>>>>>>>>>>cut>>>>>>>>>> westinit.sh <<<<<<<<<<tuc<<<<<<<<<</testing/guestbin/swan-prep --userland strongswan --x509
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# # confirm that the network is alive
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# ../../pluto/bin/wait-until-alive -I 192.0.1.254 192.0.2.254
destination -I 192.0.1.254 192.0.2.254 is alive
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# # ensure that clear text does not get through
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# iptables -A INPUT -i eth1 -s 192.0.2.0/24 -j LOGDROP
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# iptables -I INPUT -m policy --dir in --pol ipsec -j ACCEPT
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# # confirm clear text does not get through
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# ../../pluto/bin/ping-once.sh --down -I 192.0.1.254 192.0.2.254
==== cut ====
ping -q -n -c 1 -i 2 -w 1 -I 192.0.1.254 192.0.2.254
==== tuc ====
[   29.552788] IN=eth1 OUT= MAC=12:00:00:64:64:45:12:00:00:64:64:23:08:00 SRC=192.0.2.254 DST=192.0.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=54413 PROTO=ICMP TYPE=0 CODE=0 ID=2 SEQ=1 
==== cut ====
PING 192.0.2.254 (192.0.2.254) from 192.0.1.254 : 56(84) bytes of data.

--- 192.0.2.254 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
==== tuc ====
down
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# ../../pluto/bin/strongswan-start.sh
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# echo "initdone"
initdone
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# >>>>>>>>>>cut>>>>>>>>>> westrun.sh <<<<<<<<<<tuc<<<<<<<<<<strongswan up westnet-eastnet-ikev2 | grep -v libcurl
initiating IKE_SA westnet-eastnet-ikev2[1] to 192.1.2.23
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from 192.1.2.45[500] to 192.1.2.23[500] (1096 bytes)
received packet: from 192.1.2.23[500] to 192.1.2.45[500] (38 bytes)
parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]
peer didn't accept DH group ECP_256, it requested MODP_2048
initiating IKE_SA westnet-eastnet-ikev2[1] to 192.1.2.23
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from 192.1.2.45[500] to 192.1.2.23[500] (1288 bytes)
received packet: from 192.1.2.23[500] to 192.1.2.45[500] (471 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(FRAG_SUP) N(HASH_ALG) N(NATD_S_IP) N(NATD_D_IP) CERTREQ ]
selected proposal: IKE:AES_GCM_16_256/PRF_HMAC_SHA2_512/MODP_2048
received cert request for "C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org"
authentication of 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful
establishing CHILD_SA westnet-eastnet-ikev2{1}
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
sending packet: from 192.1.2.45[4500] to 192.1.2.23[4500] (1039 bytes)
received packet: from 192.1.2.23[4500] to 192.1.2.45[4500] (65 bytes)
parsed IKE_AUTH response 1 [ N(AUTH_FAILED) ]
received AUTHENTICATION_FAILED notify error
establishing connection 'westnet-eastnet-ikev2' failed
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# ping -n -c4 -I 192.0.1.254 192.0.2.254
PING 192.0.2.254 (192.0.2.254) from 192.0.1.254 : 56(84) bytes of data.
[   32.080035] IN=eth1 OUT= MAC=12:00:00:64:64:45:12:00:00:64:64:23:08:00 SRC=192.0.2.254 DST=192.0.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=55167 PROTO=ICMP TYPE=0 CODE=0 ID=3 SEQ=1 
[   33.126284] IN=eth1 OUT= MAC=12:00:00:64:64:45:12:00:00:64:64:23:08:00 SRC=192.0.2.254 DST=192.0.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=55202 PROTO=ICMP TYPE=0 CODE=0 ID=3 SEQ=2 
[   34.150210] IN=eth1 OUT= MAC=12:00:00:64:64:45:12:00:00:64:64:23:08:00 SRC=192.0.2.254 DST=192.0.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=56165 PROTO=ICMP TYPE=0 CODE=0 ID=3 SEQ=3 
[   35.174213] IN=eth1 OUT= MAC=12:00:00:64:64:45:12:00:00:64:64:23:08:00 SRC=192.0.2.254 DST=192.0.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=56734 PROTO=ICMP TYPE=0 CODE=0 ID=3 SEQ=4 

--- 192.0.2.254 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3094ms

[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no 1]# # hash algorithm notication should NOT be received
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no 1]# grep SIGNATURE_HASH_ALGO /tmp/charon.log | cut -f 2 -d "]"
 received SIGNATURE_HASH_ALGORITHMS notify
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# echo done
done
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# >>>>>>>>>>cut>>>>>>>>>> final.sh <<<<<<<<<<tuc<<<<<<<<<<if [ -f /var/run/pluto/pluto.pid ]; then ../../pluto/bin/ipsec-look.sh ; fi
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# # expect state #2, state #1 responded with INVALID_KE
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# if [ -f /var/run/pluto/pluto.pid ]; then grep "authenticated using RSA" /tmp/pluto.log ; fi
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# if [ -f /var/run/charon.pid -o -f /var/run/strongswan/charon.pid ]; then strongswan status ; fi
Shunted Connections:
Bypass LAN 192.0.1.0/24:  192.0.1.0/24 === 192.0.1.0/24 PASS
Bypass LAN 192.1.2.0/24:  192.1.2.0/24 === 192.1.2.0/24 PASS
Security Associations (0 up, 0 connecting):
  none
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# : ==== cut ====
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# if [ -f /var/run/pluto/pluto.pid ]; then ipsec auto --status ; fi
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# if [ -f /var/run/charon.pid -o -f /var/run/strongswan/charon.pid ]; then strongswan statusall ; fi
Status of IKE charon daemon (strongSwan 5.8.4, Linux 5.6.8-300.fc32.x86_64, x86_64):
  uptime: 16 seconds, since May 12 15:27:31 2020
  malloc: sbrk 1900544, mmap 0, used 852352, free 1048192
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 0
  loaded plugins: charon pkcs11 tpm aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp curve25519 chapoly xcbc cmac hmac ctr ccm gcm drbg newhope curl attr kernel-netlink resolve socket-default bypass-lan farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp led duplicheck unity counters
Listening IP addresses:
  192.0.1.254
  192.1.2.45
Connections:
westnet-eastnet-ikev2:  192.1.2.45...192.1.2.23  IKEv2
westnet-eastnet-ikev2:   local:  [C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org] uses public key authentication
westnet-eastnet-ikev2:    cert:  "C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org"
westnet-eastnet-ikev2:   remote: [C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org] uses public key authentication
westnet-eastnet-ikev2:    cert:  "C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org"
westnet-eastnet-ikev2:   child:  192.0.1.0/24 === 192.0.2.0/24 TUNNEL
Shunted Connections:
Bypass LAN 192.0.1.0/24:  192.0.1.0/24 === 192.0.1.0/24 PASS
Bypass LAN 192.1.2.0/24:  192.1.2.0/24 === 192.1.2.0/24 PASS
Security Associations (0 up, 0 connecting):
  none
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# : ==== tuc ====
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# ../bin/check-for-core.sh
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi
type=AVC msg=audit(1589311650.583:174): avc:  denied  { node_bind } for  pid=522 comm="ping" saddr=192.0.1.254 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:node_t:s0 tclass=icmp_socket permissive=1
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# : ==== end ====
[root@west interop-ikev2-strongswan-36-initiator-sha1-sha2-rsa_pss-no]# >>>>>>>>>>cut>>>>>>>>>> done <<<<<<<<<<tuc<<<<<<<<<<