Skip to content

Commit 3931abd

Browse files
proditisproditis
authored
Merge pull request #958 from proditis/master
Improvements to the docs, playbook and docker related files
2 parents cf1a5bb + 14422ff commit 3931abd

File tree

11 files changed

+121
-42
lines changed

11 files changed

+121
-42
lines changed

‎ansible/files/ctables‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/bash
2+
#
3+
# https://github.com/deitch/ctables
4+
#
5+
NSPID=${1}
6+
LINKFILE="/var/run/netns/${NSPID}"
7+
mkdir -p /var/run/netns
8+
/bin/rm -f "$LINKFILE"
9+
ln -s "/proc/$NSPID/ns/net" "$LINKFILE"
10+
ip netns exec ${NSPID} iptables -I INPUT -j REJECT
11+
ip netns exec ${NSPID} iptables -I INPUT -i lo -j ACCEPT
12+
ip netns exec ${NSPID} iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
13+
ip netns exec ${NSPID} iptables -I INPUT -s 10.0.0.0/24 -j ACCEPT
14+
ip netns exec ${NSPID} iptables -I INPUT -s 10.10.0.0/16 -j ACCEPT
15+
ip netns exec ${NSPID} iptables -I OUTPUT -o lo -j ACCEPT
16+
ip netns exec ${NSPID} iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
17+
/bin/rm -f "$LINKFILE"
18+
#. /etc/docker-extras.sh
19+
#if [ -f /proc/$NSPID/root/usr/bin/pkexec ]; then
20+
# chmod -s /proc/$NSPID/root/usr/bin/pkexec
21+
#fi

‎ansible/files/dockerd-service-override.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
# /etc/systemd/system/docker.service.d/override.conf
22
[Service]
33
ExecStart=
4-
ExecStart=/usr/bin/dockerd -H unix:// -H tcp://0.0.0.0:2376
4+
ExecStart=/usr/bin/dockerd

‎ansible/files/etc_network_interfaces.j2‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,6 @@
1-
# interfaces(5) file used by ifup(8) and ifdown(8)
2-
3-
# Please note that this file is written to be used with dhcpcd
4-
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'
5-
6-
# Include files from /etc/network/interfaces.d:
7-
source-directory /etc/network/interfaces.d
8-
9-
auto lo
10-
iface lo inet loopback
11-
12-
auto eth0
13-
iface eth0 inet static
14-
address {{ansible_host}}
15-
netmask {{ansible_default_ipv4.netmask}}
16-
gateway {{ansible_default_ipv4.gateway}}
17-
18-
allow-hotplug wlan0
19-
iface wlan0 inet manual
20-
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
21-
22-
allow-hotplug wlan1
23-
iface wlan1 inet manual
24-
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf
25-
26-
# Include files from /etc/network/interfaces.d:
27-
source-directory /etc/network/interfaces.d
1+
auto {{network.driver_options.parent}}
2+
iface {{network.driver_options.parent}} inet static
3+
address {{ipv4}}/16
4+
gateway {{network.ipam_options[0].gateway}}
5+
up ip link set {{network.driver_options.parent}} promisc on
6+
mtu 1450

‎ansible/files/iptables_rules.v4‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Generated by iptables-save v1.6.0 on Mon Sep 14 11:19:43 2020
2+
*nat
3+
:PREROUTING ACCEPT [0:0]
4+
:INPUT ACCEPT [0:0]
5+
:OUTPUT ACCEPT [0:0]
6+
:POSTROUTING ACCEPT [0:0]
7+
:DOCKER - [0:0]
8+
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
9+
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
10+
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
11+
-A DOCKER -i docker0 -j RETURN
12+
COMMIT
13+
# Completed on Mon Sep 14 11:19:43 2020
14+
# Generated by iptables-save v1.6.0 on Mon Sep 14 11:19:43 2020
15+
*filter
16+
:INPUT ACCEPT [2:104]
17+
:FORWARD DROP [0:0]
18+
:OUTPUT ACCEPT [49:13320]
19+
:DOCKER - [0:0]
20+
:DOCKER-ISOLATION-STAGE-1 - [0:0]
21+
:DOCKER-ISOLATION-STAGE-2 - [0:0]
22+
:DOCKER-USER - [0:0]
23+
-A INPUT -i lo -j ACCEPT
24+
-A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
25+
{% for dict_item in PF_TABLES.target_network_ranges %}
26+
-A INPUT -s {{dict_item}} -d {{ipv4}}/32 -j REJECT --reject-with icmp-port-unreachable
27+
{% endfor %}
28+
-A FORWARD -j DOCKER-USER
29+
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
30+
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
31+
-A FORWARD -o docker0 -j DOCKER
32+
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
33+
-A FORWARD -i docker0 -o docker0 -j ACCEPT
34+
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
35+
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
36+
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
37+
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
38+
-A DOCKER-USER -j RETURN
39+
COMMIT
40+
# Completed on Mon Sep 14 11:19:43 2020

‎ansible/playbooks/build-images.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
args: "{{container.buildargs|default(omit)}}"
1818
nocache: yes
1919
pull: no
20-
force: "{{force_build|default('no')}}"
21-
rm: yes
20+
force_source: "{{force_build|default('no')}}"
21+
force_tag: "{{force_build|default('no')}}"
2222
when: container is defined and container.build is defined
2323
delegate_to: "{{BUILDER}}"

‎ansible/playbooks/feed-challenges.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,6 @@
66
gather_facts: false
77
connection: local
88
serial: 1
9-
vars:
10-
TOKEN: randomtoken
11-
mui:
12-
URL: http://localhost:8080
139
tasks:
1410
- name: Submit challenge
1511
delegate_to: 127.0.0.1
@@ -23,6 +19,9 @@
2319
author: "{{author|default(omit)}}"
2420
icon: "{{icon|default(omit)}}"
2521
name: "{{name}}"
22+
public: "{{public|default(1)}}"
23+
active: "{{active|default(1)}}"
24+
timer: "{{timer|default(1)}}"
2625
category: "{{category}}"
2726
difficulty: "{{difficulty}}"
2827
player_type: "{{player_type}}"

‎ansible/templates/advanced-challenge.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,15 @@ name: "Challenge name"
44
category: Tutorial
55
difficulty: easy
66
player_type: offense
7+
timer: 0 # 0 Dont keep timer, 1 keep timer
8+
active: 1 # 1 = Active, 0 = Not active
9+
public: 1 # If the challenge is publicly accessible
710
description: |
8-
<p>multiline
9-
description,
11+
<p>multiline
12+
description,
1013
must
11-
keep the same
12-
indentation
14+
keep the same
15+
indentation
1316
of lines</p>
1417
1518
# empty line ends the description
@@ -23,4 +26,3 @@ questions:
2326
code: "answer3",
2427
weight: 1,
2528
}
26-

‎ansible/templates/simple-challenge.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ name: "This is the challenge name"
44
category: Tutorial # Free form
55
difficulty: easy # Free form
66
player_type: offense # offense or defense
7+
timer: 0 # 0 Dont keep timer, 1 keep timer
8+
active: 1 # 1 = Active, 0 = Not active
9+
public: 1 # If the challenge is publicly accessible
710
# Optional filename that comes with the challenge
811
# filename: challenge.zip
912
description: "<p>Description of the challenge allows limited html</p>"

‎contrib/entrypoint-vpn.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ if [ ! -f /etc/openvpn/.configured ]; then
1414
echo "00" > /etc/openvpn/crl/number
1515
echo "OPENVPN_ADMIN_PASSWORD">/etc/openvpn/private/mgmt.pwd
1616
openssl dhparam -out /etc/openvpn/dh.pem 2048
17-
openvpn --genkey --secret /etc/openvpn/private/vpn-ta.key
17+
openvpn --genkey secret /etc/openvpn/private/vpn-ta.key
1818
/var/www/echoCTF.RED/backend/yii migrate --interactive=0
1919
/var/www/echoCTF.RED/backend/yii migrate-sales/up --interactive=0
2020
/var/www/echoCTF.RED/backend/yii init_data --interactive=0

‎contrib/openvpn_tun0.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ persist-tun
2525
user _openvpn
2626
group _openvpn
2727
cipher AES-256-CBC
28+
data-ciphers AES-256-CBC
2829
auth SHA256
2930

3031
ping 3

0 commit comments

Comments
 (0)