medsrv/medcli: Remove prototypical medsrv web application and plugins

This was from a student project that has never been developed further. And similar to the manager web application it lacks all sorts of modern standards. So just remove it and the two plugins it relied on. The test scenario is renamed to avoid confusion (neither of the two p2pnat scenarios uses medsrv/medcli).
2026-07-24 14:45:27 +02:00
parent 96b0011d30
commit ac690f1a5e
62 changed files with 19 additions and 3568 deletions
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT  -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
+}
@@ -0,0 +1,54 @@
+connections {
+
+   medsrv {
+      remote_addrs  = 192.168.0.100
+
+      local {
+         auth = psk
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = [email protected]
+      }
+
+      version = 2
+      mobike = no
+      mediation = yes
+      proposals = aes128-sha256-x25519
+   }
+
+   peer {
+      local {
+         auth = pubkey
+         certs = aliceCert.pem
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = [email protected]
+      }
+      children {
+         peer {
+            remote_ts = 10.2.0.10
+
+            start_action = start
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128gcm128-x25519
+         }
+      }
+      version = 2
+      mobike = no
+      mediated_by = medsrv
+      mediation_peer = [email protected]
+      proposals = aes128-sha256-x25519
+  }
+}
+
+secrets {
+
+   ike-medsrv {
+      id = [email protected]
+      secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
+   }
+}
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT  -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
+}
@@ -0,0 +1,57 @@
+connections {
+
+   medsrv {
+      remote_addrs  = 192.168.0.100
+
+      local {
+         auth = psk
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = [email protected]
+      }
+      children {
+         medserv {
+           start_action = start
+         }
+      }
+      version = 2
+      mobike = no
+      mediation = yes
+      proposals = aes128-sha256-x25519
+   }
+
+   peer {
+      local {
+         auth = pubkey
+         certs = bobCert.pem
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = [email protected]
+      }
+      children {
+         peer {
+            remote_ts = 10.1.0.10
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128gcm128-x25519
+          }
+      }
+      version = 2
+      mobike = no
+      mediated_by = medsrv
+      mediation_peer = [email protected]
+      proposals = aes128-sha256-x25519
+   }
+}
+
+secrets {
+
+   ike-medsrv {
+      id = [email protected]
+      secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
+   }
+}
@@ -0,0 +1,24 @@
+*filter
+
+# default policy is DROP
+-P INPUT DROP
+-P OUTPUT DROP
+-P FORWARD DROP
+
+# allow IKE
+-A INPUT  -i eth0 -p udp --dport 500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 500 -j ACCEPT
+
+# allow MobIKE
+-A INPUT  -i eth0 -p udp --dport 4500 -j ACCEPT
+-A OUTPUT -o eth0 -p udp --sport 4500 -j ACCEPT
+
+# allow ssh
+-A INPUT  -p tcp --dport 22 -j ACCEPT
+-A OUTPUT -p tcp --sport 22 -j ACCEPT
+
+# allow crl fetch from winnetou
+-A INPUT  -i eth0 -p tcp --sport 80 -s PH_IP_WINNETOU -j ACCEPT
+-A OUTPUT -o eth0 -p tcp --dport 80 -d PH_IP_WINNETOU -j ACCEPT
+
+COMMIT
@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce openssl pem pkcs1 curl revocation vici kernel-netlink socket-default updown
+}
@@ -0,0 +1,36 @@
+connections {
+
+   medsrv {
+      local_addrs  = 192.168.0.100
+
+      local {
+         auth = pubkey
+         certs = carolCert.pem
+         id = [email protected]
+      }
+      remote {
+         auth = psk
+      }
+
+      version = 2
+      mobike = no
+      mediation = yes
+      proposals = aes128-sha256-x25519
+   }
+}
+
+secrets {
+
+   ike-1 {
+      id = [email protected]
+      secret = 0sBAXz/6cSITttd0CzF9799p859Pi4LPnP
+   }
+   ike-2 {
+      id = [email protected]
+      secret = 0s9tb3wiUGqUwCSRIRAwLFWfkdA8u6hHA8
+   }
+   ike-3 {
+      id = [email protected]
+      secret = 0sZVm3FLOiweS1ywUDpR/L9FvpwNYp9svt
+   }
+}