>>>>>>>>>>cut>>>>>>>>>> east.sh <<<<<<<<<<tuc<<<<<<<<<</testing/guestbin/swan-prep --x509
Preparing X.509 files
[root@east ikev2-x509-28-del-nssdb-cert]# ipsec start
Redirecting to: systemctl start ipsec.service
[    9.624990] AVX or AES-NI instructions are not detected.
[    9.627347] AVX or AES-NI instructions are not detected.
[    9.797458] IPv4 over IPsec tunneling driver
[    9.805383] IPsec XFRM device driver
[root@east ikev2-x509-28-del-nssdb-cert]# ../../guestbin/wait-until-pluto-started
==== cut ====
000   PID  Process
addconn exited
==== tuc ====
[root@east ikev2-x509-28-del-nssdb-cert]# # list certs in NSS DB
[root@east ikev2-x509-28-del-nssdb-cert]# ipsec whack --listcerts | grep east
000 End certificate "east" - SN: 0x03
000   subject: C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org
[root@east ikev2-x509-28-del-nssdb-cert]# # add / remove 'test'
[root@east ikev2-x509-28-del-nssdb-cert]# ipsec auto --add test
002 "test": added IKEv2 connection
[root@east ikev2-x509-28-del-nssdb-cert]# ipsec auto --delete test
[root@east ikev2-x509-28-del-nssdb-cert]# # delete certificate east
[root@east ikev2-x509-28-del-nssdb-cert]# certutil -d sql:/etc/ipsec.d -D -n east
[root@east ikev2-x509-28-del-nssdb-cert]# # whack should not show certificate
[root@east ikev2-x509-28-del-nssdb-cert]# ipsec whack --listcerts | grep east
[root@east ikev2-x509-28-del-nssdb-cert 1]# # try a load; should fail
[root@east ikev2-x509-28-del-nssdb-cert 1]# ipsec auto --add test
036 "test": failed to add connection: right certificate 'east' not found in the NSS database
[root@east ikev2-x509-28-del-nssdb-cert 36]# ipsec auto --delete test
[root@east ikev2-x509-28-del-nssdb-cert]# # put east back
[root@east ikev2-x509-28-del-nssdb-cert]# certutil -A -i ../../x509/certs/east.crt -d sql:/etc/ipsec.d -n east -t "P,,"
[root@east ikev2-x509-28-del-nssdb-cert]# # re-load should not dump core
[root@east ikev2-x509-28-del-nssdb-cert]# ipsec auto --add test
002 "test": added IKEv2 connection
[root@east ikev2-x509-28-del-nssdb-cert]# ipsec auto --delete test
[root@east ikev2-x509-28-del-nssdb-cert]# >>>>>>>>>>cut>>>>>>>>>> final.sh <<<<<<<<<<tuc<<<<<<<<<<../../guestbin/ipsec-look.sh
==== cut ====
start raw xfrm state:
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket out priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket in priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket out priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket in priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket out priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket in priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket out priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket in priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket out priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket in priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket out priority 0 ptype main \
src 0.0.0.0/0 dst 0.0.0.0/0 \	socket in priority 0 ptype main \
end raw xfrm state:
==== tuc ====
east Fri Jun 18 08:21:21 EDT 2021
XFRM state:
XFRM policy:
XFRM done
IPSEC mangle TABLES
NEW_IPSEC_CONN mangle TABLES
ROUTING TABLES
default via 192.1.2.254 dev eth1 proto static
192.0.1.0/24 via 192.1.2.45 dev eth1 proto static onlink
192.0.2.0/24 dev eth0 proto kernel scope link src 192.0.2.254
192.1.2.0/24 dev eth1 proto kernel scope link src 192.1.2.23
NSS_CERTIFICATES

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Libreswan test CA for mainca - Libreswan                     CT,, 
east                                                         Pu,u,u
hashsha1                                                     P,,  
nic                                                          P,,  
north                                                        P,,  
road                                                         P,,  
west                                                         P,,  
west-ec                                                      P,,  
[root@east ikev2-x509-28-del-nssdb-cert]# >>>>>>>>>> post-mortem >>>>>>>>>>../../guestbin/post-mortem.sh
+ ok=true
+ echo

+ echo shut down pluto
shut down pluto
+ echo

+ sed -n -e '1 p' -e '/sed/        {n;}' -e '/pluto/      {p;n;}' -e '/strongswan/ {p;n;}' -e '/iked/       {p;n;}'
+ ps ajx
   PPID     PID    PGID     SID TTY        TPGID STAT   UID   TIME COMMAND
      1     723     723     723 ?             -1 Ssl      0   0:00 /usr/local/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork
+ test -r /tmp/pluto.log
+ ipsec stop
Redirecting to: systemctl stop ipsec.service
+ echo

+ echo check for core files
check for core files
+ echo

++ dirname ../../guestbin/post-mortem.sh
+ ../../guestbin/check-for-core.sh
+ echo no core files found
no core files found
+ echo

+ echo check for leaks
check for leaks
+ echo

+ test -r /tmp/pluto.log
+ grep 'leak detective found [0-9]* leaks' /tmp/pluto.log
+ echo

+ echo check reference counts
check reference counts
+ echo

+ test -r /tmp/pluto.log
+ awk -f /testing/utils/refcnt.awk /tmp/pluto.log
+ echo

+ echo checking for selinux audit records
checking for selinux audit records
+ echo

+ test -f /sbin/ausearch
++ hostname
+ log=OUTPUT/east.ausearch.log
+ tee OUTPUT/east.ausearch.log
+ ausearch -r -m avc -ts boot
+ test -s OUTPUT/east.ausearch.log
+ true
[root@east ikev2-x509-28-del-nssdb-cert]# <<<<<<<<<< post-mortem <<<<<<<<<<>>>>>>>>>>cut>>>>>>>>>> done <<<<<<<<<<tuc<<<<<<<<<<