Merge track A: VERSION discipline, rekey, migration, rate limiting, O(1) index

src/config.rs

@@ -28,6 +28,14 @@ pub struct ServerConfig {
     pub authorized_keys: Vec<String>,
     #[serde(default = "default_native_auth_rate_limit_per_minute")]
     pub native_auth_rate_limit_per_minute: u32,
+    /// Rotate a client's transport traffic key after this many packets in the
+    /// current epoch (spec §11). `0` disables the packet-count trigger.
+    #[serde(default = "default_rekey_after_packets")]
+    pub rekey_after_packets: u64,
+    /// Rotate a client's transport traffic key after this many wall-clock seconds
+    /// in the current epoch (spec §11). `0` disables the time trigger.
+    #[serde(default = "default_rekey_after_secs")]
+    pub rekey_after_secs: u64,
     #[serde(default = "default_true")]
     pub allow_tcp_forwarding: bool,
     #[serde(default)]
@@ -61,6 +69,8 @@ impl Default for ServerConfig {
             host_key: default_host_key(),
             authorized_keys: default_authorized_keys(),
             native_auth_rate_limit_per_minute: default_native_auth_rate_limit_per_minute(),
+            rekey_after_packets: default_rekey_after_packets(),
+            rekey_after_secs: default_rekey_after_secs(),
             allow_tcp_forwarding: true,
             allow_remote_forwarding: false,
             allow_remote_non_loopback_bind: false,
@@ -180,6 +190,18 @@ fn default_native_auth_rate_limit_per_minute() -> u32 {
     30
 }
 
+fn default_rekey_after_packets() -> u64 {
+    // Rotate well before any AEAD nonce-reuse concern; ChaCha20-Poly1305 with a
+    // per-direction monotonic seq is safe far beyond this, but a bounded epoch
+    // keeps forward-secrecy windows small.
+    100_000
+}
+
+fn default_rekey_after_secs() -> u64 {
+    // One hour per epoch by default.
+    3600
+}
+
 fn default_auth_preference() -> String {
     "native,ssh".to_string()
 }