Secure UDP and nmea sproxy

Secure UDP and nmea_sproxy

UDPSEC is AISMixer's authenticated encrypted UDP transport for station-to-mixer traffic. It is not an external standardized protocol.

nmea_sproxy is the station-side proxy. One process represents one relation:

one local input -> one AISMixer output

Run separate processes or systemd template instances for separate local inputs or separate AISMixer destinations.

nmea_sproxy extracts both !AIVDM and !AIVDO from supported local inputs before sending them to UDPSEC or explicitly configured plain UDP output.

Implemented Relation Modes

Current local input modes:

• legacy local UDP input with listen_ip and listen_port;
• physical serial or USB virtual COM input with input.type: serial.

Current output modes:

• UDPSEC output, using legacy remote_host/remote_port or explicit output.type: udpsec;
• explicitly configured plain UDP output with output.type: udp for trusted LAN or VPN environments.

Plain UDP output is explicit compatibility behavior. It has no UDPSEC authentication, encryption, replay protection, or liveness protocol.

UDPSEC Behavior

UDPSEC provides:

• ECDSA station authentication;
• AISMixer public-key verification by the station;
• session derivation from ECDH and signatures;
• AES-GCM protected data packets;
• encrypted ping/pong liveness;
• peer timeout and reconnect;
• optional session refresh;
• NOSESSION reconnect hints;
• remote address and port pinning.

NOSESSION is an unauthenticated reconnect hint, accepted only from the configured remote address and port.

A source-IP or source-port change requires a new handshake. UDP remains an unreliable transport, so packet loss is still possible.

UDPSEC protects packets in transit. It does not prove the semantic truth or physical origin of AIS data.

Configuration Resolution

nmea_sproxy selects configuration in this order:

1. --config PATH;
2. NMEA_SPROXY_CONFIG;
3. /etc/nmea_sproxy/config.yaml;
4. config.yaml next to nmea_sproxy.py;
5. built-in defaults.

An explicitly selected --config or NMEA_SPROXY_CONFIG path must exist.

Relative station_private_key, remote_public_key, and legacy aismixer_public_key paths are resolved relative to the selected config file.

Key Paths

Standard installed station key paths:

/etc/nmea_sproxy/keys/station_private.pem
/etc/nmea_sproxy/keys/station_public.pem
/etc/nmea_sproxy/keys/aismixer_public.pem

station_private.pem stays on the station. AISMixer stores authorized station public keys, normally in /etc/aismixer/authorized_keys.yaml. The station stores the trusted AISMixer public key so it can verify the server handshake.

Plain UDP output does not load or require the UDPSEC station private key or AISMixer public key.

Local Input Examples

Legacy UDP input:

listen_ip: "::"
listen_port: 50000
allow_from:
  - 192.0.2.15

Serial input:

input:
  type: serial
  port: /dev/serial/by-id/usb-SRT_Marine_Technology_Ltd._AIS_Virtual_COM_Port_<device-id>-if00
  baudrate: 38400
  bytesize: 8
  parity: N
  stopbits: 1
  read_timeout: 1.0
  reconnect_delay: 5
  max_line_bytes: 4096

Windows serial port strings such as COM4 are also accepted in manual mode.

Output Examples

Legacy UDPSEC output:

remote_host: mixer.example.net
remote_port: 19999
source_ip: 192.0.2.20

Explicit UDPSEC output:

output:
  type: udpsec
  host: mixer.example.net
  port: 19999
  source_ip: 192.0.2.20

Explicit plain UDP output:

output:
  type: udp
  host: 192.168.10.20
  port: 17777
  source_ip: 192.168.10.15

Deployment

Installed singleton layout:

/etc/nmea_sproxy/config.yaml
/etc/systemd/system/nmea_sproxy.service

Template instance configs live under:

/etc/nmea_sproxy/instances/<operator-name>.yaml
/etc/systemd/system/nmea_sproxy@.service

The installer creates the config, instance, key, runtime, and unit layout, preserves existing configs and keys, enables only the singleton service, and starts no services automatically.

The update script refreshes runtime and unit files but does not modify /etc/nmea_sproxy configs or keys and does not restart singleton or template instances automatically.

The uninstall script preserves /etc/nmea_sproxy by default. Use --purge-config only when operator configs and keys should also be removed.

Non-Goals

nmea_sproxy does not deduplicate, assemble multipart AIS, route streams, rewrite TAG metadata, or fan out to multiple destinations. AISMixer performs those jobs.