iptables -t nat -F
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# iptables -F
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# # NAT to NIC's address
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# # NAT UDP 500,4500 to NICs address with sport
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# iptables -t nat -A POSTROUTING -s 192.1.3.0/24 -p udp --sport 4500  -j SNAT --to-source 192.1.2.254:2500-2700
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# iptables -t nat -A POSTROUTING -s 192.1.3.0/24 -p udp --sport 500  -j SNAT --to-source 192.1.2.254:3500-3700
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# iptables -t nat -A POSTROUTING -s 192.1.3.0/24 -j SNAT --to-source 192.1.2.254
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# # A tunnel should have established with non-zero byte counters
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# ipsec whack --trafficstatus
whack: Pluto is not running (no "/run/pluto/pluto.ctl")
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart 33]# >>>>>>>>>>cutnonzeroexit>>>>>>>>>> exit status 33 final.sh 'ipsec whack --trafficstatus' <<<<<<<<<<tuc<<<<<<<<<<# you should see both RSA and NULL
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart 33]# >>>>>>>>>>cutnonzeroexit>>>>>>>>>> exit status 33 final.sh '# you should see both RSA and NULL' <<<<<<<<<<tuc<<<<<<<<<<grep IKEv2_AUTH_ /tmp/pluto.log
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart 1]# >>>>>>>>>>cutnonzeroexit>>>>>>>>>> exit status 1 final.sh 'grep IKEv2_AUTH_ /tmp/pluto.log' <<<<<<<<<<tuc<<<<<<<<<<: ==== cut ====
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# ipsec auto --status
whack: Pluto is not running (no "/run/pluto/pluto.ctl")
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart 33]# >>>>>>>>>>cutnonzeroexit>>>>>>>>>> exit status 33 final.sh 'ipsec auto --status' <<<<<<<<<<tuc<<<<<<<<<<: ==== tuc ====
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# ../bin/check-for-core.sh
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi
type=AVC msg=audit(1566825654.748:208365): avc:  denied  { write } for  pid=14889 comm="ip" path="/tmp/pluto.log" dev="dm-0" ino=295025865 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:container_file_t:s0:c718,c778 tclass=file permissive=1
type=AVC msg=audit(1566825655.118:208405): avc:  denied  { write } for  pid=15139 comm="ip" path="/tmp/pluto.log" dev="dm-0" ino=63854839 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:container_file_t:s0:c718,c778 tclass=file permissive=1
type=AVC msg=audit(1566825655.118:208406): avc:  denied  { write } for  pid=15137 comm="ip" path="/tmp/pluto.log" dev="dm-0" ino=63785413 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:container_file_t:s0:c718,c778 tclass=file permissive=1
type=AVC msg=audit(1566825655.870:208468): avc:  denied  { write } for  pid=15877 comm="ip" path="/tmp/pluto.log" dev="dm-0" ino=63854839 scontext=unconfined_u:system_r:ifconfig_t:s0 tcontext=unconfined_u:object_r:container_file_t:s0:c718,c778 tclass=file permissive=1
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]# : ==== end ====
kroot@swantest:/home/build/libreswan/testing/pluto/certoe-08-nat-packet-cop-restart\[root@nic certoe-08-nat-packet-cop-restart]#