Transfer Options
Several options are available to transfer the files from the black side to the red side:
manual file transfers, where you can use any method to move files from the black side to the red side, even using a USB drive,
TCP transfer, where InterDiode uses a direct TCP connection to transfer files,
UDP transfer, where InterDiode integrates a basic UDP file transfer protocol, with error correction, for connections through a physical data diode.
Transferred data are signed and checksummed, so that the red server can verify the integrity and authenticity of the data, even if the transfer is made through an untrusted channel. The authentication is based on a shared secret stored in the environment variable SHARED_TRANSFER_KEY, which must be the same on both sides, and the integrity is based on a digital signature of the data, which is verified on the red side with the shared secret.
Manual File Transfers
File transfers can be delegated by InterDiode to the method of your choice.
Exports will be prepared in the <LOCAL_CACHE_DIR>/tmp/ directory and moved atomically to <LOCAL_CACHE_DIR>/transfer/.
Any element present in <LOCAL_CACHE_DIR>/transfer/ on the black side can be safely assumed to be ready for transfer, since the atomic move ensures that all files are fully written and consistent before being moved to the transfer directory.
You are responsible to move it atomically to the <LOCAL_CACHE_DIR>/transfer/ folder on the red server: you should copy them to another directory on the same partition first.
The <LOCAL_CACHE_DIR>/transfer/ directory is scanned every minute by InterDiode and the transfer will then be automatically picked up by InterDiode for import.
Any method to move files from the black side to the red side can be used, even using a USB drive.
TRANSFER_MODE=file
Attention
Be careful when moving data into <LOCAL_CACHE_DIR>/transfer/: the transfer must be atomic, meaning that data must be first
moved in another directory which is physically on the same device (e.g., <LOCAL_CACHE_DIR>/tmp/) and then moved atomically to the <LOCAL_CACHE_DIR>/transfer/ directory.
TCP Transfers
InterDiode can also use a direct TCP connection to transfer files. Only a raw TCP connection is used, without any protocol on top, to ensure that data is sent unidirectionally. There is no data sent from the red server to the black server, other than TCP acknowledgments. Allowed black IP addresses can be configured on the red server. Every TCP connection from an unauthorized IP address will be rejected and logged.
BLACK_SOURCE_IPS=12.34.56.0/24
RED_DESTINATION_IP=12.34.56.78
RED_DESTINATION_PORT=15124
TRANSFER_MODE=tcp
UDP Transfers
InterDiode integrates a basic UDP file transfer protocol, with error correction, for connections through a physical data diode. InterDiode has been tested with qualified data diodes like the Thales Elips SD. You can also create a prototype by building your own data diode with affordable hardware, such as TP-Link MC100CMs or MC200CMs.
RED_DESTINATION_IP=12.34.56.78
RED_DESTINATION_MAC=00:11:22:33:44:55
RED_DESTINATION_PORT=15124
TRANSFER_MODE=udp
Attention
You must inject the MAC address of the red server into the ARP cache of the black-side host machine before using the integrated air gap protocol. This must be done on the host machine, not in the Docker container. This is required since the black server will send data to the red server without any acknowledgment, and the ARP cache must be pre-populated to ensure that the data is correctly routed.
/usr/sbin/ip neigh add <RED_DESTINATION_IP> lladdr <RED_DESTINATION_MAC> dev <NETWORK_DEVICE>
# old versions of Linux may not support the "ip neigh add" command, so you can use the "arp -s" command instead
/usr/sbin/arp -s <RED_DESTINATION_IP> <RED_DESTINATION_MAC>
For optimal performance, it is recommended to increase the UDP receive buffer size and the network backlog. You can do this with the following commands:
/usr/sbin/sysctl -w net.core.rmem_max="67108864"
/usr/sbin/sysctl -w net.core.rmem_default="67108864"
/usr/sbin/sysctl -w net.core.netdev_max_backlog="10000" # increase the network backlog to handle bursts of incoming packets and prevent packet loss
/usr/sbin/sysctl -w net.ipv4.udp_mem="49314528 65752736 3082158"