RFC 2385 - Protection of BGP Sessions via the TCP MD5 Signature Option

Overview

Positive

what Ze has

Neutral

measures that are neither good news nor bad

The 8 shares marked as a part above are the whole of the 8 gated MUSTs: they add to 100%. Proven by a recorded break is a share of TAGGED UNITS, a different population, so it is not one of them.

At a glance

Enrolment

Enrolled: Protection of BGP Sessions via the TCP MD5 Signature Option. The RFC writes its obligations in lowercase; the extraction sign-off derives register 'prose'. Ze installs the application key with TCP_MD5SIG and Linux signs and validates the segments. Configuration and loopback tests cover key plumbing and acceptance. The separate-namespace veth tests in internal/core/network/rfc2385_md5_egress_integration_linux_test.go observe actual signatures, independently recompute digests, inject an unsigned SYNACK before a signed retransmission, and contrast malformed signatures with independently signed controls. Enrolled 2026-09-01.

What the public ledger says

Status: Supported on Linux; FreeBSD needs a `setkey(8)` SAD entry

Coverage

Positive and negative tests (6): RFC2385-2.0-1, RFC2385-2.0-2, RFC2385-2.0-3, RFC2385-2.0-5, RFC2385-2.0-6, RFC2385-3.0-1

Annotated (including scoped evidence) (2): RFC2385-2.0-4, RFC2385-4.3-2

Requirements

Gaps and untested MUSTs

RFC 2385 declares no gap, and every gated MUST it carries has a test bound to it.

Proof state

A tagged unit reads unproven where no discrimination record exists for it: nothing in this tree has been observed to break it, so the claim its tag makes is unproven.

RFC2385-2.0-1

The nature of the key is deliberately left unspecified, but it must be known by both ends of the connection. (§2.0)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Collateral source re-judgment 2026-10-02 after removing unrelated 2.0-6/3.0-1 and retired4.3-1 tags from the enclosing legacy test comment; executable assertions remain unchanged. RFC2385 Section2.0 says the key must be known by both ends. TestRFC2385MatchingKeysCarryASignedSession supplies the same key to RealListenerFactory through rfc2385Listener and to RealDialer, requires a completed connection, then requires exactly256KiB delivered. Negative TestRFC2385KeyOnOneEndOnlyCarriesNoSession keys only the listening socket, leaves the dialer unkeyed and requires a net.Error timeout; rfc2385DialDropped fails on a completed dial. A no-op key installation would make that negative connect and fail. Actual producer network.go controls call md5_linux.go::setTCPMD5Sig before bind/connect and propagate failures. This is Linux whole-stack key-sharing evidence, not an independent digest-composition claim. The legacy helper skips unsupported-kernel ENOPROTOOPT/EOPNOTSUPP, so skipped execution must never be reported as proof; the separately observed configured runtime now demonstrably supports keyed sockets. Source-only rejudgment; no new execution or discrimination completion claimed.

RFC2385-2.0-2

Upon receiving a signed segment, the receiver must validate it by calculating its own digest from the same data (using its own key) and comparing the two digest. (§2.0)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Collateral source re-judgment 2026-10-02 after unrelated tag removals in MatchingKeys and MismatchedKey doc comments; executable assertions remain unchanged. RFC2385 Section2.0 requires receiving TCP to validate a signed segment by calculating with its own key and comparing. Positive TestRFC2385MatchingKeysCarryASignedSession installs matching keys on real TCP sockets and requires256KiB received. Negative TestRFC2385MismatchedKeyIsDroppedWithNoResponse installs different listener/dialer keys and requires timeout rather than establishment; rfc2385DialDropped explicitly fails on successful dial. The actual configured TCP_MD5SIG socket path is network.go::RealDialer.DialContext and RealListenerFactory.Listen through md5_linux.go::setTCPMD5Sig, with Linux doing verification. Matching acceptance plus mismatching refusal discriminates key-dependent receiver validation at that boundary; exact independent digest composition is separately covered by the new2.0-6 packet carrier and is not attributed to this old loopback unit. Unsupported-kernel skips are not positive evidence. Source-only rejudgment, no new test run or native record claimed.

RFC2385-2.0-3

A failing comparison must result in the segment being dropped and must not produce any response back to the sender. (§2.0)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent post-lint judgment. RFC 2385 Section 2.0: 'A failing comparison must result in the segment being dropped and must not produce any response back to the sender.' TestRFC2385MalformedWireSignaturesAreDropped sends a SYN whose independently formed Kind 19 digest alone is corrupted and recalculates ordinary IP/TCP checksums; the same keyed RealListenerFactory receives an independently signed valid control on a distinct source port. rfc2385ExpectReply rejects any matching peer TCP response during the explicit 300ms window and requires SYNACK plus independently matching digest for the control. Non-TCP noise cannot bypass the deadline: a nonblocking receiveFrame is followed by the deadline check; EINTR/EAGAIN use errors.Is; len(packet) is checked before indexing. Capture errors return to the calling test's Fatal. The retained MatchingKeys negative requires a keyed handshake and exactly 256KiB delivered. This isolates invalid-signature silence from a dead path or rejecting everything; it is bounded packet evidence, not unlimited silence. Actual boundary: network.go::Listen installs the peer key before bind through md5_linux.go::setTCPMD5Sig and SetsockoptTCPMD5Sig; Linux TCP performs comparison and packet handling. Reviewed parent's job-network-wire-observers-privileged-cdc8e23e.log: malformed digest, missing, kind and length all PASS with a signed valid control after each 300ms silence window. Parent reports native Linux -race, only test executables elevated via -exec 'sudo -n', fixture-created private namespaces, no skips. Earlier unprivileged pre-body CAP_SYS_ADMIN/restore failure is not evidence. Current-unit native discrimination renewal remains owed; no new red is claimed.

RFC2385-2.0-4

Unlike other TCP extensions (e.g., the Window Scale option [RFC1323]), the absence of the option in the SYN,ACK segment must not cause the sender to disable its sending of signatures. (§2.0)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent post-lint judgment against RFC 2385 Section 2.0: 'Unlike other TCP extensions (e.g., the Window Scale option [RFC1323]), the absence of the option in the SYN,ACK segment must not cause the sender to disable its sending of signatures.' UnsignedSYNACKDoesNotDisableSignatures keeps DialContext on the namespace-locked caller. The joined observer now returns errors through chan error; only the calling test calls Fatal. rfc2385CheckUnsignedSYNACK independently verifies the initial signed SYN, constructs an unsigned SYNACK with reversed captured tuple and sequence+1 acknowledgment, repairs checksums, observes the exact injected image, then requires a SYN retransmission with the same ports/sequence and an independently valid digest. The caller requires a net.Error timeout, excluding unsigned establishment. Capture/option/digest failures reach the assertion owner; bounded loops and receive timeout remain. The application installs the key in network.go::DialContext through md5_linux.go::setTCPMD5Sig before connect; no remote-negotiation code clears it. Single-positive is appropriate for this no-downgrade invariant and the test observes the actual wire boundary, not only configuration state. Reviewed parent's job-network-wire-observers-privileged-cdc8e23e.log lines 19-22: exact injected unsigned SYNACK and signed retransmission, then PASS. Parent reports native Linux -race with only the test executable elevated via -exec 'sudo -n' inside private fixture namespaces. Current-unit native discrimination renewal remains owed; no fresh red is claimed.

RFC2385-2.0-5

More importantly, the sending of signatures must be under the complete control of the application, not at the mercy of the remote host not understanding the option. (§2.0)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent post-lint judgment against RFC 2385 Section 2.0: 'More importantly, the sending of signatures must be under the complete control of the application, not at the mercy of the remote host not understanding the option.' Re-read all four tags. ConfiguredKeyReachesBothSockets checks exact parsed password, dialer key/address and listener key/address via parsePeerFromTree, NewSession and md5PeersForListener; NoKeyWithoutConfiguration requires empty dialer key, nil signing peer and no listener key entries. Wire positive UnsignedSYNACKDoesNotDisableSignatures observes the exact unsigned SYNACK, then the same SYN retransmitted with independently checked digest and a dial timeout. Wire negative UnconfiguredSocketSendsNoSignature completes ordinary unkeyed TCP, rejects Kind 19 on captured handshake traffic and requires two SYN-bearing packets. receive/option errors now return to the calling test's Fatal. These are distinct configured and absent-key inputs/assertions. network.go::DialContext and ::Listen install only configured keys, propagate installation errors and reach md5_linux.go::setTCPMD5Sig before connect/bind. The absent-key wire test does not reach setTCPMD5Sig; its renewal producer remains DialContext. The digest helper's fixed rfc2385Key is the exact key these keyed fixtures install. Reviewed parent's job-network-wire-observers-privileged-cdc8e23e.log: both wire carriers PASS, signed retransmission logged, no skips. Parent reports native Linux -race with -exec 'sudo -n'; builds/native job stay unprivileged. This clean run does not renew existing discrimination; current-unit attributed reds remain owed.

RFC2385-2.0-6

Every segment sent on a TCP connection to be protected against spoofing will contain the 16-byte MD5 digest produced by applying the MD5 algorithm to these items in the following order: 1. the TCP pseudo-header (in the order: source IP address, destination IP address, zero-padded protocol number, and segment length) 2. the TCP header, excluding options, and assuming a checksum of zero 3. the TCP segment data (if any) 4. an independently-specified key or password, known to both TCPs and presumably connection-specific (§2.0)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent post-lint judgment against RFC 2385 Section 2.0: 'Every segment sent on a TCP connection to be protected against spoofing will contain the 16-byte MD5 digest produced by applying the MD5 algorithm to these items in the following order: 1. the TCP pseudo-header (in the order: source IP address, destination IP address, zero-padded protocol number, and segment length) 2. the TCP header, excluding options, and assuming a checksum of zero 3. the TCP segment data (if any) 4. an independently-specified key or password, known to both TCPs and presumably connection-specific'. CapturedSegmentsHaveIndependentDigests uses real keyed dialer/listener sockets across separate namespaces, checks every captured packet with its independent oracle, and requires SYN/SYNACK, pure ACK, data, FIN and acknowledgment of the opposite FIN in both directions plus exact data totals. The oracle hashes captured network-order addresses/protocol/full TCP length, the fixed 20-byte TCP header with checksum zeroed, payload after data offset, then rfc2385Key, without Linux's verifier. The removed key argument was always the same installed fixture key. receiveFrame validates total length and header bounds before slicing; receive clones the borrowed frame; all errors reach caller Fatal. MalformedWireSignaturesAreDropped corrupts the digest with valid ordinary checksums, asserts bounded wire silence and requires an independently signed control, isolating signing from checksum errors or an unreachable listener. Actual producer is md5_linux.go::setTCPMD5Sig before dial/listen; Linux TCP emits/verifies digests. MSS=1460 and MTU<=1500 remain supplemental, not claims under superseded MSS advice. Reviewed parent's job-network-wire-observers-privileged-cdc8e23e.log: lifecycle including bidirectional data/FIN and all malformed cases PASS. Parent reports native Linux -race with -exec 'sudo -n'. Clean execution is observed in that log; current-unit discrimination renewal is not.

RFC2385-3.0-1

The proposed option has the following format: +---------+---------+-------------------+ | Kind=19 |Length=18| MD5 digest... | +---------+---------+-------------------+ | | +---------------------------------------+ | | +---------------------------------------+ | | +-------------------+-------------------+ | | +-------------------+ The MD5 digest is always 16 bytes in length, and the option would appear in every segment of a connection. (§3.0)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Independent post-lint judgment against RFC 2385 Section 3.0's Kind=19/Length=18 format and complete sentence: 'The MD5 digest is always 16 bytes in length, and the option would appear in every segment of a connection.' CapturedSegmentsHaveIndependentDigests applies rfc2385Option and assertRFC2385Digest to every captured packet through handshake, bidirectional data, ACK and orderly FIN/FIN-ACK completion. The parser walks only the validated TCP data-offset interval, rejects malformed lengths and duplicate Kind 19 options, and requires exactly 18 option bytes and all 16 digest bytes equal the independent oracle. Helpers returning errors preserve these checks and reach caller Fatal. MalformedWireSignaturesAreDropped separately sends missing Kind 19, wrong Kind and Length 17 SYNs with recomputed ordinary checksums; each requires no matching TCP response within 300ms and a correctly encoded independently signed control SYNACK. Digest corruption remains separately covered. Cases do not depend on a neighbouring checksum error or timeout-only inference. RealDialer/RealListenerFactory install both endpoint keys through setTCPMD5Sig; Linux TCP produces the option. Reviewed parent's job-network-wire-observers-privileged-cdc8e23e.log: lifecycle and all four malformed cases PASS with exact packet evidence and no skips. Parent reports native Linux -race, only test executables elevated by -exec 'sudo -n' inside fixture namespaces. The old producer-panic records do not become current from this clean run; native current-unit discrimination renewal remains owed.

RFC2385-4.3-2

This means that the total size of the header plus option must be less than or equal to 60 bytes -- this leaves 40 bytes for options. (§4.3)

Audit verdict: enforced (the tests do what the requirement demands), fresh. Collateral source re-judgment 2026-10-02 after unrelated tag removals from TestRFC2385MatchingKeysCarryASignedSession; the executable body and this retained tag are unchanged. RFC2385 Section4.3 requires total TCP header plus options at most60bytes, leaving40bytes for options. Ze contributes no manual TCP header/options assembly: actual RealDialer and RealListenerFactory configure TCP_MD5SIG, and Linux owns the option list and data-offset field. The retained positive unit establishes keyed TCP and carries256KiB through the listener, so options fit the interoperating TCP header rather than preventing the protected connection; this is boundary evidence under the whole-stack rule. The single-positive annotation remains appropriate because Ze has no independent oversized TCP-option input/reject branch. Independent new captured-lifecycle evidence additionally observes52-byte handshake TCP headers and40-byte data/FIN headers, but that untagged observation is not substituted for this retained unit's identity. This is the header ceiling, not retired4.3-1 advertised-MSS advice; RFC6691 corrects the latter only. No native run or record refresh claimed in this source-only collateral judgment.

Extraction sign-off

Sections

Excluded sentences

Superseded

No document obsoletes RFC 2385, so its obligations are stated where they were written.