medsrv/medcli: Remove prototypical medsrv web application and plugins
This was from a student project that has never been developed further. And similar to the manager web application it lacks all sorts of modern standards. So just remove it and the two plugins it relied on. The test scenario is renamed to avoid confusion (neither of the two p2pnat scenarios uses medsrv/medcli).
This commit is contained in:
Tobias Brunner committed
1 parent
96b0011d30
commit
ac690f1a5e
62 files changed
+19
-3568
No files matched your search
@@ -0,0 +1,7 @@
|
||||
The peers <b>alice</b> and <b>bob</b> are hidden behind the NAT routers <b>moon</b> and <b>sun</b>,
|
||||
respectively. Due to this double-NAT situation they cannot set up an IPsec tunnel directly
|
||||
but need the assistance from the mediation server <b>carol</b> with which they register under
|
||||
the pseudonyms <b>6cu1UTVw@medsrv.org</b> and <b>av9oEPMz@medsrv.org</b>, respectively,
|
||||
authenticating by means of individual pre-shared keys. Using the set of endpoints relayed
|
||||
to them by the mediation server, the peers are able to set up a direct IPsec connection..
|
||||
In order to test the double NAT-ed IPsec tunnel both peers ping each other.
|
||||
@@ -0,0 +1,10 @@
|
||||
alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 local-id=6cu1UTVw@medsrv.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
bob::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=10.2.0.10 local-port=4500 local-id=av9oEPMz@medsrv.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
carol::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=.*remote-id=6cu1UTVw@medsrv.org.*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
carol::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.2 remote-port=.*remote-id=av9oEPMz@medsrv.org.*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
|
||||
alice::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::peer.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 local-id=alice@strongswan.org remote-host=192.168.0.2 remote-port=.*remote-id=bob@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*peer.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32] remote-ts=\[10.2.0.10/32]::YES
|
||||
bob::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::peer.*version=2 state=ESTABLISHED local-host=10.2.0.10 local-port=4500 local-id=bob@strongswan.org remote-host=192.168.0.1 remote-port=.*remote-id=alice@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*peer.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.10/32] remote-ts=\[10.1.0.10/32]::YES
|
||||
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
|
||||
bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
|
||||
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.*: UDP::YES
|
||||
moon::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.*: UDP::YES
|
||||
@@ -0,0 +1,24 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
|
||||
}
|
||||
@@ -0,0 +1,54 @@
|
||||
connections {
|
||||
|
||||
medsrv {
|
||||
remote_addrs = 192.168.0.100
|
||||
|
||||
local {
|
||||
auth = psk
|
||||
id = 6cu1UTVw@medsrv.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = carol@strongswan.org
|
||||
}
|
||||
|
||||
version = 2
|
||||
mobike = no
|
||||
mediation = yes
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
|
||||
peer {
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = aliceCert.pem
|
||||
id = alice@strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = bob@strongswan.org
|
||||
}
|
||||
children {
|
||||
peer {
|
||||
remote_ts = 10.2.0.10
|
||||
|
||||
start_action = start
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
mobike = no
|
||||
mediated_by = medsrv
|
||||
mediation_peer = av9oEPMz@medsrv.org
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
ike-medsrv {
|
||||
id = 6cu1UTVw@medsrv.org
|
||||
secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
connections {
|
||||
|
||||
medsrv {
|
||||
remote_addrs = 192.168.0.100
|
||||
|
||||
local {
|
||||
auth = psk
|
||||
id = av9oEPMz@medsrv.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = carol@strongswan.org
|
||||
}
|
||||
children {
|
||||
medserv {
|
||||
start_action = start
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
mobike = no
|
||||
mediation = yes
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
|
||||
peer {
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = bobCert.pem
|
||||
id = bob@strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = pubkey
|
||||
id = alice@strongswan.org
|
||||
}
|
||||
children {
|
||||
peer {
|
||||
remote_ts = 10.1.0.10
|
||||
|
||||
updown = /usr/local/libexec/ipsec/_updown iptables
|
||||
esp_proposals = aes128gcm128-x25519
|
||||
}
|
||||
}
|
||||
version = 2
|
||||
mobike = no
|
||||
mediated_by = medsrv
|
||||
mediation_peer = 6cu1UTVw@medsrv.org
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
ike-medsrv {
|
||||
id = av9oEPMz@medsrv.org
|
||||
secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
*filter
|
||||
|
||||
# default policy is DROP
|
||||
-P INPUT DROP
|
||||
-P OUTPUT DROP
|
||||
-P FORWARD DROP
|
||||
|
||||
# allow IKE
|
||||
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
|
||||
|
||||
# allow MobIKE
|
||||
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
|
||||
|
||||
# allow ssh
|
||||
-A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
-A OUTPUT -p tcp --sport 22 -j ACCEPT
|
||||
|
||||
# allow crl fetch from winnetou
|
||||
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
|
||||
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
|
||||
|
||||
COMMIT
|
||||
@@ -0,0 +1,5 @@
|
||||
# /etc/strongswan.conf - strongSwan configuration file
|
||||
|
||||
charon {
|
||||
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
connections {
|
||||
|
||||
medsrv {
|
||||
local_addrs = 192.168.0.100
|
||||
|
||||
local {
|
||||
auth = pubkey
|
||||
certs = carolCert.pem
|
||||
id = carol@strongswan.org
|
||||
}
|
||||
remote {
|
||||
auth = psk
|
||||
}
|
||||
|
||||
version = 2
|
||||
mobike = no
|
||||
mediation = yes
|
||||
proposals = aes128-sha256-x25519
|
||||
}
|
||||
}
|
||||
|
||||
secrets {
|
||||
|
||||
ike-1 {
|
||||
id = 6cu1UTVw@medsrv.org
|
||||
secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
|
||||
}
|
||||
ike-2 {
|
||||
id = F1ubAio8@medsrv.org
|
||||
secret = 0s9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8
|
||||
}
|
||||
ike-3 {
|
||||
id = av9oEPMz@medsrv.org
|
||||
secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
bob::systemctl stop strongswan
|
||||
alice::systemctl stop strongswan
|
||||
carol::systemctl stop strongswan
|
||||
alice::iptables-restore < /etc/iptables.flush
|
||||
carol::iptables-restore < /etc/iptables.flush
|
||||
bob::iptables-restore < /etc/iptables.flush
|
||||
moon::iptables-restore < /etc/iptables.flush
|
||||
sun::iptables-restore < /etc/iptables.flush
|
||||
@@ -0,0 +1,19 @@
|
||||
alice::iptables-restore < /etc/iptables.rules
|
||||
carol::iptables-restore < /etc/iptables.rules
|
||||
bob::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables-restore < /etc/iptables.rules
|
||||
sun::iptables-restore < /etc/iptables.rules
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200
|
||||
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
|
||||
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
|
||||
moon::iptables -A FORWARD -i eth0 -o eth1 -d 10.1.0.0/16 -j ACCEPT
|
||||
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p udp -j SNAT --to-source PH_IP_SUN:1200-1300
|
||||
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
|
||||
sun::iptables -A FORWARD -i eth1 -o eth0 -s 10.2.0.0/16 -j ACCEPT
|
||||
sun::iptables -A FORWARD -i eth0 -o eth1 -d 10.2.0.0/16 -j ACCEPT
|
||||
carol::systemctl start strongswan
|
||||
carol::expect-connection medsrv
|
||||
bob::systemctl start strongswan
|
||||
bob::sleep 1
|
||||
alice::systemctl start strongswan
|
||||
alice::sleep 2
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# This configuration file provides information on the
|
||||
# guest instances used for this test
|
||||
|
||||
# All guest instances that are required for this test
|
||||
#
|
||||
VIRTHOSTS="alice moon carol winnetou sun bob"
|
||||
|
||||
# Corresponding block diagram
|
||||
#
|
||||
DIAGRAM="a-m-c-w-s-b-med.png"
|
||||
|
||||
# Guest instances on which tcpdump is to be started
|
||||
#
|
||||
TCPDUMPHOSTS="moon"
|
||||
|
||||
# Guest instances on which IPsec is started
|
||||
# Used for IPsec logging purposes
|
||||
#
|
||||
IPSECHOSTS="alice carol bob"
|
||||
|
||||
# charon controlled by swanctl
|
||||
#
|
||||
SWANCTL=1
|
||||
Reference in new issue
Block a user