/testing/guestbin/swan-prep
west #
 ipsec start
Redirecting to: systemctl start ipsec.service
west #
 /testing/pluto/bin/wait-until-pluto-started
west #
 echo "initdone"
initdone
west #
 # these conns should load
west #
 # whack testing
west #
 ipsec whack --name testmanual1 --encrypt --ikev2-propose --ikev2-allow --ipv4 --host 1.2.3.4 --authby=psk --to --host 2.3.4.5 --authby=rsasig
002 added connection description "testmanual1"
west #
 ipsec whack --name testmanual2 --encrypt --ikev2-propose --ikev2-allow --ipv4 --host 1.2.3.5 --authby=null --to --host 2.3.4.6 --authby=rsasig
002 added connection description "testmanual2"
west #
 ipsec whack --name testmanual3 --psk --encrypt --ikev2-propose --ikev2-allow --ipv4 --host 1.2.3.6 --authby=psk --to --host 2.3.4.7 --authby=psk
002 added connection description "testmanual3"
west #
 # parser testing
west #
 ipsec auto --add test-default
002 added connection description "test-default"
west #
 ipsec auto --add test-v1-secret
002 added connection description "test-v1-secret"
west #
 ipsec auto --add test-v1-rsasig
002 added connection description "test-v1-rsasig"
west #
 ipsec auto --add test-passthrough
002 added connection description "test-passthrough"
west #
 ipsec auto --add test1
002 added connection description "test1"
west #
 ipsec auto --add test2
002 added connection description "test2"
west #
 ipsec auto --add test3
002 added connection description "test3"
west #
 ipsec auto --add test5
002 added connection description "test5"
west #
 ipsec auto --add test6
002 added connection description "test6"
west #
 ipsec auto --add test7
002 added connection description "test7"
west #
 ipsec auto --add test8
002 added connection description "test8"
west #
 ipsec auto --add test9
002 added connection description "test9"
west #
 # below should all fail to load
west #
 # whack testing
west #
 ipsec whack --name failtestmanual1 --ikev2-propose --ikev2-allow --ipv4 --host 1.2.3.5 --authby=null --to --host 2.3.4.6 --authby=rsasig
whack error: "failtestmanual1" non-shunt connection must have --psk or --rsasig or both
west #
 ipsec whack --name failtestmanual2 --encrypt --ipv4 --host 1.2.3.5 --authby=null --to --host 2.3.4.6 --authby=rsasig
003 Failed to add connection "failtestmanual2" : leftauth= and rightauth= require ikev2=insist
west #
 ipsec whack --name failtestmanual3 --psk --encrypt --ikev2-propose --ikev2-allow --ipv4 --host 1.2.3.4 --authby=null --to --host 2.3.4.5 --authby=rsasig
003 Failed to add connection "failtestmanual3" : leftauth=null is unequal to rightauth=rsasig so authby=PSK must not be set
west #
 ipsec whack --name failtestmanual4 --rsasig --encrypt --ikev2-propose --ikev2-allow --ipv4 --host 1.2.3.4 --authby=null --to --host 2.3.4.5 --authby=rsasig
003 Failed to add connection "failtestmanual4" : leftauth=null is unequal to rightauth=rsasig so authby=RSASIG must not be set
west #
 # parser testing
west #
 ipsec auto --add failtest0
003 Failed to add connection "failtest0" : cannot mix PSK and NULL authentication (leftauth=secret and rightauth=null)
west #
 ipsec auto --add failtest1
003 Failed to add connection "failtest1" : leftauth= and rightauth= require ikev2=insist
west #
 ipsec auto --add failtest2
003 Failed to add connection "failtest2" : leftauth=rsasig is unequal to rightauth=secret so authby=PSK must not be set
west #
 ipsec auto --add failtest3
003 Failed to add connection "failtest3" : leftauth=rsasig is unequal to rightauth=secret so authby=RSASIG must not be set
west #
 ipsec auto --add failtest4
003 Failed to add connection "failtest4" : leftauth=rsasig is unequal to rightauth=secret so authby=AUTHNULL must not be set
west #
 ipsec auto --add failtest5
003 Failed to add connection "failtest5" : leftauth= and rightauth= must both be set or both be unset
west #
 ipsec auto --add failtest6
003 Failed to add connection "failtest6" : leftauth= and rightauth= must both be set or both be unset
west #
 ipsec auto --add failtest7
003 Failed to add connection "failtest7" : leftauth= and rightauth= must both be set or both be unset
west #
 ipsec status | egrep 'policy: |our auth:'
000 "test-default":   our auth:rsasig, their auth:rsasig
000 "test-default":   policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test-passthrough":   our auth:unset, their auth:unset
000 "test-passthrough":   policy: PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO+PASS+NEVER_NEGOTIATE;
000 "test-v1-rsasig":   our auth:rsasig, their auth:rsasig
000 "test-v1-rsasig":   policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test-v1-secret":   our auth:secret, their auth:secret
000 "test-v1-secret":   policy: PSK+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test1":   our auth:secret, their auth:secret
000 "test1":   policy: PSK+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test2":   our auth:rsasig, their auth:rsasig
000 "test2":   policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test3":   our auth:null, their auth:null
000 "test3":   policy: AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test5":   our auth:secret, their auth:rsasig
000 "test5":   policy: PSK+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test6":   our auth:null, their auth:rsasig
000 "test6":   policy: AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test7":   our auth:secret, their auth:secret
000 "test7":   policy: PSK+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test8":   our auth:null, their auth:null
000 "test8":   policy: AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "test9":   our auth:rsasig, their auth:rsasig
000 "test9":   policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_PROPOSE+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO;
000 "testmanual1":   our auth:secret, their auth:rsasig
000 "testmanual1":   policy: PSK+ENCRYPT+IKEV2_ALLOW+IKEV2_PROPOSE;
000 "testmanual2":   our auth:null, their auth:rsasig
000 "testmanual2":   policy: AUTHNULL+ENCRYPT+IKEV2_ALLOW+IKEV2_PROPOSE;
000 "testmanual3":   our auth:secret, their auth:secret
000 "testmanual3":   policy: PSK+ENCRYPT+IKEV2_ALLOW+IKEV2_PROPOSE;
west #
 echo done
done
west #
west #
 if [ -n "`ls /tmp/core* 2>/dev/null`" ]; then echo CORE FOUND; mv /tmp/core* OUTPUT/; fi
west #
 if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi

