>>>>>>>>>>cut>>>>>>>>>> 02-road-init.sh <<<<<<<<<<tuc<<<<<<<<<</testing/guestbin/swan-prep
[root@road newoe-18-poc-cop-port-7]# cp road-ikev2-oe.conf /etc/ipsec.d/ikev2-oe.conf
[root@road newoe-18-poc-cop-port-7]# cp policies/* /etc/ipsec.d/policies/
[root@road newoe-18-poc-cop-port-7]# echo "192.1.2.0/24 tcp 0 7"  >> /etc/ipsec.d/policies/private-or-clear
[root@road newoe-18-poc-cop-port-7]# ipsec start
Redirecting to: systemctl start ipsec.service
[   14.198358] AVX or AES-NI instructions are not detected.
[   14.204440] AVX or AES-NI instructions are not detected.
[   14.451950] IPv4 over IPsec tunneling driver
[   14.478484] IPsec XFRM device driver
[root@road newoe-18-poc-cop-port-7]# ../../guestbin/wait-until-pluto-started
==== cut ====
000   PID  Process
000   773  addconn
000   773  addconn
try again
000   PID  Process
addconn exited
==== tuc ====
[root@road newoe-18-poc-cop-port-7]# # ensure for tests acquires expire before our failureshunt=2m
[root@road newoe-18-poc-cop-port-7]# echo 30 > /proc/sys/net/core/xfrm_acq_expires
[root@road newoe-18-poc-cop-port-7]# # give OE policies time to load
[root@road newoe-18-poc-cop-port-7]# ../../guestbin/wait-for.sh --match 'loaded 10,' -- ipsec auto --status
000 Total IPsec connections: loaded 10, active 0
[root@road newoe-18-poc-cop-port-7]# echo "initdone"
initdone
[root@road newoe-18-poc-cop-port-7]# >>>>>>>>>>cut>>>>>>>>>> 03-road-run.sh <<<<<<<<<<tuc<<<<<<<<<<# use a static source port just to prevent false positive on larval state port
[root@road newoe-18-poc-cop-port-7]# echo TRIGGER-OE | socat - TCP:192.1.2.23:7,bind=192.1.3.209,sourceport=42599
[   17.435991] alg: No test for seqiv(rfc4106(gcm(aes))) (seqiv(rfc4106(gcm_base(ctr(aes-generic),ghash-generic))))
TRIGGER-OE
[root@road newoe-18-poc-cop-port-7]# # should show tunnel and no shunts, and non-zero traffic count
[root@road newoe-18-poc-cop-port-7]# # workaround for diff err msg between fedora versions resulting in diff byte count
[root@road newoe-18-poc-cop-port-7]# ipsec whack --trafficstatus | grep -v "inBytes=0" | sed "s/type=ESP.*$/[...]/"
006 #2: "private-or-clear#192.1.2.0/24-(0--6--7)"[1] ...192.1.2.23, [...]
[root@road newoe-18-poc-cop-port-7]# ipsec whack --shuntstatus
000 Bare Shunt list:
000  
[root@road newoe-18-poc-cop-port-7]# echo done
done
[root@road newoe-18-poc-cop-port-7]# >>>>>>>>>>cut>>>>>>>>>> final.sh <<<<<<<<<<tuc<<<<<<<<<<../../guestbin/ipsec-look.sh
==== cut ====
DUMP IN: OUTPUT/road.ipsec-look.918.log
==== tuc ====
road Sat May 14 12:44:23 EDT 2022
XFRM state:
src 192.1.2.23 dst 192.1.3.209
	proto esp spi 0x2a1a7fd7 reqid 16429 mode tunnel
	replay-window 0 flag af-unspec esn
	aead rfc4106(gcm(aes)) 0x834f97b6544ecf64b9a6c65b3b095950348a61d83765fcfc2f7d2772e2c340a005911d5f 128
	anti-replay esn context:
	 seq-hi 0x0, seq 0x4, oseq-hi 0x0, oseq 0x0
	 replay_window 128, bitmap-length 4
	 00000000 00000000 00000000 0000000f 
src 192.1.3.209 dst 192.1.2.23
	proto esp spi 0x203bacf8 reqid 16429 mode tunnel
	replay-window 0 flag af-unspec esn
	aead rfc4106(gcm(aes)) 0xc236f603dfda3b0f10df9b08cadaf690d5f57da2e8f0668d8cc3d3e3ca7da1d8ad66dcde 128
	anti-replay esn context:
	 seq-hi 0x0, seq 0x0, oseq-hi 0x0, oseq 0x6
	 replay_window 128, bitmap-length 4
	 00000000 00000000 00000000 00000000 
src 192.1.3.209 dst 192.1.2.23
	proto esp spi 0x00000000 reqid 0 mode transport
	replay-window 0 
	anti-replay context: seq 0x0, oseq 0x0, bitmap 0x00000000
	sel src 192.1.3.209/32 dst 192.1.2.23/32 proto tcp sport 42599 dport 7 dev eth0 
XFRM policy:
src 192.1.2.253/32 dst 192.1.3.209/32
	dir fwd priority 2801856 ptype main
src 192.1.2.253/32 dst 192.1.3.209/32
	dir in priority 2801856 ptype main
src 192.1.2.254/32 dst 192.1.3.209/32
	dir fwd priority 2801856 ptype main
src 192.1.2.254/32 dst 192.1.3.209/32
	dir in priority 2801856 ptype main
src 192.1.3.209/32 dst 192.1.2.253/32
	dir out priority 2801856 ptype main
src 192.1.3.209/32 dst 192.1.2.254/32
	dir out priority 2801856 ptype main
src 192.1.3.209/32 dst 192.1.3.253/32
	dir out priority 2801856 ptype main
src 192.1.3.209/32 dst 192.1.3.254/32
	dir out priority 2801856 ptype main
src 192.1.3.253/32 dst 192.1.3.209/32
	dir fwd priority 2801856 ptype main
src 192.1.3.253/32 dst 192.1.3.209/32
	dir in priority 2801856 ptype main
src 192.1.3.254/32 dst 192.1.3.209/32
	dir fwd priority 2801856 ptype main
src 192.1.3.254/32 dst 192.1.3.209/32
	dir in priority 2801856 ptype main
src 192.1.2.23/32 dst 192.1.3.209/32 proto tcp sport 7
	dir fwd priority 3457216 ptype main
	tmpl src 192.1.2.23 dst 192.1.3.209
		proto esp reqid 16429 mode tunnel
src 192.1.2.23/32 dst 192.1.3.209/32 proto tcp sport 7
	dir in priority 3457216 ptype main
	tmpl src 192.1.2.23 dst 192.1.3.209
		proto esp reqid 16429 mode tunnel
src 192.1.3.209/32 dst 192.1.2.23/32 proto tcp dport 7
	dir out priority 3457216 ptype main
	tmpl src 192.1.3.209 dst 192.1.2.23
		proto esp reqid 16429 mode tunnel
src 192.1.3.209/32 dst 192.1.2.0/24 proto tcp dport 7
	dir out priority 3457233 ptype main
	tmpl src 0.0.0.0 dst 0.0.0.0
		proto esp reqid 0 mode transport
XFRM done
IPSEC mangle TABLES
NEW_IPSEC_CONN mangle TABLES
ROUTING TABLES
default via 192.1.3.254 dev eth0 proto static
192.1.3.0/24 dev eth0 proto kernel scope link src 192.1.3.209
NSS_CERTIFICATES

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

[root@road newoe-18-poc-cop-port-7]# # a tunnel should have established
[root@road newoe-18-poc-cop-port-7]# grep "^[^|].* established Child SA" /tmp/pluto.log
"private-or-clear#192.1.2.0/24-(0--6--7)"[1] ...192.1.2.23 #2: initiator established Child SA using #1; IPsec tunnel [192.1.3.209-192.1.3.209:0-65535 6] -> [192.1.2.23-192.1.2.23:7-7 6] {ESP/ESN=>0x203bacf8 <0x2a1a7fd7 xfrm=AES_GCM_16_256-NONE DPD=passive}
[root@road newoe-18-poc-cop-port-7]# >>>>>>>>>> post-mortem >>>>>>>>>>../../guestbin/post-mortem.sh
   PPID     PID    PGID     SID TTY        TPGID STAT   UID   TIME COMMAND
      1     770     770     770 ?             -1 Ssl      0   0:00 /usr/local/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork
:
: checking shutting down pluto
:
ipsec whack --shutdown
pidof pluto
PASS: shutting down pluto
:
: checking core files
:
PASS: core files
:
: checking memory leaks
:
PASS: memory leaks
:
: checking reference leaks
:
PASS: reference leaks
:
: checking xfrm errors
:
ERROR: road: XfrmOutNoStates         	3
IGNORE: xfrm errors
:
: checking state/policy entries
:
PASS: state/policy entries
:
: checking selinux audit records
:
PASS: selinux audit records
:
: unload any selinux modules
:
[root@road newoe-18-poc-cop-port-7]# <<<<<<<<<< post-mortem <<<<<<<<<<>>>>>>>>>>cut>>>>>>>>>> done <<<<<<<<<<tuc<<<<<<<<<<