I built a minimalist SPA tool using eBPF/XDP to keep ports invisible. First project in Go!
2026-03-19 03:15 UTC
Hi guys,
I wanted to share a project I’ve been working on called xSpa. It’s an implementation of Single Packet Authorization that works at the XDP level.
I built this because I wanted something faster and more DDoS-resilient than traditional port-knocking or SPA tools that rely on userspace processing or iptables. Here, the “drop-all” logic happens right at the driver level.
Key bits:
L1 verification (SipHash) in kernel space.
L2 (ChaCha20-Poly1305) in Go userspace.
It uses the eBPF ring buffer for communication.
This is my first Go project and my first shot at Open Source. I’m still a bit of a noob when it comes to kernel-level programming, so I’d love to get some feedback on the architecture and security. If anyone has time to check the code, I’d love to hear your thoughts on how to make it better.
Replies (3)
-
@non_burglar@lemmy.world 2026-03-19 14:14
Sorry, I’m failing to understand what this does, mostly because your description is mixing tcpip, socket, and xdp terminology. It’s an implementation of Single Packet Authorization that works at the XDP level. Sure, but to do what, exactly? Is this meant to run on Linux routers as a prefilter? Or on hosts themselves? In the second case, why not just use 802.11x? I don’t get the use case, or what this has to do with DDOS.
-
@db2@lemmy.world 2026-03-19 03:30
What if any role did "AI" play in this project?
-
@fruitycoder@sh.itjust.works 2026-03-19 23:22
How have tests gone so far? also cool concept, you can actually get eBPF XDP to compile to FPGA on some smart NICs even further pushing it away from the core system if it works!