I built a minimalist SPA tool using eBPF/XDP to keep ports invisible. First project in Go!

7 months ago by lucy to c/golang

High-performance, minimalist Single Packet Authorization (SPA) based on eBPF/XDP. Keeps your ports invisible to scanners and resilient to DDoS attacks by filtering traffic at the driver level. - ki...

Hi guys, I wanted to share a project I’ve been working on called xSpa. It's an implementation of Single Packet Authorization that works at the XDP level.

I built this because I wanted something faster and more DDoS-resilient than traditional port-knocking or SPA tools that rely on userspace processing or iptables. Here, the "drop-all" logic happens right at the driver level.

Key bits:

L1 verification (SipHash) in kernel space.

L2 (ChaCha20-Poly1305) in Go userspace.

It uses the eBPF ring buffer for communication.

This is my first Go project and my first shot at Open Source. I’m still a bit of a noob when it comes to kernel-level programming, so I’d love to get some feedback on the architecture and security. If anyone has time to check the code, I’d love to hear your thoughts on how to make it better.

TheBigRoomXXL 1 point a day ago

Oh, that's very cool. We don't see that kind of lower-level app very often in Go. I discovered SPAs through this post, and one thing I don't understand is how it works on the client side. It seems to break most protocols, doesn't it?"

save

path: 0 26382711, hotness: undefined, score: 1, children: 0