AISMixer

Private bounded ingress

Every configured UDP or UDPSEC input has its own bounded queue, keeping one input’s queued backlog from consuming another input’s private capacity.

Capacity-safe admission

Shared processing admission is bounded. A frame receives its immutable ProcessingSnapshot only after capacity is obtained, and a full stage waits with backpressure.

Processor-instance ownership

One processor instance owns mutable assembly, deduplication, source, multipart-metadata, and processor-metric state behind an explicit lifecycle boundary.

Bounded ordered egress

A bounded handoff carries each non-empty OutputBatch to sequential local dispatch. The completion barrier preserves processing order but is not remote receipt.

Pull-based runtime observability

Fresh immutable snapshots cover queue and backpressure state, processor and egress activity, raw and admitted input traffic, and per-target output messages and bytes.

Composable source sets

Define zones with include, union, intersection, and difference.

Logical, not geographic

Zones are sets of internal source identities—not map areas, MMSI filters, vessel filters, or payload rules.

Preserved order and per-target quality

The compiled plan preserves declared target order. Routing mode scopes deduplication to each logical target, so one dispatch path does not suppress another.

Routing status and atomic changes

Inspect the active generation, zones, routes, and targets; replace a validated snapshot or disable routing to return to legacy broadcast mode. Optional generation checks reject stale updates.

Aggregate runtime statistics

runtime.statistics reports bounded queue and backpressure state, processor activity, and egress activity in one fresh process-local pull.

Input and output traffic

runtime.statistics.inputs separates transport traffic from accepted frames. runtime.statistics.outputs reports per-target local dispatches, messages, and bytes.

Local operator interface

Use aismixerctl for local routing changes and read-only runtime inspection, with human-readable output for operators and JSON output for one-shot automation.

Ingress allow_from

Restrict UDP and UDPSEC listeners to literal IP addresses or CIDR networks, with explicit deny-all behavior available.

Outbound source_ip

Bind an egress socket to a literal IPv4 or IPv6 source address and constrain destination resolution to the same family.

Part of a layered boundary

These policies complement operating-system firewall and routing rules; they do not replace them.

Authenticated ephemeral key agreement

For every session handshake, each endpoint creates a fresh ephemeral P-256 ECDHE keypair. Long-term P-256 identity keys only authenticate canonical, role-separated SHA-256 transcript digests with ECDSA; they are not ECDHE key-agreement inputs.

HKDF-SHA256 derives independent C2S and S2C keys from the shared secret and authenticated transcript. AES-256-GCM protects encrypted data and control traffic.

Encrypted mutual confirmation

The client sends an encrypted sequence-zero ping for the pending session. The server promotes only after authenticating it and returns an encrypted sequence-zero pong under the promoted S2C key; the client treats the session as established only after authenticating that pong.

Unrelated, malformed, stale-key, wrong-sequence, and wrong-source datagrams neither confirm the candidate nor extend its fixed confirmation deadline.

Sessions, key epochs, and no fallback

A session is bound to the authenticated station and identified by a mixer-issued session locator, never by the source IP address and port. After confirmation, NMEA DATA, keepalive ping/pong, in-session control, and best-effort close are authenticated and encrypted, and every packet is bound to its session and key epoch. Receivers keep every admitted nonce for its epoch's lifetime and reject replays.

With session_refresh_interval above zero, the station renews the traffic keys inside the same session through a fresh signed ECDHE exchange; this is neither a new session nor a path change. UDPSEC has no plaintext reset, NOSESSION recovery, downgrade control, or automatic fallback to plain UDP, and it does not buffer or replay NMEA payloads. Secure session and replay state is in-memory, process-local, non-durable, and lost at restart.

Update both endpoints together: the current UDPSECv2 wire format does not interoperate with earlier builds, including the published 0.2.1 OpenWrt packages.

Short loss on the same path

Liveness recovery. The station resends its one outstanding keepalive ping at a bounded rate, with the same sequence number and a fresh encryption each time, until an authenticated answer arrives. One lost exchange does not end the session; the only terminal bound is peer_timeout after the last authenticated evidence.

New public address while the session is alive

Authenticated path migration. A new address is not trusted automatically: its packets must authenticate under the session's current keys. The aismixer service then challenges that address and moves its replies there only after the station's authenticated response arrives from it. The challenge is sent at most four times in total, at least 2 seconds apart, within a fixed 10-second window; retries improve delivery but grant no authority.

Long or terminal outage

Fresh authenticated establishment. Once the liveness bound is reached, the station performs a new signed handshake, and the aismixer service expires the idle old session on its own.