/testing/guestbin/prep.sh
ipsec.conf -> /etc/ipsec.conf
east #
 ipsec initnss
Initializing NSS database
east #
 /testing/x509/import.sh real/mainca/east.p12
 ipsec pk12util -w nss-pw -i real/mainca/east.p12
pk12util: PKCS12 IMPORT SUCCESSFUL
 ipsec certutil -M -n mainca -t CT,,
 ipsec certutil -O -n east
"mainca" [E=testing@libreswan.org,CN=Libreswan test CA for mainca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA]
  "east" [E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA]
east #
 /testing/x509/import.sh real/mainca/north.end.cert
 ipsec certutil -A -n north -t P,, -i real/mainca/north.end.cert
 ipsec certutil -O -n north
"mainca" [E=testing@libreswan.org,CN=Libreswan test CA for mainca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA]
  "north" [E=user-north@testing.libreswan.org,CN=north.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA]
east #
 /testing/x509/import.sh real/mainca/road.end.cert
 ipsec certutil -A -n road -t P,, -i real/mainca/road.end.cert
 ipsec certutil -O -n road
"mainca" [E=testing@libreswan.org,CN=Libreswan test CA for mainca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA]
  "road" [E=user-road@testing.libreswan.org,CN=road.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA]
east #
 ipsec start
Redirecting to: [initsystem]
 * Starting ipsec ... [ ok ]
east #
 ../../guestbin/wait-until-pluto-started
east #
 ipsec add l2tp-north-to-east-on-east
"l2tp-north-to-east-on-east": added oriented IKEv1 connection
east #
 ipsec add l2tp-distraction-on-east
"l2tp-distraction-on-east": added oriented IKEv1 connection
east #
 # ensure that clear text does not get through
east #
 iptables -A INPUT  -i eth1 -d 192.1.2.23 -m policy --dir in --pol none -p udp --dport 1701 -j REJECT
east #
 iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
east #
 iptables -A OUTPUT -o eth1 -s 192.1.2.23 -m policy --dir out --pol none -p udp --sport 1701 -j REJECT
east #
 iptables -A OUTPUT -m policy --dir out --pol ipsec -j ACCEPT
east #
 ../../guestbin/l2tpd.sh
'east.xl2tpd.conf' -> '/etc/xl2tpd/xl2tpd.conf'
'chap-secrets' -> '/etc/ppp/chap-secrets'
'east.ppp-options.xl2tpd' -> '/etc/ppp/options.xl2tpd'
east #
 ../../guestbin/echo-server.sh -tcp -4 7 -daemon
listening on IPv4 TCP port 7
east #
 echo done
done
east #
 ipsec _kernel state
src 192.1.2.23 dst 192.1.3.33
	proto esp spi 0xSPISPI reqid REQID mode transport
	replay-window 0 
	auth-trunc hmac(sha1) 0xHASHKEY 96
	enc cbc(aes) 0xENCKEY
	lastused YYYY-MM-DD HH:MM:SS
	dir out
	sel src 192.1.2.23/32 dst 192.1.3.33/32 proto udp sport 1701 dport 1701 
src 192.1.3.33 dst 192.1.2.23
	proto esp spi 0xSPISPI reqid REQID mode transport
	replay-window 0 
	auth-trunc hmac(sha1) 0xHASHKEY 96
	enc cbc(aes) 0xENCKEY
	lastused YYYY-MM-DD HH:MM:SS
	anti-replay esn context:
	 seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
	 replay_window 128, bitmap-length 4
	 00000000 00000000 00000000 XXXXXXXX 
	dir in
	sel src 192.1.3.33/32 dst 192.1.2.23/32 proto udp sport 1701 dport 1701 
east #
 ipsec _kernel policy
src 192.1.2.23/32 dst 192.1.3.33/32 proto udp sport 1701 dport 1701
	dir out priority PRIORITY ptype main
	tmpl src 0.0.0.0 dst 0.0.0.0
		proto esp reqid REQID mode transport
src 192.1.3.33/32 dst 192.1.2.23/32 proto udp sport 1701 dport 1701
	dir in priority PRIORITY ptype main
	tmpl src 0.0.0.0 dst 0.0.0.0
		proto esp reqid REQID mode transport
src ::/0 dst ::/0 proto ipv6-icmp type 135
	dir fwd priority PRIORITY ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
	dir in priority PRIORITY ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 135
	dir out priority PRIORITY ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
	dir fwd priority PRIORITY ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
	dir in priority PRIORITY ptype main
src ::/0 dst ::/0 proto ipv6-icmp type 136
	dir out priority PRIORITY ptype main
east #
 grep 'Result using RFC 3947' /tmp/pluto.log
| NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: no NAT detected
east #
