Documentation
¶
Overview ¶
Package carp decodes the Common Address Redundancy Protocol — the open first-hop-redundancy protocol (FHRP) used by OpenBSD, FreeBSD and pfSense / OPNsense for gateway / firewall high availability. CARP is the third member of the project's FHRP-decoder set alongside internal/hsrp (Cisco HSRP) and internal/vrrp (IETF VRRP), and it is decoded for the same reason: FHRP hijacking is a classic on-path (MITM) attack — a host that advertises for the virtual router with a better election metric becomes the master and draws the LAN's default- gateway traffic through itself. For CARP that metric is the advertisement skew (advskew): the lower it is, the more frequently the node advertises and the more likely it wins, so a captured CARP advertisement with a very low advskew (especially 0) is the hijack / preemption signal.
Wrap-vs-native judgement ¶
Native. A CARP advertisement is a fixed 36-octet structure (carried in an IP packet with protocol number 112, shared with VRRP, to the 224.0.0.18 multicast): a version/type octet, the VHID, advskew, auth length, demotion, advbase, a checksum, a 64-bit counter and a 20-octet SHA-1 HMAC. Decoding is byte-field extraction — a dependency is not justified. stdlib only, no new go.mod dep.
Verifiable / no confidently-wrong output ¶
Every header field was verified field-for-field against scapy's CARP layer. The advertisement interval is the documented CARP timing (advbase + advskew/256 seconds). The 20-octet HMAC is surfaced as hex and NOT verified — it is an SHA-1 HMAC keyed by the CARP passphrase, which is not on the wire (the same reason the vtp / wpa decoders do not verify their keyed digests).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
Version int `json:"version"`
Type int `json:"type"`
TypeName string `json:"type_name"`
VHID int `json:"vhid"` // virtual host ID (the redundancy group)
AdvSkew int `json:"adv_skew"`
AdvBase int `json:"adv_base"`
AdvIntervalSec float64 `json:"adv_interval_sec"`
AuthLen int `json:"auth_len"`
Demotion int `json:"demotion"`
ChecksumHex string `json:"checksum_hex"`
CounterHex string `json:"counter_hex"`
HMACSHA1Hex string `json:"hmac_sha1_hex"`
Notes []string `json:"notes,omitempty"`
}
Result is the decoded view of a CARP advertisement.
Source Files