• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1LOCALHOST = "192.168.1.1"
2
3# params for ipsec.conf
4IPSEC_CONF = {
5    "config setup": {
6        "charondebug": "chd 2,ike 2,knl 2,net 2,esp 2,dmn 2,"
7                       "mgr 2,lib 1,cfg 2,enc 1".__repr__(),
8        "uniqueids": "never"
9    },
10    "conn %default": {
11        "ike": "aes128-sha-modp1024",
12        "esp": "aes128-sha1"
13    }
14}
15
16IPSEC_L2TP_PSK = {
17    "conn L2TP_PSK": {
18        "keyexchange": "ikev1",
19        "type": "transport",
20        "left": LOCALHOST,
21        "leftprotoport": "17/1701",
22        "leftauth": "psk",
23        "right": "%any",
24        "rightprotoport": "17/%any",
25        "rightsubnet": "0.0.0.0/0",
26        "rightauth": "psk",
27        "auto": "add"
28    }
29}
30
31IPSEC_L2TP_RSA = {
32    "conn L2TP_RSA": {
33        "keyexchange": "ikev1",
34        "type": "transport",
35        "left": LOCALHOST,
36        "leftprotoport": "17/1701",
37        "leftauth": "pubkey",
38        "leftcert": "serverCert.der",
39        "right": "%any",
40        "rightprotoport": "17/%any",
41        "rightsubnet": "0.0.0.0/0",
42        "rightauth": "pubkey",
43        "auto": "add"
44    }
45}
46
47IPSEC_HYBRID_RSA = {
48    "conn HYBRID_RSA": {
49        "keyexchange": "ikev1",
50        "left": LOCALHOST,
51        "leftsubnet": "0.0.0.0/0",
52        "leftauth": "pubkey",
53        "leftcert": "serverCert.der",
54        "leftsendcert": "always",
55        "right": "%any",
56        "rightsubnet": "0.0.0.0/0",
57        "rightauth": "pubkey",
58        "rightauth2": "xauth",
59        "xauth": "server",
60        "auto": "add",
61    }
62}
63
64IPSEC_XAUTH_PSK = {
65    "conn XAUTH_PSK": {
66        "keyexchange": "ikev1",
67        "left": LOCALHOST,
68        "leftsubnet": "0.0.0.0/0",
69        "leftauth": "psk",
70        "right": "%any",
71        "rightsubnet": "0.0.0.0/0",
72        "rightauth": "psk",
73        "rightauth2": "xauth",
74        "auto": "add",
75    }
76}
77
78IPSEC_XAUTH_RSA = {
79    "conn XAUTH_RSA": {
80        "keyexchange": "ikev1",
81        "left": LOCALHOST,
82        "leftsubnet": "0.0.0.0/0",
83        "leftcert": "serverCert.der",
84        "leftsendcert": "always",
85        "right": "%any",
86        "rightsubnet": "0.0.0.0/0",
87        "rightauth": "xauth",
88        "xauth": "server",
89        "auto": "add",
90    }
91}
92
93IPSEC_IKEV2_MSCHAPV2 = {
94    "conn IKEV2_MSCHAPV2": {
95        "keyexchange": "ikev2",
96        "left": LOCALHOST,
97        "leftid": LOCALHOST,
98        "leftcert": "serverCert.der",
99        "leftsubnet": "0.0.0.0/0",
100        "leftauth": "pubkey",
101        "leftsendcert": "always",
102        "right": "%any",
103        "rightid": "vpntest",
104        "rightauth": "eap-mschapv2",
105        "auto": "add"
106    }
107}
108
109IPSEC_IKEV2_PSK = {
110    "conn IKEV2_PSK": {
111        "keyexchange": "ikev2",
112        "left": LOCALHOST,
113        "leftid": LOCALHOST,
114        "leftauth": "psk",
115        "leftsubnet": "0.0.0.0/0",
116        "right": "%any",
117        "rightid": "vpntest",
118        "rightauth": "psk",
119        "auto": "add"
120    }
121}
122
123IPSEC_IKEV2_RSA = {
124    "conn IKEV2_RSA": {
125        "keyexchange": "ikev2",
126        "left": LOCALHOST,
127        "leftid": LOCALHOST,
128        "leftcert": "serverCert.der",
129        "leftsubnet": "0.0.0.0/0",
130        "leftauth": "pubkey",
131        "leftsendcert": "always",
132        "right": "%any",
133        "rightid": "vpntest@%s" % LOCALHOST,
134        "rightauth": "pubkey",
135        "rightcert": "clientCert.pem",
136        "auto": "add"
137    }
138}
139
140IPSEC_IKEV2_MSCHAPV2_HOSTNAME = {
141    "conn IKEV2_MSCHAPV2_HOSTNAME": {
142        "keyexchange": "ikev2",
143        "left": LOCALHOST,
144        "leftid": "strongswan-vpn-server.android-iperf.com",
145        "leftcert": "serverCert.der",
146        "leftsubnet": "0.0.0.0/0",
147        "leftauth": "pubkey",
148        "leftsendcert": "always",
149        "right": "%any",
150        "rightid": "vpntest",
151        "rightauth": "eap-mschapv2",
152        "auto": "add"
153    }
154}
155
156IPSEC_IKEV2_PSK_HOSTNAME = {
157    "conn IKEV2_PSK_HOSTNAME": {
158        "keyexchange": "ikev2",
159        "left": LOCALHOST,
160        "leftid": "strongswan-vpn-server.android-iperf.com",
161        "leftauth": "psk",
162        "leftsubnet": "0.0.0.0/0",
163        "right": "%any",
164        "rightid": "vpntest",
165        "rightauth": "psk",
166        "auto": "add"
167    }
168}
169
170IPSEC_IKEV2_RSA_HOSTNAME = {
171    "conn IKEV2_RSA_HOSTNAME": {
172        "keyexchange": "ikev2",
173        "left": LOCALHOST,
174        "leftid": "strongswan-vpn-server.android-iperf.com",
175        "leftcert": "serverCert.der",
176        "leftsubnet": "0.0.0.0/0",
177        "leftauth": "pubkey",
178        "leftsendcert": "always",
179        "right": "%any",
180        "rightid": "vpntest@strongswan-vpn-server.android-iperf.com",
181        "rightauth": "pubkey",
182        "rightcert": "clientCert.pem",
183        "auto": "add"
184    }
185}
186
187# parmas for lx2tpd
188
189XL2TPD_CONF_GLOBAL = (
190    "[global]",
191    "ipsec saref = no",
192    "debug tunnel = no",
193    "debug avp = no",
194    "debug network = no",
195    "debug state = no",
196    "access control = no",
197    "rand source = dev",
198    "port = 1701",
199)
200
201XL2TPD_CONF_INS = (
202    "[lns default]",
203    "require authentication = yes",
204    "pass peer = yes",
205    "ppp debug = no",
206    "length bit = yes",
207    "refuse pap = yes",
208    "refuse chap = yes",
209)
210
211XL2TPD_OPTION = (
212    "require-mschap-v2",
213    "refuse-mschap",
214    "ms-dns 8.8.8.8",
215    "ms-dns 8.8.4.4",
216    "asyncmap 0",
217    "auth",
218    "crtscts",
219    "idle 1800",
220    "mtu 1410",
221    "mru 1410",
222    "connect-delay 5000",
223    "lock",
224    "hide-password",
225    "local",
226    "debug",
227    "modem",
228    "proxyarp",
229    "lcp-echo-interval 30",
230    "lcp-echo-failure 4",
231    "nomppe"
232)
233
234# iptable rules for vpn_pptp
235FIREWALL_RULES_FOR_PPTP = (
236    "iptables -A input_rule -i ppp+ -j ACCEPT",
237    "iptables -A output_rule -o ppp+ -j ACCEPT",
238    "iptables -A forwarding_rule -i ppp+ -j ACCEPT"
239)
240
241# iptable rules for vpn_l2tp
242FIREWALL_RULES_FOR_L2TP = (
243    "iptables -I INPUT  -m policy --dir in --pol ipsec --proto esp -j ACCEPT",
244    "iptables -I FORWARD  -m policy --dir in --pol ipsec --proto esp -j ACCEPT",
245    "iptables -I FORWARD  -m policy --dir out --pol ipsec --proto esp -j ACCEPT",
246    "iptables -I OUTPUT   -m policy --dir out --pol ipsec --proto esp -j ACCEPT",
247    "iptables -t nat -I POSTROUTING -m policy --pol ipsec --dir out -j ACCEPT",
248    "iptables -A INPUT -p esp -j ACCEPT",
249    "iptables -A INPUT -i eth0.2 -p udp --dport 500 -j ACCEPT",
250    "iptables -A INPUT -i eth0.2 -p tcp --dport 500 -j ACCEPT",
251    "iptables -A INPUT -i eth0.2 -p udp --dport 4500 -j ACCEPT",
252    "iptables -A INPUT -p udp --dport 500 -j ACCEPT",
253    "iptables -A INPUT -p udp --dport 4500 -j ACCEPT",
254    "iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT"
255)
256
257FIREWALL_RULES_DISABLE_DNS_RESPONSE = (
258    "iptables -I OUTPUT -p udp --sport 53 -j DROP",
259    "iptables -I OUTPUT -p tcp --sport 53 -j DROP",
260    "ip6tables -I OUTPUT -p udp --sport 53 -j DROP",
261    "ip6tables -I OUTPUT -p tcp --sport 53 -j DROP",
262)
263
264
265# Object for vpn profile
266class VpnL2tp(object):
267    """Profile for vpn l2tp type.
268
269    Attributes:
270        hostname: vpn server domain name
271        address: vpn server address
272        username: vpn user account
273        password: vpn user password
274        psk_secret: psk for ipsec
275        name: vpn server name for register in OpenWrt
276    """
277
278    def __init__(self,
279                 vpn_server_hostname,
280                 vpn_server_address,
281                 vpn_username,
282                 vpn_password,
283                 psk_secret,
284                 server_name):
285        self.name = server_name
286        self.hostname = vpn_server_hostname
287        self.address = vpn_server_address
288        self.username = vpn_username
289        self.password = vpn_password
290        self.psk_secret = psk_secret
291