/testing/guestbin/swan-prep
west #
 # install selinux; generated in OUTPUT by east
west #
 semodule -i OUTPUT/ipsecspd.pp
west #
 # start pluto
west #
 ipsec start
Redirecting to: [initsystem]
west #
 ../../guestbin/wait-until-pluto-started
west #
 echo 1 > /proc/sys/net/core/xfrm_acq_expires
west #
 ipsec auto --add labeled
002 "labeled": added IKEv2 connection
west #
 echo "initdone"
initdone
west #
 # for port re-use in tests with protoport selectors
west #
 echo 1 >/proc/sys/net/ipv4/tcp_tw_reuse
west #
 ipsec auto --up labeled
1v2 "labeled" #1: initiating IKEv2 connection
1v2 "labeled" #1: sent IKE_SA_INIT request
002 "labeled" #1: omitting CHILD SA payloads
1v2 "labeled" #1: sent IKE_AUTH request {cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}
003 "labeled" #1: established IKE SA; authenticated using RSA with SHA2_512 and preloaded certificate '@east'
west #
 # expect policy but no states
west #
 ../../guestbin/ipsec-look.sh
west NOW
XFRM state:
XFRM policy:
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir fwd priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir in priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.45/32 dst 192.1.2.23/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir out priority 2080702 ptype main
	tmpl src 192.1.2.45 dst 192.1.2.23
		proto esp reqid REQID mode tunnel
XFRM done
IPSEC mangle TABLES
NEW_IPSEC_CONN mangle TABLES
ROUTING TABLES
default via 192.1.2.254 dev eth1
192.0.1.0/24 dev eth0 proto kernel scope link src 192.0.1.254
192.0.2.0/24 via 192.1.2.23 dev eth1
192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.45
NSS_CERTIFICATES
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
west #
 # trigger an acquire; both ends initiate Child SA
west #
 echo "quit" | runcon -t netutils_t nc -w 50 -p 4301 -vvv 192.1.2.23 4300 2>&1 | sed "s/received in .*$/received .../"
Ncat: Version 7.80 ( https://nmap.org/ncat )
NCAT DEBUG: Using system default trusted CA certificates and those in PATH/share/ncat/ca-bundle.crt.
NCAT DEBUG: Unable to load trusted CA certificates from PATH/share/ncat/ca-bundle.crt: error:02001002:system library:fopen:No such file or directory
libnsock nsock_iod_new2(): nsock_iod_new (IOD #1)
libnsock nsock_connect_tcp(): TCP connection requested to 192.1.2.23:4300 (IOD #1) EID 8
libnsock mksock_bind_addr(): Binding to 0.0.0.0:4301 (IOD #1)
libnsock nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.1.2.23:4300]
Ncat: Connected to 192.1.2.23:4300.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #2)
libnsock nsock_read(): Read request from IOD #1 [192.1.2.23:4300] (timeout: -1ms) EID 18
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 26
libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 26 [peer unspecified] (5 bytes): quit.
libnsock nsock_write(): Write request for 5 bytes to IOD #1 EID 35 [192.1.2.23:4300]
libnsock nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 35 [192.1.2.23:4300]
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 42
libnsock nsock_trace_handler_callback(): Callback: READ EOF for EID 42 [peer unspecified]
libnsock nsock_trace_handler_callback(): Callback: READ EOF for EID 18 [192.1.2.23:4300]
Ncat: 5 bytes sent, 0 bytes received ...
libnsock nsock_iod_delete(): nsock_iod_delete (IOD #1)
libnsock nsock_iod_delete(): nsock_iod_delete (IOD #2)
west #
 ../../guestbin/wait-for.sh --match 'labeled..2.' ipsec trafficstatus
006 #3: "labeled"[2] 192.1.2.23, type=ESP, add_time=1234567890, inBytes=164, outBytes=0, id='@east'
west #
 # no shunts; two transports; two x two states
west #
 ipsec shuntstatus
000 Bare Shunt list:
000  
west #
 ipsec showstates
000 #1: "labeled":500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); REKEY in XXs; newest ISAKMP; idle;
000 #2: "labeled"[1] 192.1.2.23:500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; newest IPSEC; isakmp#1; idle;
000 #2: "labeled"[1] 192.1.2.23 esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.2.45 tun.0@192.1.2.23 tun.0@192.1.2.45 Traffic: ESPin=0B ESPout=273B ESPmax=0B 
000 #3: "labeled"[2] 192.1.2.23:500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; newest IPSEC; isakmp#1; idle;
000 #3: "labeled"[2] 192.1.2.23 esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.2.45 tun.0@192.1.2.23 tun.0@192.1.2.45 Traffic: ESPin=164B ESPout=0B ESPmax=0B 
west #
 ../../guestbin/ipsec-look.sh
west NOW
XFRM state:
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:netutils_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:netutils_t:s0-s0:c0.c1023 
XFRM policy:
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir fwd priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir in priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.45/32 dst 192.1.2.23/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir out priority 2080702 ptype main
	tmpl src 192.1.2.45 dst 192.1.2.23
		proto esp reqid REQID mode tunnel
XFRM done
IPSEC mangle TABLES
NEW_IPSEC_CONN mangle TABLES
ROUTING TABLES
default via 192.1.2.254 dev eth1
192.0.1.0/24 dev eth0 proto kernel scope link src 192.0.1.254
192.0.2.0/24 via 192.1.2.23 dev eth1
192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.45
NSS_CERTIFICATES
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
west #
 # let another on-demand label establish; only 1 SA is added
west #
 echo "quit" | runcon -u system_u -r system_r -t sshd_t nc -w 50 -vvv 192.1.2.23 22 2>&1 | sed "s/received in .*$/received .../"
Ncat: Version 7.80 ( https://nmap.org/ncat )
NCAT DEBUG: Using system default trusted CA certificates and those in PATH/share/ncat/ca-bundle.crt.
NCAT DEBUG: Unable to load trusted CA certificates from PATH/share/ncat/ca-bundle.crt: error:02001002:system library:fopen:No such file or directory
libnsock nsock_iod_new2(): nsock_iod_new (IOD #1)
libnsock nsock_connect_tcp(): TCP connection requested to 192.1.2.23:22 (IOD #1) EID 8
libnsock nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.1.2.23:22]
Ncat: Connected to 192.1.2.23:22.
libnsock nsock_iod_new2(): nsock_iod_new (IOD #2)
libnsock nsock_read(): Read request from IOD #1 [192.1.2.23:22] (timeout: -1ms) EID 18
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 26
libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 26 [peer unspecified] (5 bytes): quit.
libnsock nsock_write(): Write request for 5 bytes to IOD #1 EID 35 [192.1.2.23:22]
libnsock nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 35 [192.1.2.23:22]
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 42
libnsock nsock_trace_handler_callback(): Callback: READ EOF for EID 42 [peer unspecified]
libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [192.1.2.23:22] (21 bytes): SSH-2.0-OpenSSH_XXX
SSH-2.0-OpenSSH_XXX
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #1 [192.1.2.23:22] EID 50
libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 50 [192.1.2.23:22] (36 bytes): Invalid SSH identification string...
Invalid SSH identification string.
libnsock nsock_readbytes(): Read request for 0 bytes from IOD #1 [192.1.2.23:22] EID 58
libnsock nsock_trace_handler_callback(): Callback: READ EOF for EID 58 [192.1.2.23:22]
Ncat: 5 bytes sent, 57 bytes received ...
libnsock nsock_iod_delete(): nsock_iod_delete (IOD #1)
libnsock nsock_iod_delete(): nsock_iod_delete (IOD #2)
west #
 ../../guestbin/wait-for.sh --match 'labeled..3.' ipsec trafficstatus
006 #4: "labeled"[3] 192.1.2.23, type=ESP, add_time=1234567890, inBytes=377, outBytes=429, id='@east'
west #
 # there should be no shunts
west #
 ipsec shuntstatus
000 Bare Shunt list:
000  
west #
 ipsec showstates
000 #1: "labeled":500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); REKEY in XXs; newest ISAKMP; idle;
000 #2: "labeled"[1] 192.1.2.23:500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; newest IPSEC; isakmp#1; idle;
000 #2: "labeled"[1] 192.1.2.23 esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.2.45 tun.0@192.1.2.23 tun.0@192.1.2.45 Traffic: ESPin=0B ESPout=273B ESPmax=0B 
000 #3: "labeled"[2] 192.1.2.23:500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; newest IPSEC; isakmp#1; idle;
000 #3: "labeled"[2] 192.1.2.23 esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.2.45 tun.0@192.1.2.23 tun.0@192.1.2.45 Traffic: ESPin=164B ESPout=0B ESPmax=0B 
000 #4: "labeled"[3] 192.1.2.23:500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; newest IPSEC; isakmp#1; idle;
000 #4: "labeled"[3] 192.1.2.23 esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.2.45 tun.0@192.1.2.23 tun.0@192.1.2.45 Traffic: ESPin=377B ESPout=429B ESPmax=0B 
west #
 ../../guestbin/ipsec-look.sh
west NOW
XFRM state:
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context system_u:system_r:sshd_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context system_u:system_r:sshd_t:s0-s0:c0.c1023 
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:netutils_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:netutils_t:s0-s0:c0.c1023 
XFRM policy:
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir fwd priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir in priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.45/32 dst 192.1.2.23/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir out priority 2080702 ptype main
	tmpl src 192.1.2.45 dst 192.1.2.23
		proto esp reqid REQID mode tunnel
XFRM done
IPSEC mangle TABLES
NEW_IPSEC_CONN mangle TABLES
ROUTING TABLES
default via 192.1.2.254 dev eth1
192.0.1.0/24 dev eth0 proto kernel scope link src 192.0.1.254
192.0.2.0/24 via 192.1.2.23 dev eth1
192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.45
NSS_CERTIFICATES
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
west #
 # now the fun begins
west #
 ipsec whack --rekey-ike --name 1
002 rekeying IKE SA state #1 of connection "labeled"
002 "labeled" #5: initiating rekey to replace IKE SA #1
1v2 "labeled" #5: sent CREATE_CHILD_SA request to rekey IKE SA
002 "labeled" #5: rekeyed #1 STATE_V2_REKEY_IKE_I1 and expire it remaining life XXs
004 "labeled" #5: established IKE SA {cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}
002 "labeled" #1: deleting state (STATE_V2_ESTABLISHED_IKE_SA) and sending notification
west #
 ipsec whack --rekey-ipsec --name 2
002 rekeying IPsec SA state #2 of connection "labeled"[1] 192.1.2.23
002 "labeled"[1] 192.1.2.23 #6: initiating rekey to replace Child SA #2
1v2 "labeled"[1] 192.1.2.23 #6: sent CREATE_CHILD_SA request to rekey IPsec SA
002 "labeled"[1] 192.1.2.23 #6: rekeyed #2 STATE_V2_REKEY_CHILD_I1 and expire it remaining life XXs
004 "labeled"[1] 192.1.2.23 #6: established Child SA; IPsec tunnel [192.1.2.45-192.1.2.45:0-65535 0] -> [192.1.2.23-192.1.2.23:0-65535 0] {ESP=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATOA=none NATD=none DPD=passive}
002 "labeled"[1] 192.1.2.23 #2: deleting established Child SA using IKE SA #5
005 "labeled"[1] 192.1.2.23 #2: ESP traffic information: in=0B out=273B
west #
 ipsec whack --rekey-ipsec --name 3
002 rekeying IPsec SA state #3 of connection "labeled"[2] 192.1.2.23
002 "labeled"[2] 192.1.2.23 #7: initiating rekey to replace Child SA #3
1v2 "labeled"[2] 192.1.2.23 #7: sent CREATE_CHILD_SA request to rekey IPsec SA
002 "labeled"[2] 192.1.2.23 #7: rekeyed #3 STATE_V2_REKEY_CHILD_I1 and expire it remaining life XXs
004 "labeled"[2] 192.1.2.23 #7: established Child SA; IPsec tunnel [192.1.2.45-192.1.2.45:0-65535 0] -> [192.1.2.23-192.1.2.23:0-65535 0] {ESP=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATOA=none NATD=none DPD=passive}
002 "labeled"[2] 192.1.2.23 #3: deleting established Child SA using IKE SA #5
005 "labeled"[2] 192.1.2.23 #3: ESP traffic information: in=164B out=0B
west #
 ipsec whack --rekey-ipsec --name 4
002 rekeying IPsec SA state #4 of connection "labeled"[3] 192.1.2.23
002 "labeled"[3] 192.1.2.23 #8: initiating rekey to replace Child SA #4
1v2 "labeled"[3] 192.1.2.23 #8: sent CREATE_CHILD_SA request to rekey IPsec SA
002 "labeled"[3] 192.1.2.23 #8: rekeyed #4 STATE_V2_REKEY_CHILD_I1 and expire it remaining life XXs
004 "labeled"[3] 192.1.2.23 #8: established Child SA; IPsec tunnel [192.1.2.45-192.1.2.45:0-65535 0] -> [192.1.2.23-192.1.2.23:0-65535 0] {ESP=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATOA=none NATD=none DPD=passive}
002 "labeled"[3] 192.1.2.23 #4: deleting established Child SA using IKE SA #5
005 "labeled"[3] 192.1.2.23 #4: ESP traffic information: in=377B out=429B
west #
 echo done
done
west #
 ../../guestbin/ipsec-look.sh
west NOW
XFRM state:
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context system_u:system_r:sshd_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context system_u:system_r:sshd_t:s0-s0:c0.c1023 
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 
src 192.1.2.23 dst 192.1.2.45
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:netutils_t:s0-s0:c0.c1023 
src 192.1.2.45 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode tunnel
	replay-window 32 flag af-unspec
	aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
	security context unconfined_u:unconfined_r:netutils_t:s0-s0:c0.c1023 
XFRM policy:
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir fwd priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.23/32 dst 192.1.2.45/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir in priority 2080702 ptype main
	tmpl src 192.1.2.23 dst 192.1.2.45
		proto esp reqid REQID mode tunnel
src 192.1.2.45/32 dst 192.1.2.23/32
	security context system_u:object_r:ipsec_spd_t:s0
	dir out priority 2080702 ptype main
	tmpl src 192.1.2.45 dst 192.1.2.23
		proto esp reqid REQID mode tunnel
XFRM done
IPSEC mangle TABLES
NEW_IPSEC_CONN mangle TABLES
ROUTING TABLES
default via 192.1.2.254 dev eth1
192.0.1.0/24 dev eth0 proto kernel scope link src 192.0.1.254
192.0.2.0/24 via 192.1.2.23 dev eth1
192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.45
NSS_CERTIFICATES
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
west #
 
