Critical fix: outbound TCP connect moved from main loop to session
thread. Main loop was blocking on CometTcpConnect (15s timeout)
preventing inbound connections from being accepted. This caused
the daemon to miss incoming calls while polling outbound nodes.
BinkP security:
- ED25519 mutual auth: originator verifies answerer's pubkey
- Removed self-announced key fallback on answerer
- cetSessionReject fires on all auth failures (ED25519, CRAM, plain)
BinkP CRYPT (binkd-compatible):
- CRC32 stream cipher from binkd crypt.c (Roger Schlafly)
- Activates on CRAM-MD5 auth + both sides advertise CRYPT
- Follows Argus activation rules (CRAM or originator + password)
BinkP DES-CBC (Argus-compatible):
- Pure Pascal DES implementation (FIPS 46-3), 13/13 test vectors
- ENC DES/CBC negotiation via M_ERR per Argus protocol
- Key checksum verification (ECB encrypt + MD5 CRC16)
BinkP NR mode:
- Sender sends M_FILE with offset -1 (resume-capable)
- After sending, doesn't wait for M_GOT
- Activates when both sides advertise NR
Config: added DESKey per-node option for DES-CBC encryption.
Tests: test_des.pas (DES unit), test_binkp.sh (comprehensive suite).
Ken Johnson
be07621a50