50 lines
2.4 KiB
Markdown
50 lines
2.4 KiB
Markdown
# Security model
|
|
|
|
## What is protected
|
|
|
|
The server treats every public listener as hostile. v1 requires a configured
|
|
client ID and at least 256 bits of entropy in its shared secret. Direct UDP
|
|
authenticates every session and every data packet, rejects replay, tolerates
|
|
authenticated NAT rebinding, and does not trust a session ID by itself.
|
|
TLS-capable transports authenticate the server through normal X.509 hostname
|
|
verification and authenticate the client with a post-connection HMAC
|
|
challenge/response.
|
|
|
|
Secrets and application payloads must not appear in logs. Cryptographic
|
|
operations belong to maintained Rust libraries; wgcloak does not implement
|
|
encryption, HMAC, HKDF, SHA, or TLS itself.
|
|
|
|
## Local permissions
|
|
|
|
Use separate secret files rather than inline values. Secret files should be
|
|
owned by the service account and mode `0600`; the parent configuration
|
|
directory should not be writable by untrusted users. The Unix control socket
|
|
must be created in a private runtime directory with restrictive ownership and
|
|
mode (normally `0600`). Do not put it in a world-writable directory.
|
|
|
|
The systemd templates apply `NoNewPrivileges`, a read-only system view, private
|
|
temporary storage, restricted address families, and other process hardening.
|
|
Review `ReadWritePaths`, certificate access, and local policy before enabling
|
|
them. Grant only `CAP_NET_BIND_SERVICE` when a low port is essential. Never
|
|
grant `CAP_NET_ADMIN` or `CAP_SYS_ADMIN` for normal operation.
|
|
|
|
## Threat boundaries
|
|
|
|
The relay protects session admission and transport integrity; it does not make
|
|
the encapsulated application secure. Direct UDP is not encrypted by wgcloak,
|
|
so use QUIC, HTTP/3, or TLS/TCP when outer confidentiality is needed. A shared
|
|
secret is a credential: rotate it out of band and avoid putting it in command
|
|
lines, shell history, or issue reports.
|
|
|
|
Resource limits and bounded parsing reduce denial-of-service exposure, but a
|
|
public relay still needs host firewalling, monitoring, and capacity planning.
|
|
Authentication failure must stop probing rather than causing endless fallback
|
|
traffic.
|
|
|
|
## Explicit non-goals
|
|
|
|
v1 does not configure WireGuard, create TUN/TAP interfaces, manage routes or
|
|
firewalls, provide traffic-shaping or browser/TLS-fingerprint evasion, hide
|
|
traffic metadata from a compromised host, cluster servers, or support multiple
|
|
simultaneous client tunnels. These boundaries are intentional.
|