C2 VPN verification
- Area
- C — Trust & correctness
- Audience
- operator
- Kind
- feature
- Status
- accepted
- Maturity
- shipped
- Shipped in
- 0.6.0
- Labels
- vpn, network, verification
- Requires
- B5
The feature in the specification · Read at
Requirements
Verification MUST compare public IP observed from inside the download client's namespace against the VPN container's.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn.rs
- cited by
- lemonfiber@4ccc9f6bf1lemonfiber@fb11824654
A mismatch between the download client's egress and the tunnel MUST be reported as leaking at critical severity.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn.rs
- cited by
- lemonfiber@4ccc9f6bf1
Inability to reach an IP-echo source MUST report unverified, never pass.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn.rs
- cited by
- lemonfiber@88253a6514lemonfiber@4ccc9f6bf1
Forwarded-port assignment, client configuration, reachability and post-reconnect match MUST each be checked separately.
A forwarded port that changed MUST be re-pushed to the download client automatically and the change recorded.
When the tunnel is up but no port was granted on a port-forwarding-capable provider, that provider's known trap MUST be named as the first candidate cause.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn/port_forward.rs
- cited by
- lemonfiber@05e0b8951f
Killswitch verification MUST be opt-in and MUST report unverified until it has been run.
Killswitch verification MUST restore the prior state and MUST verify restoration before reporting.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn/killswitch.rs
- cited by
- lemonfiber@8fbe3c67ff
Egress matching MUST be re-checked periodically while torrent transfers are active.
A leak detected after startup MUST notify immediately at critical severity.
The VPN exit country MUST be reported.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn.rs
- cited by
- lemonfiber@4ccc9f6bf1
A download client not sharing the VPN's network namespace MUST be reported as leaking, naming the network mode.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn.rs
- cited by
- lemonfiber@4ccc9f6bf1
Where the VPN is unconfigured by acknowledged choice, lemonfiber MUST NOT repeat the warning on every run.
Disagreement between IP-echo sources MUST be reported rather than resolved arbitrarily.
Providers MUST be modelled by capability, not by name; support MUST NOT be limited to an enumerated provider list.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn.rs
- cited by
- lemonfiber@4ccc9f6bf1
Where the provider does not support port forwarding, port checks MUST report not-applicable and MUST NOT report as failed or degraded.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn/port_forward.rs
- cited by
- lemonfiber@05e0b8951f
The consequence of running without a forwarded port — reduced peer connectivity and seeding — MUST be stated once at setup, and MUST NOT be repeated as a recurring warning.
Where a provider's capability is unknown, port checks MUST report unverified rather than assuming presence or absence.
- locked by
- 0.6.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/vpn/port_forward.rs
- cited by
- lemonfiber@05e0b8951f
Both the port-acquire and port-release paths MUST be wired, so the client re-acquires correctly after a tunnel drop.
Changing to a provider without port forwarding MUST state the resulting loss of seeding performance.