IRFARP (IRan Freedom ARP) System

The IRFARP System is a monolithic Rust application designed for covert communication. Its primary goal is to evade deep packet inspection (DPI) by leveraging custom raw IP protocols, including ICMP, a configurable Custom IP protocol, and the Iran Revolutionary Protocol (IRP). This system establishes a reliable, encrypted tunnel between a client and a server.

Features

• Custom Raw IP Protocols: Utilizes ICMP, a configurable Custom IP protocol number (default 253), and the Iran Revolutionary Protocol (IRP) using IP protocol number 254 for data tunneling.
• Banking-Grade Security: Employs audited cryptographic libraries (aes-gcm, hkdf, rand) for robust encryption and secure key derivation.
• Reliable Transport: Incorporates custom reliability mechanisms, including sequence numbers, acknowledgments, retransmissions, and flow control, to ensure data integrity over unreliable covert channels.
• Obfuscation: Includes random padding for IRP packets to further obscure traffic patterns and enhance stealth.
• Cross-Platform (Linux-focused): Raw socket operations are currently implemented for Linux, providing a foundation that can be extended to other operating systems.
• Metrics: Basic connection metrics are collected and logged, offering insights into system performance and operational status.

Prerequisites

To build and run the IRFARP System, the following are required:

• Rust Programming Language: The latest stable version of Rust.
• Linux Operating System: Raw socket capabilities are currently supported on Linux.
• setcap Utility: This utility is necessary to grant the compiled executable the required network capabilities without running as root. It's typically found in libcap2-bin (Debian/Ubuntu) or libcap (Fedora/CentOS).

Getting Started

Follow these steps to set up, configure, build, and deploy the IRFARP system.

1. Clone the Repository (or Create Project)

If cloning an existing repository:

git clone <repository-url>
cd irfarp_system

If starting a new project:

cargo new irfarp_system --bin
cd irfarp_system

2. Configure Cargo.toml

Ensure the Cargo.toml file in the project root includes all necessary dependencies and release profile optimizations for performance and binary size. (The Cargo.toml content would typically be provided in a separate file or directly in the repository).

An example Cargo.toml structure:

# Cargo.toml
[package]
name = "irfarp_system"
version = "0.1.0"
edition = "2021"

[dependencies]
tokio = { version = "1", features = ["full"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
log = "0.4"
env_logger = "0.11"
chrono = { version = "0.4", features = ["serde"] }
rand = "0.8"
getrandom = { version = "0.2", features = ["js"] }
aes-gcm = { version = "0.10", features = ["aes_ni"] }
hkdf = "0.12"
sha2 = "0.10"
bincode = "1"
base64 = "0.21"
byteorder = "1"

[target.'cfg(target_os = "linux")'.dependencies]
libc = "0.2"

[profile.release]
opt-level = "s"
lto = true
codegen-units = 1
strip = true

3. Place Source Code

The core application logic resides in a single source file. Place the Rust code (e.g., from irfarp-monolithic-system) into src/main.rs.

4. Generate Configuration Files

The application can generate example configuration files:

cargo run -- generate-config

This command creates server_config_example.json and client_config_example.json in the project root.

5. Edit Configuration Files

It is crucial to customize the generated configuration files:

• YOUR_SERVER_PUBLIC_IP: Replace this placeholder with the actual public IP address of the server (German egress node) in both server_config_example.json and client_config_example.json.
• YOUR_SECURE_32_BYTE_BASE64_ENCODED_KEY_HERE: This represents the master authentication key.

  • Secure Generation: Generate a random 32-byte key on a secure machine and base64 encode it. Example for Linux/macOS:
    head -c 32 /dev/urandom | base64

  • Placement: Replace the placeholder in both configuration files with this generated base64 string. The key must be identical on both server and client.

• Service Tokens: Replace placeholder tokens (e.g., UNIQUE_SSH_SERVICE_TOKEN_12345) with strong, unique, randomly generated strings for each service. The auth_token in the client configuration must match the token for the service it intends to connect to on the server.
• Client protocol_pool: Define the ordered list of covert protocols the client should attempt (e.g., ["irp", "icmp", "custom-ip-253"]). The client will cycle through this list.
• Timeouts and Retries: Adjust connect_timeout_ms, retry_delay_ms, and max_retries as needed for network conditions.
• RTO Values: Set initial_rto_ms and max_rto_ms for Retransmission Timeout.
• IRP Obfuscation Padding: Configure irp_obfuscation_min_padding and irp_obfuscation_max_padding to control the range of random padding added to IRP data packets.

6. Build the Project

Compile the application in release mode for optimized performance and a smaller binary size:

cargo build --release

The compiled executable will be located at target/release/irfarp_system.

7. Grant Raw Socket Capabilities (Linux Only)

The system requires CAP_NET_RAW capability to operate raw IP sockets. Grant this capability to the executable:

sudo setcap cap_net_raw+ep target/release/irfarp_system

This is a more secure alternative to running the entire program as root.

8. Configure Firewall Rules

Proper firewall configuration is critical for the system's functionality.

On the Server (German Egress Node):

• Inbound ICMP: Allow inbound ICMP traffic (Echo Request/Reply).
• Inbound Custom IP: Allow inbound traffic for the configured Custom IP protocol number (e.g., protocol 253).
• Inbound IRP: Allow inbound traffic for IP protocol 254 (IRP).
• Inbound TCP for Services: Allow inbound TCP connections on the bind_addr ports for local services (e.g., 127.0.0.1:22 for SSH, 127.0.0.1:80 for web server). These are internal connections from the irfarp_system to the actual services running on the server.

On the Client (Iranian 10Gbps Server):

• Outbound ICMP: Allow outbound ICMP traffic.
• Outbound Custom IP: Allow outbound traffic for the configured Custom IP protocol number.
• Outbound IRP: Allow outbound traffic for IP protocol 254 (IRP).
• Inbound TCP for Local Services: Ensure inbound TCP connections on the local_addr ports for local services (e.g., 127.0.0.1:22 for SSH, 127.0.0.1:80 for web) are allowed. Client applications will connect to these ports.

9. Run the IRFARP-Server

Execute the server component on your designated egress node:

target/release/irfarp_system server server_config_example.json

10. Run the IRFARP-Client

Execute the client component on your designated client machine:

target/release/irfarp_system client client_config_example.json

Contributing

Contributions are welcome! Please feel free to open issues or submit pull requests.

License

This project is licensed under the MIT License.