekey replay from epoch conflict

2026-07-08T09:02:24Z

keyrot_rekey() treated any re-key attempt against a live epoch (current or previous) the same way, whether the offered root key matched the live one (a replay) or was genuinely different (a conflict). Compare the offered key against the live batch's root and return -EREPLAY for a match, keeping -1/-ECRYPT for an actual conflict, so callers can handle replayed re-keys distinctly from real ones. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Harden crypto unit tests

2026-07-08T09:02:23Z

Stop the non-OpenSSL runners from masking a real failure as SKIP by only downgrading to SKIP if they passed. Fix a stray call that ran test_kex_dhe_wrong_algo in the skip branch. Fix double free + free of an uninitialised pointer in test_store_add. Test that a KDF- less derive must fail. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Reject re-key to a live epoch

2026-07-08T09:02:23Z

A re-key epoch arrives from the peer, so we need to reject duplicates to avoid two batches sharing a wire epoch with different keys. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

build: Fix OpenSSL version check for PQC

2026-07-08T09:02:12Z

ML-KEM, ML-DSA and SLH-DSA all landed in OpenSSL 3.5.0, not 3.4.0. ML-KEM+ML-DSA and SLH-DSA can be disabled by DISABLE_ML / DISABLE_SLH. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders