shadow_protocols/

timing.rs

//! Timing Engine for Traffic Pattern Obfuscation
//! 
//! Mimics realistic timing patterns from legitimate protocols to resist timing analysis.

use rand::Rng;
use rand_distr::{Distribution, Normal, Exp};
use std::time::{Duration, Instant};

/// Timing pattern type
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum TimingPattern {
    /// Constant inter-packet delay
    Constant(Duration),
    /// Gaussian distribution
    Gaussian { mean_ms: u64, stddev_ms: u64 },
    /// Exponential distribution (Poisson process)
    Exponential { rate_per_sec: f64 },
    /// WebRTC-like pattern (burst + jitter)
    WebRTC,
    /// HTTPS-like pattern (request-response)
    HTTPS,
    /// Custom pattern
    Custom,
}

/// Timing engine that generates realistic inter-packet delays
pub struct TimingEngine {
    pattern: TimingPattern,
    last_send: Instant,
    packet_count: u64,
}

impl TimingEngine {
    /// Create new timing engine with pattern
    pub fn new(pattern: TimingPattern) -> Self {
        Self {
            pattern,
            last_send: Instant::now(),
            packet_count: 0,
        }
    }

    /// Get next delay duration
    pub fn next_delay(&mut self) -> Duration {
        self.packet_count += 1;
        
        match self.pattern {
            TimingPattern::Constant(d) => d,
            
            TimingPattern::Gaussian { mean_ms, stddev_ms } => {
                let mut rng = rand::thread_rng();
                let normal = Normal::new(mean_ms as f64, stddev_ms as f64).unwrap();
                let delay_ms = normal.sample(&mut rng).max(0.0) as u64;
                Duration::from_millis(delay_ms)
            }
            
            TimingPattern::Exponential { rate_per_sec } => {
                let mut rng = rand::thread_rng();
                let exp = Exp::new(rate_per_sec).unwrap();
                let delay_sec = exp.sample(&mut rng);
                Duration::from_secs_f64(delay_sec)
            }
            
            TimingPattern::WebRTC => {
                self.webrtc_timing()
            }
            
            TimingPattern::HTTPS => {
                self.https_timing()
            }
            
            TimingPattern::Custom => {
                // Placeholder for custom patterns
                Duration::from_millis(50)
            }
        }
    }

    /// WebRTC-like timing: 30fps video with jitter
    fn webrtc_timing(&mut self) -> Duration {
        let mut rng = rand::thread_rng();
        
        // Base: 33.3ms per frame (30fps)
        let base_ms = 33;
        
        // Add Gaussian jitter: mean=0, stddev=5ms
        let jitter = Normal::new(0.0, 5.0).unwrap().sample(&mut rng);
        
        // Occasional burst packets (audio/video sync)
        let burst = if self.packet_count % 30 == 0 {
            // Every 30 packets, send burst
            rng.gen_range(0..5)
        } else {
            base_ms
        };
        
        Duration::from_millis((burst as f64 + jitter).max(1.0) as u64)
    }

    /// HTTPS-like timing: request-response pattern
    fn https_timing(&mut self) -> Duration {
        let mut rng = rand::thread_rng();
        
        // Alternate between request and response
        if self.packet_count % 2 == 0 {
            // Request: user think time (exponential)
            let think_time = Exp::new(0.5).unwrap().sample(&mut rng);
            Duration::from_secs_f64(think_time)
        } else {
            // Response: server processing (Gaussian)
            let processing: f64 = Normal::new(50.0, 20.0).unwrap().sample(&mut rng);
            Duration::from_millis(processing.max(10.0) as u64)
        }
    }

    /// Wait for next packet time (maintains target rate)
    pub async fn wait_next(&mut self) {
        let delay = self.next_delay();
        let elapsed = self.last_send.elapsed();
        
        if delay > elapsed {
            tokio::time::sleep(delay - elapsed).await;
        }
        
        self.last_send = Instant::now();
    }

    /// Change timing pattern
    pub fn set_pattern(&mut self, pattern: TimingPattern) {
        self.pattern = pattern;
    }

    /// Get current pattern
    pub fn pattern(&self) -> TimingPattern {
        self.pattern
    }

    /// Reset timing state
    pub fn reset(&mut self) {
        self.last_send = Instant::now();
        self.packet_count = 0;
    }
}

/// Burst timing generator for packet trains
pub struct BurstTiming {
    /// Packets per burst
    burst_size: usize,
    /// Inter-burst delay
    burst_delay: Duration,
    /// Inter-packet delay within burst
    packet_delay: Duration,
    /// Current position in burst
    position: usize,
}

impl BurstTiming {
    /// Create new burst timing
    pub fn new(burst_size: usize, burst_delay: Duration, packet_delay: Duration) -> Self {
        Self {
            burst_size,
            burst_delay,
            packet_delay,
            position: 0,
        }
    }

    /// Get next delay
    pub fn next_delay(&mut self) -> Duration {
        self.position += 1;
        
        if self.position >= self.burst_size {
            self.position = 0;
            self.burst_delay
        } else {
            self.packet_delay
        }
    }
}

/// Adaptive timing that adjusts to network conditions
pub struct AdaptiveTiming {
    /// Base timing engine
    engine: TimingEngine,
    /// Measured RTT samples
    rtt_samples: Vec<Duration>,
    /// Maximum samples to keep
    max_samples: usize,
}

impl AdaptiveTiming {
    /// Create new adaptive timing
    pub fn new(pattern: TimingPattern) -> Self {
        Self {
            engine: TimingEngine::new(pattern),
            rtt_samples: Vec::new(),
            max_samples: 100,
        }
    }

    /// Record RTT measurement
    pub fn record_rtt(&mut self, rtt: Duration) {
        self.rtt_samples.push(rtt);
        
        if self.rtt_samples.len() > self.max_samples {
            self.rtt_samples.remove(0);
        }
        
        // Adapt timing based on RTT
        self.adapt();
    }

    /// Adapt timing pattern based on measurements
    fn adapt(&mut self) {
        if self.rtt_samples.is_empty() {
            return;
        }

        // Calculate mean RTT
        let mean_rtt: Duration = self.rtt_samples.iter().sum::<Duration>() / self.rtt_samples.len() as u32;
        
        // Adjust timing to avoid congestion
        // Simple heuristic: if RTT > 200ms, slow down
        if mean_rtt > Duration::from_millis(200) {
            // Slow down by 20%
            let current_delay = self.engine.next_delay();
            let new_delay = current_delay + current_delay / 5;
            self.engine.set_pattern(TimingPattern::Constant(new_delay));
        }
    }

    /// Get next delay
    pub fn next_delay(&mut self) -> Duration {
        self.engine.next_delay()
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_constant_timing() {
        let mut engine = TimingEngine::new(TimingPattern::Constant(Duration::from_millis(100)));
        
        for _ in 0..10 {
            assert_eq!(engine.next_delay(), Duration::from_millis(100));
        }
    }

    #[test]
    fn test_gaussian_timing() {
        let mut engine = TimingEngine::new(TimingPattern::Gaussian {
            mean_ms: 50,
            stddev_ms: 10,
        });
        
        let mut delays = Vec::new();
        for _ in 0..100 {
            delays.push(engine.next_delay().as_millis());
        }
        
        // Check that mean is approximately 50ms
        let mean: u128 = delays.iter().sum::<u128>() / delays.len() as u128;
        assert!((mean as i128 - 50).abs() < 15, "Mean: {}", mean);
    }

    #[test]
    fn test_burst_timing() {
        let mut burst = BurstTiming::new(
            5,
            Duration::from_millis(100),
            Duration::from_millis(10),
        );
        
        // First 4 packets: short delay
        for _ in 0..4 {
            assert_eq!(burst.next_delay(), Duration::from_millis(10));
        }
        
        // 5th packet: long delay (burst boundary)
        assert_eq!(burst.next_delay(), Duration::from_millis(100));
    }

    #[test]
    fn test_pattern_switching() {
        let mut engine = TimingEngine::new(TimingPattern::Constant(Duration::from_millis(50)));
        
        assert_eq!(engine.next_delay(), Duration::from_millis(50));
        
        engine.set_pattern(TimingPattern::Constant(Duration::from_millis(100)));
        
        assert_eq!(engine.next_delay(), Duration::from_millis(100));
    }
}