feat: add ESP32 embedded agent + namespace VRF reference docs + update android-agent submodule
- apps/device-agent-embedded/: ESP32 WireGuard agent (C, ESP-IDF, mbedTLS) - reference/namespace-vrf/: Linux namespace/VRF network isolation docs - apps/android-agent: VPN permission check, StartResult sealed class
This commit is contained in:
datadunia
@@ -0,0 +1,494 @@
|
||||
# Namespace + VRF Security Considerations
|
||||
|
||||
## Overview
|
||||
|
||||
This document covers security aspects of the Namespace + VRF architecture, including isolation guarantees, attack surfaces, and best practices.
|
||||
|
||||
## Isolation Guarantees
|
||||
|
||||
### Network Namespace Isolation
|
||||
|
||||
**What's isolated:**
|
||||
- Network interfaces
|
||||
- Routing tables
|
||||
- iptables/nftables rules
|
||||
- Socket bindings
|
||||
- `/proc/net` entries
|
||||
- Firewall rules
|
||||
|
||||
**What's NOT isolated:**
|
||||
- Kernel (shared)
|
||||
- Process IDs (different namespace, but visible with `nsenter`)
|
||||
- Filesystem (shared unless `--mount` used)
|
||||
- Users (shared unless `--user` used)
|
||||
|
||||
**Guarantee Level:** HIGH
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────┐
|
||||
│ Namespace Isolation │
|
||||
│ │
|
||||
│ ✅ Network interfaces (complete isolation) │
|
||||
│ ✅ Routing tables (complete isolation) │
|
||||
│ ✅ nftables rules (complete isolation) │
|
||||
│ ✅ Socket bindings (complete isolation) │
|
||||
│ ⚠️ Kernel (shared) │
|
||||
│ ⚠️ Filesystem (shared) │
|
||||
│ ⚠️ Process IDs (visible with nsenter) │
|
||||
└─────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
### VRF Isolation
|
||||
|
||||
**What's isolated:**
|
||||
- Routing tables
|
||||
- Gateway routes
|
||||
- Policy routing
|
||||
|
||||
**What's NOT isolated:**
|
||||
- Network interfaces (shared within namespace)
|
||||
- Kernel (shared)
|
||||
- nftables rules (shared within namespace)
|
||||
|
||||
**Guarantee Level:** MEDIUM
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────┐
|
||||
│ VRF Isolation │
|
||||
│ │
|
||||
│ ✅ Routing tables (complete isolation) │
|
||||
│ ✅ Gateway routes (complete isolation) │
|
||||
│ ⚠️ Network interfaces (shared within namespace) │
|
||||
│ ⚠️ Kernel (shared) │
|
||||
│ ⚠️ nftables rules (shared within namespace) │
|
||||
└─────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## Attack Surfaces
|
||||
|
||||
### 1. Cross-Namespace Attacks
|
||||
|
||||
**Risk:** LOW
|
||||
|
||||
**Attack Vector:**
|
||||
- Attacker gains access to one namespace
|
||||
- Attempts to access other namespaces
|
||||
|
||||
**Mitigation:**
|
||||
- Network namespace isolation prevents direct access
|
||||
- No routing between namespaces without explicit veth pairs
|
||||
- nftables rules can block cross-namespace traffic
|
||||
|
||||
**Detection:**
|
||||
```bash
|
||||
# Monitor cross-namespace attempts
|
||||
ip netns exec ns_test tcpdump -i any -n | grep -v "ns_test"
|
||||
```
|
||||
|
||||
### 2. VRF Escape Attacks
|
||||
|
||||
**Risk:** LOW
|
||||
|
||||
**Attack Vector:**
|
||||
- Attacker in one VRF attempts to access another VRF
|
||||
- Uses routing table manipulation
|
||||
|
||||
**Mitigation:**
|
||||
- VRF isolation prevents routing table access
|
||||
- Each VRF has separate routing table
|
||||
- No shared routing state
|
||||
|
||||
**Detection:**
|
||||
```bash
|
||||
# Monitor VRF routing changes
|
||||
ip netns exec ns_test ip route show table 100
|
||||
ip netns exec ns_test ip route show table 200
|
||||
```
|
||||
|
||||
### 3. Kernel Exploits
|
||||
|
||||
**Risk:** MEDIUM
|
||||
|
||||
**Attack Vector:**
|
||||
- Kernel vulnerability allows namespace escape
|
||||
- Shared kernel between all namespaces
|
||||
|
||||
**Mitigation:**
|
||||
- Keep kernel updated
|
||||
- Use kernel security modules (SELinux, AppArmor)
|
||||
- Limit namespace capabilities
|
||||
|
||||
**Detection:**
|
||||
```bash
|
||||
# Monitor kernel messages
|
||||
dmesg | grep -i "namespace\|vrf\|escape"
|
||||
```
|
||||
|
||||
### 4. Resource Exhaustion
|
||||
|
||||
**Risk:** MEDIUM
|
||||
|
||||
**Attack Vector:**
|
||||
- Attacker creates excessive namespaces/VRFs
|
||||
- Exhausts kernel resources
|
||||
|
||||
**Mitigation:**
|
||||
- Limit number of namespaces per user
|
||||
- Monitor resource usage
|
||||
- Implement quotas
|
||||
|
||||
**Detection:**
|
||||
```bash
|
||||
# Monitor namespace count
|
||||
ip netns list | wc -l
|
||||
|
||||
# Monitor VRF count
|
||||
ip link show type vrf | wc -l
|
||||
```
|
||||
|
||||
### 5. API Access Control Bypass
|
||||
|
||||
**Risk:** LOW
|
||||
|
||||
**Attack Vector:**
|
||||
- Attacker bypasses namespace-scoped API
|
||||
- Accesses other namespaces via API
|
||||
|
||||
**Mitigation:**
|
||||
- Middleware validates namespace access
|
||||
- Role-based access control
|
||||
- JWT tokens with namespace claims
|
||||
|
||||
**Detection:**
|
||||
```bash
|
||||
# Monitor API access
|
||||
journalctl -u nexusguard-server | grep "namespace"
|
||||
```
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### 1. Namespace Creation
|
||||
|
||||
```bash
|
||||
# DO: Create namespace with limited capabilities
|
||||
ip netns add ns_test
|
||||
|
||||
# DO: Set resource limits
|
||||
ulimit -n 65535
|
||||
|
||||
# DON'T: Use --privileged flag in containers
|
||||
docker run --privileged ... # BAD
|
||||
|
||||
# DO: Use specific capabilities
|
||||
docker run --cap-add=NET_ADMIN --cap-add=SYS_ADMIN ... # GOOD
|
||||
```
|
||||
|
||||
### 2. VRF Configuration
|
||||
|
||||
```bash
|
||||
# DO: Use separate routing tables
|
||||
ip link add vrf:main type vrf table 100
|
||||
ip link add vrf:isolated type vrf table 200
|
||||
|
||||
# DO: Add routes to correct table
|
||||
ip route add 10.100.0.0/24 dev wg0 table 100
|
||||
|
||||
# DON'T: Share routing tables between VRFs
|
||||
# BAD: Using same table ID for different VRFs
|
||||
```
|
||||
|
||||
### 3. nftables Rules
|
||||
|
||||
```bash
|
||||
# DO: Create per-namespace tables
|
||||
ip netns exec ns_test nft add table ip nexusguard
|
||||
|
||||
# DO: Set default DROP policy
|
||||
ip netns exec ns_test nft add chain ip nexusguard forward '{type filter hook forward priority filter; policy drop;}'
|
||||
|
||||
# DO: Allow only necessary traffic
|
||||
ip netns exec ns_test nft add rule ip nexusguard forward iifname wg0 accept
|
||||
|
||||
# DON'T: Use default ACCEPT policy
|
||||
# BAD: policy accept;
|
||||
```
|
||||
|
||||
### 4. WireGuard Configuration
|
||||
|
||||
```bash
|
||||
# DO: Use strong keys
|
||||
wg genkey | wg pubkey
|
||||
|
||||
# DO: Use preshared keys
|
||||
wg genpsk
|
||||
|
||||
# DO: Limit allowed IPs
|
||||
wg set wg0 peer <pubkey> allowed-ips 10.100.0.2/32
|
||||
|
||||
# DON'T: Use 0.0.0.0/0 for allowed IPs
|
||||
# BAD: allowed-ips 0.0.0.0/0
|
||||
```
|
||||
|
||||
### 5. API Authentication
|
||||
|
||||
```go
|
||||
// DO: Validate namespace access
|
||||
func (h *Handler) ValidateNamespaceAccess(userID, namespaceID uuid.UUID) error {
|
||||
var nsUser models.NamespaceUser
|
||||
if err := h.db.Where("user_id = ? AND namespace_id = ?", userID, namespaceID).
|
||||
First(&nsUser).Error; err != nil {
|
||||
return fmt.Errorf("access denied")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DO: Check role permissions
|
||||
func (h *Handler) CheckPermission(namespaceID, userID uuid.UUID, requiredRole string) error {
|
||||
var nsUser models.NamespaceUser
|
||||
if err := h.db.Where("user_id = ? AND namespace_id = ?", userID, namespaceID).
|
||||
First(&nsUser).Error; err != nil {
|
||||
return fmt.Errorf("access denied")
|
||||
}
|
||||
|
||||
if !hasPermission(nsUser.Role, requiredRole) {
|
||||
return fmt.Errorf("insufficient permissions")
|
||||
}
|
||||
return nil
|
||||
}
|
||||
```
|
||||
|
||||
## Compliance Considerations
|
||||
|
||||
### PCI DSS
|
||||
|
||||
**Requirements:**
|
||||
- Network segmentation
|
||||
- Access control
|
||||
- Audit logging
|
||||
|
||||
**Implementation:**
|
||||
```bash
|
||||
# Create PCI-compliant namespace
|
||||
ip netns add ns_pci
|
||||
|
||||
# Isolate PCI workloads
|
||||
ip link add vrf:pci type vrf table 300
|
||||
|
||||
# Add strict firewall rules
|
||||
ip netns exec ns_pci nft add table ip pci
|
||||
ip netns exec ns_pci nft add chain ip pci forward '{type filter hook forward priority filter; policy drop;}'
|
||||
ip netns exec ns_pci nft add rule ip pci forward iifname wg-pci accept
|
||||
|
||||
# Enable logging
|
||||
ip netns exec ns_pci nft add rule ip pci forward log prefix "PCI: " accept
|
||||
```
|
||||
|
||||
### HIPAA
|
||||
|
||||
**Requirements:**
|
||||
- Data isolation
|
||||
- Access control
|
||||
- Audit trails
|
||||
|
||||
**Implementation:**
|
||||
```bash
|
||||
# Create HIPAA-compliant namespace
|
||||
ip netns add ns_hipaa
|
||||
|
||||
# Isolate healthcare data
|
||||
ip link add vrf:hipaa type vrf table 400
|
||||
|
||||
# Add strict access controls
|
||||
ip netns exec ns_hipaa nft add table ip hipaa
|
||||
ip netns exec ns_hipaa nft add chain ip hipaa forward '{type filter hook forward priority filter; policy drop;}'
|
||||
ip netns exec ns_hipaa nft add rule ip hipaa forward iifname wg-hipaa accept
|
||||
|
||||
# Enable audit logging
|
||||
ip netns exec ns_hipaa nft add rule ip hipaa forward log prefix "HIPAA: " accept
|
||||
```
|
||||
|
||||
### SOC 2
|
||||
|
||||
**Requirements:**
|
||||
- Security controls
|
||||
- Monitoring
|
||||
- Incident response
|
||||
|
||||
**Implementation:**
|
||||
```bash
|
||||
# Create SOC 2-compliant namespace
|
||||
ip netns add ns_soc2
|
||||
|
||||
# Add monitoring
|
||||
ip netns exec ns_soc2 tcpdump -i any -w /var/log/soc2/capture.pcap
|
||||
|
||||
# Add alerting
|
||||
ip netns exec ns_soc2 nft add rule ip soc2 forward log prefix "SOC2: " accept
|
||||
```
|
||||
|
||||
## Monitoring and Alerting
|
||||
|
||||
### Namespace Monitoring
|
||||
|
||||
```bash
|
||||
# Monitor namespace creation
|
||||
ip netns list | while read ns; do
|
||||
echo "Namespace: $ns"
|
||||
ip netns exec "$ns" ip link show | grep -v "lo:"
|
||||
done
|
||||
|
||||
# Monitor namespace resource usage
|
||||
for ns in $(ip netns list | awk '{print $1}'); do
|
||||
echo "=== $ns ==="
|
||||
ip netns exec "$ns" cat /proc/net/dev
|
||||
done
|
||||
```
|
||||
|
||||
### VRF Monitoring
|
||||
|
||||
```bash
|
||||
# Monitor VRF creation
|
||||
ip link show type vrf | grep "vrf:" | awk '{print $2}'
|
||||
|
||||
# Monitor VRF routing tables
|
||||
for vrf in $(ip link show type vrf | grep "vrf:" | awk '{print $2}' | cut -d: -f1); do
|
||||
echo "=== $vrf ==="
|
||||
ip route show table all | grep "$vrf"
|
||||
done
|
||||
```
|
||||
|
||||
### Security Monitoring
|
||||
|
||||
```bash
|
||||
# Monitor cross-namespace attempts
|
||||
ip netns exec ns_test tcpdump -i any -n 2>&1 | \
|
||||
grep -v "ns_test" | \
|
||||
logger -t "namespace-security"
|
||||
|
||||
# Monitor VRF escape attempts
|
||||
ip netns exec ns_test ip route show table all | \
|
||||
grep -v "table 100" | \
|
||||
logger -t "vrf-security"
|
||||
```
|
||||
|
||||
## Incident Response
|
||||
|
||||
### Namespace Compromise
|
||||
|
||||
**Detection:**
|
||||
```bash
|
||||
# Check for suspicious activity
|
||||
ip netns exec ns_test tcpdump -i any -n -c 1000 > /tmp/suspicious.pcap
|
||||
|
||||
# Check for unauthorized access
|
||||
ip netns exec ns_test ss -tulpn
|
||||
|
||||
# Check for unusual processes
|
||||
ip netns exec ns_test ps aux
|
||||
```
|
||||
|
||||
**Response:**
|
||||
```bash
|
||||
# Isolate namespace
|
||||
ip netns exec ns_test nft add chain ip nexusguard isolate '{type filter hook forward priority 0; policy drop;}'
|
||||
|
||||
# Capture forensics
|
||||
ip netns exec ns_test tcpdump -i any -w /forensics/ns_test.pcap
|
||||
|
||||
# Reset namespace
|
||||
ip netns del ns_test
|
||||
ip netns add ns_test
|
||||
```
|
||||
|
||||
### VRF Escape
|
||||
|
||||
**Detection:**
|
||||
```bash
|
||||
# Monitor routing table changes
|
||||
ip netns exec ns_test ip route show table all | \
|
||||
awk 'NR>1{print $1}' | sort | uniq -c | sort -rn
|
||||
|
||||
# Check for unauthorized routes
|
||||
ip netns exec ns_test ip route show table 100 | grep -v "10.100.0.0/24"
|
||||
```
|
||||
|
||||
**Response:**
|
||||
```bash
|
||||
# Flush VRF routes
|
||||
ip netns exec ns_test ip route flush table 100
|
||||
|
||||
# Recreate VRF
|
||||
ip netns exec ns_test ip link del vrf:main
|
||||
ip netns exec ns_test ip link add vrf:main type vrf table 100
|
||||
ip netns exec ns_test ip link set vrf:main up
|
||||
```
|
||||
|
||||
## Security Auditing
|
||||
|
||||
### Audit Commands
|
||||
|
||||
```bash
|
||||
# List all namespaces
|
||||
ip netns list
|
||||
|
||||
# List all VRFs
|
||||
ip link show type vrf
|
||||
|
||||
# List all WireGuard interfaces
|
||||
ip netns exec ns_test wg show
|
||||
|
||||
# List all nftables rules
|
||||
ip netns exec ns_test nft list ruleset
|
||||
|
||||
# Check namespace permissions
|
||||
psql -U nexusguard -d nexusguard -c "
|
||||
SELECT n.name, nu.role, u.username
|
||||
FROM namespaces n
|
||||
JOIN namespace_users nu ON n.id = nu.namespace_id
|
||||
JOIN users u ON nu.user_id = u.id
|
||||
ORDER BY n.name, nu.role;
|
||||
"
|
||||
```
|
||||
|
||||
### Audit Logging
|
||||
|
||||
```bash
|
||||
# Enable audit logging
|
||||
auditctl -w /var/run/netns -p wa -k namespace
|
||||
auditctl -w /etc/netns -p wa -k namespace
|
||||
|
||||
# Check audit logs
|
||||
ausearch -k namespace --interpret
|
||||
```
|
||||
|
||||
### Security Scanning
|
||||
|
||||
```bash
|
||||
# Scan for open ports
|
||||
ip netns exec ns_test ss -tulpn
|
||||
|
||||
# Scan for vulnerabilities
|
||||
ip netns exec ns_test lynis audit system
|
||||
|
||||
# Check for misconfigurations
|
||||
ip netns exec ns_test nft list ruleset | \
|
||||
grep -E "(policy accept|0.0.0.0/0)"
|
||||
```
|
||||
|
||||
## Conclusion
|
||||
|
||||
The Namespace + VRF architecture provides **strong isolation guarantees** for network workloads. Key security considerations:
|
||||
|
||||
1. **Namespace isolation** is HIGH — complete network stack isolation
|
||||
2. **VRF isolation** is MEDIUM — routing table isolation within namespace
|
||||
3. **Attack surfaces** are limited but exist (kernel, filesystem)
|
||||
4. **Compliance** is achievable with proper implementation
|
||||
5. **Monitoring** is essential for security assurance
|
||||
|
||||
**Recommendation:** Implement with security best practices and regular auditing.
|
||||
|
||||
---
|
||||
|
||||
**Status:** Security reference — not yet implemented
|
||||
**Last Updated:** 2026-07-10
|
||||
**Author:** NexusGuard Team
|
||||
Reference in New Issue
Block a user