/testing/guestbin/swan-prep
west #
 # dmesg -n 6
west #
 # nohup tcpdump -i eth1 -s 65535 -X -vv -nn tcp > OUTPUT/west.tcpdump & sleep 1 # wait for nohup msg
west #
 # nohup dumpcap -i eth1 -w /tmp/west.pcap > OUTPUT/west.dumpcap & sleep 1 # wait for nohup msg
west #
 # confirm that the network is alive
west #
 # ../../guestbin/wait-until-alive -I 192.0.1.254 192.0.2.254
west #
 # make sure that clear text does not get through
west #
 # iptables -F
west #
 # iptables -X
west #
 # does this block the ping response?
west #
 # iptables -A INPUT -i eth1 -s 192.0.2.0/24 -j DROP
west #
 # iptables -A OUTPUT -o eth1 -p tcp --dport 4500 -j ACCEPT
west #
 # confirm with a ping
west #
 # ../../guestbin/ping-once.sh --down -I 192.0.1.254 192.0.2.254
west #
 ipsec start
Redirecting to: [initsystem]
west #
 ../../guestbin/wait-until-pluto-started
west #
 ipsec auto --add westnet-eastnet-ikev2
002 "westnet-eastnet-ikev2": added IKEv2 connection
west #
 ipsec auto --status | grep westnet-eastnet-ikev2
000 "westnet-eastnet-ikev2": 192.0.1.0/24===192.1.2.45[@west]...192.1.2.23[@east]===192.0.2.0/24; unrouted; eroute owner: #0
000 "westnet-eastnet-ikev2":     oriented; my_ip=unset; their_ip=unset; my_updown=ipsec _updown;
000 "westnet-eastnet-ikev2":   xauth us:none, xauth them:none,  my_username=[any]; their_username=[any]
000 "westnet-eastnet-ikev2":   our auth:rsasig(RSASIG+RSASIG_v1_5), their auth:RSASIG+ECDSA+RSASIG_v1_5, our autheap:none, their autheap:none;
000 "westnet-eastnet-ikev2":   modecfg info: us:none, them:none, modecfg policy:push, dns:unset, domains:unset, cat:unset;
000 "westnet-eastnet-ikev2":   sec_label:unset;
000 "westnet-eastnet-ikev2":   ike_life: 28800s; ipsec_life: 28800s; replay_window: 128; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0;
000 "westnet-eastnet-ikev2":   retransmit-interval: 9999ms; retransmit-timeout: 99s; iketcp:yes; iketcp-port:4500;
000 "westnet-eastnet-ikev2":   initial-contact:no; cisco-unity:no; fake-strongswan:no; send-vendorid:no; send-no-esp-tfc:no;
000 "westnet-eastnet-ikev2":   policy: IKEv2+RSASIG+ECDSA+RSASIG_v1_5+ENCRYPT+TUNNEL+PFS+IKE_FRAG_ALLOW+ESN_NO+ESN_YES;
000 "westnet-eastnet-ikev2":   v2-auth-hash-policy: SHA2_256+SHA2_384+SHA2_512;
000 "westnet-eastnet-ikev2":   conn_prio: 24,24; interface: eth1; metric: 0; mtu: unset; sa_prio:auto; sa_tfc:none;
000 "westnet-eastnet-ikev2":   nflog-group: unset; mark: unset; vti-iface:unset; vti-routing:no; vti-shared:no; nic-offload:auto;
000 "westnet-eastnet-ikev2":   our idtype: ID_FQDN; our id=@west; their idtype: ID_FQDN; their id=@east
000 "westnet-eastnet-ikev2":   liveness: passive; dpdaction:hold; dpddelay:0s; retransmit-timeout:60s
000 "westnet-eastnet-ikev2":   nat-traversal: encaps:auto; keepalive:20s
000 "westnet-eastnet-ikev2":   newest ISAKMP SA: #0; newest IPsec SA: #0; conn serial: $1;
west #
 echo "initdone"
initdone
west #
 # the sleep is to keep the pipe open, something better?
west #
 send() { { printf "$@" ; for c in 1 2 3 4 5 6 7 8 9 10 ; do sleep 1 ; printf "" ; done; } | ncat east 4500 ; }
west #
 # 4.  TCP-Encapsulated Stream Prefix
west #
 #
west #
 #  0      1      2      3      4      5
west #
 # +------+------+------+------+------+------+
west #
 # | 0x49 | 0x4b | 0x45 | 0x54 | 0x43 | 0x50 |
west #
 # +------+------+------+------+------+------+
west #
 #
west #
 # followed by ...
west #
 #
west #
 # 3.1.  TCP-Encapsulated IKE Header Format
west #
 #                      1                   2                   3
west #
 #  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
west #
 #                                 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
west #
 #                                 |            Length             |
west #
 # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
west #
 # |                         Non-ESP Marker                        |
west #
 # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
west #
 # |                                                               |
west #
 # ~                      IKE header [RFC7296]                     ~
west #
 # |                                                               |
west #
 # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
west #
 #
west #
 # ... where LENGTH includes the length field
west #
 # open the TCP socket
west #
 send ''
west #
 # send one byte
west #
 send 'I'
west #
 # send not IKETCP
west #
 send '123456'
west #
 # send IKETCP prefix
west #
 send 'IKETCP'
west #
 # send IKETCP prefix + <00>
west #
 send 'IKETCP\00'
west #
 # send IKETCP prefix + length=0; min length is 2
west #
 send 'IKETCP\x0\x0'
Ncat: Connection reset by peer.
west #
 # send IKETCP prefix + length=2
west #
 send 'IKETCP\x0\x2'
west #
 # send IKETCP prefix + length=6 + non-ESP marker (0)
west #
 send 'IKETCP\x00\x06''\x00\x00\x00\x00'
west #
 # send IKETCP prefix + length=6 + non-ESP marker (0) + <ff> == mangled
west #
 send 'IKETCP\x00\x07''\x00\x00\x00\x00''\xff'
west #
 # send IKETCP prefix + length=2+4+28=0x22 + non-ESP marker (0) + <header:length=28=0x1c>
west #
 send 'IKETCP\x00\x22''\x00\x00\x00\x00''\x01\x02\x03\x04\x05\x06\x07\x08''\x00\x00\x00\x00\x00\x00\x00\x00''\x00\x20\x22\x08''\x00\x00\x00\x00''\x00\x00\x00\x1c' | hexdump
0000000 2a00 0000 0000 0201 0403 0605 0807 0000
0000010 0000 0000 0000 2029 2022 0000 0000 0000
0000020 2400 0000 0800 0000 0700               
000002a
west #
 # send IKETCP prefix + length=0x00ff
west #
 # for some reason this sometimes causes EAGAIN on east
west #
 send 'IKETCP\x00\xff'
west #
 # send IKETCP prefix + length=0xffff
west #
 send 'IKETCP\xff\xff'
west #
 ipsec look
west NOW
XFRM state:
XFRM policy:
XFRM done
IPSEC mangle TABLES
NEW_IPSEC_CONN mangle TABLES
ROUTING TABLES
default via 192.1.2.254 dev eth1
192.0.1.0/24 dev eth0 proto kernel scope link src 192.0.1.254
192.0.2.0/24 via 192.1.2.23 dev eth1
192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.45
NSS_CERTIFICATES
Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI
west #
 grep '^connection from' /tmp/pluto.log
west #
 
