Maybenot模拟器

Maybenot框架的模拟器。

示例用法

有关API的详细信息，请参阅cargo文档。以下是如何使用模拟器的简单示例

use maybenot::{framework::TriggerEvent, machine::Machine};
use maybenot_simulator::{parse_trace, sim};
use std::{str::FromStr, time::Duration};

// A trace of ten packets from the client's perspective when visiting
// google.com over WireGuard. The format is: "time,direction,size\n". The
// direction is either "s" (sent) or "r" (received). The time is in
// nanoseconds since the start of the trace. The size is in bytes.
let raw_trace = "0,s,52
19714282,r,52
183976147,s,52
243699564,r,52
1696037773,s,40
2047985926,s,52
2055955094,r,52
9401039609,s,73
9401094589,s,73
9420892765,r,191";

// The delay between client and server. This is for the simulation of the
// network between the client and server
let delay = Duration::from_millis(10);

// Parse the raw trace into a queue of events for the simulator. This uses
// the delay to generate a queue of events at the client and server in such
// a way that the client is ensured to get the packets in the same order and
// at the same time as in the raw trace.
let mut input_trace = parse_trace(raw_trace, delay);

// A simple machine that sends one padding packet of 1000 bytes 20
// milliseconds after the first NonPaddingSent is sent.
let m = "789cedcfc10900200805506d82b6688c1caf5bc3b54823f4a1a2a453b7021ff8ff49\
41261f685323426187f8d3f9cceb18039205b9facab8914adf9d6d9406142f07f0";
let m = Machine::from_str(m).unwrap();

// Run the simulator with the machine at the client. Run the simulation up
// until 100 packets have been recorded (total, client and server).
let trace = sim(&[m], &[], &mut input_trace, delay, 100, true);

// print packets from the client's perspective
let starting_time = trace[0].time;
trace
    .into_iter()
    .filter(|p| p.client)
    .for_each(|p| match p.event {
        TriggerEvent::NonPaddingSent { bytes_sent } => {
            println!(
                "sent {} bytes at {} ms",
                bytes_sent,
                (p.time - starting_time).as_millis()
            );
        }
        TriggerEvent::PaddingSent { bytes_sent, .. } => {
            println!(
                "sent {} bytes of padding at {} ms",
                bytes_sent,
                (p.time - starting_time).as_millis()
            );
        }
        TriggerEvent::NonPaddingRecv { bytes_recv } => {
            println!(
                "received {} bytes at {} ms",
                bytes_recv,
                (p.time - starting_time).as_millis()
            );
        }
        TriggerEvent::PaddingRecv { bytes_recv, .. } => {
            println!(
                "received {} bytes of padding at {} ms",
                bytes_recv,
                (p.time - starting_time).as_millis()
            );
        }
        _ => {}
    });

生成以下输出

sent 52 bytes at 0 ms
received 52 bytes at 19 ms
sent 1000 bytes of padding at 20 ms
sent 52 bytes at 183 ms
received 52 bytes at 243 ms
sent 40 bytes at 1696 ms
sent 52 bytes at 2047 ms
received 52 bytes at 2055 ms
sent 73 bytes at 9401 ms
sent 73 bytes at 9401 ms
received 191 bytes at 9420 ms

主要限制

这是一个原型模拟器，因此它有许多限制。首先，它是一个模拟器！我们使用框架和客户端与服务器之间的网络来模拟与应用程序/目标的集成。我们有一个sim2real问题。

在网络安全方面，模拟器的相关代码在src/network.rs中。它非常简单：我们使用固定的静态延迟。这应该得到改进，并与现实世界的网络实验进行评估。模拟器的目标不一定是一个完美的模拟器，而是一个有用的模拟器，用于制作不同类型的流量分析防御。

在模拟机器的阻塞操作方面也存在根本问题。因为模拟器将加密网络流量的基本网络跟踪作为输入，所以我们不知道加密跟踪中数据包之间的任何语义或相互依赖关系。因此，我们无法正确地模拟阻塞操作。例如，如果一台机器阻止了一个数据包，我们无法知道被阻止的数据包是否包含导致后续接收到的数据包中包含响应的资源请求。模拟器仍会高兴地接收加密网络跟踪中的资源。这里有龙。

丰富的调试输出

可以将环境变量RUST_LOG=debug设置为运行模拟器以获取丰富的调试输出。例如，要使用调试输出运行集成测试test_bypass_machine，请运行以下命令

RUST_LOG=debug cargo test test_bypass_machine

贡献

除非你明确声明，否则，任何有意提交以包含在你根据Apache-2.0许可证定义的作品中的贡献，均应作为MIT或Apache-2.0双重许可，不得附加任何其他条款或条件。

赞助

得到了Mullvad VPN、瑞典互联网基金会和瑞典知识基金会的支持。