diff options
| author | Linus Färnstrand <linus@mullvad.net> | 2020-06-23 12:21:43 +0200 |
|---|---|---|
| committer | Linus Färnstrand <linus@mullvad.net> | 2020-06-23 15:45:57 +0200 |
| commit | 63193938c1c5719e06eae51f8d213af55125a2de (patch) | |
| tree | 4148087a4cf3fae9abad38093414f2db1c4b131c /docs/security.md | |
| parent | b3d5b44d96b4ba5bf63a5291c226d6197753d535 (diff) | |
| download | mullvadvpn-63193938c1c5719e06eae51f8d213af55125a2de.tar.xz mullvadvpn-63193938c1c5719e06eae51f8d213af55125a2de.zip | |
Update security document with restrictions to allow relay rule
This fixes audit finding MUL-02-002 and MUL-02-004
Diffstat (limited to 'docs/security.md')
| -rw-r--r-- | docs/security.md | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/docs/security.md b/docs/security.md index 6ec2547bba..7fc5369bd3 100644 --- a/docs/security.md +++ b/docs/security.md @@ -122,13 +122,23 @@ been established and verified to work. Then it transitions to the [connected] st In this state, network traffic to the IP+port+protocol combination used for the first hop of the VPN tunnel is allowed on all interfaces, together with responses to this outgoing traffic. First hop means the bridge server if one is used, otherwise the VPN server directly. +This IP+port+protocol combination should only be allowed for the process establishing the +VPN tunnel, or only administrator level processes, depending on what the platform firewall +allows restricting. On Windows the rule only allows processes from binaries in certain paths. +On Linux and macOS the rule only allows packets from processes running as `root`. +This process/user check is important to not allow unprivileged programs +to leak packets to this IP outside the tunnel, as those packets can be fingerprinted. + Examples: 1. No bridge is used and the tunnel protocol is OpenVPN trying to connect with UDP to a VPN - server at IP `a.b.c.d` port `1301` - Allow traffic to `a.b.c.d:1301/UDP` and incoming matching - traffic. + server at IP `a.b.c.d` port `1301` - Allow traffic to `a.b.c.d:1301/UDP` for `openvpn.exe` + or any process running as `root`, and incoming matching traffic. 1. Connecting to the same VPN server, but via a bridge. The bridge is at IP `e.f.g.h` and the - proxy service listens on TCP port `443` - Allow traffic to `e.f.g.h:443/TCP` and incoming matching + proxy service listens on TCP port `443` - Allow traffic to `e.f.g.h:443/TCP` for + `sslocal.exe` or any process running as `root`, and incoming matching traffic. Do not allow any direct communication with the VPN server. +1. Connecting to `a.b.c.d` port `1234` using WireGuard: Allow `a.b.c.d:1234/UDP` for + `mullvad-daemon.exe` or any process running as `root`. If connecting via WireGuard, this state allows ICMP packets to and from the in-tunnel IPs (both v4 and v6) of the relay server the app is currently connecting to. That means the private |