Security audit — full code review & offensive assessment

[juev]

Security audit — full code review & offensive assessment

Type: tracking issue (meta) · Scope: self-assessment by maintainers

Goal

Conduct a structured security review of nebula-mgmt and nebula-agent,
combining a full source audit with an attacker-centric assessment. We treat
the control plane as a high-value target: it holds CA private keys, operator
credentials, enrollment tokens, and the authority to sign certificates that
grant access to the overlay network.

Threat objectives under test

1. Key extraction — recover CA private key material or the master KEK
   (NEBULA_MGMT_MASTER_KEY) at rest or at runtime.
2. Host management takeover — issue, revoke, or rotate certificates or
   alter firewall rules without proper authorization.
3. Network access — obtain a signed host certificate and reach another
   user's devices on the mesh.
4. Tenant isolation break — escalate from a non-admin operator to all
   operators' CAs and hosts ("all users on the server").

Methodology

• STRIDE threat model per entry point (management API, web UI, agent
  enroll/poll, OIDC, CLI, config).
• Source audit per package (auth, pki, keystore, api, store, web, agent,
  ratelimit, config) — authz boundaries, crypto, input validation,
  injection, secrets handling.
• Offensive testing against a local instance: auth bypass, token reuse,
  IDOR/tenancy break, certificate-issuance abuse, enrollment forgery.
• Tooling baseline: govulncheck, gosec, golangci-lint, generative fuzzing
  (ADR 0009).

Reporting

• This issue tracks progress and methodology only.
• Confirmed vulnerabilities are reported privately via
  GitHub Security Advisories (see SECURITY.md) and fixed before disclosure.
• Negative results (attempted-and-failed attacks) are documented to record
  what the design already withstands.

Checklist

• Threat model document → security: write a STRIDE threat-model document #207
• Local multi-operator test bench → security: reproducible local multi-operator offensive test bench #208
• Tooling baseline captured → ci(security): wire govulncheck + standalone gosec into the tooling baseline #209
• Audit: auth / sessions / OIDC
• Audit: pki / keystore (key material)
• Audit: api authz & tenancy
• Audit: agent enroll/poll
• Audit: store (SQL, migrations)
• Offensive pass per objective (1–4)
• Findings triaged & remediated

[juev]

Audit pass complete (2026-06-01)

Full source + offensive audit run across auth, pki, keystore, api, store, web, agent, ratelimit, config. 27 candidate findings raised, adversarially cross-verified → 5 confirmed, 22 refuted.

Confirmed exploitable (host-takeover, revocation not durable) — tracked privately via a draft GitHub Security Advisory per SECURITY.md, not detailed here.

Hardening (not exploitable / out-of-scope per SECURITY.md), tracked publicly:

• hardening: enforce TLS by default (refuse plaintext HTTP unless explicitly opted out) #179 — enforce TLS by default
• hardening: constant-time login to prevent username enumeration #180 — constant-time login (username enumeration)
• hardening: zeroize decrypted CA key material on LoadByID error path #181 — zeroize CA key material on error path

Defended (attacks attempted and refuted by design): envelope-encryption AAD/nonce attacks (GCM tag is the binding), cross-tenant IDOR/privesc (CA-ownership checks hold), OIDC token substitution (state + signature + single-use code), TOTP reuse (atomic session-state gate), SQLi (only test-only PRAGMA helpers), enroll-token entropy (crypto/rand UUID + SHA-256 + atomic single-use).