/testing/guestbin/swan-prep
west #
 ipsec start
Redirecting to: [initsystem]
west #
 ../../guestbin/wait-until-pluto-started
west #
 echo "initdone"
initdone
west #
 # these conns should load
west #
 # whack testing
west #
 ipsec whack --name testmanual1 --encrypt --ikev2 --ipv4 --host 1.2.3.4 --authby=psk --to --host 2.3.4.5 --authby=rsasig
"testmanual1": added IKEv2 connection
west #
 ipsec whack --name testmanual2 --encrypt --ikev2 --ipv4 --host 1.2.3.5 --authby=null --to --host 2.3.4.6 --authby=rsasig
"testmanual2": added IKEv2 connection
west #
 ipsec whack --name testmanual3 --psk --encrypt --ikev2 --ipv4 --host 1.2.3.6 --authby=psk --to --host 2.3.4.7 --authby=psk
"testmanual3": added IKEv2 connection
west #
 # parser testing
west #
 ipsec auto --add test-default
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test-default": added IKEv2 connection
west #
 ipsec auto --add test-v1-secret
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test-v1-secret": added IKEv1 connection
west #
 ipsec auto --add test-v1-rsasig
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test-v1-rsasig": added IKEv1 connection
west #
 ipsec auto --add test-passthrough
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test-passthrough": failed to add connection: shunt connection cannot have authentication method other then authby=never
west #
 ipsec auto --add test1
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test1": added IKEv2 connection
west #
 ipsec auto --add test2
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test2": added IKEv2 connection
west #
 ipsec auto --add test3
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test3": added IKEv2 connection
west #
 ipsec auto --add test5
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test5": added IKEv2 connection
west #
 ipsec auto --add test6
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test6": added IKEv2 connection
west #
 ipsec auto --add test7
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test7": added IKEv2 connection
west #
 ipsec auto --add test8
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test8": added IKEv2 connection
west #
 ipsec auto --add test9
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test9": added IKEv2 connection
west #
 ipsec auto --add test10
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test10": added IKEv2 connection
west #
 ipsec auto --add test11
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"test11": added IKEv2 connection
west #
 echo "all remaining tests should fail"
all remaining tests should fail
west #
 # whack testing
west #
 ipsec whack --name failtestmanual1 --ikev2 --ipv4 --host 1.2.3.5 --authby=null --to --host 2.3.4.6 --authby=rsasig
"failtestmanual1": failed to add connection: non-shunt connection must have AH or ESP
west #
 ipsec whack --name failtestmanual2 --ikev1 --encrypt --ipv4 --host 1.2.3.5 --authby=null --to --host 2.3.4.6 --authby=rsasig
"failtestmanual2": failed to add connection: leftauth= and rightauth= require ikev2
west #
 # parser testing
west #
 ipsec auto --add failtest0
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest0": failed to add connection: cannot mix PSK and NULL authentication (leftauth=secret and rightauth=null)
west #
 ipsec auto --add failtest1
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest1": failed to add connection: leftauth= and rightauth= require ikev2
west #
 ipsec auto --add failtest3
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest3": failed to add connection: leftauth= and rightauth= require ikev2
west #
 ipsec auto --add failtest4
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
conn failtest4 did not load properly
west #
 ipsec auto --add failtest5
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest5": failed to add connection: leftauth= and rightauth= must both be set or both be unset
west #
 ipsec auto --add failtest6
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest6": failed to add connection: leftauth= and rightauth= must both be set or both be unset
west #
 ipsec auto --add failtest7
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest7": failed to add connection: leftauth= and rightauth= must both be set or both be unset
west #
 ipsec auto --add failtest8
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest8": failed to add connection: shunt connection cannot have authentication method other then authby=never
west #
 ipsec auto --add failtest9
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest9": failed to add connection: shunt connection cannot have authentication method other then authby=never
west #
 ipsec auto --add failtest10
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
conn failtest10 did not load properly
west #
 ipsec auto --add failtest11
while loading 'failtest4': ikev1 connection must use authby= of rsasig, secret or never
while loading 'failtest10': ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
addconn, in config '/etc/ipsec.conf', ikev1 connection must use authby= of rsasig, secret or never
ikev1 connection must use authby= of rsasig, secret or never
"failtest11": failed to add connection: leftauth/rightauth can only be 'eaponly' when using leftautheap/rightautheap is not 'none'
west #
 echo "Showing policies of all loaded connections"
Showing policies of all loaded connections
west #
 ipsec status | grep -E 'policy: |our auth:'
"test-default":   our auth:rsasig, their auth:rsasig, our autheap:none, their autheap:none;
"test-default":   policy: IKEv2+RSASIG+ECDSA+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test-default":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
"test-v1-rsasig":   our auth:rsasig, their auth:rsasig, our autheap:none, their autheap:none;
"test-v1-rsasig":   policy: IKEv1+RSASIG+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test-v1-secret":   our auth:secret, their auth:secret, our autheap:none, their autheap:none;
"test-v1-secret":   policy: IKEv1+PSK+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test1":   our auth:secret, their auth:secret, our autheap:none, their autheap:none;
"test1":   policy: IKEv2+PSK+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test1":   v2-auth-hash-policy: none;
"test10":   our auth:eaponly, their auth:eaponly, our autheap:tls, their autheap:tls;
"test10":   policy: IKEv2+RSASIG+ECDSA+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test10":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
"test11":   our auth:eaponly, their auth:rsasig, our autheap:tls, their autheap:none;
"test11":   policy: IKEv2+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test11":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
"test2":   our auth:rsasig, their auth:rsasig, our autheap:none, their autheap:none;
"test2":   policy: IKEv2+RSASIG+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test2":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
"test3":   our auth:null, their auth:null, our autheap:none, their autheap:none;
"test3":   policy: IKEv2+AUTH_NULL+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test3":   v2-auth-hash-policy: none;
"test5":   our auth:secret, their auth:rsasig, our autheap:none, their autheap:none;
"test5":   policy: IKEv2+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test5":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
"test6":   our auth:null, their auth:rsasig, our autheap:none, their autheap:none;
"test6":   policy: IKEv2+RSASIG+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test6":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
"test7":   our auth:secret, their auth:secret, our autheap:none, their autheap:none;
"test7":   policy: IKEv2+PSK+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test7":   v2-auth-hash-policy: none;
"test8":   our auth:null, their auth:null, our autheap:none, their autheap:none;
"test8":   policy: IKEv2+AUTH_NULL+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test8":   v2-auth-hash-policy: none;
"test9":   our auth:rsasig, their auth:rsasig, our autheap:none, their autheap:none;
"test9":   policy: IKEv2+RSASIG+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
"test9":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
"testmanual1":   our auth:secret, their auth:rsasig, our autheap:none, their autheap:none;
"testmanual1":   policy: IKEv2+ENCRYPT;
"testmanual1":   v2-auth-hash-policy: none;
"testmanual2":   our auth:null, their auth:rsasig, our autheap:none, their autheap:none;
"testmanual2":   policy: IKEv2+RSASIG+ENCRYPT;
"testmanual2":   v2-auth-hash-policy: none;
"testmanual3":   our auth:secret, their auth:secret, our autheap:none, their autheap:none;
"testmanual3":   policy: IKEv2+PSK+ENCRYPT;
"testmanual3":   v2-auth-hash-policy: none;
west #
 echo done
done
west #
 
