{"id":1231,"date":"2016-08-28T13:54:29","date_gmt":"2016-08-28T12:54:29","guid":{"rendered":"http:\/\/cdblog.cdstealer.com\/?p=1231"},"modified":"2019-12-09T18:32:55","modified_gmt":"2019-12-09T18:32:55","slug":"android-vpn","status":"publish","type":"post","link":"https:\/\/cdblog.cdstealer.com\/?p=1231","title":{"rendered":"Android VPN"},"content":{"rendered":"

\"strongswanandroid\"<\/p>\n

This setup below is what suited my requirements. \u00a0I'm sure there'll be another way of implementing this, but this works for me :)<\/p>\n

For this I'm using the following:<\/p>\n

# emerge --info\nPortage 2.3.0 (python 3.4.3-final-0, default\/linux\/amd64\/13.0\/no-multilib, gcc-4.9.3, glibc-2.22-r4, 4.8.7-gentoo x86_64)\n=================================================================\nSystem uname: Linux-4.8.7-gentoo-x86_64-Intel-R-_Core-TM-_i7-6700K_CPU_@_4.00GHz-with-gentoo-2.2\nKiB Mem: 32896588 total, 15127076 free\nKiB Swap: 3640916 total, 3640916 free\nTimestamp of repository gentoo: Sun, 13 Nov 2016 04:15:01 +0000<\/pre>\n
And this version of strongswan:<\/p>\n
# emerge -p strongswan\n\nThese are the packages that would be merged, in order:\n\nCalculating dependencies... done!\n[ebuild R ~] net-misc\/strongswan-5.5.0<\/pre>\n
Strongswan Config<\/h3>\n
Once installed, we need to setup the configs. \u00a0The main config is located at \/etc\/ipsec.conf:<\/p>\n
This is my file with the obvious changes ;)<\/p>\n
# ipsec.conf - strongSwan IPsec configuration file\n\nconfig setup\n uniqueids=never\n #charondebug=\"cfg 2, dmn 2, ike 2, net 2\"\n\nconn %default\n dpdaction=restart\n dpddelay=300s\n reauth=yes\n aggressive=no\n fragmentation=yes\n type=tunnel\n forceencaps=yes\n modeconfig=pull\n auto=add\n closeaction=clear\n compress=no\n left=my.vpn.com\n leftid=\"C=GB, O=strongSwan, CN=my.vpn.com\"\n leftsubnet=0.0.0.0\/0\n leftcert=vpnHostCert.pem\n leftsendcert=always\n leftfirewall=yes\n\nconn IPSec-Android-Strongswan\n keyexchange=ikev2\n rightauth=pubkey\n rightauth2=eap-md5\n right=%any\n rightid=\"C=GB, O=strongSwan, CN=my@email.com\"\n rightsourceip=10.10.10.199\/31\n rightsendcert=ifasked\n\n# Unable to get the native VPN working with this setup\n#conn IPSec-Android-Native\n# keyexchange=ikev1\n# rightauth=pubkey\n# rightauth2=xauth\n# right=%any\n# rightsourceip=10.10.10.199\/26\n# rightsendcert=ifasked<\/pre>\n
I'll explain each segment in order. \u00a0The official doc can be found here<\/a>.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
conn %default<\/td>\nThis is the default stanza. \u00a0This instructs strongswan to use anything here in addition to other connections if defined.<\/td>\n<\/tr>\n
dpdaction=restart<\/td>\nControls the use of the Dead Peer Detection.<\/td>\n<\/tr>\n
dpddelay=300s<\/td>\nHow often to check if the client is still connected.<\/td>\n<\/tr>\n
reauth=yes<\/td>\nWhen re-exchanging keys whether to re-athenticate.<\/td>\n<\/tr>\n
aggressive=no<\/td>\nWhether to use IKEv1 Aggressive or Main Mode (the default).<\/td>\n<\/tr>\n
fragmentation=yes<\/td>\nIf set to yes (the default since 5.5.1) and the peer supports it, larger IKE messages will be sent in fragments.<\/td>\n<\/tr>\n
type=tunnel<\/td>\nThe type of the connection.<\/td>\n<\/tr>\n
forceencaps=yes<\/td>\nForce UDP encapsulation for ESP packets even if no NAT situation is detected.<\/td>\n<\/tr>\n
modeconfig=pull<\/td>\nDefines which mode is used to assign a virtual IP.<\/td>\n<\/tr>\n
auto=add<\/td>\nWhat operation, if any, should be done automatically at IPsec startup.<\/td>\n<\/tr>\n
closeaction=clear<\/td>\nDefines the action to take if the remote peer unexpectedly closes.<\/td>\n<\/tr>\n
compress=no<\/td>\nWhether IPComp compression of content is proposed on the connection.<\/td>\n<\/tr>\n
left=my.vpn.com<\/td>\nThe IP address of the participant's public-network interface.<\/td>\n<\/tr>\n
leftid=\"C=GB, O=strongSwan, CN=my.vpn.com\"<\/td>\nHow the left|right<\/em> participant should be identified for authentication.<\/td>\n<\/tr>\n
leftsubnet=0.0.0.0\/0<\/td>\nPrivate subnet behind the left participant.<\/td>\n<\/tr>\n
leftcert=vpnHostCert.pem<\/td>\nThe path to the left|right participant's X.509 certificate.<\/td>\n<\/tr>\n
leftsendcert=always<\/td>\nIfasked<\/strong>, meaning that
\nthe peer must send a certificate request (CR) payload in order to get a certificate in return<\/td>\n<\/tr>\n
leftfirewall=yes<\/td>\nWhether the left<\/em>\u00a0participant is doing forwarding-firewalling (including masquerading)
\nusing iptables for traffic from leftsubnet.<\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n\n\n\n\n\n\n
conn IPSec-Android-Strongswan<\/td>\nA connection stanza<\/td>\n<\/tr>\n
keyexchange=ikev2<\/td>\nMethod of key exchange.<\/td>\n<\/tr>\n
rightauth=pubkey<\/td>\nAuthentication method to use locally (left) or require from the remote (right) side.<\/td>\n<\/tr>\n
rightauth2=eap-md5<\/td>\nSame as rightauth<\/em>, but defines an additional authentication exchange.<\/td>\n<\/tr>\n
right=%any<\/td>\nIf %any<\/em> is used for the remote endpoint it literally means any IP address.<\/td>\n<\/tr>\n
rightid=\"C=GB, O=strongSwan, CN=my@email.com\"<\/td>\nHow the right<\/em> participant should be identified for authentication.<\/td>\n<\/tr>\n
rightsourceip=10.10.10.199\/26<\/td>\nThe internal source IP to use in a tunnel for the remote peer.<\/td>\n<\/tr>\n
rightsendcert=ifasked<\/td>\nifasked<\/strong>, meaning that
\nthe peer must send a certificate request (CR) payload in order to get a certificate in return.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n\n\n\n\n\n\n\n\n
conn IPSec-Android-Native<\/td>\nA connection stanza<\/td>\n<\/tr>\n
keyexchange=ikev1<\/td>\nMethod of key exchange.<\/td>\n<\/tr>\n
rightauth=pubkey<\/td>\nAuthentication method to use locally (left) or require from the remote (right) side.<\/td>\n<\/tr>\n
rightauth2=xauth<\/td>\nSame as rightauth<\/em>, but defines an additional authentication exchange.<\/td>\n<\/tr>\n
right=%any<\/td>\nIf %any<\/em> is used for the remote endpoint it literally means any IP address.<\/td>\n<\/tr>\n
rightsourceip=10.10.10.200<\/td>\nThe internal source IP to use in a tunnel for the remote peer.<\/td>\n<\/tr>\n
rightsendcert=ifasked<\/td>\nifasked<\/strong>, meaning that
\nthe peer must send a certificate request (CR) payload in order to get a certificate in return.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Next we setup a secret.<\/p>\n
# cat \/etc\/ipsec.secrets \n: RSA vpnHostKey.pem\n<user> : XAUTH \"top_secret_password\"\n<user> : EAP \"top_secret_password\"<\/pre>\n
I'll explain each line. \u00a0Full documentation can be found here<\/a>.<\/p>\n\n\n\n\n\n
: RSA vpnHostKey.pem<\/td>\nSets the cert to be used for authentication.<\/td>\n<\/tr>\n
<user> : XAUTH \"top_secret_password\"<\/td>\nSets the password for XAUTH method of authentication.<\/td>\n<\/tr>\n
<user> : EAP \"top_secret_password\"<\/td>\nSets the password for EAP\u00a0method of authentication.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
That's it for the strongswan config itself. Now we need to create the certificates.<\/p>\n
As of version 5.8.0, ipsec.conf and ipsec.secrets are no longer required or work.\u00a0 These now need to be converted into a json format in swanctl.conf.<\/p>\n\n\n\n
\n
connections {\n        IPSec-Android-Strongswan {\n          unique=no\n          version=2\n          dpd_delay=300s\n          rekey_time=0\n          reauth_time=0\n          aggressive=no\n          fragmentation=yes\n          encap=yes\n          pull=yes\n          version=2\n          pools=vpn_example\n          mobike=yes\n          send_cert=always\n                local {\n                  certs=vpnHostCert.pem\n                  id = @vpn.example.com\n                }\n                remote {\n                  auth=pubkey\n                }\n                remote2 {\n                  auth=eap-md5\n                }\n                children {\n                        IPSec-Android-Strongswan {\n                          mode=tunnel\n                          dpd_action=clear\n                          start_action=none\n                          close_action=none\n                          ipcomp=yes\n                          local_ts=0.0.0.0\/0\n                        }\n                }\n        }\n}\npools {\n  vpn_example {\n    addrs=10.10.10.10\/30\n  }\n}\nsecrets {\n  private-vpn_example {\n    file=vpnHostKey.pem\n  }\n  eap-user1 {\n    id=username1\n    secret=\"password1\"\n  }\n  eap-user2 {\n    id=username2\n    secret=\"password2\"\n  }\n}\nauthorities {\n  IPSec-Android-Strongswan {\n    cacert=strongswanCert.pem\n  }\n}\n<\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Certificates<\/h3>\n
NOTE:\u00a0 From 5.8.0, the certificate paths have changed from \/etc\/ipsec.d\/... to \/etc\/swanctl\/...<\/p>\n
x509\/ = User Certs<\/p>\n
private\/ = Private key(s)<\/p>\n
x509ca\/ = Root cert(s)<\/p>\n
Let's start by creating the root certificate:<\/p>\n
$ cd \/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>\n$ ipsec pki --<\/span>gen --<\/span>type rsa --<\/span>size 4096<\/span> --<\/span>outform pem > <\/span>private\/<\/span>strongswanKey.<\/span>pem\n$ chmod 600<\/span> private\/<\/span>strongswanKey.<\/span>pem\n$ ipsec pki --<\/span>self --<\/span>ca --<\/span>lifetime 3650<\/span> --<\/span>in<\/span> private\/<\/span>strongswanKey.<\/span>pem --<\/span>type rsa --<\/span>dn \"C=GB, O=strongSwan, CN=strongSwan Root CA\"<\/span> --<\/span>outform pem ><\/span> cacerts\/<\/span>strongswanCert.<\/span>pem<\/code><\/pre>\n
You can change the Distinguished Name (DN) to more relevant values for country (C), organization (O), and common name (CN), but you don\u2019t have to.<\/p>\n
To list the properties of your newly generated certificate, type in the following command:<\/p>\n
$ ipsec pki --<\/span>print --<\/span>in<\/span> cacerts\/<\/span>strongswanCert.<\/span>pem<\/code><\/pre>\n
Create your VPN host certificate:<\/p>\n
$ cd \/etc\/ipsec.d\/\n$ ipsec pki --gen --type rsa --size 2048\u00a0--outform pem\u00a0> private\/vpnHostKey.pem\n$ chmod 600 private\/vpnHostKey.pem\n$ ipsec pki --pub --in private\/vpnHostKey.pem --type rsa |\u00a0ipsec pki --issue --lifetime 730\u00a0--cacert cacerts\/strongswanCert.pem\u00a0--cakey private\/strongswanKey.pem\u00a0--dn \"C=GB, O=strongSwan, CN=my.vpn.com\"\u00a0--san my.vpn.com\u00a0--flag serverAuth --flag ikeIntermediate\u00a0--outform pem > certs\/vpnHostCert.pem<\/pre>\n
To look at the properties of your new certificate, execute the command:<\/p>\n
ipsec pki --<\/span>print --<\/span>in<\/span> certs\/<\/span>vpnHostCert.<\/span>pem<\/code><\/pre>\n
Create a client certificate:<\/p>\n
$ cd \/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>\n$ ipsec pki --<\/span>gen --<\/span>type rsa --<\/span>size 2048<\/span> --<\/span>outform pem ><\/span> private\/User<\/span>Key.<\/span>pem\n$ chmod 600<\/span> private\/User<\/span>Key.<\/span>pem\n$ ipsec pki --<\/span>pub --<\/span>in<\/span> private\/User<\/span>Key.<\/span>pem --<\/span>type rsa |<\/span> ipsec pki --<\/span>issue --<\/span>lifetime 730<\/span> --<\/span>cacert cacerts\/<\/span>strongswanCert.<\/span>pem --<\/span>cakey private\/<\/span>strongswanKey.<\/span>pem --<\/span>dn \"C=GB, O=strongSwan, CN=user@vpn.com\"<\/span> --<\/span>san user@vpn.com --<\/span>outform pem ><\/span> certs\/User<\/span>Cert.<\/span>pem<\/code><\/pre>\n
Export client certificate as a\u00a0PKCS#12 file:<\/p>\n
cd \/etc\/ipsec.d\/\n$ openssl pkcs12 -export -inkey private\/UserKey.pem \\\n -in certs\/UserCert.pem -name \"User's VPN Certificate\" \\\n -certfile cacerts\/strongswanCert.pem \\\n -caname \"strongSwan Root CA\" \\\n -out User.p12<\/pre>\n
Revoke a certificate (if needed):<\/p>\n
$ cd \/etc\/ipsec.d\/\n$ ipsec pki --signcrl --reason key-compromise \\\n --cacert cacerts\/strongswanCert.pem \\\n --cakey private\/strongswanKey.pem \\\n --cert certs\/UserCert.pem \\\n --outform pem > crls\/crl.pem<\/pre>\n
To add another revoked certificate to the same list, we need to copy the existing list into a temporary file:<\/p>\n
$ cd \/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>\n$ cp crls\/<\/span>crl.<\/span>pem crl.<\/span>pem.<\/span>tmp\n$ ipsec pki --<\/span>signcrl --<\/span>reason key-<\/span>compromise \\\n\t--<\/span>cacert cacerts\/<\/span>strongswanCert.<\/span>pem \\\n\t--<\/span>cakey private\/<\/span>strongswanKey.<\/span>pem \\\n\t--<\/span>cert certs\/<\/span>AnotherStolenCert.<\/span>pem \\\n\t--<\/span>lastcrl crl.<\/span>pem.<\/span>tmp \\\n\t--<\/span>outform pem ><\/span> crls\/<\/span>crl.<\/span>pem\n$ rm crl.<\/span>pem.<\/span>tmp<\/code><\/pre>\n
CERTIFICATES \u2013 RECAP:<\/p>\n
So far you\u2019ve created the following files:<\/p>\n
\/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>private\/<\/span>strongswanKey.<\/span>pem  # CA private key\n<\/span>\/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>cacerts\/<\/span>strongswanCert.<\/span>pem # CA certificate\n<\/span>\/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>private\/<\/span>vpnHostKey.<\/span>pem     # VPN host private key\n<\/span>\/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>certs\/<\/span>vpnHostCert.<\/span>pem      # VPN host certificate\n<\/span>\/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>private\/Us<\/span>erKey.<\/span>pem   # Client \"User\" private key\n<\/span>\/<\/span>etc\/<\/span>ipsec.<\/span>d\/<\/span>certs\/Us<\/span>erCert.<\/span>pem    # Client \"User\" certificate\n<\/span>\/<\/span>etc\/<\/span>ipsec.<\/span>d\/Us<\/span>er.<\/span>p12              # Client \"User\" PKCS#12 file<\/span><\/code><\/pre>\n
Firewall Rules<\/h3>\n
I'm sure you'll have some sort of router ;) \u00a0So you'll need to open up and forward the ports to your VPN server.<\/p>\n
You'll only need UDP ports 500 & 4500.<\/p>\n
Port 500 is the IPSEC port and 4500 is the port used for NATing.<\/p>\n
That's the entry point sorted. \u00a0Now for iptables.<\/p>\n
I have these defined to manage the VPN traffic:<\/p>\n
iptables -t nat -A POSTROUTING -s <VIP> -o <INTERFACE> -m policy --dir out --pol ipsec -j ACCEPT\niptables -t nat -A POSTROUTING -s <VIP> -o <INTERFACE> -j MASQUERADE\niptables -t nat -A POSTROUTING -o <INTERFACE> ! -p esp -j SNAT --to-source <VPN_IP>\niptables -A INPUT -p esp -j ACCEPT\niptables -A INPUT -p ah -j ACCEPT<\/pre>\n
<VIP> is the IP\/CIDR which is assigned to the client.
\n<INTERFACE> is the network interface name eg eth0.
\n<\/strong><VPN_IP> is the IP the VPN server listens on.
\nThe bottom two just accept the required protocols.<\/p>\n
You may also need to open up access to ranges used by your mobile service provider. \u00a0eg<\/p>\n
iptables -A INPUT -s <mobile_cidr>\/22 -p udp -m multiport --dports 500,4500 -j ACCEPT<\/pre>\n
You may also need to allow the VIP address assigned to the client to connect to internal services. \u00a0This could be something as global as:<\/p>\n
iptables -A INPUT -s 10.10.10.200 -j ACCEPT<\/pre>\n
or could be tied down to specific ports.<\/p>\n
DNS<\/h3>\n
If the virtual IP that is assigned is on the same network as the server, you can just add the following to your ipsec.conf:<\/p>\n
rightdns = <dns_server_ip><\/pre>\n
If you assign a virtual IP that is on a different network, then you will need to make some additional changes. \u00a0You won't see any errors regarding DNS in any logs, it just won't work!
\nFor example, in the client log, you'd see:<\/p>\n
Aug 28 06:59:18 08[IKE] installing DNS server 111.111.111.119\nAug 28 06:59:18 08[IKE] installing new virtual IP 112.112.112.120\n<\/pre>\n
but if you try and resolve any internal hostnames, it just won't work.<\/p>\n
You need to make the following change to either strongswan.conf or charon.conf (recommended) within the strongswan.d directory.<\/p>\n
charon {\n    plugins {<\/strong><\/span>\n        attr {<\/strong><\/span>\n        dns = 111.111.111.119<\/strong><\/span>\n       split-include = 112.112.112.120, 111.111.111.0\/24<\/strong><\/span>\n             }<\/strong><\/span>\n            }<\/strong><\/span>\n       }<\/pre>\n
As we are splitting the DNS, we need to use the attr<\/strong> plugin. \u00a0You can check if this is loaded when the strongswan daemon is started.<\/p>\n
Aug 28 07:28:23 <hostname> charon[22120]: 00[LIB] loaded plugins: charon pkcs11 aes des blowfish rc2 sha2 sha1 md4 md5 rdrand random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp xcbc cmac hmac ctr ccm gcm attr<\/strong><\/span> kernel-netlink resolve socket-default socket-dynamic farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-radius eap-tls xauth-generic xauth-eap xauth-pam dhcp unity<\/pre>\n
The other thing you will need to do (only if you run your own DNS) is to allow the VPN network to query DNS. \u00a0This is done by adding the VPN subnet or assigned virtual IP of the client to named.conf.<\/p>\n
This is found within the options block.<\/p>\n
allow-query { 127.0.0.1; 111.111.111.0\/24; 112.112.112.120;<\/span><\/strong> };<\/pre>\n
Client setup (strongswan<\/a>)<\/h2>\n
First of all, you'll need to get the pk12 certificate you've created onto your phone (email, cloud storage etc etc). \u00a0Once saved to a location, we need to load it into Android.<\/p>\n
Go to settings and tap \"Security\".<\/p>\n
\"\"<\/p>\n
Then tap \"Install from storage\".<\/p>\n
\"\"<\/p>\n
Browse to where you saved the cert. \u00a0You will be asked for the passphrase set in the cert.<\/p>\n
\"\"<\/p>\n
Once installed, go back to \"Security\" and tap \"User credentials\"<\/p>\n
\"\"<\/p>\n
You should see your certificate entry. \u00a0There are no details to be had here. \u00a0The only option if you tap the cert is to remove it.<\/p>\n
\"\"<\/p>\n
That's it for the certificate installation; now onto the client setup.<\/p>\n
If you haven't installed Strongswan, what are you waiting for? ;)<\/p>\n
Open the app and tap \"ADD VPN PROFILE\"<\/p>\n
\"\"<\/p>\n
Complete the details and ensure you have selected the installed certificate (User certificate).<\/p>\n
\"\"<\/p>\n
Click SAVE and you're done.<\/p>\n
Now to test it! \u00a0Disconnect from your wifi and tap the entry you should now have in the strongswan app. \u00a0If all went well, you should be connected.<\/p>\n
\"\"<\/p>\n","protected":false},"excerpt":{"rendered":"
This setup below is what suited my requirements. \u00a0I'm sure there'll be another way of implementing this, but this works for me :) For this I'm using the following: # emerge --info Portage 2.3.0 (python 3.4.3-final-0, default\/linux\/amd64\/13.0\/no-multilib, gcc-4.9.3, glibc-2.22-r4, 4.8.7-gentoo x86_64) ================================================================= System uname: Linux-4.8.7-gentoo-x86_64-Intel-R-_Core-TM-_i7-6700K_CPU_@_4.00GHz-with-gentoo-2.2 KiB Mem: 32896588 total, 15127076 free KiB Swap: 3640916 total, … Continue reading Android VPN<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[161,18,251,252],"class_list":["post-1231","post","type-post","status-publish","format-standard","hentry","category-gentoo","tag-android-2","tag-linux","tag-strongswan","tag-vpn"],"_links":{"self":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/1231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1231"}],"version-history":[{"count":33,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/1231\/revisions"}],"predecessor-version":[{"id":2040,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=\/wp\/v2\/posts\/1231\/revisions\/2040"}],"wp:attachment":[{"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cdblog.cdstealer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}