shadow_network_sim/

censorship.rs

//! Censorship simulation — model how censors block, throttle, and detect traffic.

use serde::{Serialize, Deserialize};

/// Types of censorship mechanisms.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum CensorshipMethod {
    /// Block by IP address.
    IpBlocking,
    /// Block by destination port.
    PortBlocking,
    /// Deep packet inspection for protocol signatures.
    Dpi,
    /// Throttle bandwidth below usability.
    Throttling,
    /// DNS poisoning / hijacking.
    DnsPoisoning,
    /// TCP RST injection.
    TcpReset,
    /// Active probing to detect circumvention tools.
    ActiveProbing,
}

/// A censorship rule that triggers on specific conditions.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct BlockingRule {
    pub method: CensorshipMethod,
    /// Pattern to match (IP prefix, port number, protocol signature, etc.).
    pub pattern: String,
    /// Human-readable description.
    pub description: String,
    /// Whether this rule is currently active.
    pub active: bool,
}

impl BlockingRule {
    pub fn ip_block(ip_prefix: &str) -> Self {
        Self {
            method: CensorshipMethod::IpBlocking,
            pattern: ip_prefix.to_string(),
            description: format!("Block IP prefix {}", ip_prefix),
            active: true,
        }
    }

    pub fn port_block(port: u16) -> Self {
        Self {
            method: CensorshipMethod::PortBlocking,
            pattern: port.to_string(),
            description: format!("Block port {}", port),
            active: true,
        }
    }

    pub fn dpi_rule(signature: &str) -> Self {
        Self {
            method: CensorshipMethod::Dpi,
            pattern: signature.to_string(),
            description: format!("DPI detect: {}", signature),
            active: true,
        }
    }

    pub fn throttle_rule(pattern: &str) -> Self {
        Self {
            method: CensorshipMethod::Throttling,
            pattern: pattern.to_string(),
            description: format!("Throttle: {}", pattern),
            active: true,
        }
    }
}

/// Simulated network packet for censorship testing.
#[derive(Debug, Clone)]
pub struct SimulatedPacket {
    pub source_ip: String,
    pub dest_ip: String,
    pub source_port: u16,
    pub dest_port: u16,
    pub payload: Vec<u8>,
    pub protocol: String,
}

/// Result of censorship check.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum CensorResult {
    /// Packet passed through unmodified.
    Allowed,
    /// Packet was blocked.
    Blocked(String),
    /// Packet was throttled (reduced bandwidth).
    Throttled(String),
    /// Connection was reset via TCP RST.
    Reset(String),
}

/// Censorship simulator with configurable rule sets.
pub struct CensorshipSimulator {
    rules: Vec<BlockingRule>,
    /// Statistics.
    packets_seen: u64,
    packets_blocked: u64,
    packets_throttled: u64,
}

impl CensorshipSimulator {
    pub fn new() -> Self {
        Self {
            rules: Vec::new(),
            packets_seen: 0,
            packets_blocked: 0,
            packets_throttled: 0,
        }
    }

    /// Create a simulator with common censorship rules.
    pub fn with_standard_rules() -> Self {
        let mut sim = Self::new();
        // Block common circumvention ports
        sim.add_rule(BlockingRule::port_block(9001)); // Tor default
        sim.add_rule(BlockingRule::port_block(443));  // HTTPS (extreme)
        // DPI for known protocols
        sim.add_rule(BlockingRule::dpi_rule("TLS_OBFS"));
        sim.add_rule(BlockingRule::dpi_rule("SHADOW"));
        // Throttle VPN-like traffic
        sim.add_rule(BlockingRule::throttle_rule("VPN_PATTERN"));
        sim
    }

    /// Add a blocking rule.
    pub fn add_rule(&mut self, rule: BlockingRule) {
        self.rules.push(rule);
    }

    /// Remove all rules.
    pub fn clear_rules(&mut self) {
        self.rules.clear();
    }

    /// Check a packet against all active rules.
    pub fn check_packet(&mut self, packet: &SimulatedPacket) -> CensorResult {
        self.packets_seen += 1;

        for rule in &self.rules {
            if !rule.active {
                continue;
            }

            match rule.method {
                CensorshipMethod::IpBlocking => {
                    if packet.dest_ip.starts_with(&rule.pattern)
                        || packet.source_ip.starts_with(&rule.pattern)
                    {
                        self.packets_blocked += 1;
                        return CensorResult::Blocked(rule.description.clone());
                    }
                }
                CensorshipMethod::PortBlocking => {
                    if let Ok(port) = rule.pattern.parse::<u16>() {
                        if packet.dest_port == port || packet.source_port == port {
                            self.packets_blocked += 1;
                            return CensorResult::Blocked(rule.description.clone());
                        }
                    }
                }
                CensorshipMethod::Dpi => {
                    // Check payload for signature bytes
                    let sig = rule.pattern.as_bytes();
                    if packet.payload.windows(sig.len()).any(|w| w == sig) {
                        self.packets_blocked += 1;
                        return CensorResult::Blocked(rule.description.clone());
                    }
                    // Also check protocol field
                    if packet.protocol.contains(&rule.pattern) {
                        self.packets_blocked += 1;
                        return CensorResult::Blocked(rule.description.clone());
                    }
                }
                CensorshipMethod::Throttling => {
                    if packet.protocol.contains(&rule.pattern) {
                        self.packets_throttled += 1;
                        return CensorResult::Throttled(rule.description.clone());
                    }
                }
                CensorshipMethod::TcpReset => {
                    if packet.dest_ip.starts_with(&rule.pattern) {
                        self.packets_blocked += 1;
                        return CensorResult::Reset(rule.description.clone());
                    }
                }
                _ => {}
            }
        }

        CensorResult::Allowed
    }

    /// Batch test: returns (allowed, blocked, throttled) counts.
    pub fn batch_test(&mut self, packets: &[SimulatedPacket]) -> (usize, usize, usize) {
        let mut allowed = 0;
        let mut blocked = 0;
        let mut throttled = 0;

        for pkt in packets {
            match self.check_packet(pkt) {
                CensorResult::Allowed => allowed += 1,
                CensorResult::Blocked(_) => blocked += 1,
                CensorResult::Throttled(_) => throttled += 1,
                CensorResult::Reset(_) => blocked += 1,
            }
        }

        (allowed, blocked, throttled)
    }

    /// Get statistics.
    pub fn stats(&self) -> CensorStats {
        CensorStats {
            packets_seen: self.packets_seen,
            packets_blocked: self.packets_blocked,
            packets_throttled: self.packets_throttled,
            rules_active: self.rules.iter().filter(|r| r.active).count(),
        }
    }

    /// Number of rules.
    pub fn rule_count(&self) -> usize {
        self.rules.len()
    }
}

impl Default for CensorshipSimulator {
    fn default() -> Self {
        Self::new()
    }
}

/// Censorship statistics.
#[derive(Debug, Clone)]
pub struct CensorStats {
    pub packets_seen: u64,
    pub packets_blocked: u64,
    pub packets_throttled: u64,
    pub rules_active: usize,
}

impl CensorStats {
    pub fn block_rate(&self) -> f64 {
        if self.packets_seen == 0 {
            0.0
        } else {
            self.packets_blocked as f64 / self.packets_seen as f64
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn make_packet(dest_ip: &str, dest_port: u16, payload: &[u8], protocol: &str) -> SimulatedPacket {
        SimulatedPacket {
            source_ip: "10.0.0.1".into(),
            dest_ip: dest_ip.into(),
            source_port: 12345,
            dest_port,
            payload: payload.to_vec(),
            protocol: protocol.into(),
        }
    }

    #[test]
    fn test_ip_blocking() {
        let mut sim = CensorshipSimulator::new();
        sim.add_rule(BlockingRule::ip_block("192.168.1"));

        let blocked = make_packet("192.168.1.5", 80, b"hello", "TCP");
        let allowed = make_packet("10.0.0.5", 80, b"hello", "TCP");

        assert!(matches!(sim.check_packet(&blocked), CensorResult::Blocked(_)));
        assert_eq!(sim.check_packet(&allowed), CensorResult::Allowed);
    }

    #[test]
    fn test_port_blocking() {
        let mut sim = CensorshipSimulator::new();
        sim.add_rule(BlockingRule::port_block(9001));

        let blocked = make_packet("10.0.0.5", 9001, b"data", "TCP");
        let allowed = make_packet("10.0.0.5", 80, b"data", "TCP");

        assert!(matches!(sim.check_packet(&blocked), CensorResult::Blocked(_)));
        assert_eq!(sim.check_packet(&allowed), CensorResult::Allowed);
    }

    #[test]
    fn test_dpi_detection() {
        let mut sim = CensorshipSimulator::new();
        sim.add_rule(BlockingRule::dpi_rule("SHADOW"));

        // Payload contains the signature
        let detected = make_packet("10.0.0.5", 443, b"xyzSHADOWabc", "TLS");
        let clean = make_packet("10.0.0.5", 443, b"normal traffic", "TLS");

        assert!(matches!(sim.check_packet(&detected), CensorResult::Blocked(_)));
        assert_eq!(sim.check_packet(&clean), CensorResult::Allowed);
    }

    #[test]
    fn test_throttling() {
        let mut sim = CensorshipSimulator::new();
        sim.add_rule(BlockingRule::throttle_rule("VPN"));

        let vpn = make_packet("10.0.0.5", 1194, b"data", "VPN_TUNNEL");
        let normal = make_packet("10.0.0.5", 80, b"data", "HTTP");

        assert!(matches!(sim.check_packet(&vpn), CensorResult::Throttled(_)));
        assert_eq!(sim.check_packet(&normal), CensorResult::Allowed);
    }

    #[test]
    fn test_batch_statistics() {
        let mut sim = CensorshipSimulator::with_standard_rules();

        let packets = vec![
            make_packet("10.0.0.5", 80, b"normal", "HTTP"),
            make_packet("10.0.0.5", 9001, b"tor data", "TCP"),
            make_packet("10.0.0.5", 8080, b"safe", "HTTP"),
        ];

        let (allowed, blocked, _throttled) = sim.batch_test(&packets);
        assert_eq!(allowed, 2);
        assert_eq!(blocked, 1);
    }
}