Security review notes: QUIC TLS verification, Linux firewall stubs, and auth token randomness

[MidasWR]

Hi,

While reviewing the current tree (0.25.8-25-gdc7f2ee4 on my side), I found a few security-relevant points that may deserve triage:

1. QUIC layer uses InsecureSkipVerify

File:

• vendor/0xacab.org/leap/obfsvpn/obfsvpn/quic.go:72

Observed code:

• InsecureSkipVerify: true

This disables TLS certificate verification in the QUIC transport layer. Even if this is intended for obfuscation only, it would be useful to clarify the expected threat model and whether another trust mechanism compensates for this.

2. Linux firewall helpers are stubs

File:

• pkg/helper/linux.go

Observed behavior:

• firewallStart(...) logs do nothing, not implemented
• firewallStop() logs do nothing, not implemented

This suggests Linux does not enforce firewall / kill-switch behavior in this path. If traffic leak protection is expected on Linux, this may need documentation or implementation.

3. Local auth token generation uses math/rand

File:

• pkg/backend/auth.go

Observed code:

• token generation uses math/rand
• token characters are generated with rand.Intn(...)

If this token is used as authentication material for local control endpoints, crypto/rand would be a safer default.

I’m not assuming all of these are exploitable by themselves, but they seem worth maintainer review.

If this should be handled privately instead of in a public issue, I’m happy to move it to the appropriate channel.

Powered by Ares-assisted review.