/testing/guestbin/swan-prep --46 --x509 --x509name key4096 Preparing X.509 files west # ipsec start Redirecting to: [initsystem] west # /testing/pluto/bin/wait-until-pluto-started west # ipsec auto --add v6-tunnel 002 added connection description "v6-tunnel" west # ipsec whack --impair suppress-retransmits west # echo "initdone" initdone west # ipsec auto --up v6-tunnel 002 "v6-tunnel" #1: initiating v2 parent SA 1v2 "v6-tunnel" #1: initiate 1v2 "v6-tunnel" #1: STATE_PARENT_I1: sent v2I1, expected v2R1 1v2 "v6-tunnel" #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_256 group=MODP2048} 002 "v6-tunnel" #2: certificate verified OK: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA 002 "v6-tunnel" #2: IKEv2 mode peer ID is ID_DER_ASN1_DN: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' 003 "v6-tunnel" #2: Authenticated using RSA 002 "v6-tunnel" #2: negotiated connection [2001:111:1111::-2001:111:1111:ffff:ffff:ffff:ffff:ffff:0-65535 0] -> [2001:2222:222:2200::-2001:2222:222:22ff:ffff:ffff:ffff:ffff:0-65535 0] 004 "v6-tunnel" #2: STATE_V2_IPSEC_I: IPsec SA established tunnel mode {ESP=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE NATOA=none NATD=none DPD=passive} west # grep "fragment number" /tmp/pluto.log | fragment number: 1 (0x1) | fragment number: 2 (0x2) | fragment number: 3 (0x3) | fragment number: 1 (0x1) | received IKE encrypted fragment number '1', total number '2', next payload '36' | fragment number: 2 (0x2) | received IKE encrypted fragment number '2', total number '2', next payload '0' west # echo done done west # ../../pluto/bin/ipsec-look.sh west NOW XFRM state: src 2001:db8:1:2::23 dst 2001:db8:1:2::45 proto esp spi 0xSPISPI reqid REQID mode tunnel replay-window 32 flag af-unspec aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128 src 2001:db8:1:2::45 dst 2001:db8:1:2::23 proto esp spi 0xSPISPI reqid REQID mode tunnel replay-window 32 flag af-unspec aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128 XFRM policy: src 2001:111:1111::/48 dst 2001:2222:222:2200::/56 dir out priority 1036231 ptype main tmpl src 2001:db8:1:2::45 dst 2001:db8:1:2::23 proto esp reqid REQID mode tunnel src 2001:2222:222:2200::/56 dst 2001:111:1111::/48 dir fwd priority 1036231 ptype main tmpl src 2001:db8:1:2::23 dst 2001:db8:1:2::45 proto esp reqid REQID mode tunnel src 2001:2222:222:2200::/56 dst 2001:111:1111::/48 dir in priority 1036231 ptype main tmpl src 2001:db8:1:2::23 dst 2001:db8:1:2::45 proto esp reqid REQID mode tunnel src ::/0 dst ::/0 proto ipv6-icmp type 135 dir fwd priority 1 ptype main src ::/0 dst ::/0 proto ipv6-icmp type 135 dir in priority 1 ptype main src ::/0 dst ::/0 proto ipv6-icmp type 135 dir out priority 1 ptype main src ::/0 dst ::/0 proto ipv6-icmp type 136 dir fwd priority 1 ptype main src ::/0 dst ::/0 proto ipv6-icmp type 136 dir in priority 1 ptype main src ::/0 dst ::/0 proto ipv6-icmp type 136 dir out priority 1 ptype main XFRM done IPSEC mangle TABLES NEW_IPSEC_CONN mangle TABLES ROUTING TABLES default via 192.1.2.254 dev eth1 192.0.1.0/24 dev eth0 proto kernel scope link src 192.0.1.254 192.0.2.0/24 via 192.1.2.23 dev eth1 192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.45 2001:db8:0:1::/64 dev eth0 proto kernel metric 256 2001:db8::/48 via 2001:db8:1:2::23 dev eth1 metric 1024 2001:db8:1:2::/64 dev eth1 proto kernel metric 256 2001:db8:9:4::/64 dev eth2 proto kernel metric 256 fe80::/64 dev eth0 proto kernel metric 256 fe80::/64 dev eth1 proto kernel metric 256 fe80::/64 dev eth2 proto kernel metric 256 default via 2001:db8:1:2::254 dev eth1 metric 1 default via 2001:db8:1:2::254 dev eth1 metric 1024 NSS_CERTIFICATES Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI Libreswan test CA for mainca - Libreswan CT,, east P,, east-ec P,, hashsha1 P,, key4096 u,u,u nic P,, north P,, road P,, west # west # ../bin/check-for-core.sh west # if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi