https://gitlab.synchro.net/main/sbbs/-/commit/3c2eb2443df8934ae295f2c3
Modified Files:
src/ssh/deucessh-conn.h src/ssh/key_algo/rsa-sha2-256.c ssh-ed25519.c src/ssh/ssh-auth.c ssh-conn.c ssh-trans.c ssh.c
Log Message:
Final hardening: timing, scrubbing, threads, NULL, lifetime

1. Constant-time MAC: memcmp  CRYPTO_memcmp (timing side-channel)
2. Sensitive data scrubbing: cleanse_free() helper; OPENSSL_cleanse
on shared_secret, session_id, exchange_hash, derived keys (27
sites), passwords, stack MAC/tmp buffers before free/return
3. Thread safety: buf_mtx in send_data, send_extended_data,
send_eof, send_close, maybe_replenish_window to prevent
data races with demux thread on remote_window/eof/close flags
4. NULL checks: all ~40 DSSH_PUBLIC functions validate pointer
parameters; parse helpers allow NULL data with data_len==0
5. Lifetime docs: channel handle rules in deucessh-conn.h
6. Zero-size write: bufsz==0 returns 0 (no empty DATA message)
7. Callback validation: set_callbacks rejects NULL tx/rx/rx_line

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/ac54d2f4d12d779f0349b66b
Modified Files:
src/ssh/deucessh-conn.h ssh-conn.c ssh-internal.h ssh-trans.c ssh-trans.h src/ssh/test/dssh_test_internal.h test_conn.c
Log Message:
Implement ZC core; rewire stream API on top of ZC internals

Factored send_packet_inner into tx_finalize (DSSH_PRIVATE) which
handles padding, MAC, encrypt, send, and counters given a payload
already in tx_packet[9]. send_packet_inner now copies payload then
calls tx_finalize. drain_tx_queue promoted to DSSH_PRIVATE.

ZC core in ssh-conn.c:
- zc_getbuf_inner: acquires tx_mtx, waits for rekey, drains tx_queue,
checks remote_window/remote_max_packet under buf_mtx, returns
pointer into tx_packet data area past the channel header
- zc_send_inner: fills channel header (msg_type, channel_id,
data_type_code, length) at tx_packet[9], calls tx_finalize,
deducts from remote_window, releases tx_mtx
- zc_cancel_inner: releases tx_mtx without sending

Stream write (dssh_chan_write) rewired: calls zc_getbuf_inner, memcpy, zc_send_inner. Eliminates the per-packet malloc that send_data used. DSSH_ERROR_NOMORE (window full) mapped to 0 bytes sent.

Demux RX data path rewired: handle_channel_data/extended_data call
the channel's zc_cb for new-model channels (releasing buf_mtx first,
setting _Thread_local in_zc_rx guard). Stream channels use
stream_zc_cb which copies into ring buffer under buf_mtx.

Public ZC API: dssh_chan_zc_open, dssh_chan_zc_getbuf,
dssh_chan_zc_send, dssh_chan_zc_cancel. All validate ch, check
in_zc_rx guard, delegate to inner functions.

Event callback setters: dssh_chan_set_event_cb,
dssh_session_set_event_cb.

Deleted send_data/send_extended_data (old malloc-based send path).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/5b7759df96efa5972c0a8638
Modified Files:
src/ssh/deucessh-conn.h ssh-conn.c ssh-internal.h ssh-trans.c src/ssh/test/dssh_test_internal.h test_chan.c
Log Message:
Add configurable event queue cap (default 64) to prevent OOM

A malicious peer can flood CHANNEL_REQUESTs (signal, break,
window-change) to grow the event queue without bound. Add a
per-channel max_events cap (default 64, inherited from session).
When the queue is full, the demux thread closes the channel.

- event_queue_push() returns DSSH_ERROR_TOOMANY at cap
- dssh_session_set_max_events() sets default (before start)
- dssh_chan_set_max_events() adjusts per-channel (DSSH_ERROR_INVALID
if cap < current count)
- Pass 0 to disable the cap
- All event_queue_push() call sites now check return values

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net