diff options
Diffstat (limited to 'cmake')
| -rw-r--r-- | cmake/config/ipcp/eth.cmake | 4 | ||||
| -rw-r--r-- | cmake/config/ipcp/unicast.cmake | 19 | ||||
| -rw-r--r-- | cmake/config/lib.cmake | 4 | ||||
| -rw-r--r-- | cmake/dependencies/crypt/openssl.cmake | 51 |
4 files changed, 41 insertions, 37 deletions
diff --git a/cmake/config/ipcp/eth.cmake b/cmake/config/ipcp/eth.cmake index d336d647..6a044d4b 100644 --- a/cmake/config/ipcp/eth.cmake +++ b/cmake/config/ipcp/eth.cmake @@ -10,8 +10,8 @@ set(IPCP_ETH_WR_THR 1 CACHE STRING "Number of writer threads in Ethernet IPCP") set(IPCP_ETH_QDISC_BYPASS false CACHE BOOL "Bypass the Qdisc in the kernel when using raw sockets") -set(IPCP_ETH_SNDBUF 0 CACHE STRING - "Raw socket SO_SNDBUF in bytes; 0 = leave kernel default (wmem_default)") +set(IPCP_ETH_SNDBUF 4096 CACHE STRING + "Raw socket SO_SNDBUF in bytes (floored to one frame); 0 = kernel default") set(IPCP_ETH_RCVBUF 0 CACHE STRING "Raw socket SO_RCVBUF in bytes; 0 = leave kernel default (rmem_default)") set(IPCP_ETH_LO_MTU 9000 CACHE STRING diff --git a/cmake/config/ipcp/unicast.cmake b/cmake/config/ipcp/unicast.cmake index b8d4d516..92eeae65 100644 --- a/cmake/config/ipcp/unicast.cmake +++ b/cmake/config/ipcp/unicast.cmake @@ -9,6 +9,25 @@ set(IPCP_UNICAST_MTU 1400 CACHE STRING set(PFT_SIZE 256 CACHE STRING "Prefix forwarding table size for the Unicast IPCP") +# Aggregate congestion-avoidance context interning. One ctx is shared +# per (peer, qos cube); this is the hash table bucket count. Must be a +# power of two (the bucket index masks with CA_BUCKETS - 1). +set(IPCP_CA_BUCKETS 64 CACHE STRING + "Hash buckets for aggregate CA context interning (power of two)") +math(EXPR IPCP_CA_BUCKETS_POW2 "${IPCP_CA_BUCKETS} & (${IPCP_CA_BUCKETS} - 1)") +if((IPCP_CA_BUCKETS LESS 1) OR (NOT IPCP_CA_BUCKETS_POW2 EQUAL 0)) + message(FATAL_ERROR "IPCP_CA_BUCKETS must be a positive power of two") +endif() + +# Per-flow (non-aggregated) congestion avoidance. Aggregate CA per +# (peer, qos cube) is the production behaviour; enable this only to +# build the legacy per-flow reference for A/B testing and bisection. +set(IPCP_CA_PER_FLOW FALSE CACHE BOOL + "Use per-flow congestion avoidance (testing only)") +if(IPCP_CA_PER_FLOW) + message(STATUS "IPCP per-flow congestion avoidance (testing build)") +endif() + # Protocol debugging set(DEBUG_PROTO_DHT FALSE CACHE BOOL "Add DHT protocol debug logging") diff --git a/cmake/config/lib.cmake b/cmake/config/lib.cmake index 2c01b311..81a7d6ba 100644 --- a/cmake/config/lib.cmake +++ b/cmake/config/lib.cmake @@ -97,6 +97,8 @@ set(KEY_REKEY_WATERMARK 4 CACHE STRING "Re-key when this many node keys remain; 0 disables the count trigger") set(KEY_REPLAY_WINDOW 2048 CACHE STRING "RX replay window in packets; power of two, >= 128") +set(KEY_REKEY_WM_CHECK_BITS 16 CACHE STRING + "Re-key watermark is consulted once per 2^n flow writes") if(NOT KEY_REPLAY_WINDOW MATCHES "^[0-9]+$") message(FATAL_ERROR "KEY_REPLAY_WINDOW must be a positive integer") endif() @@ -111,7 +113,7 @@ endif() # that leaves a high-rate flow no room to complete the exchange. Production # defaults are vast; this guards under-sized (test) geometries. if(KEY_REKEY_WATERMARK GREATER 0) - set(_rk_wm_check 65536) # FLOW_WM_CHECK in src/lib/dev.c (2^16) + math(EXPR _rk_wm_check "1 << ${KEY_REKEY_WM_CHECK_BITS}") math(EXPR _rk_lead "${KEY_REKEY_WATERMARK} << (${KEY_LEAF_BITS} + ${KEY_NODE_BITS})") math(EXPR _rk_min "2 * ${_rk_wm_check}") diff --git a/cmake/dependencies/crypt/openssl.cmake b/cmake/dependencies/crypt/openssl.cmake index 38eb826f..b0fa8d11 100644 --- a/cmake/dependencies/crypt/openssl.cmake +++ b/cmake/dependencies/crypt/openssl.cmake @@ -25,49 +25,32 @@ message(STATUS "OpenSSL support enabled, found version ${OPENSSL_VERSION}") set(HAVE_OPENSSL TRUE CACHE INTERNAL "OpenSSL cryptography support available") -if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.4.0") - set(DISABLE_ML_KEM FALSE CACHE BOOL - "Disable ML-KEM support") - set(DISABLE_ML_DSA FALSE CACHE BOOL - "Disable ML-DSA support") - if(NOT DISABLE_ML_KEM) - set(HAVE_OPENSSL_ML_KEM TRUE CACHE INTERNAL - "OpenSSL ML-KEM available") - message(STATUS "OpenSSL ML-KEM support enabled") - else() - message(STATUS "OpenSSL ML-KEM support disabled") - unset(HAVE_OPENSSL_ML_KEM CACHE) - endif() - if(NOT DISABLE_ML_DSA) - set(HAVE_OPENSSL_ML_DSA TRUE CACHE INTERNAL - "OpenSSL ML-DSA available") - message(STATUS "OpenSSL ML-DSA support enabled") - else() - message(STATUS "OpenSSL ML-DSA support disabled") - unset(HAVE_OPENSSL_ML_DSA CACHE) - endif() -else() - message(STATUS - "Install OpenSSL >= 3.4.0 for ML-KEM/ML-DSA") - unset(HAVE_OPENSSL_ML_KEM CACHE) - unset(HAVE_OPENSSL_ML_DSA CACHE) -endif() - if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.5.0") - set(DISABLE_SLH_DSA FALSE CACHE BOOL + set(DISABLE_ML FALSE CACHE BOOL + "Disable ML-KEM/ML-DSA support") + set(DISABLE_SLH FALSE CACHE BOOL "Disable SLH-DSA support") - if(NOT DISABLE_SLH_DSA) - set(HAVE_OPENSSL_SLH_DSA TRUE CACHE INTERNAL + if(NOT DISABLE_ML) + set(HAVE_ML TRUE CACHE INTERNAL + "OpenSSL ML-KEM/ML-DSA available") + message(STATUS "OpenSSL ML-KEM/ML-DSA support enabled") + else() + message(STATUS "OpenSSL ML-KEM/ML-DSA support disabled") + unset(HAVE_ML CACHE) + endif() + if(NOT DISABLE_SLH) + set(HAVE_SLH TRUE CACHE INTERNAL "OpenSSL SLH-DSA available") message(STATUS "OpenSSL SLH-DSA support enabled") else() message(STATUS "OpenSSL SLH-DSA support disabled") - unset(HAVE_OPENSSL_SLH_DSA CACHE) + unset(HAVE_SLH CACHE) endif() else() message(STATUS - "Install OpenSSL >= 3.5.0 for SLH-DSA") - unset(HAVE_OPENSSL_SLH_DSA CACHE) + "Install OpenSSL >= 3.5.0 for PQC (ML-KEM/ML-DSA/SLH-DSA)") + unset(HAVE_ML CACHE) + unset(HAVE_SLH CACHE) endif() # Secure memory options are in cmake/config/global.cmake |