2.4 KiB
Security model
What is protected
The server treats every public listener as hostile. v1 requires a configured client ID and at least 256 bits of entropy in its shared secret. Direct UDP authenticates every session and every data packet, rejects replay, tolerates authenticated NAT rebinding, and does not trust a session ID by itself. TLS-capable transports authenticate the server through normal X.509 hostname verification and authenticate the client with a post-connection HMAC challenge/response.
Secrets and application payloads must not appear in logs. Cryptographic operations belong to maintained Rust libraries; wgcloak does not implement encryption, HMAC, HKDF, SHA, or TLS itself.
Local permissions
Use separate secret files rather than inline values. Secret files should be
owned by the service account and mode 0600; the parent configuration
directory should not be writable by untrusted users. The Unix control socket
must be created in a private runtime directory with restrictive ownership and
mode (normally 0600). Do not put it in a world-writable directory.
The systemd templates apply NoNewPrivileges, a read-only system view, private
temporary storage, restricted address families, and other process hardening.
Review ReadWritePaths, certificate access, and local policy before enabling
them. Grant only CAP_NET_BIND_SERVICE when a low port is essential. Never
grant CAP_NET_ADMIN or CAP_SYS_ADMIN for normal operation.
Threat boundaries
The relay protects session admission and transport integrity; it does not make the encapsulated application secure. Direct UDP is not encrypted by wgcloak, so use QUIC, HTTP/3, or TLS/TCP when outer confidentiality is needed. A shared secret is a credential: rotate it out of band and avoid putting it in command lines, shell history, or issue reports.
Resource limits and bounded parsing reduce denial-of-service exposure, but a public relay still needs host firewalling, monitoring, and capacity planning. Authentication failure must stop probing rather than causing endless fallback traffic.
Explicit non-goals
v1 does not configure WireGuard, create TUN/TAP interfaces, manage routes or firewalls, provide traffic-shaping or browser/TLS-fingerprint evasion, hide traffic metadata from a compromised host, cluster servers, or support multiple simultaneous client tunnels. These boundaries are intentional.