xah30
c6f0d7af9b
Three v2-hardening features in aura-cli, one pass:
- nat::NatGuard: RAII auto-config of IP forwarding + MASQUERADE on server
startup. Linux (sysctl ip_forward + iptables -t nat MASQUERADE) and
macOS (sysctl ip.forwarding + pfctl with /tmp/aura-nat.conf). dry_run
works on every platform (logs "would run: ..."). Reverts everything in
Drop. New [server.nat] {auto, egress_iface, dry_run}; absent section =
back-compat no-op. Removes v1's "manual NAT/forwarding" step.
- privdrop::drop_to_user: drop euid/gid after binding TUN + privileged
ports. Linux setresuid/setresgid, macOS setgid+setuid (permanent drop),
Windows no-op with warning. New [server] / [client] run_as = "..."
(optional). Skipped with info-log if already non-root.
- admin: split transport into cfg(unix) Unix-socket and cfg(windows) Tokio
named-pipe modules sharing one JSON-line serve/request flow over
AsyncRead/AsyncWrite. DEFAULT_SOCKET = "/tmp/aura-admin.sock" on Unix,
r"\\.\pipe\aura-admin" on Windows. Removes v1's "admin Unix-only".
Deps: nix 0.29 user feature under [target.'cfg(unix)'.dependencies] (cli-
local, not workspace). Workspace: 155 tests passed (+13), clippy -D warnings
clean, fmt clean.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
85 lines
3.5 KiB
TOML
85 lines
3.5 KiB
TOML
# Aura VPN client configuration (project §9).
|
|
# Copy to client.toml and adjust. Paths may begin with `~` (expands to your home directory).
|
|
|
|
[client]
|
|
# Human-readable client name / id.
|
|
name = "laptop"
|
|
# Server UDP socket address.
|
|
server_addr = "203.0.113.10:443"
|
|
# Outer-TLS SNI (camouflage hostname) presented to the server. Also the name verified
|
|
# inside the Aura handshake against the server certificate's SAN.
|
|
sni = "cdn.example.com"
|
|
# Optional: drop privileges to this non-root user AFTER the TUN device has been brought up.
|
|
# Recommended when `aura client` is launched via sudo so the long-running router loop runs
|
|
# as an ordinary user. Linux uses setresuid/setresgid; macOS uses setgid/setuid; Windows is a
|
|
# no-op (use a service account instead). When omitted (or already running as non-root) no
|
|
# privilege change happens.
|
|
# run_as = "nobody"
|
|
|
|
[pki]
|
|
# Trust anchor (the Aura CA) and this client's leaf cert/key, all PEM.
|
|
# Issue with: aura pki issue-client --id laptop --out ~/.aura --ca ~/.aura
|
|
ca_cert = "~/.aura/ca.crt"
|
|
cert = "~/.aura/client.crt"
|
|
key = "~/.aura/client.key"
|
|
|
|
[tunnel]
|
|
# Requested TUN interface name (advisory on macOS, where the kernel assigns utunN).
|
|
tun_name = "aura0"
|
|
# Local address assigned to the TUN device, and its prefix length.
|
|
local_ip = "10.7.0.2"
|
|
prefix = 24
|
|
# TUN MTU.
|
|
mtu = 1420
|
|
# Tunnel resolver DNS (informational; the system resolver is used in v1).
|
|
dns = "10.7.0.1"
|
|
|
|
# Split-tunnel routing: the default action plus per-destination overrides.
|
|
[tunnel.split]
|
|
# Default for destinations matching no rule below: "VPN" or "DIRECT".
|
|
default = "VPN"
|
|
|
|
# Send these directly (bypass the tunnel): RFC1918 ranges stay on the LAN...
|
|
[[tunnel.split.direct]]
|
|
cidr = "192.168.0.0/16"
|
|
|
|
[[tunnel.split.direct]]
|
|
cidr = "10.0.0.0/8"
|
|
|
|
# ...and a corporate domain egresses directly (resolved to host routes at startup).
|
|
[[tunnel.split.direct]]
|
|
domain = "intranet.example.com"
|
|
|
|
# Force a more-specific range back through the VPN (longest-prefix wins over 10.0.0.0/8).
|
|
[[tunnel.split.vpn]]
|
|
cidr = "10.7.0.0/24"
|
|
|
|
[mimicry]
|
|
# Enable traffic padding to blend packet sizes into HTTPS buckets.
|
|
padding = false
|
|
|
|
[transport]
|
|
# Fallback order tried left-to-right ("handover"): the first transport that connects wins. Aura's
|
|
# own UDP transport is primary; TCP/443 and QUIC (HTTP/3 mimicry) are fallbacks for networks that
|
|
# throttle or block plain UDP. Omitting this whole section uses ["udp","tcp","quic"] on 443/443/444.
|
|
order = ["udp", "tcp", "quic"]
|
|
# Per-transport server ports. The server IP comes from [client] server_addr above (its port there is
|
|
# ignored). The UDP transport and QUIC both ride UDP, so udp_port and quic_port MUST differ; TCP may
|
|
# reuse the UDP port number.
|
|
udp_port = 443
|
|
tcp_port = 443
|
|
quic_port = 444
|
|
# UDP: pad datagrams up to HTTPS size buckets to blur the on-wire size distribution.
|
|
obfuscate = true
|
|
# TCP: prepend a minimal HTTP/1.1 preamble (Host = [client] sni) so the open resembles plain HTTP.
|
|
masquerade = true
|
|
|
|
[transport.masks]
|
|
# Daily protocol-mask rotation. When `true`, every day at 05:00 MSK (= 02:00 UTC) the client
|
|
# derives a new (SNI, User-Agent, Server-header, padding-profile) tuple from
|
|
# HKDF-SHA256(CA-fingerprint, MSK-date) and uses it for any subsequent connect — the server derives
|
|
# the same tuple independently from the same CA fingerprint, so no wire coordination is needed.
|
|
# Existing connections keep the mask they connected with. Default: true.
|
|
# When `false`, the static values above ([client] sni, [transport] obfuscate, ...) are used as-is.
|
|
enabled = true
|