Versions in this module Expand all Collapse all v0 v0.19.0 Jul 21, 2026 v0.18.0 Jul 21, 2026 Changes in this version + const AESGCM128 + const AESGCM256 + const ALPN + const Initiator + const MasterKeyLen + const MaxVNI + const ProtocolVersion + const Responder + const RootSecretLen + var ErrGrantRejected = errors.New("control: key request rejected by responder") + var ErrSPIExhausted = errors.New("control: SPI counter space exhausted; master-key rotation required") + var ErrVNIExhausted = errors.New("control: VNI space exhausted") + func CanonicalInitiator(localPub, peerPub *ecdsa.PublicKey) (bool, error) + func ClientTLSConfig(local *Identity, peerPub *ecdsa.PublicKey) (*tls.Config, error) + func DeriveSAKey(masterKey []byte, spi uint32, v ICXVersion) ([]byte, error) + func ExportRootSecret(cs tls.ConnectionState) ([]byte, error) + func MakeSPI(masterKeyIndex int, role Role, counter uint32) (uint32, error) + func MarshalPublicKey(pub *ecdsa.PublicKey) (string, error) + func MasterKeyIndex(spi uint32) int + func ParsePublicKey(s string) (*ecdsa.PublicKey, error) + func PublicKeyEqual(a, b *ecdsa.PublicKey) bool + func ReservedSPI(spi uint32) bool + func ServerTLSConfig(local *Identity, peerPub *ecdsa.PublicKey) (*tls.Config, error) + func ServerTLSConfigAuth(local *Identity, authorize PeerAuthorizer) (*tls.Config, error) + type DirectionalSAs struct + Master [MasterKeyLen]byte + RxSPI uint32 + TxSPI uint32 + Version ICXVersion + type ICXVersion = psp.ICXVersion + type Identity struct + func GenerateIdentity() (*Identity, error) + func LoadIdentityPEM(pemBytes []byte) (*Identity, error) + func (id *Identity) Fingerprint() (string, error) + func (id *Identity) MarshalPrivatePEM() ([]byte, error) + func (id *Identity) PublicKey() *ecdsa.PublicKey + func (id *Identity) PublicKeyString() (string, error) + func (id *Identity) TLSCertificate() (tls.Certificate, error) + type KeyGrant struct + SAs *DirectionalSAs + VNI uint32 + type KeyGranter interface + Grant func(peer *ecdsa.PublicKey, addr netip.Addr, sas *DirectionalSAs) (vni uint32, err error) + Release func(peer *ecdsa.PublicKey, vni uint32) error + type Listener struct + func Listen(pconn net.PacketConn, local *Identity, peerPub *ecdsa.PublicKey) (*Listener, error) + func ListenPeers(pconn net.PacketConn, local *Identity, authorize PeerAuthorizer) (*Listener, error) + func (l *Listener) Accept(ctx context.Context) (*Session, error) + func (l *Listener) Addr() net.Addr + func (l *Listener) Close() error + type MasterKeys struct + func DeriveMasterKeys(rootSecret []byte) (*MasterKeys, error) + func (m *MasterKeys) DeriveSA(spi uint32, v ICXVersion) (*SA, error) + type PeerAuthorizer func(peerPub *ecdsa.PublicKey) error + func PinnedPeer(peerPub *ecdsa.PublicKey) PeerAuthorizer + type Role = psp.Role + func RoleOf(spi uint32) Role + type SA struct + Key []byte + SPI uint32 + Version ICXVersion + type SAInstaller func(master [MasterKeyLen]byte, rxSPI, txSPI uint32) error + type SPIAllocator struct + func NewSPIAllocator(role Role) *SPIAllocator + func (a *SPIAllocator) Allocate(masterKeyIndex int) (uint32, error) + type Session struct + func Dial(ctx context.Context, pconn net.PacketConn, peerAddr net.Addr, local *Identity, ...) (*Session, error) + func (s *Session) Close() error + func (s *Session) Context() context.Context + func (s *Session) MasterKeys() *MasterKeys + func (s *Session) NegotiateSAs(ctx context.Context, v ICXVersion) (*DirectionalSAs, error) + func (s *Session) PeerPublicKey() (*ecdsa.PublicKey, error) + func (s *Session) ReleaseKeys(ctx context.Context, vni uint32) error + func (s *Session) RequestKeys(ctx context.Context, v ICXVersion, addr netip.Addr) (*KeyGrant, error) + func (s *Session) Role() Role + func (s *Session) ServeKeyPlane(ctx context.Context, granter KeyGranter) error + func (s *Session) TLSState() tls.ConnectionState + type Tunnel struct + func NewTunnel(cfg TunnelConfig, install SAInstaller) (*Tunnel, error) + func (t *Tunnel) Bringup(ctx context.Context) (err error) + func (t *Tunnel) Close() error + func (t *Tunnel) Initiator() bool + func (t *Tunnel) Run(ctx context.Context) error + type TunnelConfig struct + Conn net.PacketConn + Local *Identity + PeerAddr net.Addr + PeerPub *ecdsa.PublicKey + RekeyInterval time.Duration + type VNIAllocator struct + func NewVNIAllocator(grace time.Duration) *VNIAllocator + func (a *VNIAllocator) Allocate() (uint32, error) + func (a *VNIAllocator) Live() int + func (a *VNIAllocator) Release(vni uint32)
Go to main page