mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-09 16:24:45 +00:00
Johnathan Corgan
4ad5940114
Migrate the FSP end-to-end session subsystem into src/proto/fsp/ following the established sans-IO shape, and retire the src/protocol grab-bag now that FSP was its last occupant. Relocate the FSP session wire (node/session_wire.rs plus the FSP message types from protocol/session.rs) into proto/fsp/wire.rs. Hoist the pure decision logic into proto/fsp/core.rs over plain-data SessionSnapshots returning an ordered FspAction list the shell drives: session-rekey policy, msg3-resend classification, post-decrypt epoch reaction, setup/dual-init tie-break, coords/path-MTU emit-policy, bounded pending-queue, and IPv6 ECN. The crypto-owning SessionEntry stays shell-side in node/session.rs (matching the FMP ActivePeer pattern); proto/fsp is wire + core + limits only, with no proto->noise dependency and no crypto. Move the coords helpers to proto/stp/ (they serialize TreeCoordinate), and split SessionMessageType: the encrypted-inner 0x10-0x1F variants stay in proto/fsp/wire.rs while the 0x20-0x2F routing signals become a new RoutingSignalType in proto/routing/wire.rs. Migrate the session-MMP shell adapter, which continues to drive proto/mmp/. Retire src/protocol: LinkMessageType and SessionDatagram move to a new shared proto/link.rs, ProtocolError becomes proto::Error (relocated verbatim), the deprecated MessageType alias and the unimported PROTOCOL_VERSION are dropped, and src/protocol/ is deleted along with its lib.rs module declaration. Behavior-neutral: wire bytes unchanged, oracle tests pass unedited except mod-path relocation; adds rekey/epoch characterization tests and pure poll/emit-policy core tests.
24 lines
1.1 KiB
Rust
24 lines
1.1 KiB
Rust
//! FSP session-rekey timing constants.
|
|
//!
|
|
//! Pure, runtime-agnostic bounds for the session-rekey lifecycle, relocated
|
|
//! from the async `node::handlers::rekey` shell. The shell resolves the clock
|
|
//! and pre-evaluates the timer predicates against these; the core reads only
|
|
//! the resulting plain-data snapshot fields.
|
|
|
|
/// Keep the previous session alive for this long after cutover.
|
|
pub(crate) const DRAIN_WINDOW_SECS: u64 = 10;
|
|
|
|
/// Suppress local rekey initiation for this long after receiving a peer's
|
|
/// rekey msg1.
|
|
pub(crate) const REKEY_DAMPENING_SECS: u64 = 30;
|
|
|
|
/// Liveness bound on how long the FSP rekey initiator holds the `current` +
|
|
/// `pending` state before cutting over to the new epoch.
|
|
///
|
|
/// This is NOT safety-critical: overlapping-epoch trial-decrypt covers any
|
|
/// skew between the two endpoints' cutovers. The timer only bounds how long the
|
|
/// initiator advertises the old K-bit. An opportunistic early cutover also
|
|
/// fires if the initiator authenticates a peer frame against its own `pending`
|
|
/// session (the responder cut over first).
|
|
pub(crate) const FSP_CUTOVER_DELAY_MS: u64 = 2000;
|