Documentation
¶
Overview ¶
Package tagger provides a transparent IPv4 IPID tagger that injects a 16-bit TESLA-derived authentication tag into every outgoing IPv4 packet.
The tagger operates at the Go socket layer and is invisible to the WASM debuglet module. It wraps outgoing net.Conn and net.PacketConn connections via WrappedConn / WrappedPacketConn.
Tag Placement ¶
The 16-bit tag is written into the IPv4 Identification (IPID) field (bytes 4–5 of the IPv4 header, big-endian). The IPv4 header checksum is recomputed after the field is updated.
Platform notes ¶
Tagging is performed in pure Go and runs on all platforms. On Linux an additional eBPF-based tagger is available for in-kernel, zero-copy tagging (see internal/executor/tagger/ebpf).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IPv4Checksum ¶
IPv4Checksum computes the one's-complement checksum over an IPv4 header (helper exposed for tests).
Types ¶
type Tagger ¶
type Tagger struct {
// contains filtered or unexported fields
}
Tagger is the pure-Go IPv4 IPID tagger backed by a TESLA key schedule.
func New ¶
func New(schedule *tesla.KeySchedule, measurementID []byte) *Tagger
New creates a Tagger for the given key schedule and measurement ID. measurementID should be the raw bytes of the measurement UUID string.
func (*Tagger) Schedule ¶
func (t *Tagger) Schedule() *tesla.KeySchedule
func (*Tagger) SetSocketMark ¶
func (*Tagger) TagPacket ¶
TagPacket rewrites the IPID field of a raw IPv4 packet and recomputes the IPv4 header checksum. The packet is modified in-place; the same slice is returned.
The HMAC tag is computed over the packet in canonical form: both the IPID field (bytes 4–5) and the IPv4 header checksum field (bytes 10–11) are zeroed before hashing. This allows a verifier to reproduce the same hash input without knowing the original checksum or IPID values.
If pkt does not begin with a valid IPv4 header (version 4, IHL ≥ 5) the packet is returned unmodified without error. While the schedule has no usable signing key (epoch 0, whose key is the public anchor) the packet is likewise returned unmodified and untagged, as on the eBPF path.
type TaggerInterface ¶
type TaggerInterface interface {
// TagPacket rewrites the IPID field of the raw IPv4 packet bytes in-place
// and returns the modified slice. The slice may be the same underlying
// array as pkt (modified in-place) or a copy.
TagPacket(pkt []byte) ([]byte, error)
SetSocketMark(fd int) error
Close() error
Schedule() *tesla.KeySchedule
}
TaggerInterface is the abstraction used by both the pure-Go tagger and the eBPF tagger, enabling performance comparison.
type WrappedConn ¶
WrappedConn wraps a net.Conn and tags every Write with the Tagger before sending. Reads pass through unmodified. All other net.Conn methods delegate to the underlying connection.
func WrapConn ¶
func WrapConn(c net.Conn, t TaggerInterface) *WrappedConn
WrapConn returns a WrappedConn that tags outgoing packets.
type WrappedPacketConn ¶
type WrappedPacketConn struct {
net.PacketConn
// contains filtered or unexported fields
}
WrappedPacketConn wraps a net.PacketConn and tags every WriteTo call.
func WrapPacketConn ¶
func WrapPacketConn(c net.PacketConn, t TaggerInterface) *WrappedPacketConn
WrapPacketConn returns a WrappedPacketConn that tags outgoing packets.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package ebpf provides an eBPF-based IPv4 IPID tagger for Linux.
|
Package ebpf provides an eBPF-based IPv4 IPID tagger for Linux. |
|
Package tesla implements a TESLA-inspired hash-chain key schedule for delayed disclosure of packet authentication keys.
|
Package tesla implements a TESLA-inspired hash-chain key schedule for delayed disclosure of packet authentication keys. |