124 lines
3.8 KiB
Bash
124 lines
3.8 KiB
Bash
for p in /root/vpn /etc/wireguard/wg0.conf /etc/openvpn/server/lab.conf /etc/swanctl/conf.d/lab.conf; do
|
|
[ -e $p ] && refuse "$p already exists; move it away and start again"
|
|
done
|
|
ip link show wg0 >/dev/null 2>&1 && refuse "an interface wg0 already exists; take it down and start again"
|
|
# Reset removes every package installed from here on, by setup or by the
|
|
# tasks, and only those.
|
|
pkgs_now() { if is_rhel; then rpm -qa --qf '%{NAME}\n'; else dpkg-query -W -f '${db:Status-Abbrev} ${Package}\n' | awk '$1 == "ii" { print $2 }'; fi | sort -u; }
|
|
pkgs_now >"$LAB_STATE/pkgs-before"
|
|
active strongswan && state_set strongswan-was-active 1
|
|
if command -v ufw >/dev/null && ufw status | grep -q 'Status: active'; then
|
|
tar -C /etc -cf "$LAB_STATE/ufw.tar" ufw
|
|
fi
|
|
peer_up
|
|
|
|
# The peer's strongSwan: its own charon, with its own control socket.
|
|
pkg_install charon-systemd strongswan-swanctl
|
|
mkdir -p /etc/le-lab-peer-ipsec /etc/netns/lepeer/wireguard /etc/netns/lepeer/openvpn
|
|
cat >/etc/le-lab-peer-ipsec/strongswan.conf <<'X'
|
|
# The peer's strongSwan: like the system's, with its own control socket.
|
|
charon {
|
|
load_modular = yes
|
|
plugins {
|
|
include /etc/strongswan.d/charon/*.conf
|
|
vici {
|
|
socket = unix:///run/le-lab-peer-charon.vici
|
|
}
|
|
}
|
|
}
|
|
charon-systemd {
|
|
load_modular = yes
|
|
plugins {
|
|
include /etc/strongswan.d/charon/*.conf
|
|
vici {
|
|
socket = unix:///run/le-lab-peer-charon.vici
|
|
}
|
|
}
|
|
}
|
|
X
|
|
cat >/etc/le-lab-peer-ipsec/swanctl.conf <<'X'
|
|
connections {
|
|
host-host {
|
|
version = 2
|
|
local_addrs = 10.99.0.2
|
|
remote_addrs = 10.99.0.1
|
|
proposals = aes256gcm16-prfsha256-ecp256
|
|
local {
|
|
auth = psk
|
|
id = peer
|
|
}
|
|
remote {
|
|
auth = psk
|
|
id = server
|
|
}
|
|
children {
|
|
host-host {
|
|
mode = transport
|
|
esp_proposals = aes256gcm16-ecp256
|
|
start_action = trap
|
|
}
|
|
}
|
|
}
|
|
}
|
|
secrets {
|
|
ike-lab {
|
|
id-server = server
|
|
id-peer = peer
|
|
secret = "lab-ipsec-psk-for-testing-only"
|
|
}
|
|
}
|
|
X
|
|
chmod 600 /etc/le-lab-peer-ipsec/swanctl.conf
|
|
cat >/etc/systemd/system/le-lab-peer-ipsec.service <<'X'
|
|
[Unit]
|
|
Description=Practice lab: strongSwan on the peer
|
|
Requires=le-lab-peer.service
|
|
After=le-lab-peer.service network.target
|
|
|
|
[Service]
|
|
Type=notify
|
|
NetworkNamespacePath=/run/netns/lepeer
|
|
# swanctl's AppArmor profile only allows the system's control socket.
|
|
AppArmorProfile=unconfined
|
|
ExecStart=/usr/bin/env STRONGSWAN_CONF=/etc/le-lab-peer-ipsec/strongswan.conf /usr/sbin/charon-systemd
|
|
ExecStartPost=/usr/sbin/swanctl --load-all --noprompt --file /etc/le-lab-peer-ipsec/swanctl.conf --uri unix:///run/le-lab-peer-charon.vici
|
|
Restart=on-failure
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
cat >/etc/systemd/system/le-lab-peer-wg.service <<'X'
|
|
[Unit]
|
|
Description=Practice lab: the peer's WireGuard client
|
|
Requires=le-lab-peer.service
|
|
After=le-lab-peer.service network.target
|
|
ConditionPathExists=/etc/netns/lepeer/wireguard/wg0.conf
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
NetworkNamespacePath=/run/netns/lepeer
|
|
ExecStart=/usr/bin/wg-quick up /etc/netns/lepeer/wireguard/wg0.conf
|
|
ExecStop=/usr/bin/wg-quick down /etc/netns/lepeer/wireguard/wg0.conf
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
cat >/etc/systemd/system/le-lab-peer-openvpn.service <<'X'
|
|
[Unit]
|
|
Description=Practice lab: the peer's OpenVPN client
|
|
Requires=le-lab-peer.service
|
|
After=le-lab-peer.service network.target
|
|
ConditionPathExists=/etc/netns/lepeer/openvpn/lab.conf
|
|
|
|
[Service]
|
|
NetworkNamespacePath=/run/netns/lepeer
|
|
ExecStart=/usr/sbin/openvpn --config /etc/netns/lepeer/openvpn/lab.conf
|
|
Restart=on-failure
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
X
|
|
systemctl daemon-reload
|
|
systemctl enable --now --quiet le-lab-peer-ipsec.service
|