[vxfemboy]

Summary

Closes Sub-project #4 / Roadmap Item 3 (Traffic-Analysis Defense, #11).

This PR introduces end-to-end traffic-analysis defense (DAITA — Defending Against Intrusion with Traffic Analysis) and AmneziaWG-inspired wire shaping recipes across crates/yip-obf, bin/yipd, and crates/yip-io. The implementation directly mitigates the three primary side channels used by modern deep packet inspection classifiers, website fingerprinting classifiers, and statistical traffic-analysis models:

1. Packet Size Histograms: Eliminated via discrete bucket quantization (TrafficDefensePreset and round_to_bucket).
2. Idle-to-Active Burst Transitions: Masked via stochastic, multi-packet zero-allocation decoy bursts (JUNK_TYPE).
3. Inter-Arrival Time Regularity: Disrupted via bounded egress timing micro-jitter with overrun protection and event-loop poll timeout clamping.

All primitives maintain 100% wire-format compatibility with yip-obf, execute with zero heap allocations on the packet fast path, and enforce strict #![forbid(unsafe_code)] across all core and daemon crates.

---

Architectural Highlights

1. Discrete Bucket Quantization (crates/yip-obf, bin/yipd/src/peer_manager/obf.rs)

• In crates/yip-obf: Added TrafficDefensePreset enum (Off, Balanced, Paranoid) and round_to_bucket(raw_wire_len, buckets, max_budget) -> usize.
• Buckets:
  • balanced: [256, 512, 1024, 1420]
  • paranoid: [512, 1420] (2-state burst bucketing)
• Bounds: Guarantees $W_{\text{raw}} \le B_k \le M_{\text{budget}}$. Integrates cleanly with RFC 8899 PLPMTUD without padding probes beyond their measured budget or exceeding path MTU floors.
• Handshake integration: Post-quantum hybrid handshake packets (HandshakeInit 1,025B, HandshakeResp 945B) blend invisibly into standard data packet size buckets (1,420B and 1,024B/1,420B).

2. Zero-Allocation Decoy Bursts (bin/yipd/src/peer_manager/)

• During idle periods (governed by stochastic Poisson/uniform intervals $\pm 25%$), PeerManager::tick emits bursts of 1–defense_cover_burst_max decoy datagrams.
• Encrypted under the active link obfuscation key (obf_key / obf_psk) with ptype = JUNK_TYPE (6).
• Reuses obf_scratch by passing an empty body &[] and padding length pad_len = target_wire - 11 directly into yip_obf::obfuscate_into. Produces target wire size datagrams with zero heap allocations.
• Receivers authenticate decoys and discard them in constant time before TUN queueing or FEC reassembly, preventing session state mutation or replay counter corruption.

3. Bounded Micro-Jitter Delay Queue with Overrun Protection (bin/yipd/src/peer_manager/)

• Packets queued for micro-jitter delay (0..=defense_jitter_max_ms) are held in VecDeque<ScheduledDatagram>.
• Capacity is bounded by MAX_JITTER_QUEUE = 1024.
• Under heavy bulk traffic (e.g. iperf3 saturating line rate), buffer overruns trigger strict flush-oldest semantics (pop_front()), ensuring zero tail drops and preventing latency spikes.
• Continuous draining: All ready packets are dispatched during on_tun, on_udp (finish_wrapped), and tick.

4. Event-Loop Poll Timeout Clamping (crates/yip-io/src/poll.rs, bin/yipd/src/sharding.rs)

• Exposes next_timeout_ms via the Dispatch trait in yip-io, backed by PeerManager::next_scheduled_egress_delay_ms(now_ms).
• In run_poll (single-threaded runtime) and sharding.rs (multi-queue runtime), libc::epoll_wait's timeout is clamped to min(default_timeout_ms, delay_ms).
• Prevents 2–4ms micro-jittered packets from stalling until 10–50ms periodic timer ticks.

5. Multi-Engine Netns Integration & DPI Verification (bin/yipd/tests/tunnel_netns.rs)

• Added netns_tunnel_with_traffic_defense_balanced and netns_tunnel_with_traffic_defense_paranoid running real bidirectional pings and 3s iperf3 streams in isolated namespaces over veth pairs.
• Implemented safe, endianness-aware PCAP parser validating that on-wire captured UDP packets strictly belong to the configured discrete bucket sets ({256, 512, 1024, 1420} and {512, 1420}).
• Multi-engine DPI verification:
  • tshark: 0 packets match wg || openvpn || isakmp || esp || ah || udpencap || dtls.
  • nDPI (ndpiReader): classified strictly as Unknown / Unrated, 0 detections in VPN category.

---

Verification

• cargo fmt --check: Passed cleanly.
• cargo clippy --workspace --all-targets -- -D warnings: Passed with zero warnings.
• python3 crates/yip-bench/generate-graphs.py --check: Passed cleanly.
• cargo test --workspace: All 387+ workspace unit and integration tests passed.
• Pre-commit hooks: Passed.