Documentation
¶
Overview ¶
Package obfuscate implements shadowgate's headerless, fully-encrypted UDP packet format. Every datagram on the wire is
nonce (24 random bytes) || XChaCha20-Poly1305(key, nonce, plaintext)
where the plaintext carries a small encrypted header, the payload, and random padding. There is no plaintext header, no handshake, and no fixed length, so a passive observer sees only high-entropy datagrams of varying size. Only a holder of the pre-shared password can produce or open a datagram.
Index ¶
Constants ¶
const KeySize = 32
KeySize is the derived key length in bytes.
Variables ¶
var ErrInvalidPacket = errors.New("obfuscate: invalid packet")
ErrInvalidPacket is returned by Open for any datagram that cannot be authenticated and parsed, so callers can uniformly drop bad input.
Functions ¶
Types ¶
type Codec ¶
type Codec struct {
// contains filtered or unexported fields
}
Codec seals and opens obfuscated datagrams. A Codec is safe for concurrent use by multiple goroutines: the underlying AEAD is stateless and each Seal draws a fresh random nonce.
func NewCodec ¶
NewCodec builds a Codec from a 32-byte key. maxPadding is the maximum number of random bytes appended (inside the encryption) to each datagram; 0 disables padding.
func (*Codec) Open ¶
func (self *Codec) Open(datagram []byte) (sequence uint64, streamId uint16, payload []byte, err error)
Open authenticates and parses a datagram, returning the sequence number, stream id, and payload. The returned payload is backed by a freshly allocated buffer and is safe to retain. Any malformed or unauthenticated datagram yields ErrInvalidPacket.
type ReplayWindow ¶
type ReplayWindow struct {
// contains filtered or unexported fields
}
ReplayWindow is a sliding-window replay filter. Sequence numbers start at 1 (0 is never valid). It is not safe for concurrent use; callers must confine a ReplayWindow to a single goroutine or guard it with a lock.
func (*ReplayWindow) Accept ¶
func (self *ReplayWindow) Accept(sequence uint64) bool
Accept reports whether sequence is fresh. It returns true and records the sequence the first time it is seen, and false for a duplicate or a sequence so old it has fallen out of the window.
Source Files