{"id":29869492,"url":"https://github.com/murilochianfa/srv6-pot-tlv","last_synced_at":"2025-07-30T16:36:42.127Z","repository":{"id":291973520,"uuid":"955450517","full_name":"MuriloChianfa/srv6-pot-tlv","owner":"MuriloChianfa","description":"Design and implementation of a new SRv6 Proof-of-Transit TLV using SipHash, Poly1305 and BLAKE3 Keyed-hash through eBPF XDP and TC.","archived":false,"fork":false,"pushed_at":"2025-06-29T09:16:18.000Z","size":3217,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-07-21T18:30:58.817Z","etag":null,"topics":["blake3","ebpf","golang","hmac-sha256","ipv6","kernel","keyed-hashing","linux","poly1305","seg6","segment-routing","siphash","srv6","tc","tlv","xdp"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MuriloChianfa.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-03-26T16:53:49.000Z","updated_at":"2025-07-05T10:38:52.000Z","dependencies_parsed_at":null,"dependency_job_id":"99f852bb-7153-4aa6-a6c4-0f2b25f8aca9","html_url":"https://github.com/MuriloChianfa/srv6-pot-tlv","commit_stats":null,"previous_names":["murilochianfa/srv6-pot-tlv"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/MuriloChianfa/srv6-pot-tlv","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MuriloChianfa%2Fsrv6-pot-tlv","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MuriloChianfa%2Fsrv6-pot-tlv/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MuriloChianfa%2Fsrv6-pot-tlv/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MuriloChianfa%2Fsrv6-pot-tlv/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MuriloChianfa","download_url":"https://codeload.github.com/MuriloChianfa/srv6-pot-tlv/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MuriloChianfa%2Fsrv6-pot-tlv/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267899872,"owners_count":24163001,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-30T02:00:09.044Z","response_time":70,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blake3","ebpf","golang","hmac-sha256","ipv6","kernel","keyed-hashing","linux","poly1305","seg6","segment-routing","siphash","srv6","tc","tlv","xdp"],"created_at":"2025-07-30T16:36:37.877Z","updated_at":"2025-07-30T16:36:42.112Z","avatar_url":"https://github.com/MuriloChianfa.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003eSRv6 Proof-of-Transit TLV\u003c/h1\u003e\n\u003ch3 align=\"center\"\u003eBased on SipHash, Poly1305 and BLAKE3 keyed-hash functions\u003c/h3\u003e\n\n```bash\n                 0                   1                   2                   3\n                 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1\n                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n                |   Type (8b)   |  Length (8b)  |      Reserved/Flags (16b)      |\n                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n                |                          Nonce (96b)                           |\n                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n                |                      Witness (64-256b)                         |\n                |                            ...                                 |\n                +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n```\n\nThis project demonstrates a mechanism for achieving **Proof-of-Transit (PoT)** in an **SRv6 (Segment Routing over IPv6)** network using **eBPF  (Extended Berkeley Packet Filter)** attached to Linux **TC (Traffic Control)** and **XDP (eXpress Data Path)** hooks.\n\nThe core idea is to embed a custom **Type-Length-Value (TLV)** object within the **Segment Routing Header (SRH)** through all nodes in the path. This **TLV** contains metadata (random nonce) and a cryptographic hash (computed through the fast **SipHash**, **Poly1305** and **BLAKE3 Keyed-hash** algorithms) that allows downstream nodes to verify the path taken by the packet.\n\n## Getting Started\n\n\u003cdetails open\u003e\n  \u003csummary style=\"font-size: 16px;\"\u003e\u003cstrong\u003eCompiling the BTF bytecode and the CLI tool\u003c/strong\u003e\u003c/summary\u003e\n\n  #### Requirements\n\n  * **Linux Kernel:** Version supporting eBPF, TC BPF, XDP, and SRv6.\n  * **libbpf-dev:** Development headers for libbpf, same as the Kernel.\n  * **iproute2:** For managing TC filters and XDP programs.\n  * **clang/llvm:** For compiling C code to eBPF bytecode.\n\n  #### Compiling\n\n  ```bash\n  # Install Linux Kernel headers and tools\n  apt install linux-image-$(uname -r) linux-headers-$(uname -r) linux-tools-$(uname -r)\n\n  # Install required libraries\n  apt install clang llvm libbpf-dev libelf-dev make\n\n  # Compile all algorithms\n  make blake3\n  make siphash\n  make halfsiphash\n  make hmac-sha1\n  make poly1305\n\n  # The artefacts will be generated here\n  ls -l cmd/build/\n  ```\n\u003c/details\u003e\n\u003cdetails open\u003e\n  \u003csummary style=\"font-size: 16px;\"\u003e\u003cstrong\u003eUsage options and key management\u003c/strong\u003e\u003c/summary\u003e\n\n  ```bash\n  Usage:\n    seg6-pot-tlv --load \u003ciface\u003e\n        Loads \u0026 attaches the eBPF XDP and TC programs to \u003ciface\u003e and pins the maps.\n\n    seg6-pot-tlv --sid \u003csid\u003e --key \u003ckey\u003e\n        Updates the pinned map with \u003csid\u003e (IPv6) with the related \u003ckey\u003e (max 32B).\n\n    seg6-pot-tlv --keys\n        Shows all the keys pinned on the key map with their related SID.\n\n  Examples:\n    sudo ./seg6-pot-tlv --load ens5\n    sudo ./seg6-pot-tlv --sid 2001:db8:ff:1::1 --key aa112233445566778899aabbccddeeff00112233445566778899aabbccddee11\n    sudo ./seg6-pot-tlv --sid 2001:db8:ff:2::1 --key bb112233445566778899aabbccddeeff00112233445566778899aabbccddee22\n    sudo ./seg6-pot-tlv --sid 2001:db8:ff:3::1 --key cc112233445566778899aabbccddeeff00112233445566778899aabbccddee33\n    sudo ./seg6-pot-tlv --sid 2001:db8:ff:4::1 --key dd112233445566778899aabbccddeeff00112233445566778899aabbccddee44\n  ```\n\u003c/details\u003e\n\u003cdetails\u003e\n  \u003csummary style=\"font-size: 16px;\"\u003e\u003cstrong\u003eDebugging TLV logs and operations\u003c/strong\u003e\u003c/summary\u003e\n\n  ```bash\n  # Monitor eBPF logs\n  bpftool prog trace\n\n  # Monitor SRv6 packets\n  tcpdump -pni any \"ip6[6]==43\" -vvv -x\n  tshark -i any -p -f \"ip6[6]==43\" -V -x\n  ```\n\n  \u003cdiv align=\"center\"\u003e\u003cimg src=\"./tests/debug/success-logs.png\" /\u003e\u003c/div\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n  \u003csummary style=\"font-size: 16px;\"\u003e\u003cstrong\u003eSetting-up DEMO scenario for tests\u003c/strong\u003e\u003c/summary\u003e\n\n  - [topology/README.md](topology/README.md)\n\u003c/details\u003e\n\u003cdetails\u003e\n  \u003csummary style=\"font-size: 16px;\"\u003e\u003cstrong\u003eRun tests and evaluation\u003c/strong\u003e\u003c/summary\u003e\n\n  - [tests/round-trip-time/README.md](tests/round-trip-time/README.md)\n  - [tests/throughput/README.md](tests/throughput/README.md)\n\u003c/details\u003e\n\n## Preliminary Results\n\n\u003cblockquote style=\"margin-bottom: 2px;\"\u003eEnvironment: x86_64 Xeon E5-2683 v4 @ 2.10GHz, 128G RAM, Ubuntu 24.04\u003c/blockquote\u003e\n\u003cblockquote style=\"margin-top: 0; margin-bottom: 6px;\"\u003eTools: Clang 18.1.3, Kernel 6.11.0-19-generic, Realtek RTL8411 PCI Gigabit Ethernet\u003c/blockquote\u003e\n\n\u003cdiv align=\"center\"\u003e\u003cimg src=\"./tests/debug/srv6-pot-tlv-overhead.png\" /\u003e\u003c/div\u003e\n\u003cdiv align=\"center\"\u003e\u003cimg src=\"./tests/round-trip-time/round-trip-time.png\" /\u003e\u003c/div\u003e\n\u003cdiv align=\"center\"\u003e\u003cimg src=\"./tests/throughput/throughput.png\" /\u003e\u003c/div\u003e\n\n## DEMO scenario\n\n\u003cblockquote style=\"margin-bottom: 2px;\"\u003eSRv6 Domain: VRF 10 table local, IPv6 Network 2001:db8::ff::/48\u003c/blockquote\u003e\n\u003cblockquote style=\"margin-top: 0; margin-bottom: 6px;\"\u003eSRv6 Setup: R1 and R4 Action End.DT6, R2, R3, and R5 Action End\u003c/blockquote\u003e\n\n\u003cdiv align=\"center\"\u003e\u003cimg src=\"./topology/qemu-virtual-srv6.png\" /\u003e\u003c/div\u003e\n\n## Warning Notice\n\n\u003e [!IMPORTANT]\n\u003e\n\u003e The following work and its results are the artefacts of a project presented for the Network Security class on a Master's in Computer Science from State University of Londrina (UEL) in order to obtain a good grade on the subject.\n\u003e\n\u003e This repository is created **solely for educational purposes**. The content provided here is intended to serve as examples and study material. **There are no guarantees that the code or any other material is suitable or safe for production use**.\n\u003e\n\u003e If you choose to use any part of this project in a production environment, **you do so at your own risk**. It is strongly recommended to thoroughly review the code and implement proper testing before any production use.\n\n## Must Read References\n\n- **IETF (2025).** *[Segment Routing over IPv6 (SRv6) Security](https://datatracker.ietf.org/doc/draft-ietf-spring-srv6-security/)*\n- **Iannone, L. (2024).** *[Segment Routing over IPv6 Proof of Transit](https://datatracker.ietf.org/meeting/119/materials/slides-119-spring-srv6-proof-of-transit-00)*\n- **Borges, R. et al. (2023).** *[In-situ Proof-of-Transit for Path-Aware Programmable Networks.](https://ieeexplore.ieee.org/document/10175482)*\n- **Hara, Y. et al. (2025).** *[eBPF-Based Ordered Proof of Transit for Trustworthy Service Function Chaining.](https://ieeexplore.ieee.org/document/10924210)*\n- **Borges, R. et al. (2024).** *[PoT-PolKA: Let the Edge Control the Proof-of-Transit in Path-Aware Networks.](https://ieeexplore.ieee.org/document/10500862)*\n- **Martinez, A. et al. (2024).** *[Implementation of a Traffic Flow Path Verification System in a Data Network.](https://ieeexplore.ieee.org/document/10597042)*\n- **Martinello, M. et al. (2024).** *[PathSec: Path-Aware Secure Routing with Native Path Verification and Auditability.](https://ieeexplore.ieee.org/document/10807493)*\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmurilochianfa%2Fsrv6-pot-tlv","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmurilochianfa%2Fsrv6-pot-tlv","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmurilochianfa%2Fsrv6-pot-tlv/lists"}