-
Notifications
You must be signed in to change notification settings - Fork 31
Expand file tree
/
Copy pathrelease-notes.txt
More file actions
3782 lines (2853 loc) · 164 KB
/
Copy pathrelease-notes.txt
File metadata and controls
3782 lines (2853 loc) · 164 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
= Release Notes for ION =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
= ION 4.2.0 - Status Report Generation Disabled By Default =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Bundle status report generation is now DISABLED by default on newly
initialized BP nodes, in conformance with RFC 9171 Section 5.1, which
requires that "the generation of status reports MUST be disabled by
default and enabled only when the risk of excessive network traffic is
deemed acceptable."
BEHAVIOR CHANGE:
- A freshly initialized node no longer generates status reports, even for
bundles whose status-report-request flags are set. A bundle's request
flags are honored as a request, not a command: the node's local policy
(RFC 9171 5.1 / 5.4-5.10) overrides them. Bundle forwarding and delivery
are unaffected; only the diagnostic report bundles are suppressed.
- A new status report mode, "none", has been added to the existing
"m srmode" command (alongside traditional, compressed, and both) and is
the default for newly initialized nodes.
- A node whose BP database was initialized by an EARLIER ION release keeps
its previously configured mode across upgrade; only newly initialized
nodes default to "none".
ANTI-CASCADE HARDENING (RFC 9171 4.2.3):
- A status report is now never generated about a bundle whose ADU is an
administrative record, preventing a status report from triggering
another status report. BIBE PDUs remain exempt, as BIBE custody
transfer legitimately relies on administrative bundles.
TO RESTORE PREVIOUS BEHAVIOR:
- Add "m srmode traditional" to the node's .bprc BEFORE the "s" (start)
command. The status report mode is read and cached when each ION daemon
starts, so it must be set before startup; changing it at run time will
not affect already-running daemons until the node is restarted.
AFFECTED TOOLS:
- Tools that solicit status reports (bptrace, bpsendfile with report
flags, bping -f, and any application setting SRR flags) will observe no
returned reports until the destination and intermediate nodes are
configured with "m srmode traditional". Reliability mechanisms (custody
transfer, BIBE, LTP) do not depend on status reports and are unaffected.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
= ION 4.2.0 - DCCP Deprecation =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
DCCP (Datagram Congestion Control Protocol) convergence layer and link
service have been REMOVED from ION.
RATIONALE:
- Linux kernel DCCP implementation is in maintenance mode and being
considered for deprecation upstream
- DCCP support in ION was Linux-only (required kernel >= 3.2.0)
- Marked as "untested" in ION documentation since introduction
- Excluded from CI/CD automated testing
- Last updated in 2013 by Samuel Jero (Ohio University)
- No known active deployments or users
REMOVED COMPONENTS:
- dccpcli, dccpclo - BP DCCP convergence layer input/output daemons
- dccplsi, dccplso - LTP DCCP link service input/output daemons
- All DCCP source code, headers, tests, and documentation
MIGRATION:
Users who may have been using DCCP should migrate to alternative
convergence layers:
- For LTP: Use UDP link service (udplsi/udplso) - standard choice
- For BP: Use STCP (stcpcli/stcpclo) or TCP (tcpcli/tcpclo) convergence
layers for reliable transport
- For BP: Use UDP (udpcli/udpclo) for unreliable but simpler transport
Configuration file changes required:
- Replace "a protocol dccp ..." with "a protocol udp ..." or "a protocol stcp ..."
- Replace "dccpcli" with "udpcli", "stcpcli", or "tcpcli"
- Replace "dccpclo" with "udpclo", "stcpclo", or "tcpclo"
- Replace "dccplsi" with "udplsi"
- Replace "dccplso" with "udplso"
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
= ION 4.2.0 - ipn/imc EID CBOR Encoding Preservation =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ION now preserves the CBOR array encoding (2-element vs 3-element) of
each ipn and imc EID as it was received or configured, rather than
re-deriving it from the fully-qualified node number when a bundle is
(re)serialized.
BACKGROUND:
RFC 9758 permits an ipn EID to be encoded either as a 2-element array
[node-number, service-number] or a 3-element array
[allocator-identifier, node-number, service-number]; both denote the
same EID. Previously ION stored only the fully-qualified node number
and chose the encoding at serialization time (3-element when the
allocator was non-zero, 2-element otherwise). Because ION reconstructs
the primary block on every hop, any EID whose received form differed
from that rule was silently transcoded. RFC 9758 6.4 notes that
syntax-based integrity checks may treat the two encodings differently,
so transcoding an EID covered by a BPSec Block Integrity Block (BIB)
invalidates the signature at a downstream verifier.
CHANGE:
- A new EidFormat field on each EndpointId records whether the EID was
acquired or configured as a 2-element or 3-element encoding.
serializeEid now honors it, and acquireEid and parseEidString set it.
- The default (EidFormatDefault) reproduces the previous, RFC-recommended
behavior (2-element for the default allocator, 3-element otherwise), so
EIDs originated on nodes using the default allocator are unchanged on
the wire.
- Primary block, Previous Node Block, CTEB, CREB, custody signals, status
reports and BPSec canonicalization all inherit the behavior because
they share serializeEid/acquireEid.
BUILD NOTE - Clean rebuild required:
The EidFormat field occupies existing padding within EndpointId, so
sizeof(EndpointId) and sizeof(Bundle) are unchanged and no SDR datastore
migration is required. This has been verified (sizeof(EndpointId) == 24,
unchanged) on x86_64, on 64-bit RTEMS (aarch64-rtems6, LP64), and on
32-bit RTEMS (arm-rtems6, ILP32) with the standard ION build setting
LONG_LONG_OKAY=1, under which uvast is a 64-bit, 8-byte-aligned type.
This is nonetheless a struct-layout change: rebuild all ION components
from source after updating so that every translation unit shares the new
definition. The only configuration in which the field grows
sizeof(EndpointId) is a 32-bit build with LONG_LONG_OKAY=0 (uvast defined
as a 4-byte unsigned long, which cannot represent node numbers above 4G
in the first place); such a build must drain and rebuild the SDR before
restarting.
%%%%%%%%%%%
= GENERAL =
%%%%%%%%%%%
The ION (interplanetary overlay network) software is a suite of communication
protocol implementations designed to support mission operation communications
across an end-to-end interplanetary network, which might include on-board
(flight) subnets, in-situ planetary or lunar networks, proximity links, deep
space links, and terrestrial internets. Included in the ION software
distribution are the following packages:
- ici (interplanetary communication infrastructure), a set of libraries
that provide flight-software-compatible support for functions on which
the other packages rely, such as dynamic memory management, non-volatile
storage management, and inter-task communication via shared memory.
The ici libraries are designed to make the porting of IPN software to
multiple operating systems - Linux, VxWorks, Solaris, etc. - as easy as
possible. Ici now includes zco (zero-copy object), a library that
minimizes the copying of application data as it is encapsulated in
multiple layers of protocol structure while traversing the protocol
stack.
- bp (bundle protocol), an implementation of the Delay-Tolerant
Networking (DTN) architecture's Bundle Protocol.
- ltp (licklider transmission protocol), a DTN convergence layer protocol
for reliable transmission over links characterized by long or highly
variable delay.
- dgr (datagram retransmission), an alternative implementation of ltp
that is designed for use over the Internet protocol stack. dgr
implements congestion control and is designed for relatively high
performance.
- bssp (bundle streaming service protocol), a DTN convergence layer protocol
for reliable transmission of streaming data.
- ams - an implementation of the CCSDS Asynchronous Message Service.
- cfdp - a class-1 (Unacknowledged) implementation of the CCSDS File
Delivery Protocol.
- bss - a Bundle Streaming Service (BSS) for disruption-tolerant reliable
data streaming. BSS supports real-time streaming applications by
passing the bundle payloads to the associated application for immediate
display of the most recent data while storing all bundle payloads
received into a database for user-directed playback.
- dtpc (delay-tolerant payload conditioning), an application framework
providing TCP-like support for end-to-end retransmission and data delivery
in transmission order without duplication or omission.
Features included:
- cgr - Contract graph routing: a method of dynamic routing designed for
space based applications of ION, but still usable for terrestrial
applications. It computes routes using scheduled communication and deals
with time-varying network topology.
- brs - Bundle relay service: provides interconnectivity between networks
that do not allow servers (those behind NAT for example). For more
information, check man brsscla and man brsccla.
February 2026
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
= NOTES ON RELEASE 4.2.0-b =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
ION Open Source 4.2.0 beta. Highlights of the changes since the 4.2.0-a.2
alpha follow; see the git history for the complete list.
Security:
- Fixed a remotely triggerable denial of service (GHSA-27wg-h3xq-4p9g) in
BPv7 bundle acquisition. A syntactically valid bundle whose payload block
carried the empty CBOR byte string (h'', 0x40) has a zero-length payload,
which is legal under RFC 9171. acquireBundle() passed that length to
zco_clone(), which rejects a zero-length clone via CHKZERO(length > 0) in
zco.c, terminating the receiving process. An unauthenticated sender could
crash any reachable induct that feeds bundle bytes into bpEndAcq() with a
single small datagram. Zero-length payloads are now represented with an
empty inbound ZCO via zco_create(); nonzero-length payloads are unchanged.
A conformance regression (tests/conformance_test) injects the zero-length
payload bundle and verifies the node keeps acquiring traffic.
Contact Graph Routing (CGR) reliability:
- Fixed a series of use-after-free and dangling-handle defects in the CGR
route computation and teardown paths: centralized route-hops teardown to
resolve a contact<->route use-after-free, guarded stale contact and spur
waypoint citations during removeRoute, severed dangling rootOfSpur
references, and de-duplicated route-list migration to prevent duplicate
route citations.
Build system:
- Substantial configure.ac and Makefile.am overhaul: DGR, TC, BSSP, and
DTPC are now conditionally built; IMC support is honored consistently
across sources; AMS builds against libexpat were reworked; and several
stale conditionals and AC_ARG usages were cleaned up. AC_INIT metadata
(package name and project URL) was corrected.
RTEMS port:
- Added an RTEMS BPv7 port under arch-rtems (build.sh, wscript), with CFDP,
DGR, BSSP, and AMS enabled in the minimal port, plus build-info and
memory-footprint diagnostics.
Testing and CI:
- The conformance test now polls for expected results instead of sampling
once after a fixed delay, and CI adds TCP, CFDP, and AMS loopback
scenario verification.
%%%%%%%%%%%%%%%%%%%%%%%%%%
= NOTES ON RELEASE 4.2 =
%%%%%%%%%%%%%%%%%%%%%%%%%%
CFDP directory listing hardening (bpcp -r):
- Fixed undefined behavior in bpcp's read_remote_dir(): when a manifest
entry exactly filled the caller's buffer with no NUL inside it, the
subsequent strlen() call would read past the buffer. The buffer is
now unconditionally NUL-terminated.
- Added a v2 directory listing format alongside the existing one,
selected by passing CFDP_DIRLIST_OPTION_STATUS_BYTES to the new
cfdp_rls_extended() API. The v2 manifest carries a per-entry
status byte (currently signaling NAME_TRUNCATED) and a type byte
(REGULAR / DIRECTORY / SYMLINK / OTHER / UNKNOWN), and the response
carries a listing-level "incomplete" flag.
- The CFDP responder now drops directory entries whose names exceed
the manifest's per-entry length cap (255 bytes legacy, 511 bytes v2)
rather than silently truncating them, and sets the incomplete flag
in v2 responses. Truncated names looked fetchable but did not
exist on the remote -- this was a silent corruption. Behavior
change for any caller that was receiving over-length-clipped names:
those entries are now omitted from the manifest entirely.
- bpcp -r opts into v2 by default and surfaces incomplete listings,
unreliable names, and skipped symlinks in a final stderr summary.
bpcp -r now exits non-zero when any of these silent-failure
conditions occur.
- bpcp -r now skips symbolic links by default (was: silently followed
via S_ISDIR). Pass the new -F flag to follow symlinks for users who
explicitly want that behavior. This aligns with scp -r's default.
- cfdp_rls() is preserved as an ABI-compatible wrapper around
cfdp_rls_extended(); existing callers (including cfdptest) require
no source changes.
- Backward compatibility: the v2 request is wire-compatible with old
responders. Old + new in any combination keep working; v2
semantics are only active when both ends support them.
%%%%%%%%%%%%%%%%%%%%%%%%%%
= NOTES ON RELEASE 4.1.4 =
%%%%%%%%%%%%%%%%%%%%%%%%%%
This final release of ION 4.1.4 represents the culmination of extensive security
hardening, protocol enhancements, and platform portability improvements since the
4.1.4-b.1 beta release. The release includes 288 commits addressing critical security
vulnerabilities, implementing CCSDS Orange Book custody transfer specifications, adding
new convergence layer adapters, and improving system stability across all supported
platforms.
!!! IMPORTANT BUILD NOTE — Clean rebuild required !!!
The size of the `ResourceLock` opaque buffer in `ici/include/platform.h`
was increased from `uvast opaque[13]` (104 bytes on 64-bit) to
`uvast opaque[24]` (192 bytes) to accommodate RTEMS 6 on AArch64,
where the underlying `pthread_mutex_t` is significantly larger than
on glibc Linux. A compile-time assertion in `ici/library/platform.c`
(`verify_sufficient_semaphore_space[]`) guards this size and will
fail the build if it is ever too small for the target platform.
This is an ABI-breaking change for any translation unit that embeds
a `ResourceLock` in a struct. After updating to 4.1.4, every ION
component (`.a`, `.so`, daemons, tools, and any downstream application
linking against ION) MUST be rebuilt from source. Linking a newly
compiled header against a pre-built library with the old layout will
produce silent memory corruption.
No migration of persistent state is required: `ResourceLock` is only
used in process-local memory (function/file-scope static variables in
ici and ams, and heap-allocated fields inside single-daemon state in
bpv7/ipnd and nm). No `ResourceLock` is embedded in SDR storage, in
the SM working-memory partition, or in any data structure exchanged
between processes, so in-flight nodes do not need to flush or rewrite
any shared-memory state across the upgrade — they only need a clean
ION rebuild followed by a normal restart.
Critical Security Fixes
- **File Transfer Security**: Fixed multiple critical vulnerabilities in sendfile/recvfile:
- Path traversal vulnerability allowing access outside designated directories
- Stack overflow in file path handling
- Time-of-check/time-of-use (TOCTOU) race conditions
- Resource leaks and improper memory cleanup
- Added input validation and secure path canonicalization
- **BPSec Policy Engine**: Added NULL checks for security policy radix trees to prevent
crashes during rule lookup with missing or invalid policy configurations.
- **Input Validation**: Enhanced validation throughout the codebase including:
- Canonical extension block number validation (must be < 255)
- Stricter sscanf return value checking to prevent buffer overflows
- Improved error handling for malformed configuration inputs
Custody Transfer and Bundle Management (CCSDS Orange Book Compliance)
- **Aggregate Custody Signals (CBR/CT)**: Complete implementation of CCSDS Custody
Transfer and Bundle Refusal specifications:
- CTEB (Custody Transfer Extension Block) for custody metadata
- CREB (Custody Refusal Extension Block) for refusal reasons
- CRS (Compressed Reporting Signals) using CBOR encoding
- Custody-originated tracking and bundle detention mechanisms
- Support for non-zero sequence IDs in custody signals
- Comprehensive test suite with isolated subtests for each feature
- Full API documentation and man pages
- **Bundle Lifecycle Management**: Enhanced bundle state tracking throughout custody
transfer operations with proper validation of custody acceptance/refusal conditions.
New Convergence Layer Adapters
- **File CLA**: Production implementation of file-based convergence layer adapter
for applications requiring file system-based bundle exchange, with complete
documentation and man pages.
- **SPP/EPP CLA Prototypes**: Initial prototypes for specialized convergence layers:
- SPP (Space Packet Protocol) CLA with loopback provider stub
- EPP (Encapsulation Packet Protocol) CLA with loopback provider stub
- Regression test templates and online documentation
- Error handling improvements for transmission success/failure cases
LTP Protocol Enhancements
- **Statistics Collection**: Implemented C11 atomic operations for lock-free LTP
statistics batching, significantly improving performance under high load.
- **Session Management**:
- Fixed checkpoint timer cancellation when receiving partial segment coverage,
preventing sender from getting stuck in limbo state
- Added import session inactivity timeout to prevent denial-of-service from
incomplete sessions
- Improved LTP cancel segment acknowledgment for completed sessions
- **Monitoring Tools**:
- New ltpstats utility for real-time LTP performance monitoring
- Enhanced ltpwatch with improved reporting capabilities
Bundle Protocol (BP) Improvements
- **Statistics and Monitoring**:
- Implemented C11 atomic operations for lock-free BP statistics collection
- Fixed BP statistics naming inconsistencies
- Exposed numBundlesDeleted counter in bpnmtest
- Corrected bpstats delivery (dlv) reporting
- **Extension Block Management**:
- Fixed extension block number duplication when cloning bundles for multicast
or fragmentation
- Added verification that payload block number is always 1
- Improved extension block documentation explaining ION's behavior and rationales
- Removed obsolete HIRR (Hop-in-Route-Record) code
- **Routing Enhancements**:
- Allow best-effort bundles to use reliable CLAs when no unreliable CLA available
- Fixed TOCTOU race in contact state checking during bundle transmission
- Fixed egress plan configuration errors
SDR (Simple Data Recorder) Enhancements
- **Performance Instrumentation**: Added comprehensive SDR transaction performance
monitoring controlled by --enable-sdr-perf configure option:
- Transaction timing and throughput measurement
- Caller tracking for performance profiling
- Improved diagnostics for SDR modification sources
- **Reversibility and Recovery**:
- Enhanced ionrestart recovery with defensive checks for transaction cancellation
- Fixed SDR owner mismatch during ionrestart
- Improved sdr_exit_xn to trigger proper cancellation instead of aborting
- Converted fatal CHKZERO assertions in sdr_list operations to defensive warnings
- Added documentation on SDR reversibility mechanisms
Error Handling and Reliability
- **CHK Assertion Improvements**:
- Added fail-fast mode for CHK assertion macros
- Implemented stack trace support for FreeBSD, macOS, and Linux
- Graceful error handling for CHK assertions during shutdown/ionrestart
- Defensive ownership checks before SDR writes to handle transaction cancellation
- **Daemon Management**:
- Daemonized psmwatch and sdrwatch with automatic configuration detection
- Fixed ionrestart race conditions in daemon startup
- Improved ionexit hang handling after TCP outduct stop/start
- Enhanced monitoring utility descriptions and usage documentation
- **Semaphore Management**:
- Fixed POSIX named semaphore race conditions causing segmentation faults in bpcp
- Implemented reference counting and deferred deletion for semaphores
- Fixed sm_SemTake to return 0 when semaphore is ended
- Resolved semaphore cleanup ordering issues
CFDP (File Delivery Protocol) Improvements
- **Race Condition Fixes**:
- Fixed CFDP event queue race condition with producer-consumer mutex pattern
- Proper semaphore state management and cleanup ordering
- Fixed event_wait_id handling to prevent segmentation faults
- **Compilation Fixes**:
- Fixed checksum function signature compatibility with --enable-high-speed option
Network Management and Administration APIs
- **Bulk Removal APIs**: Added runtime reconfiguration capabilities for:
- Outducts and inducts
- Endpoints and spans
- Seats and egress plans
- Complete test coverage in admin_public_api/bulk_removal
- **AMP/NM Enhancements**:
- Fixed bp_agent ADM type mismatches with ION-specific extensions
- Fixed zero timestamp in AMP agent registration messages
- Updated conformance test infrastructure with Python 3.9+ requirement
Platform Portability
- **macOS**:
- Added newline to ltpcancel.c to quiet compiler warnings
- Fixed watchdog test termination issues
- Fixed ipaddr-caching tests for mDNS-enabled systems
- **FreeBSD**:
- Fixed date command syntax compatibility
- Improved backtrace linking
- Updated stack trace support
- Fixed LTP cancel tests with prerequisite checks
- Excluded problematic CFDP tcputa tests due to timing issues
- **Solaris**:
- Replaced bzero with memset for POSIX compliance (gf-complete build)
- Fixed grep compatibility for POSIX compliance
- Improved UDP buffer handling for larger Solaris defaults
- Added Solaris-specific test adjustments
Testing Infrastructure
- **Test Framework Enhancements**:
- Added --from and --to options to runtests for selective test execution
- Implemented stress test mode for debugging
- Added timeout support to prevent tests from hanging
- Improved test cleanup scripts and IPC artifact management
- Skip tests gracefully when required tools or conditions are missing
- **CI/CD Improvements**:
- Added Fedora 42 to BETR platform regression testing
- Added merge queue support to required CI workflows
- Updated RTEMS regression test PR status reporting
- Improved workflow permissions for security compliance
Build System and Dependencies
- **Third-Party Libraries**:
- Switched from ZFEC to Jerasure and GF-Complete libraries for erasure coding
- Updated licensing terms and TC README for third-party dependencies
- Added pkg-config support with comprehensive documentation
- **Code Quality**:
- Added EditorConfig and clang-format configuration files
- Enforced .git-blame-ignore-revs for mass formatting changes
- Removed obsolete code (BPv6 references, ACS infrastructure, ECLSA v2)
- Fixed hundreds of compiler warnings across all warning levels
Documentation Improvements
- **Man Pages**:
- Fixed cross-references and formatting across all man pages
- Corrected DTPC typos to DTPC throughout documentation
- Added missing man pages for CBR/CT APIs
- Enhanced ionsecadmin, ionrc, ipnadmin, and other admin utility documentation
- Improved CFDP, TC, and DTKA utility documentation
- **Technical Documentation**:
- Added SDR reversibility documents
- Reorganized documentation categorization
- Added IPN name transition document
- Enhanced documentation on monitoring tools usage
- Added regression test documentation for EXPERT setting
Code Cleanup
- **Standards Compliance**:
- Compliant #include guard names throughout codebase
- Proper #endif comments for all include guards
- Fixed header inclusion ordering and dependencies
- Removed redundant and commented-out code
- **Removed Legacy Code**:
- Removed all BPv6-related code and configuration
- Removed bpversion utility (superseded by version commands in admin tools)
- Removed bprecvfile2 (obsolete)
- Removed duplicate source files (ams/library crypt.c and marshal.c)
- Cleaned up obsolete demos and redundant tests
Bug Fixes
- **Bundle Processing**:
- Fixed acquireEid return value check and bundleZco leak
- Fixed parseEidString concurrency issue with internal copy
- Fixed bpecho spurious "!" output and added TTL option
- Fixed bpcancel to use strtouvast() for creationMsec parsing
- Fixed bss-multicast infinite loop when stdin is redirected
- **Network Operations**:
- Fixed CLA loopback tests leaving orphaned processes
- Fixed TCP outduct receive thread shutdown
- Fixed bpcp Remote_Remote transfer race condition on exit
- Fixed stdout redirection pattern compatibility
- **Memory and Resource Management**:
- Fixed unsigned underflow in SDR performance time difference macro
- Improved reference counter management throughout codebase
- Fixed qualifier and const restriction issues
Miscellaneous
- **Command Line Tools**:
- Added linenoise library for command history support in interactive tools
- Updated system_up script to check only required programs per test
- Improved error messages and diagnostic output
- **Development Tools**:
- Renamed dev makefile platform from i86_64-fedora to x86_64-linux
- Updated build configuration for TC module integration
- Fixed ionwatch compilation issues
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
= NOTES ON RELEASE 4.1.4-b.1 =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
This beta release represents a major milestone with the completion of the RTEMS 6.1
port, significant improvements to code quality and portability, new networking
capabilities, and enhanced utilities for bundle management and CFDP file transfers.
RTEMS 6.1 Real-Time Operating System Port
- Full RTEMS 6.1 Port: ION has been successfully ported to RTEMS 6.1 for ARM64
(AArch64) platforms, featuring:
- Support for RTEMS libbsd (FreeBSD network stack) integration
- UDP-based LTP networking tested and verified in QEMU simulation
- 64-bit addressing support (SPACE_ORDER=3)
- ION Admin Public API for configuration (no configuration files required)
- Comprehensive documentation in arch-rtems/ directory
- Template implementation for adaptation to specific hardware platforms
- CI/CD workflow integration for RTEMS builds
Dual-Stack IPv4/IPv6 Networking Support
**IMPORTANT NOTE ON DUAL-STACK NETWORKING**: The dual-stack IPv4/IPv6 capability
will automatically use the network address family returned by hostname resolution.
Most operating systems return IPv6 addresses first when available, and ION's network
stack will use the first entry returned. If a host is not properly configured for
the returned address family, this may cause network address family conflicts,
resulting in connection failures for TCP, UDP, and LTPCLA (which runs over UDP).
The most reliable approach is to use explicit IP addresses if known. If using
hostnames, ensure all hosts resolve to the correct address family as the first entry
in DNS resolution.
- LTPCL Dual-Stack: Added experimental dual-stack IPv4 and IPv6 support for the
LTP Convergence Layer, allowing nodes to communicate over both protocol versions
simultaneously.
- TCPCL Dual-Stack: Implemented dual-stack IPv4 and IPv6 support for the TCP
Convergence Layer with regression tests.
- UDPCL Dual-Stack: Previously introduced in 4.1.4-a.2, further refined and tested
for production use.
New Bundle Management Utilities
- bpinspect: New utility for inspecting, filtering, and managing bundles in ION's
custody. Features include:
- Bundle listing with detailed metadata
- Filtering by source, destination, creation time, and other attributes
- Suspend and resume operations for selective bundle processing
- Critical bug fix for bp_suspend functionality
- bptracker: Enhanced interactive mode for demonstration of bundle tracking
capabilities, providing fine-grained control over individual bundles with:
- Flexible send syntax
- Real-time bundle status monitoring
- Source routing record (SRR) parsing improvements
- bpcrash_hard: New testing utility for validating ION's crash recovery and
reversibility features under extreme failure conditions.
CFDP Enhancements
- Enhanced cfdptest Utility: Major improvements to the CFDP testing tool:
- Transaction tracking and summary display
- Per-transaction control commands (cancel, suspend, resume)
- Terminology updates (ack → closure-reqt) for RFC compliance
- Reset command (R) to clear source/destination filenames
- Version command (v) for build information
- Updated man pages and usage documentation
- Empty File Transfer: ION now correctly handles CFDP transfers of zero-byte files.
- Automatic Proxy Launch: CFDP server proxy (bpcpd) can now be automatically
launched through cfdprc configuration file.
- Event Reporting: Enhanced CFDP event reporting API with more detailed file
transfer status and progress information, including closureRequested field.
LTP Protocol Improvements
- Dynamic Parameter Control: New capability for direct configuration of LTP
maxRetries and segment loss rate parameters with updated regression tests.
- Default Value Behavior: Updated default parameter handling for improved
reliability and performance.
Code Quality and Standards Compliance
- C18/C99 Compliance: Updated build system to prefer C18 (ISO 9899:2018) standard
with fallback to C99, ensuring maximum portability and standards compliance.
- Strict Compiler Warnings: Enforced -Wextra, -Wstrict-prototypes, and -pedantic
compiler flags across the entire codebase, resolving hundreds of warnings to
improve code quality and catch potential bugs.
- Thread Safety: Implemented thread-safe versions of iToa, uToa, vastToa, and
uvastToa functions with proper type-specific conversions for 32-bit systems.
- POSIX Compliance: Refactored POSIX named semaphore implementation with reference
counting and deferred deletion to mitigate race conditions, particularly for
bpcp utility.
Security and Stability Fixes
- Extension Block Overflow: Fixed buffer overflow vulnerability when processing
non-standard extension blocks. Added regression test for memory allocation
vulnerabilities.
- BPSec Configuration: Corrected handling of bundles with no CRC and no BIB,
with tests to verify proper rejection of invalid security configurations.
- NULL Source EID Handling: Fixed bug in handling NULL source EIDs and state
changes between bundle list and cancel operations.
- Race Condition Fixes: Addressed semaphore cleanup race conditions in bpcp and
resource lock initialization issues.
Contact Graph Routing (CGR) Enhancements
- Adjacent Contact Support: Prototype support for adjacent contact routing with
documentation and test cases.
- Routing Visualization: Automated generation of routing visualization data
through cgrfetch utility improvements, enabling graphical analysis of routing
decisions.
- CGR Analysis Tools: Refactored cgr-test and asymmetric-range tests to produce
sample CGR analysis data with comprehensive usage documentation.
Platform Portability Improvements
- macOS Compatibility: Resolved multiple platform-specific issues including
compilation syntax errors and system() call restrictions with active child
processes.
- FreeBSD Support: Updated for compatibility with FreeBSD networking stack and
build environment, including tar-over-ssh deployment for CI/CD.
- Solaris Support: Addressed compiler warnings specific to Solaris and added
timeout protections for test suite stability.
- ARM Architecture: Fixed ARM default unsigned char issues in tcpcli.c and other
platform-specific type handling.
- MUSL libc: Enhanced compatibility with MUSL C library and Clang compiler, though
semaphore limitations require single-instance deployment per host.
Build System Enhancements
- Configure Options: New options to selectively disable DGR and BSSP modules
(--disable-dgr, --disable-bssp) for minimal builds.
- ion-core Build: Per-extension build options for customized ion-core package
configurations.
- Development Makefiles: Continued maintenance and updates to manual Makefile.dev
system for i86_64-fedora platform, including support for new executables:
- SPP convergence layer (sppcli, sppclo)
- New test utilities (entropy_test, sdr_test_util)
- Bundle inspection tool (bpinspect)
- Additional diagnostic tools
Testing and CI/CD Improvements
- Regression Test Suite: Enhanced test infrastructure with:
- Optional test designation for non-critical tests
- Improved cleanup handling for failed tests
- Timeout mechanisms to prevent hanging tests
- Preservation of test logs (PRESERVE_TEST_LOG default to 1)
- Automated ION security database initialization
- GitHub Actions Workflows: Updated CI/CD pipelines with:
- RTEMS-specific build workflow
- Submodule initialization improvements
- Workspace cleanup between runs
- ion.log capture and custom timeout support
- JSON dependency validation
- Cross-Platform Testing: Expanded test coverage across Linux, macOS, FreeBSD,
and Solaris platforms with platform-specific accommodations.
Documentation Updates
- Public API Documentation: Added comprehensive online documentation for ION's
public administrative API set.
- RTEMS Documentation: Complete documentation package for RTEMS 6.1 port in
arch-rtems/ directory, including:
- Installation and build instructions
- Key fixes and troubleshooting guide (KEY-FIXES-SUMMARY.md)
- UDP network status and configuration (UDP-NETWORK-STATUS.md)
- Platform-specific customization guidelines
- Man Page Updates: Updated documentation for LTP maxRetries parameter
clarification and deprecated maxber usage in regression tests.
Deprecations and Cleanup
- maxber Parameter: Deprecated use of maxber in regression tests; updated
documentation to clarify proper usage.
- Legacy Code Removal: Continued cleanup of obsolete code including old dtnperf
(now part of dtnsuite).
- SBSP References: Removed confusing SBSP references from build flags and include
paths.
Known Issues and Limitations
- MUSL libc: Named semaphore limitations restrict deployment to one ION instance
per host; many regression tests will fail due to this constraint.
- RTEMS Port: Template implementation requires adaptation to specific hardware
platforms and BSPs; loopback testing defaults to 127.0.0.1.
- Dual-Stack Networking: IPv4/IPv6 dual-stack features remain experimental;
production deployments should be thoroughly tested.
Developer Notes
- Thread Synchronization: Refactored libams to use platform abstraction layer for
thread synchronization.
- Type Conversions: Created type-specific ToString functions (vastToa, uvastToa,
size_tToa) for improved type safety and 32/64-bit compatibility.
This beta release includes 162 commits since ION 4.1.4-a.2, representing extensive
testing, refinement, and new capabilities. Users are encouraged to test thoroughly
in their environments and report any issues through the GitHub issue tracker.
= Release Notes for ION 4.1.4-a.2 =
September 19, 2025
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
= NOTES ON RELEASE 4.1.4-a.2 =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
This release introduces several new experimental features, key updates, and
bug fixes while removing obsolete code.
Removal of BPv6
The BPv6 codebase has been removed starting with this release. This legacy
code had remained unchanged since ION version 3.7.4. For users who still
require BPv6, the final stable release containing it is ION 4.1.3s.
Experimental Features
- Dual-Stack for UDPCLA: Introduced experimental support for IPv4 and IPv6
dual-stack networking in the UDP Convergence Layer Adapter.
- 'IPN' URI Scheme: Added a prototype implementation for the updated 'IPN'
URI scheme, as specified in RFC 9758.
- SPP Convergence Layer: Included a prototype of the Space Packet Protocol
(SPP) convergence layer adapter for experimentation.
Improvements & Stability Fixes
- Security: A new, robust, and platform-native entropy polling module has
been added to meet high-integrity standards for cryptographic key generation.
- Networking: An address caching and re-resolution mechanism was added for
the UDPCL output and LSO daemons (UDPCLO/UDPLSO).
- The ION codebase has been decoupled from GNU-C extensions to improve
portability.
- ION can now be compiled on MUSL libc using the Clang compiler.
Due to limitation of the maximum allowed named semaphores for MUSL, it
is recommended that user deploy only 1 instance of ION per host. Many
regression tests are expected to fail since they require multiple instances
of ION running simultaneously on the same host.
- Fixed a bug in the ionlauncher capability.
- Resolved an issue in the ionTerminate function that caused crashes
during the ION shutdown process.
- Corrected a bug that allowed a node to source a bundle with an incorrect
node number.
- The cfdptest program was updated to provide detailed event reporting and
a new directory listing command. The event reporting API was also enhanced
to deliver more detailed file transfer status and progress.
- The obsolete civetweb-based REST API for the network management module
has been removed.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
= NOTES ON RELEASE 4.1.4-a.1 =
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Beginning with ION 4.1.4, alpha and beta releases will be issued between the
releases to make new features and bugfixes available for community testing.
Alpha and Beta releases are tested on a limited number of platforms and may
contain known bugs/idiosyncrasies, which will be documented in the release
notes.
Updates for alpha release #1:
update-4.1.4-cfdp-out-of-order-eof
* Updates CFDP algorithm handling of out-of-order arrival PDUs.
update-4.1.4-a1-bpsec-config-doc
* Adds BpSec configuration example to online documentation.
multicast-issue-273-4.1.4
* Fixes an issue related to Multicast startup order requirement.
multicast-issue-273-4.1.4
* Fixes issue with multicast startup order
update-4.1.4-keygentime-fix
* Fixes a specific DTKA configuration issue.
update-4.1.4-freebsd-update
* Update to address various freebsd build issues
update-4.1.4-fix-ovrd-crash
* Fix crash caused by reading deleted bundle's ovrd metadata in SDR.
update-4.1.4-unibo-cgr-relocate
* Relocate unibo-cgr code to contrib folder as a git submodule referencing external repository where code is actively maintained. This change also applies to the dtnsuite and dtnperf source code in the contrib folder. Removed the RGR extension block code that contains security vulnerability; notify the developer of Unibo-CGR to update the code upstream.
update-4.1.4-resource-lock-fix
* This resolved the main issue of correctly initializing the mutex (the previous mutex was repeatedly initialized); upgrade to POSIX recursive mutex to simply operation. For older SVR4 Unix-based systems, such as Solaris predating v10, it may not work. Similarly, on Windows, older mingw may not work.
update-4.1.4-lockPartition-concurrency-fix
* Fix concurrency issues of partitionLock
update-4.1.4-windows-build
* Update instructions and dependency installation scripts for windows 10 build prototype
update-4.1.4-address-sanitizer-rebase
* Fix buffer and various memory overflow discovered by address sanitizer instrumentation.
update-4.1.4-issue_455_mc_doc
* Adds best practices for multicast to documentation
update-4.1.4-tc-dtka-duration
* Reduce regression test time for dtka using only 1 key type; can be changed by env variables set at test time.
update-4.1.4-ionterminate
* Fixes a segfault whenever ION shutdown routines are called (ionTerminate)
and ensures ION shared resources are released.
* This is work-in-progress due to concurrency issues: if another process tries
to access the SDR while ionTerminate() is running, that other process has
been observed to segfault; but the shutdown routine itself still finishes
successfully and releases shared resources. This is an improvement over the
previous unavoidable segfault in ionTerminate() that always left the SDR
shared memory in an unusable and unrecoverable state, from then on
triggering failures or segfaults in processes attempting to attach to or
reinitialize the SDR.
%%%%%%%%%%%%%%%%%%%%%%%%%%%
= NOTES ON RELEASE 4.1.3s =
%%%%%%%%%%%%%%%%%%%%%%%%%%%
Beginning with the ION 4.1.3s release, ION will include support for compilation
with Mbed TLS cryptographic library. ION version 4.1.3s includes support for Mbed TLS version 2.28.
To enable use of Mbed TLS cryptogrpahic library in ION, you must have already built the Mbed TLS
version 2.28.x shared libraries with #define MBEDTLS_NIST_KW_C enabled (see mbedtls/include/mbedtls/config.h).
Make sure the Mbed TLS assets are installed in /usr/local/include/ and
/usr/local/lib with correct permissions, or you can define alternate
locations by running:
./configure --enable-crypto-mbedtls MBED_LIB_PATH=/path/to/libraries MBED_INC_PATH=/path/to/includes
To build Mbed TLS:
1. Download the Mbed-TLS 2.28.2 source code.
2. Open mbedtls-2.28.x/include/mbedtls/config.h and uncomment the line
that has #define MBEDTLS_NIST_KW_C commented out by default.
3. Run the following commands:
Linux and MacOS)
make SHARED=1
sudo make install
Windows 7)
make CC="gcc -std=c99" WINDOWS_BUILD=1 SHARED=1
make CC="gcc -std=c99" WINDOWS_BUILD=1 install
* NOTE: this should install things in /msys/local which is okay
To compile ION with MBEDTLS_SUITES configure with:
./configure --enable-crypto-mbedtls
To enable BPSec logging (recommended for verification of BPSec functionality and required by BPSec regression tests)
use the following configuration flag:
--enable-bpsec-debugging
The following code changes have been made to support this option:
* Added ici/MBEDTLS_SUITES folder.
* Updated configure.ac and Makefile.am to allow for linking against
MBEDTLS libraries.
ION 4.1.3s provides a 'enable_manual_build.sh' script that switches ION from autoconf build system (the default)
to the manual developmental build system based consisting of a Makefile at the root of ION source tree and a set of Makefiles
under the directories of individual components of ION. See the online documentation for more details.
Branches included in this release:
update-4.1.3s-ion-documentation
* Update ION documentation files.
update-4.1.3s-bpcounter-delivery-release
* Updates the bpcounter.c program so it releases the pilot bundle.
update-4.1.3s-dtnnone-vulnerability
* Addresses a vulnerability that freezes ION if a bundle with
null-endpoint were injected into ION node.
update-4.1.3s-imc-pnb-extblock-crash
* Fixes a vulnerability when a pnb extension block contains invalid eid
(or say imc scheme for a node that does not recognize it) causing a crash
of the bundle acquisition process.
update-4.1.4-test-suite
* General improvements to the test scripts.
update-4.1.3s-cgrfetch
* Fixes a segfault at the end of cgrfetch call.
update-4.1.3s_libmetadata_libsecypt
* Includes branch update-4.1.3s_bpsec_updates and also update-4.1.3s_secfix_testfix