denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

medsrv/medcli: Remove prototypical medsrv web application and plugins

Browse Source 
This was from a student project that has never been developed further.
And similar to the manager web application it lacks all sorts of modern
standards.  So just remove it and the two plugins it relied on.

The test scenario is renamed to avoid confusion (neither of the two
p2pnat scenarios uses medsrv/medcli).
This commit is contained in:
Tobias Brunner
2026-07-24 14:45:27 +02:00
parent 96b0011d30
commit ac690f1a5e
62 changed files with 19 additions and 3568 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testing/tests/p2pnat/different-nats/description.txt
+7
View File
@@ -0,0 +1,7 @@
The peers <b>alice</b> and <b>bob</b> are hidden behind the NAT routers <b>moon</b> and <b>sun</b>,
respectively. Due to this double-NAT situation they cannot set up an IPsec tunnel directly
but need the assistance from the mediation server <b>carol</b> with which they register under
the pseudonyms <b>[email protected]</b> and <b>[email protected]</b>, respectively,
authenticating by means of individual pre-shared keys. Using the set of endpoints relayed
to them by the mediation server, the peers are able to set up a direct IPsec connection..
In order to test the double NAT-ed IPsec tunnel both peers ping each other.
testing/tests/p2pnat/different-nats/evaltest.dat
+10
View File
@@ -0,0 +1,10 @@
alice::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 [email protected] remote-host=192.168.0.100 remote-port=4500 [email protected].*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
bob::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=10.2.0.10 local-port=4500 [email protected] remote-host=192.168.0.100 remote-port=4500 [email protected].*nat-local=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
carol::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=.*[email protected].*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
carol::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::medsrv.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.2 remote-port=.*[email protected].*nat-remote=yes nat-any=yes encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519::YES
alice::swanctl --list-sas --ike-id 1 --raw 2> /dev/null::peer.*version=2 state=ESTABLISHED local-host=10.1.0.10 local-port=4500 [email protected] remote-host=192.168.0.2 remote-port=.*[email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*peer.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.10/32] remote-ts=\[10.2.0.10/32]::YES
bob::swanctl --list-sas --ike-id 2 --raw 2> /dev/null::peer.*version=2 state=ESTABLISHED local-host=10.2.0.10 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=.*[email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*peer.*reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.10/32] remote-ts=\[10.1.0.10/32]::YES
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
bob:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
moon::tcpdump::IP moon.strongswan.org.* > sun.strongswan.org.*: UDP::YES
moon::tcpdump::IP sun.strongswan.org.* > moon.strongswan.org.*: UDP::YES
testing/tests/p2pnat/different-nats/hosts/alice/etc/iptables.rules
+24
View File
@@ -0,0 +1,24 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow IKE
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
COMMIT
testing/tests/p2pnat/different-nats/hosts/alice/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
}
testing/tests/p2pnat/different-nats/hosts/alice/etc/swanctl/swanctl.conf
Executable
+54
View File
@@ -0,0 +1,54 @@
connections {
medsrv {
remote_addrs = 192.168.0.100
local {
auth = psk
id = [email protected]
}
remote {
auth = pubkey
id = [email protected]
}
version = 2
mobike = no
mediation = yes
proposals = aes128-sha256-x25519
}
peer {
local {
auth = pubkey
certs = aliceCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = [email protected]
}
children {
peer {
remote_ts = 10.2.0.10
start_action = start
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
mobike = no
mediated_by = medsrv
mediation_peer = [email protected]
proposals = aes128-sha256-x25519
}
}
secrets {
ike-medsrv {
id = [email protected]
secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
}
}
testing/tests/p2pnat/different-nats/hosts/bob/etc/iptables.rules
+24
View File
@@ -0,0 +1,24 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow IKE
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
COMMIT
testing/tests/p2pnat/different-nats/hosts/bob/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
}
testing/tests/p2pnat/different-nats/hosts/bob/etc/swanctl/swanctl.conf
Executable
+57
View File
@@ -0,0 +1,57 @@
connections {
medsrv {
remote_addrs = 192.168.0.100
local {
auth = psk
id = [email protected]
}
remote {
auth = pubkey
id = [email protected]
}
children {
medserv {
start_action = start
}
}
version = 2
mobike = no
mediation = yes
proposals = aes128-sha256-x25519
}
peer {
local {
auth = pubkey
certs = bobCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = [email protected]
}
children {
peer {
remote_ts = 10.1.0.10
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128gcm128-x25519
}
}
version = 2
mobike = no
mediated_by = medsrv
mediation_peer = [email protected]
proposals = aes128-sha256-x25519
}
}
secrets {
ike-medsrv {
id = [email protected]
secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
}
}
testing/tests/p2pnat/different-nats/hosts/carol/etc/iptables.rules
+24
View File
@@ -0,0 +1,24 @@
*filter
# default policy is DROP
-P INPUT DROP
-P OUTPUT DROP
-P FORWARD DROP
# allow IKE
-A INPUT -i eth0 -p udp --dport 500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
# allow MobIKE
-A INPUT -i eth0 -p udp --dport 4500 -j ACCEPT
-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
# allow ssh
-A INPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -p tcp --sport 22 -j ACCEPT
# allow crl fetch from winnetou
-A INPUT -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
COMMIT
testing/tests/p2pnat/different-nats/hosts/carol/etc/strongswan.conf
+5
View File
@@ -0,0 +1,5 @@
# /etc/strongswan.conf - strongSwan configuration file
charon {
load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
}
testing/tests/p2pnat/different-nats/hosts/carol/etc/swanctl/swanctl.conf
Executable
+36
View File
@@ -0,0 +1,36 @@
connections {
medsrv {
local_addrs = 192.168.0.100
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = psk
}
version = 2
mobike = no
mediation = yes
proposals = aes128-sha256-x25519
}
}
secrets {
ike-1 {
id = [email protected]
secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
}
ike-2 {
id = [email protected]
secret = 0s9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8
}
ike-3 {
id = [email protected]
secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
}
}
testing/tests/p2pnat/different-nats/posttest.dat
+8
View File
@@ -0,0 +1,8 @@
bob::systemctl stop strongswan
alice::systemctl stop strongswan
carol::systemctl stop strongswan
alice::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
bob::iptables-restore < /etc/iptables.flush
moon::iptables-restore < /etc/iptables.flush
sun::iptables-restore < /etc/iptables.flush
testing/tests/p2pnat/different-nats/pretest.dat
+19
View File
@@ -0,0 +1,19 @@
alice::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
bob::iptables-restore < /etc/iptables.rules
moon::iptables-restore < /etc/iptables.rules
sun::iptables-restore < /etc/iptables.rules
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p udp -j SNAT --to-source PH_IP_MOON:1100-1200
moon::iptables -t nat -A POSTROUTING -o eth0 -s 10.1.0.0/16 -p tcp -j SNAT --to-source PH_IP_MOON:2000-2100
moon::iptables -A FORWARD -i eth1 -o eth0 -s 10.1.0.0/16 -j ACCEPT
moon::iptables -A FORWARD -i eth0 -o eth1 -d 10.1.0.0/16 -j ACCEPT
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p udp -j SNAT --to-source PH_IP_SUN:1200-1300
sun::iptables -t nat -A POSTROUTING -o eth0 -s 10.2.0.0/16 -p tcp -j SNAT --to-source PH_IP_SUN:2000-2100
sun::iptables -A FORWARD -i eth1 -o eth0 -s 10.2.0.0/16 -j ACCEPT
sun::iptables -A FORWARD -i eth0 -o eth1 -d 10.2.0.0/16 -j ACCEPT
carol::systemctl start strongswan
carol::expect-connection medsrv
bob::systemctl start strongswan
bob::sleep 1
alice::systemctl start strongswan
alice::sleep 2
testing/tests/p2pnat/different-nats/test.conf
+25
View File
@@ -0,0 +1,25 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou sun bob"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-s-b-med.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="alice carol bob"
# charon controlled by swanctl
#
SWANCTL=1