def test_master_key_generation_and_load(self):
masterkey = MasterKey('ut', local_test=False)
self.assertIsInstance(masterkey.master_key, bytes)
os.path.isfile(f"{DIR_USER_DATA}ut_login_data")
self.assertEqual(
os.path.getsize(f"{DIR_USER_DATA}ut_login_data"),
ARGON2_SALT_LEN + KEY_LENGTH + 3 * INTEGER_SETTING_LEN)
masterkey = MasterKey('ut', local_test=False)
self.assertIsInstance(masterkey.master_key, bytes)
def test_master_key_generation_and_load(self, *_: Any) -> None:
with self.assertRaises(SystemExit):
MasterKey(self.operation, local_test=True)
master_key = MasterKey(self.operation, local_test=True)
self.assertIsInstance(master_key.master_key, bytes)
self.assertEqual(os.path.getsize(self.file_name), MASTERKEY_DB_SIZE + BLAKE2_DIGEST_LENGTH)
master_key2 = MasterKey(self.operation, local_test=True)
self.assertIsInstance(master_key2.master_key, bytes)
self.assertEqual(master_key.master_key, master_key2.master_key)
def test_determine_memory_cost(self, *_: Any) -> None:
master_key = MasterKey(self.operation, local_test=True)
master_key.determine_memory_cost("password",
8 * b'salt',
time_cost=1,
memory_cost=1024,
parallelism=1)
def test_database_data_caching_and_storage_on_command(self, *_: Any):
master_key = MasterKey(self.operation, local_test=True)
master_key.new_master_key(replace=False)
self.assertEqual(len(master_key.database_data), MASTERKEY_DB_SIZE)
master_key.replace_database_data()
self.assertIsNone(master_key.database_data)
self.assertTrue(os.path.isfile(self.file_name))
def test_determine_time_cost(self, *_: Any) -> None:
master_key = MasterKey(self.operation, local_test=True)
# Test1: Sentinel returns immediately if MAX_KEY_DERIVATION_TIME is exceeded
time_cost, kd_time, _ = master_key.determine_time_cost("password",
8 * b'salt',
memory_cost=512,
parallelism=1)
self.assertEqual(time_cost, 1)
self.assertEqual(kd_time, 4.1)
# Test2: Second key derivation time sentinel
time_cost, kd_time, _ = master_key.determine_time_cost("password",
8 * b'salt',
memory_cost=512,
parallelism=1)
self.assertEqual(time_cost, 2)
self.assertEqual(kd_time, 4.1)
# Test3: Complete binary search with search end
time_cost, kd_time, _ = master_key.determine_time_cost("password",
8 * b'salt',
memory_cost=512,
parallelism=1)
self.assertEqual(time_cost, 40)
self.assertEqual(kd_time, 2.5)
def test_invalid_data_in_db_raises_critical_error(self, _):
for delta in [-1, 1]:
ensure_dir(DIR_USER_DATA)
with open(self.file_name, 'wb+') as f:
f.write(os.urandom(MASTERKEY_DB_SIZE + delta))
with self.assertRaises(SystemExit):
_ = MasterKey(self.operation, local_test=False)
def test_load_master_key_with_invalid_data_raises_critical_error(self, _: Any) -> None:
# Setup
ensure_dir(DIR_USER_DATA)
data = os.urandom(MASTERKEY_DB_SIZE + BLAKE2_DIGEST_LENGTH)
with open(self.file_name, 'wb+') as f:
f.write(data)
# Test
with self.assertRaises(SystemExit):
_ = MasterKey(self.operation, local_test=False)
def test_invalid_data_in_db_raises_critical_error(self, _: Any) -> None:
for delta in [-1, 1]:
# Setup
ensure_dir(DIR_USER_DATA)
data = os.urandom(MASTERKEY_DB_SIZE + delta)
data += blake2b(data)
with open(self.file_name, 'wb+') as f:
f.write(data)
# Test
with self.assertRaises(SystemExit):
_ = MasterKey(self.operation, local_test=False)
def test_class(self):
# Setup
o_get_password = getpass.getpass
getpass.getpass = lambda x: 'testpwd'
# Test
masterkey = MasterKey('ut', local_test=False)
self.assertIsInstance(masterkey.master_key, bytes)
os.path.isfile(f"{DIR_USER_DATA}/ut_login_data")
self.assertEqual(os.path.getsize(f"{DIR_USER_DATA}/ut_login_data"),
32 + 32 + 8 + 8)
cleanup()
masterkey = MasterKey('ut', local_test=True)
self.assertIsInstance(masterkey.master_key, bytes)
masterkey = MasterKey('ut', local_test=True)
self.assertIsInstance(masterkey.master_key, bytes)
# Teardown
getpass.getpass = o_get_password
cleanup()
def test_authenticate_action(self, *_: Any) -> None:
master_key = MasterKey(self.operation, local_test=True)
self.assert_se("Authentication aborted.", master_key.authenticate_action)
self.assertTrue(master_key.authenticate_action())
def test_password_generation(self, *_: Any) -> None:
master_key = MasterKey(self.operation, local_test=True)
self.assertIsInstance(master_key.master_key, bytes)
def main() -> None:
"""Load persistent data and launch the Transmitter/Receiver Program.
This function decrypts user data from databases and launches
processes for Transmitter or Receiver Program. It then monitors the
EXIT_QUEUE for EXIT/WIPE signals and each process in case one of
them dies.
If you're reading this code to get the big picture on how TFC works,
start by looking at the loop functions below, defined as the target
for each process, from top to bottom:
From `input_loop` process, you can see how the Transmitter
Program processes a message or command from the user, creates
assembly packets for a message/file/command, and how those are
eventually pushed into a multiprocessing queue, from where they are
loaded by the `sender_loop`.
The `sender_loop` process encrypts outgoing assembly packets,
and outputs the encrypted datagrams to the Networked Computer. The
process also sends assembly packets to the `log_writer_loop`.
The `log_writer_loop` process filters out non-message assembly
packets and if logging for contact is enabled, stores the message
assembly packet into an encrypted log database.
The `noise_loop` processes are used to provide the `sender_loop`
an interface identical to that of the `input_loop`. The
`sender_loop` uses the interface to load noise packets/commands when
traffic masking is enabled.
Refer to the file `relay.py` to see how the Relay Program on
Networked Computer manages datagrams between the network and
Source/Destination Computer.
In Receiver Program (also launched by this file), the `gateway_loop`
process acts as a buffer for incoming datagrams. This buffer is
consumed by the `receiver_loop` process that organizes datagrams
loaded from the buffer into a set of queues depending on datagram
type. Finally, the `output_loop` process loads and processes
datagrams from the queues in the order of priority.
"""
working_dir = f'{os.getenv("HOME")}/{DIR_TFC}'
ensure_dir(working_dir)
os.chdir(working_dir)
operation, local_test, data_diode_sockets = process_arguments()
check_kernel_version()
check_kernel_entropy()
print_title(operation)
master_key = MasterKey( operation, local_test)
gateway = Gateway( operation, local_test, data_diode_sockets)
settings = Settings( master_key, operation, local_test)
contact_list = ContactList(master_key, settings)
key_list = KeyList( master_key, settings)
group_list = GroupList( master_key, settings, contact_list)
if settings.software_operation == TX:
onion_service = OnionService(master_key)
queues = {MESSAGE_PACKET_QUEUE: Queue(), # Standard messages
COMMAND_PACKET_QUEUE: Queue(), # Standard commands
TM_MESSAGE_PACKET_QUEUE: Queue(), # Traffic masking messages
TM_FILE_PACKET_QUEUE: Queue(), # Traffic masking files
TM_COMMAND_PACKET_QUEUE: Queue(), # Traffic masking commands
TM_NOISE_PACKET_QUEUE: Queue(), # Traffic masking noise packets
TM_NOISE_COMMAND_QUEUE: Queue(), # Traffic masking noise commands
RELAY_PACKET_QUEUE: Queue(), # Unencrypted datagrams to Networked Computer
LOG_PACKET_QUEUE: Queue(), # `log_writer_loop` assembly packets to be logged
LOG_SETTING_QUEUE: Queue(), # `log_writer_loop` logging state management between noise packets
TRAFFIC_MASKING_QUEUE: Queue(), # `log_writer_loop` traffic masking setting management commands
LOGFILE_MASKING_QUEUE: Queue(), # `log_writer_loop` logfile masking setting management commands
KEY_MANAGEMENT_QUEUE: Queue(), # `sender_loop` key database management commands
SENDER_MODE_QUEUE: Queue(), # `sender_loop` default/traffic masking mode switch commands
WINDOW_SELECT_QUEUE: Queue(), # `sender_loop` window selection commands during traffic masking
EXIT_QUEUE: Queue() # EXIT/WIPE signal from `input_loop` to `main`
} # type: Dict[bytes, Queue]
process_list = [Process(target=input_loop, args=(queues, settings, gateway, contact_list, group_list,
master_key, onion_service, sys.stdin.fileno())),
Process(target=sender_loop, args=(queues, settings, gateway, key_list)),
Process(target=log_writer_loop, args=(queues, settings)),
Process(target=noise_loop, args=(queues, contact_list)),
Process(target=noise_loop, args=(queues,))]
else:
queues = {GATEWAY_QUEUE: Queue(), # Buffer for incoming datagrams
LOCAL_KEY_DATAGRAM_HEADER: Queue(), # Local key datagrams
MESSAGE_DATAGRAM_HEADER: Queue(), # Message datagrams
FILE_DATAGRAM_HEADER: Queue(), # File datagrams
COMMAND_DATAGRAM_HEADER: Queue(), # Command datagrams
EXIT_QUEUE: Queue() # EXIT/WIPE signal from `output_loop` to `main`
}
process_list = [Process(target=gateway_loop, args=(queues, gateway)),
Process(target=receiver_loop, args=(queues, gateway)),
Process(target=output_loop, args=(queues, gateway, settings, contact_list, key_list,
group_list, master_key, sys.stdin.fileno()))]
for p in process_list:
p.start()
monitor_processes(process_list, settings.software_operation, queues)
def main() -> None:
"""Derive master key, decrypt databases and initialize processes."""
os.chdir(sys.path[0])
init_entropy()
operation, local_test, dd_sockets = process_arguments()
clear_screen()
c_print("TFC", head=1, tail=1)
master_key = MasterKey(operation, local_test)
settings = Settings(master_key, operation, local_test, dd_sockets)
contact_list = ContactList(master_key, settings)
key_list = KeyList(master_key, settings)
group_list = GroupList(master_key, settings, contact_list)
gateway = Gateway(settings)
process_list = []
if settings.software_operation == 'tx':
queues = {
MESSAGE_PACKET_QUEUE: Queue(),
FILE_PACKET_QUEUE: Queue(),
COMMAND_PACKET_QUEUE: Queue(),
LOG_PACKET_QUEUE: Queue(),
NOISE_PACKET_QUEUE: Queue(),
NOISE_COMMAND_QUEUE: Queue(),
KEY_MANAGEMENT_QUEUE: Queue(),
WINDOW_SELECT_QUEUE: Queue()
}
if settings.session_trickle:
np_filler = Process(target=noise_process,
args=(P_N_HEADER, queues[NOISE_PACKET_QUEUE],
contact_list))
nc_filler = Process(target=noise_process,
args=(C_N_HEADER, queues[NOISE_COMMAND_QUEUE]))
process_list.extend([np_filler, nc_filler])
for p in [np_filler, nc_filler]:
p.start()
while any([
q.qsize() < 1000 for q in
[queues[NOISE_PACKET_QUEUE], queues[NOISE_COMMAND_QUEUE]]
]):
time.sleep(0.1)
sender_process = Process(target=sender_loop,
args=(settings, queues, gateway, key_list))
input_process = Process(target=tx_loop,
args=(settings, queues, gateway,
contact_list, group_list, master_key,
sys.stdin.fileno()))
log_process = Process(target=log_writer,
args=(queues[LOG_PACKET_QUEUE], ))
process_list.extend([sender_process, input_process, log_process])
for p in [sender_process, input_process, log_process]:
p.start()
elif settings.software_operation == 'rx':
queues = {
LOCAL_KEY_PACKET_HEADER: Queue(),
PUBLIC_KEY_PACKET_HEADER: Queue(),
MESSAGE_PACKET_HEADER: Queue(),
COMMAND_PACKET_HEADER: Queue(),
IMPORTED_FILE_CT_HEADER: Queue(),
GATEWAY_QUEUE: Queue()
}
gateway_process = Process(target=gw_incoming,
args=(gateway, queues[GATEWAY_QUEUE]))
receiver_process = Process(target=receiver_loop,
args=(settings, queues))
output_process = Process(target=rx_loop,
args=(settings, queues, contact_list,
key_list, group_list, master_key,
sys.stdin.fileno()))
process_list.extend(
[gateway_process, receiver_process, output_process])
for p in [gateway_process, receiver_process, output_process]:
p.start()
while True:
try:
time.sleep(0.1)
if not all([p.is_alive() for p in process_list]):
for p in process_list:
p.terminate()
exit()
except (EOFError, KeyboardInterrupt):
pass
def test_kd_binary_search(self, *_: Any) -> None:
MasterKey(self.operation, local_test=True)
def test_kd_binary_serach(self, *_):
MasterKey(self.operation, local_test=True)
def main() -> None:
"""Derive master key, decrypt databases and initialize processes."""
os.chdir(sys.path[0])
check_kernel_version()
check_kernel_entropy()
operation, local_test, dd_sockets = process_arguments()
clear_screen()
c_print(TFC, head=1, tail=1)
master_key = MasterKey(operation, local_test)
settings = Settings(master_key, operation, local_test, dd_sockets)
contact_list = ContactList(master_key, settings)
key_list = KeyList(master_key, settings)
group_list = GroupList(master_key, settings, contact_list)
gateway = Gateway(settings)
if settings.software_operation == TX:
queues = {
MESSAGE_PACKET_QUEUE: Queue(),
FILE_PACKET_QUEUE: Queue(),
COMMAND_PACKET_QUEUE: Queue(),
NH_PACKET_QUEUE: Queue(),
LOG_PACKET_QUEUE: Queue(),
EXIT_QUEUE: Queue(),
NOISE_PACKET_QUEUE: Queue(),
NOISE_COMMAND_QUEUE: Queue(),
KEY_MANAGEMENT_QUEUE: Queue(),
WINDOW_SELECT_QUEUE: Queue()
}
process_list = [
Process(target=input_loop,
args=(queues, settings, gateway, contact_list, group_list,
master_key, sys.stdin.fileno())),
Process(target=sender_loop,
args=(queues, settings, gateway, key_list)),
Process(target=log_writer_loop, args=(queues, ))
]
if settings.session_traffic_masking:
process_list.extend([
Process(target=noise_loop,
args=(P_N_HEADER, queues[NOISE_PACKET_QUEUE],
contact_list)),
Process(target=noise_loop,
args=(C_N_HEADER, queues[NOISE_COMMAND_QUEUE]))
])
else:
queues = {
LOCAL_KEY_PACKET_HEADER: Queue(),
PUBLIC_KEY_PACKET_HEADER: Queue(),
MESSAGE_PACKET_HEADER: Queue(),
COMMAND_PACKET_HEADER: Queue(),
IMPORTED_FILE_HEADER: Queue(),
EXIT_QUEUE: Queue(),
GATEWAY_QUEUE: Queue()
}
process_list = [
Process(target=gateway_loop, args=(queues, gateway)),
Process(target=receiver_loop, args=(queues, settings)),
Process(target=output_loop,
args=(queues, settings, contact_list, key_list, group_list,
master_key, sys.stdin.fileno()))
]
for p in process_list:
p.start()
while True:
with ignored(EOFError, KeyboardInterrupt):
time.sleep(0.1)
if not all([p.is_alive() for p in process_list]):
for p in process_list:
p.terminate()
sys.exit(1)
if not queues[EXIT_QUEUE].empty():
command = queues[EXIT_QUEUE].get()
for p in process_list:
p.terminate()
if command == WIPE:
subprocess.Popen(
f"find {DIR_USER_DATA} -name '{operation}*' -type f -exec shred -n 3 -z -u {{}} \;",
shell=True).wait()
os.system('poweroff')
else:
sys.exit(0)
