Documentation
¶
Overview ¶
Package tagger provides a transparent IPv4 IPID tagger that injects a 16-bit TESLA-derived authentication tag into every outgoing IPv4 packet.
The tagger operates at the Go socket layer and is invisible to the WASM debuglet module. It wraps outgoing net.Conn and net.PacketConn connections via WrappedConn / WrappedPacketConn.
Tag Placement ¶
The 16-bit tag is written into the IPv4 Identification (IPID) field (bytes 4–5 of the IPv4 header, big-endian). The IPv4 header checksum is recomputed after the field is updated.
Platform notes ¶
Tagging is performed in pure Go and runs on all platforms. On Linux an additional eBPF-based tagger is available for in-kernel, zero-copy tagging (see internal/executor/tagger/ebpf).
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrDatagramUntagged = errors.New("tagger: datagrams on this connection cannot be tagged in user space")
ErrDatagramUntagged reports a connection whose datagrams the pure-Go tagger cannot tag: not IPv4, not UDP or ICMP, or no raw socket available. The caller keeps using the connection untagged.
Functions ¶
func IPv4Checksum ¶
IPv4Checksum computes the one's-complement checksum over an IPv4 header (helper exposed for tests).
Types ¶
type Tagger ¶
type Tagger struct {
// contains filtered or unexported fields
}
Tagger is the pure-Go IPv4 IPID tagger backed by a TESLA key schedule.
func New ¶
func New(schedule *tesla.KeySchedule, measurementID []byte) *Tagger
New creates a Tagger for the given key schedule and measurement ID. measurementID should be the raw bytes of the measurement UUID string.
func (*Tagger) Schedule ¶
func (t *Tagger) Schedule() *tesla.KeySchedule
func (*Tagger) SetSocketMark ¶
func (*Tagger) TagPacket ¶
TagPacket rewrites the IPID field of a raw IPv4 packet and recomputes the IPv4 header checksum. The packet is modified in-place; the same slice is returned.
The tag is the kernel tagger's SipHash, computed over the packet in canonical form (see tesla.ComputeTag): both the IPID field (bytes 4–5) and the IPv4 header checksum field (bytes 10–11) are zeroed before hashing. This allows a verifier to reproduce the same hash input without knowing the original checksum or IPID values.
If pkt does not begin with a valid IPv4 header (version 4, IHL ≥ 5) the packet is returned unmodified without error. While the schedule has no usable signing key (epoch 0, whose key is the public anchor) the packet is likewise returned unmodified and untagged, as on the eBPF path.
func (*Tagger) WrapDatagram ¶
WrapDatagram returns conn wrapped so that every Write leaves as one IPv4 packet whose IP ID carries this run's tag, as the eBPF tagger would have written it. conn is a connected UDP socket or a connected ip4:icmp socket to an IPv4 destination. The packets are sent through a raw IPPROTO_RAW socket of the wrapper's own, which needs CAP_NET_RAW; conn itself is left as it is and keeps receiving the replies. Any other connection is refused with ErrDatagramUntagged and stays usable untagged.
type TaggerInterface ¶
type TaggerInterface interface {
// TagPacket rewrites the IPID field of the raw IPv4 packet bytes in-place
// and returns the modified slice. The slice may be the same underlying
// array as pkt (modified in-place) or a copy.
TagPacket(pkt []byte) ([]byte, error)
SetSocketMark(fd int) error
Close() error
Schedule() *tesla.KeySchedule
}
TaggerInterface is the abstraction used by both the pure-Go tagger and the eBPF tagger, enabling performance comparison.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package ebpf provides an eBPF-based IPv4 IPID tagger for Linux.
|
Package ebpf provides an eBPF-based IPv4 IPID tagger for Linux. |
|
Package tesla implements a TESLA-inspired hash-chain key schedule for delayed disclosure of packet authentication keys.
|
Package tesla implements a TESLA-inspired hash-chain key schedule for delayed disclosure of packet authentication keys. |