Merge branch 'swanctl-testing'

src/libimcv/imv/data.sql

@@ -484,30 +484,66 @@ INSERT INTO products (			/* 81 */
  'Android 6.0.1'
 );
 
-INSERT INTO products (          /* 82 */
+INSERT INTO products (      /* 82 */
   name
 ) VALUES (
  'Debian 8.5 i686'
 );
 
-INSERT INTO products (          /* 83 */
+INSERT INTO products (      /* 83 */
   name
 ) VALUES (
  'Debian 8.5 x86_64'
 );
 
-INSERT INTO products (          /* 84 */
+INSERT INTO products (      /* 84 */
   name
 ) VALUES (
  'Debian 8.6 i686'
 );
 
-INSERT INTO products (          /* 85 */
+INSERT INTO products (      /* 85 */
   name
 ) VALUES (
  'Debian 8.6 x86_64'
 );
 
+INSERT INTO products (      /* 86 */
+  name
+) VALUES (
+ 'Debian 8.7 i686'
+);
+
+INSERT INTO products (      /* 87 */
+  name
+) VALUES (
+ 'Debian 8.7 x86_64'
+);
+
+INSERT INTO products (      /* 88 */
+  name
+) VALUES (
+ 'Debian 8.8 i686'
+);
+
+INSERT INTO products (      /* 89 */
+  name
+) VALUES (
+ 'Debian 8.8 x86_64'
+);
+
+INSERT INTO products (      /* 90 */
+  name
+) VALUES (
+ 'Debian 8.9 i686'
+);
+
+INSERT INTO products (      /* 91 */
+  name
+) VALUES (
+ 'Debian 8.9 x86_64'
+);
+
 /* Directories */
 
 INSERT INTO directories (		/*  1 */
@@ -1036,6 +1072,36 @@ INSERT INTO groups_product_defaults (
   4, 76
 );
 
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  4, 82
+);
+
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  4, 84
+);
+
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  4, 86
+);
+
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  4, 88
+);
+
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  4, 90
+);
+
 INSERT INTO groups_product_defaults (
   group_id, product_id
 ) VALUES (
@@ -1126,6 +1192,24 @@ INSERT INTO groups_product_defaults (
   5, 85
 );
 
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  5, 87
+);
+
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  5, 89
+);
+
+INSERT INTO groups_product_defaults (
+  group_id, product_id
+) VALUES (
+  5, 91
+);
+
 INSERT INTO groups_product_defaults (
   group_id, product_id
 ) VALUES (

testing/do-tests

@@ -825,7 +825,7 @@ do
 	for host in $IPSECHOSTS
 	do
 	    eval HOSTLOGIN=root@\$ipv4_${host}
-	    ssh $SSHCONF $HOSTLOGIN "grep -s -E 'charon|last message repeated|imcv' \
+	    ssh $SSHCONF $HOSTLOGIN "grep -s -E 'systemd|swanctl|charon|last message repeated|imcv' \
 		/var/log/daemon.log" >> $TESTRESULTDIR/${host}.daemon.log
 	done
 

testing/scripts/build-baseimage

@@ -18,7 +18,7 @@ INC=$INC,libxml2-dev,libtspi-dev,libsqlite3-dev,openssh-server,tcpdump,psmisc
 INC=$INC,openssl,vim,sqlite3,conntrack,gdb,cmake,libltdl-dev,liblog4cxx10-dev
 INC=$INC,libboost-thread-dev,libboost-system-dev,git-core,iperf,htop,screen
 INC=$INC,gnat,gprbuild,acpid,acpi-support-base,libldns-dev,libunbound-dev
-INC=$INC,dnsutils,libsoup2.4-dev,ca-certificates,unzip
+INC=$INC,dnsutils,libsoup2.4-dev,ca-certificates,unzip,libsystemd-dev
 INC=$INC,python,python-setuptools,python-dev,python-pip,apt-transport-https
 INC=$INC,libjson0-dev,libxslt1-dev,libapache2-mod-wsgi,iptables-dev
 case "$BASEIMGSUITE" in

testing/scripts/recipes/013_strongswan.mk

@@ -103,7 +103,8 @@ CONFIG_OPTS = \
 	--enable-lookip \
 	--enable-bliss \
 	--enable-sha3 \
-	--enable-newhope
+	--enable-newhope \
+	--enable-systemd
 
 export ADA_PROJECT_PATH=/usr/local/ada/lib/gnat
 

testing/tests/af-alg/alg-camellia/description.txt

@@ -1,3 +1,3 @@
-Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the IKE cipher suite <b>CAMELLIA_CBC_256 /
+Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the IKE cipher suite <b>camellia256-sha512-modp3072</b>
-HMAC_SHA2_512_256 / PRF_HMAC_SHA2_512 / MODP_3072</b> well as the ESP cipher suite <b>CAMELLIA_CBC_192 / HMAC_SHA384_192</b>.
+well as the ESP cipher suite <b>camellia192-sha384</b>.  A ping from <b>carol</b> to <b>alice</b> successfully
-A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
+checks the established tunnel.

testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf

@@ -1,10 +1,18 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
+
+charon-systemd {
   load = random nonce pem pkcs1 af-alg gmp x509 revocation kernel-netlink curl socket-default updown vici
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds 
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
 }

testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf

@@ -1,10 +1,18 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
+
+charon-systemd {
   load = random nonce pem pkcs1 af-alg gmp x509 revocation kernel-netlink curl socket-default updown vici
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds 
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
 }

testing/tests/af-alg/alg-camellia/posttest.dat

@@ -1,5 +1,5 @@
 carol::swanctl --terminate --ike home
-carol::service charon stop 2> /dev/null
+carol::systemctl stop strongswan-swanctl
-moon::service charon stop 2> /dev/null
+moon::systemctl stop strongswan-swanctl
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush

testing/tests/af-alg/alg-camellia/pretest.dat

@@ -1,7 +1,7 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
-moon::service charon start 2> /dev/null
+moon::systemctl start strongswan-swanctl
-carol::service charon start 2> /dev/null
+carol::systemctl start strongswan-swanctl
 moon::expect-connection net 
 carol::expect-connection home
 carol::swanctl --initiate --child home 2> /dev/null

testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,13 +1,20 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
+
+charon-systemd {
   load = random nonce test-vectors pem pkcs1 af-alg gmp x509 revocation curl ctr ccm gcm kernel-netlink socket-default updown vici
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds 
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
-
   integrity_test = yes
   crypto_test {
     on_add = yes

testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,13 +1,20 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
+
+charon-systemd {
   load = random nonce test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp x509 revocation curl hmac xcbc ctr ccm gcm kernel-netlink socket-default updown vici
 
-  start-scripts {
+   syslog {
-    creds = /usr/local/sbin/swanctl --load-creds 
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
-
   integrity_test = yes
   crypto_test {
     on_add = yes

testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,13 +1,20 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
+
+charon-systemd {
   load = random nonce test-vectors pem pkcs1 af-alg gmp x509 revocation curl ctr ccm gcm kernel-netlink socket-default updown vici
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds 
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
-
   integrity_test = yes
   crypto_test {
     on_add = yes

testing/tests/af-alg/rw-cert/posttest.dat

@@ -1,8 +1,8 @@
 carol::swanctl --terminate --ike home
 dave::swanctl --terminate --ike home
-carol::service charon stop 2> /dev/null
+carol::systemctl stop strongswan-swanctl
-dave::service charon stop 2> /dev/null
+dave::systemctl stop strongswan-swanctl
-moon::service charon stop 2> /dev/null
+moon::systemctl stop strongswan-swanctl
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
 dave::iptables-restore < /etc/iptables.flush

testing/tests/af-alg/rw-cert/pretest.dat

@@ -1,9 +1,9 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
 dave::iptables-restore < /etc/iptables.rules
-moon::service charon start 2> /dev/null
+moon::systemctl start strongswan-swanctl
-carol::service charon start 2> /dev/null
+carol::systemctl start strongswan-swanctl
-dave::service charon start 2> /dev/null
+dave::systemctl start strongswan-swanctl
 moon::expect-connection net 
 carol::expect-connection home 
 carol::swanctl --initiate --child home 2> /dev/null

testing/tests/gcrypt-ikev1/alg-serpent/description.txt

@@ -1,4 +1,4 @@
 Roadwarrior <b>carol</b> proposes  to gateway <b>moon</b> the strong cipher suite
-<b>SERPENT_CBC_256 / HMAC_SHA2_512 / MODP_4096</b> for the IKE protocol and 
+<b>serpent256-sha512-modp4096</b> for the IKE protocol and <b>serpent256-sha512</b>
-<b>SERPENT_CBC_256 / HMAC_SHA2_512_256 </b> for ESP packets. A ping from <b>carol</b> to
+for ESP packets. A ping from <b>carol</b> to <b>alice</b> successfully checks the
-<b>alice</b> successfully checks the established tunnel.
+established tunnel.

testing/tests/gcrypt-ikev1/alg-serpent/hosts/carol/etc/strongswan.conf

@@ -1,11 +1,19 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
   load = nonce pem pkcs1 gcrypt hmac x509 revocation curl vici kernel-netlink socket-default
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds 
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
   send_vendor_id = yes
 }

testing/tests/gcrypt-ikev1/alg-serpent/hosts/moon/etc/strongswan.conf

@@ -1,11 +1,19 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
   load = nonce pem pkcs1 gcrypt hmac x509 revocation vici kernel-netlink socket-default
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
   send_vendor_id = yes
 }

testing/tests/gcrypt-ikev1/alg-serpent/posttest.dat

@@ -1,2 +1,2 @@
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
-carol::service charon stop
+moon::systemctl stop strongswan-swanctl

testing/tests/gcrypt-ikev1/alg-serpent/pretest.dat

@@ -1,5 +1,5 @@
-moon::service charon start 2> /dev/null
+moon::systemctl start strongswan-swanctl
-carol::service charon start 2> /dev/null
+carol::systemctl start strongswan-swanctl
 moon::expect-connection rw
 carol::expect-connection home
 carol::swanctl --initiate --child home 2> /dev/null

testing/tests/gcrypt-ikev1/alg-twofish/description.txt

@@ -1,4 +1,4 @@
 Roadwarrior <b>carol</b> proposes  to gateway <b>moon</b> the strong cipher suite
-<b>TWOFISH_CBC_256 / HMAC_SHA2_512 / MODP_4096</b> for the IKE protocol and 
+<b>twofish256-sha512-modp4096</b> for the IKE protocol and <b>twofish256-sha512</b>
-<b>TWOFISH_CBC_256 / HMAC_SHA2_512_256 </b> for ESP packets. A ping from <b>carol</b> to
+for ESP packets. A ping from <b>carol</b> to <b>alice</b> successfully checks the
-<b>alice</b> successfully checks the established tunnel.
+established tunnel.

testing/tests/gcrypt-ikev1/alg-twofish/hosts/carol/etc/strongswan.conf

@@ -1,11 +1,19 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
   load = nonce pem pkcs1 gcrypt hmac x509 revocation curl vici kernel-netlink socket-default
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds 
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
   send_vendor_id = yes
 }

testing/tests/gcrypt-ikev1/alg-twofish/hosts/moon/etc/strongswan.conf

@@ -1,11 +1,19 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random
+}
+
+charon-systemd {
   load = nonce pem pkcs1 gcrypt hmac x509 revocation vici kernel-netlink socket-default
 
-  start-scripts {
+  syslog {
-    creds = /usr/local/sbin/swanctl --load-creds
+    daemon {
-    conns = /usr/local/sbin/swanctl --load-conns
+      default = 1
+    }
+    auth {
+      default = 0
+    }
   }
   send_vendor_id = yes
 }

testing/tests/gcrypt-ikev1/alg-twofish/posttest.dat

@@ -1,2 +1,2 @@
-moon::service charon stop
+carol::systemctl stop strongswan-swanctl
-carol::service charon stop
+moon::systemctl stop strongswan-swanctl

testing/tests/gcrypt-ikev1/alg-twofish/pretest.dat

@@ -1,5 +1,5 @@
-moon::service charon start 2> /dev/null
+moon::systemctl start strongswan-swanctl
-carol::service charon start 2> /dev/null
+carol::systemctl start strongswan-swanctl
 moon::expect-connection rw
 carol::expect-connection home
 carol::swanctl --initiate --child home 2> /dev/null

testing/tests/gcrypt-ikev2/alg-camellia/description.txt

@@ -1,4 +1,3 @@
-Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the IKE cipher suite <b>CAMELLIA_CBC_256 /
+Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the IKE cipher suite
-HMAC_SHA2_512_256 / MODP_2048</b> by defining <b>ike=camellia256-sha256-modp2048</b> as well as
+<b>camellia256-sha512-modp3072</b> as well as the ESP cipher suite <b>camellia192-sha384</b>.
-the ESP cipher suite <b>CAMELLIA_CBC_192 / HMAC_SHA1_96</b> by defining <b>esp=camellia192-sha1</b>
+A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.
-in ipsec.conf. A ping from <b>carol</b> to <b>alice</b> successfully checks the established tunnel.

testing/tests/gcrypt-ikev2/alg-camellia/evaltest.dat

@@ -1,12 +1,6 @@
-moon:: ipsec status 2> /dev/null::rw.*ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
-carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
-moon:: ipsec status 2> /dev/null::rw.*INSTALLED, TUNNEL::YES
-carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
-carol::ipsec statusall 2> /dev/null::IKE proposal: CAMELLIA_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_3072::YES
 carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
-moon:: ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
+carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
-carol::ipsec statusall 2> /dev/null::CAMELLIA_CBC_192/HMAC_SHA2_384_192::YES
+moon:: swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
 moon:: ip xfrm state::enc cbc(camellia)::YES
 carol::ip xfrm state::enc cbc(camellia)::YES
 moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES

testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/ipsec.conf

@@ -1,22 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	keyexchange=ikev2
-	ike=camellia256-sha512-modp3072!
-	esp=camellia192-sha384!
-
-conn home
-	left=PH_IP_CAROL
-	leftfirewall=yes
-	leftcert=carolCert.pem
-	[email protected]
-	right=PH_IP_MOON
-	rightsubnet=10.1.0.0/16
-	[email protected]
-	auto=add 

testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/strongswan.conf

@@ -1,5 +1,18 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
-  load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
+
+charon-systemd {
+  load = random nonce pem pkcs1 gcrypt hmac x509 revocation kernel-netlink curl socket-default updown vici
+
+  syslog {
+    daemon {
+      default = 1
+    }
+    auth {
+      default = 0
+    }
+  }
 }

testing/tests/gcrypt-ikev2/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf

@@ -0,0 +1,27 @@
+connections {
+
+   home {
+      local_addrs  = 192.168.0.100
+      remote_addrs = 192.168.0.1 
+
+      local {
+         auth = pubkey
+         certs = carolCert.pem
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org 
+      }
+      children {
+         home {
+            remote_ts = 10.1.0.0/16 
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = camellia192-sha384
+         }
+      }
+      version = 2
+      proposals = camellia256-sha512-modp3072
+   }
+}

testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/ipsec.conf

@@ -1,21 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	keyexchange=ikev2
-	ike=camellia256-sha512-modp3072!
-	esp=camellia192-sha384!
-
-conn rw
-	left=PH_IP_MOON
-	leftfirewall=yes
-	leftcert=moonCert.pem
-	[email protected]
-	leftsubnet=10.1.0.0/16
-	right=%any
-	auto=add

testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/strongswan.conf

@@ -1,5 +1,18 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
-  load = curl pem pkcs1 gcrypt nonce x509 revocation hmac xcbc stroke kernel-netlink socket-default updown
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
+
+charon-systemd {
+  load = random nonce pem pkcs1 gcrypt hmac x509 revocation kernel-netlink curl socket-default updown vici
+
+  syslog {
+    daemon {
+      default = 1
+    }
+    auth {
+      default = 0
+    }
+  }
 }

testing/tests/gcrypt-ikev2/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf

@@ -0,0 +1,25 @@
+connections {
+
+   rw {
+      local_addrs  = 192.168.0.1
+
+      local {
+         auth = pubkey
+         certs = moonCert.pem
+         id = moon.strongswan.org
+      }
+      remote {
+         auth = pubkey
+      }
+      children {
+         net {
+            local_ts  = 10.1.0.0/16 
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = camellia192-sha384
+         }
+      }
+      version = 2
+      proposals = camellia256-sha512-modp3072
+   }
+}

testing/tests/gcrypt-ikev2/alg-camellia/posttest.dat

@@ -1,4 +1,5 @@
-moon::ipsec stop
+carol::swanctl --terminate --ike home
-carol::ipsec stop
+carol::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush

testing/tests/gcrypt-ikev2/alg-camellia/pretest.dat

@@ -1,7 +1,7 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
-moon::ipsec start
+moon::systemctl start strongswan-swanctl
-carol::ipsec start
+carol::systemctl start strongswan-swanctl
-moon::expect-connection rw
+moon::expect-connection net 
 carol::expect-connection home
-carol::ipsec up home
+carol::swanctl --initiate --child home 2> /dev/null

testing/tests/gcrypt-ikev2/alg-camellia/test.conf

@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
 # Used for IPsec logging purposes
 #
 IPSECHOSTS="moon carol"
+
+# charon controlled by swanctl
+#
+SWANCTL=1

testing/tests/gcrypt-ikev2/rw-cert/description.txt

@@ -5,8 +5,8 @@ plugins <b>aes des sha1 sha2 md5 gmp</b>.
 <p>
 The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each 
 to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
-Upon the successful establishment of the IPsec tunnels, <b>leftfirewall=yes</b>
+Upon the successful establishment of the IPsec tunnels, the <b>updown</b> directive
-automatically inserts iptables-based firewall rules that let pass the tunneled traffic.
+in swanctl.conf automatically inserts iptables-based firewall rules that let pass the
-In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
+tunneled traffic. In order to test both tunnel and firewall, both <b>carol</b> and
-the client <b>alice</b> behind the gateway <b>moon</b>.
+<b>dave</b> ping the client <b>alice</b> behind the gateway <b>moon</b>.
 

testing/tests/gcrypt-ikev2/rw-cert/evaltest.dat

@@ -1,13 +1,9 @@
-carol::ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
-dave:: ipsec status 2> /dev/null::home.*ESTABLISHED.*[email protected].*moon.strongswan.org::YES
-moon:: ipsec status 2> /dev/null::rw\[1]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
-moon:: ipsec status 2> /dev/null::rw\[2]: ESTABLISHED.*moon.strongswan.org.*[email protected]::YES
-carol::ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-dave:: ipsec status 2> /dev/null::home.*INSTALLED, TUNNEL::YES
-moon:: ipsec status 2> /dev/null::rw[{]1}.*INSTALLED, TUNNEL::YES
-moon:: ipsec status 2> /dev/null::rw[{]2}.*INSTALLED, TUNNEL::YES
 carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
 dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
+carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
+dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
+moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
+moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
 moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
 moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
 moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES

testing/tests/gcrypt-ikev2/rw-cert/hosts/carol/etc/ipsec.conf

@@ -1,22 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	keyexchange=ikev2
-	ike=3des-sha1-modp1536!
-	esp=3des-sha1!
-
-conn home
-	left=PH_IP_CAROL
-	leftcert=carolCert.pem
-	[email protected]
-	leftfirewall=yes
-	right=PH_IP_MOON
-	[email protected]
-	rightsubnet=10.1.0.0/16
-	auto=add

testing/tests/gcrypt-ikev2/rw-cert/hosts/carol/etc/strongswan.conf

@@ -1,8 +1,20 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
-  load = curl test-vectors pem pkcs1 gcrypt nonce x509 revocation hmac xcbc ctr ccm gcm stroke kernel-netlink socket-default updown
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
 
+charon-systemd {
+  load = curl test-vectors pem pkcs1 gcrypt nonce x509 revocation hmac xcbc ctr ccm gcm vici kernel-netlink socket-default updown
+
+  syslog {
+    daemon {
+      default = 1
+    }
+    auth {
+      default = 0
+    }
+  }
   integrity_test = yes
   crypto_test {
     on_add = yes

testing/tests/gcrypt-ikev2/rw-cert/hosts/carol/etc/swanctl/swanctl.conf

@@ -0,0 +1,27 @@
+connections {
+
+   home {
+      local_addrs  = 192.168.0.100
+      remote_addrs = 192.168.0.1 
+
+      local {
+         auth = pubkey
+         certs = carolCert.pem
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org 
+      }
+      children {
+         home {
+            remote_ts = 10.1.0.0/16 
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = 3des-sha1-modp1536
+         }
+      }
+      version = 2
+      proposals = 3des-sha1-modp1536 
+   }
+}

testing/tests/gcrypt-ikev2/rw-cert/hosts/dave/etc/ipsec.conf

@@ -1,22 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	keyexchange=ikev2
-	ike=aes256-sha512-modp2048!
-	esp=aes256-sha512!
-
-conn home
-	left=PH_IP_DAVE
-	leftcert=daveCert.pem
-	[email protected]
-	leftfirewall=yes
-	right=PH_IP_MOON
-	[email protected]
-	rightsubnet=10.1.0.0/16
-	auto=add

testing/tests/gcrypt-ikev2/rw-cert/hosts/dave/etc/strongswan.conf

@@ -1,8 +1,20 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
-  load = test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc ctr ccm gcm stroke kernel-netlink socket-default updown
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
 
+charon-systemd {
+  load = test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random nonce x509 curl revocation hmac xcbc ctr ccm vici stroke kernel-netlink socket-default updown
+
+  syslog {
+    daemon {
+      default = 1
+    }
+    auth {
+      default = 0
+    }
+  }
   integrity_test = yes
   crypto_test {
     required = yes

testing/tests/gcrypt-ikev2/rw-cert/hosts/dave/etc/swanctl/swanctl.conf

@@ -0,0 +1,27 @@
+connections {
+
+   home {
+      local_addrs  = 192.168.0.200
+      remote_addrs = 192.168.0.1 
+
+      local {
+         auth = pubkey
+         certs = daveCert.pem
+         id = [email protected]
+      }
+      remote {
+         auth = pubkey
+         id = moon.strongswan.org 
+      }
+      children {
+         home {
+            remote_ts = 10.1.0.0/16 
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128-sha256-modp3072
+         }
+      }
+      version = 2
+      proposals = aes128-sha256-modp3072
+   }
+}

testing/tests/gcrypt-ikev2/rw-cert/hosts/moon/etc/ipsec.conf

@@ -1,21 +0,0 @@
-# /etc/ipsec.conf - strongSwan IPsec configuration file
-
-config setup
-
-conn %default
-	ikelifetime=60m
-	keylife=20m
-	rekeymargin=3m
-	keyingtries=1
-	keyexchange=ikev2
-	ike=aes256-sha512-modp2048,3des-sha1-modp1536!
-	esp=aes256-sha512,3des-sha1!
-
-conn rw
-	left=PH_IP_MOON
-	leftcert=moonCert.pem
-	[email protected]
-	leftsubnet=10.1.0.0/16
-	leftfirewall=yes
-	right=%any
-	auto=add

testing/tests/gcrypt-ikev2/rw-cert/hosts/moon/etc/strongswan.conf

@@ -1,8 +1,20 @@
 # /etc/strongswan.conf - strongSwan configuration file
 
-charon {
+swanctl {
-  load = curl test-vectors pem pkcs1 gcrypt nonce x509 revocation hmac xcbc ctr ccm gcm stroke kernel-netlink socket-default updown
+  load = pem pkcs1 x509 revocation constraints pubkey openssl random 
+}
 
+charon-systemd {
+  load = curl test-vectors pem pkcs1 gcrypt nonce x509 revocation hmac xcbc ctr ccm gcm vici kernel-netlink socket-default updown
+
+  syslog {
+    daemon {
+      default = 1
+    }
+    auth {
+      default = 0
+    }
+  }
   integrity_test = yes
   crypto_test {
     on_add = yes

testing/tests/gcrypt-ikev2/rw-cert/hosts/moon/etc/swanctl/swanctl.conf

@@ -0,0 +1,25 @@
+connections {
+
+   rw {
+      local_addrs  = 192.168.0.1
+
+      local {
+         auth = pubkey
+         certs = moonCert.pem
+         id = moon.strongswan.org
+      }
+      remote {
+         auth = pubkey
+      }
+      children {
+         net {
+            local_ts  = 10.1.0.0/16 
+
+            updown = /usr/local/libexec/ipsec/_updown iptables
+            esp_proposals = aes128-sha256-modp3072,3des-sha1-modp1536
+         }
+      }
+      version = 2
+      proposals = aes128-sha256-modp3072,3des-sha1-modp1536 
+   }
+}

testing/tests/gcrypt-ikev2/rw-cert/posttest.dat

@@ -1,6 +1,8 @@
-moon::ipsec stop
+carol::swanctl --terminate --ike home
-carol::ipsec stop
+dave::swanctl --terminate --ike home
-dave::ipsec stop
+carol::systemctl stop strongswan-swanctl
+dave::systemctl stop strongswan-swanctl
+moon::systemctl stop strongswan-swanctl
 moon::iptables-restore < /etc/iptables.flush
 carol::iptables-restore < /etc/iptables.flush
 dave::iptables-restore < /etc/iptables.flush

testing/tests/gcrypt-ikev2/rw-cert/pretest.dat

@@ -1,11 +1,11 @@
 moon::iptables-restore < /etc/iptables.rules
 carol::iptables-restore < /etc/iptables.rules
 dave::iptables-restore < /etc/iptables.rules
-moon::ipsec start
+moon::systemctl start strongswan-swanctl
-carol::ipsec start
+carol::systemctl start strongswan-swanctl
-dave::ipsec start
+dave::systemctl start strongswan-swanctl
-moon::expect-connection rw
+moon::expect-connection net 
 carol::expect-connection home 
+carol::swanctl --initiate --child home 2> /dev/null
 dave::expect-connection home
-carol::ipsec up home
+dave::swanctl --initiate --child home 2> /dev/null
-dave::ipsec up home

testing/tests/gcrypt-ikev2/rw-cert/test.conf

@@ -19,3 +19,7 @@ TCPDUMPHOSTS="moon"
 # Used for IPsec logging purposes
 #
 IPSECHOSTS="moon carol dave"
+
+# charon controlled by swanctl
+#
+SWANCTL=1

testing/tests/ipv6-stroke/host2host-ikev1/description.txt

@@ -0,0 +1,5 @@
+An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
+The authentication is based on X.509 certificates. Upon the successful establishment of
+the IPsec tunnel, <b>leftfirewall=yes</b> automatically inserts ip6tables-based firewall
+rules that let pass the tunneled traffic. In order to test both the host-to-host tunnel
+and the firewall rules, <b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command.

testing/tests/ipv6-stroke/host2host-ikev1/evaltest.dat

@@ -0,0 +1,7 @@
+moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
+sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
+moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES

testing/tests/ipv6-stroke/host2host-ikev1/hosts/moon/etc/strongswan.conf

@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+   load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+}

testing/tests/ipv6-stroke/host2host-ikev1/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+}

testing/tests/ipv6-stroke/host2host-ikev1/posttest.dat

@@ -0,0 +1,6 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush

testing/tests/ipv6-stroke/host2host-ikev1/pretest.dat

@@ -0,0 +1,9 @@
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
+moon::ipsec start
+sun::ipsec start
+moon::expect-connection host-host
+sun::expect-connection host-host
+moon::ipsec up host-host

testing/tests/ipv6-stroke/host2host-ikev1/test.conf

@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="moon winnetou sun"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s-ip6.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# IP protocol used by IPsec is IPv6
+#
+IPV6=1

testing/tests/ipv6-stroke/host2host-ikev2/description.txt

@@ -0,0 +1,5 @@
+An IPv6 ESP connection between the hosts <b>moon</b> and <b>sun</b> is successfully set up.
+The authentication is based on X.509 certificates. Upon the successful establishment of
+the IPsec tunnel, <b>leftfirewall=yes</b> automatically inserts ip6tables-based firewall
+rules that let pass the tunneled traffic. In order to test both the host-to-host tunnel
+and the firewall rules, <b>moon</b> sends an IPv6 ICMP request to <b>sun</b> using the ping6 command.

testing/tests/ipv6-stroke/host2host-ikev2/evaltest.dat

@@ -0,0 +1,7 @@
+moon::ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon::ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
+sun:: ipsec status 2> /dev/null::host-host.*INSTALLED, TUNNEL::YES
+moon::ping6 -c 1 -p deadbeef ip6-sun.strongswan.org::64 bytes from ip6-sun.strongswan.org: icmp_seq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES

testing/tests/ipv6-stroke/host2host-ikev2/hosts/moon/etc/strongswan.conf

@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+}

testing/tests/ipv6-stroke/host2host-ikev2/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,5 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+}

testing/tests/ipv6-stroke/host2host-ikev2/posttest.dat

@@ -0,0 +1,6 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush

testing/tests/ipv6-stroke/host2host-ikev2/pretest.dat

@@ -0,0 +1,9 @@
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
+moon::ipsec start
+sun::ipsec start
+moon::expect-connection host-host
+sun::expect-connection host-host
+moon::ipsec up host-host

testing/tests/ipv6-stroke/host2host-ikev2/test.conf

@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="moon winnetou sun"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="m-w-s-ip6.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# IP protocol used by IPsec is IPv6
+#
+IPV6=1

testing/tests/ipv6-stroke/net2net-ikev1/description.txt

@@ -0,0 +1,6 @@
+An IPv6 ESP tunnel connection between the gateways <b>moon</b> and <b>sun</b> is successfully set up.
+It connects the two subnets hiding behind their respective gateways. The authentication is based on
+X.509 certificates. Upon the successful establishment of the IPsec tunnel, <b>leftfirewall=yes</b>
+automatically inserts ip6tables-based firewall rules that let pass the tunneled traffic.
+In order to test both the net-to-net tunnel and the firewall rules, client <b>alice</b> behind <b>moon</b>
+sends an IPv6 ICMP request to client <b>bob</b> behind <b>sun</b> using the ping6 command.

testing/tests/ipv6-stroke/net2net-ikev1/evaltest.dat

@@ -0,0 +1,7 @@
+moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun::  ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
+sun::  ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES
+alice::ping6 -c 1 -p deadbeef ip6-bob.strongswan.org::64 bytes from ip6-bob.strongswan.org: icmp_seq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES

testing/tests/ipv6-stroke/net2net-ikev1/hosts/moon/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}

testing/tests/ipv6-stroke/net2net-ikev1/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}

testing/tests/ipv6-stroke/net2net-ikev1/posttest.dat

@@ -0,0 +1,10 @@
+moon::ipsec stop
+sun::ipsec stop
+alice::"ip route del fec2:\:/16 via fec1:\:1"
+moon::"ip route del fec2:\:/16 via fec0:\:2"
+sun::"ip route del fec1:\:/16 via fec0:\:1"
+bob::"ip route del fec1:\:/16 via fec2:\:1"
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush

testing/tests/ipv6-stroke/net2net-ikev1/pretest.dat

@@ -0,0 +1,13 @@
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
+alice::"ip route add fec2:\:/16 via fec1:\:1"
+moon::"ip route add fec2:\:/16 via fec0:\:2"
+sun::"ip route add fec1:\:/16 via fec0:\:1"
+bob::"ip route add fec1:\:/16 via fec2:\:1"
+moon::ipsec start
+sun::ipsec start
+moon::expect-connection net-net
+sun::expect-connection net-net
+moon::ipsec up net-net

testing/tests/ipv6-stroke/net2net-ikev1/test.conf

@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="alice moon winnetou sun bob"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b-ip6.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# IP protocol used by IPsec is IPv6
+#
+IPV6=1

testing/tests/ipv6-stroke/net2net-ikev2/description.txt

@@ -0,0 +1,6 @@
+An IPv6 ESP tunnel connection between the gateways <b>moon</b> and <b>sun</b> is successfully set up.
+It connects the two subnets hiding behind their respective gateways. The authentication is based on
+X.509 certificates. Upon the successful establishment of the IPsec tunnel, <b>leftfirewall=yes</b>
+automatically inserts ip6tables-based firewall rules that let pass the tunneled traffic.
+In order to test both the net-to-net tunnel and the firewall rules, client <b>alice</b> behind <b>moon</b>
+sends an IPv6 ICMP request to client <b>bob</b> behind <b>sun</b> using the ping6 command.

testing/tests/ipv6-stroke/net2net-ikev2/evaltest.dat

@@ -0,0 +1,7 @@
+moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun::  ipsec status 2> /dev/null::net-net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
+sun::  ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES
+alice::ping6 -c 1 -p deadbeef ip6-bob.strongswan.org::64 bytes from ip6-bob.strongswan.org: icmp_seq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES

testing/tests/ipv6-stroke/net2net-ikev2/hosts/moon/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}

testing/tests/ipv6-stroke/net2net-ikev2/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}

testing/tests/ipv6-stroke/net2net-ikev2/posttest.dat

@@ -0,0 +1,10 @@
+moon::ipsec stop
+sun::ipsec stop
+alice::"ip route del fec2:\:/16 via fec1:\:1"
+moon::"ip route del fec2:\:/16 via fec0:\:2"
+sun::"ip route del fec1:\:/16 via fec0:\:1"
+bob::"ip route del fec1:\:/16 via fec2:\:1"
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush

testing/tests/ipv6-stroke/net2net-ikev2/pretest.dat

@@ -0,0 +1,13 @@
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
+alice::"ip route add fec2:\:/16 via fec1:\:1"
+moon::"ip route add fec2:\:/16 via fec0:\:2"
+sun::"ip route add fec1:\:/16 via fec0:\:1"
+bob::"ip route add fec1:\:/16 via fec2:\:1"
+moon::ipsec start
+sun::ipsec start
+moon::expect-connection net-net
+sun::expect-connection net-net
+moon::ipsec up net-net

testing/tests/ipv6-stroke/net2net-ikev2/test.conf

@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="alice moon winnetou sun bob"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b-ip6.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# IP protocol used by IPsec is IPv6
+#
+IPV6=1

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev1/description.txt

@@ -0,0 +1,4 @@
+An IPv6 ESP tunnel connection between the gateways <b>moon</b> and <b>sun</b> is successfully set up.
+It connects the two IPv4 subnets hiding behind their respective gateways. The authentication is based on
+X.509 certificates. In order to test the IPv4-over-IPv6 ESP tunnel, client <b>alice</b> behind <b>moon</b>
+sends an IPv4 ICMP request to client <b>bob</b> behind <b>sun</b> using the ping command.

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev1/evaltest.dat

@@ -0,0 +1,7 @@
+moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun::  ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
+sun::  ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev1/hosts/moon/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev1/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev1/posttest.dat

@@ -0,0 +1,6 @@
+moon::ipsec stop
+sun::ipsec stop
+moon::iptables-restore < /etc/iptables.flush
+sun::iptables-restore < /etc/iptables.flush
+moon::ip6tables-restore < /etc/ip6tables.flush
+sun::ip6tables-restore < /etc/ip6tables.flush

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev1/pretest.dat

@@ -0,0 +1,9 @@
+moon::iptables-restore < /etc/iptables.drop
+sun::iptables-restore < /etc/iptables.drop
+moon::ip6tables-restore < /etc/ip6tables.rules
+sun::ip6tables-restore < /etc/ip6tables.rules
+moon::ipsec start
+sun::ipsec start
+moon::expect-connection net-net
+sun::expect-connection net-net
+moon::ipsec up net-net

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev1/test.conf

@@ -0,0 +1,25 @@
+#!/bin/bash
+#
+# This configuration file provides information on the
+# guest instances used for this test
+
+# All guest instances that are required for this test
+#
+VIRTHOSTS="alice moon winnetou sun bob"
+ 
+# Corresponding block diagram
+#
+DIAGRAM="a-m-w-s-b-ip4-in-ip6.png"
+
+# Guest instances on which tcpdump is to be started
+#
+TCPDUMPHOSTS="sun"
+
+# Guest instances on which IPsec is started
+# Used for IPsec logging purposes
+#
+IPSECHOSTS="moon sun"
+
+# IP protocol used by IPsec is IPv6
+#
+IPV6=1

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev2/description.txt

@@ -0,0 +1,4 @@
+An IPv6 ESP tunnel connection between the gateways <b>moon</b> and <b>sun</b> is successfully set up.
+It connects the two IPv4 subnets hiding behind their respective gateways. The authentication is based on
+X.509 certificates. In order to test the IPv4-over-IPv6 ESP tunnel, client <b>alice</b> behind <b>moon</b>
+sends an IPv4 ICMP request to client <b>bob</b> behind <b>sun</b> using the ping command.

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev2/evaltest.dat

@@ -0,0 +1,7 @@
+moon:: ipsec status 2> /dev/null::net-net.*ESTABLISHED.*moon.strongswan.org.*sun.strongswan.org::YES
+sun::  ipsec status 2> /dev/null::net.net.*ESTABLISHED.*sun.strongswan.org.*moon.strongswan.org::YES
+moon:: ipsec status 2> /dev/null::net-net.*INSTALLED, TUNNEL::YES
+sun::  ipsec status 2> /dev/null::net.net.*INSTALLED, TUNNEL::YES
+alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
+sun::tcpdump::IP6 ip6-moon.strongswan.org > ip6-sun.strongswan.org: ESP::YES
+sun::tcpdump::IP6 ip6-sun.strongswan.org > ip6-moon.strongswan.org: ESP::YES

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev2/hosts/moon/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}

testing/tests/ipv6-stroke/net2net-ip4-in-ip6-ikev2/hosts/sun/etc/strongswan.conf

@@ -0,0 +1,7 @@
+# /etc/strongswan.conf - strongSwan configuration file
+
+charon {
+  load = random nonce aes sha1 sha2 pem pkcs1 curve25519 gmp x509 curl revocation hmac stroke kernel-netlink socket-default updown
+
+  fragment_size = 1400
+}