PRE-TEST

moon# iptables-restore < /etc/iptables.rules

carol# iptables-restore < /etc/iptables.rules

carol# iptables-restore < /etc/iptables.rules

carol# cd /etc/swanctl; rm rsa/* x509/*

dave# cd /etc/swanctl; rm rsa/* x509/*

alice# freeradius

moon# systemctl start strongswan

carol# systemctl start strongswan

dave# systemctl start strongswan

moon# expect-connection rw-eap

carol# expect-connection home

carol# swanctl --initiate --child home 2> /dev/null
[IKE] initiating IKE_SA home[1] to 192.168.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from 192.168.0.100[500] to 192.168.0.1[500] (240 bytes)
[NET] received packet: from 192.168.0.1[500] to 192.168.0.100[500] (248 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/CURVE_25519
[IKE] sending cert request for "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG] no IDi configured, default to IP address 192.168.0.100
[IKE] establishing CHILD_SA home{1}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr CPRQ(ADDR) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (304 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (1236 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (516 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1680 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
[IKE] received end entity cert "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
[CFG]   using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
[CFG]   using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
[CFG]   fetching crl from 'http://crl.strongswan.org/strongswan.crl' ...
[CFG]   using trusted certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG]   crl correctly signed by "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG]   crl is valid: until Mar 25 18:47:43 2025
[CFG] certificate status is good
[IKE] authentication of 'moon.strongswan.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_IDENTITY (id 0x00), sending 'carol'
[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
[NET] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (80 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (96 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/MD5 ]
[IKE] server requested EAP_MD5 authentication (id 0x01)
[ENC] generating IKE_AUTH request 3 [ EAP/RES/MD5 ]
[NET] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (96 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (80 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/SUCC ]
[IKE] EAP method EAP_MD5 succeeded, no MSK established
[IKE] authentication of '192.168.0.100' (myself) with EAP
[ENC] generating IKE_AUTH request 4 [ AUTH ]
[NET] sending packet: from 192.168.0.100[4500] to 192.168.0.1[4500] (112 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.100[4500] (288 bytes)
[ENC] parsed IKE_AUTH response 4 [ AUTH CPRP(ADDR) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) ]
[IKE] authentication of 'moon.strongswan.org' with EAP successful
[IKE] installing new virtual IP 10.3.0.1
[IKE] peer supports MOBIKE
[IKE] IKE_SA home[1] established between 192.168.0.100[192.168.0.100]...192.168.0.1[moon.strongswan.org]
[IKE] scheduling rekeying in 14195s
[IKE] maximum IKE_SA lifetime 15635s
[CFG] selected proposal: ESP:AES_GCM_16_128/NO_EXT_SEQ
[IKE] CHILD_SA home{1} established with SPIs c9bc0195_i ca7ab435_o and TS 10.3.0.1/32 === 10.1.0.0/16
initiate completed successfully

dave# expect-connection home

dave# swanctl --initiate --child home 2> /dev/null
[IKE] initiating IKE_SA home[1] to 192.168.0.1
[ENC] generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
[NET] sending packet: from 192.168.0.200[500] to 192.168.0.1[500] (240 bytes)
[NET] received packet: from 192.168.0.1[500] to 192.168.0.200[500] (248 bytes)
[ENC] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/CURVE_25519
[IKE] sending cert request for "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG] no IDi configured, default to IP address 192.168.0.200
[IKE] establishing CHILD_SA home{1}
[ENC] generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr CPRQ(ADDR) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
[NET] sending packet: from 192.168.0.200[4500] to 192.168.0.1[4500] (304 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.200[4500] (1236 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(1/2) ]
[ENC] received fragment #1 of 2, waiting for complete IKE message
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.200[4500] (516 bytes)
[ENC] parsed IKE_AUTH response 1 [ EF(2/2) ]
[ENC] received fragment #2 of 2, reassembled fragmented IKE message (1680 bytes)
[ENC] parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
[IKE] received end entity cert "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
[CFG]   using certificate "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
[CFG]   using trusted ca certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG]   reached self-signed root ca with a path length of 0
[CFG] checking certificate status of "C=CH, O=strongSwan Project, CN=moon.strongswan.org"
[CFG]   fetching crl from 'http://crl.strongswan.org/strongswan.crl' ...
[CFG]   using trusted certificate "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG]   crl correctly signed by "C=CH, O=strongSwan Project, CN=strongSwan Root CA"
[CFG]   crl is valid: until Mar 25 18:47:43 2025
[CFG] certificate status is good
[IKE] authentication of 'moon.strongswan.org' with RSA_EMSA_PKCS1_SHA2_256 successful
[IKE] server requested EAP_IDENTITY (id 0x00), sending 'dave'
[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]
[NET] sending packet: from 192.168.0.200[4500] to 192.168.0.1[4500] (80 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.200[4500] (96 bytes)
[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/MD5 ]
[IKE] server requested EAP_MD5 authentication (id 0x01)
[ENC] generating IKE_AUTH request 3 [ EAP/RES/MD5 ]
[NET] sending packet: from 192.168.0.200[4500] to 192.168.0.1[4500] (96 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.200[4500] (80 bytes)
[ENC] parsed IKE_AUTH response 3 [ EAP/SUCC ]
[IKE] EAP method EAP_MD5 succeeded, no MSK established
[IKE] authentication of '192.168.0.200' (myself) with EAP
[ENC] generating IKE_AUTH request 4 [ AUTH ]
[NET] sending packet: from 192.168.0.200[4500] to 192.168.0.1[4500] (112 bytes)
[NET] received packet: from 192.168.0.1[4500] to 192.168.0.200[4500] (288 bytes)
[ENC] parsed IKE_AUTH response 4 [ AUTH CPRP(ADDR) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) ]
[IKE] authentication of 'moon.strongswan.org' with EAP successful
[IKE] installing new virtual IP 10.3.0.2
[IKE] peer supports MOBIKE
[IKE] IKE_SA home[1] established between 192.168.0.200[192.168.0.200]...192.168.0.1[moon.strongswan.org]
[IKE] scheduling rekeying in 13274s
[IKE] maximum IKE_SA lifetime 14714s
[CFG] selected proposal: ESP:AES_GCM_16_128/NO_EXT_SEQ
[IKE] CHILD_SA home{1} established with SPIs cf72db83_i cfc69a4e_o and TS 10.3.0.2/32 === 10.1.0.0/16
initiate completed successfully


TEST

carol# swanctl --list-sas --raw 2> /dev/null | grep 'home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=192.168.0.100 remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.3.0.1] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.1/32] remote-ts=\[10.1.0.0/16]' [YES]
list-sa event {home {uniqueid=1 version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=192.168.0.100 remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes initiator-spi=9752d3ca1a9940d4 responder-spi=3ddad966bacd980c encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 established=1 rekey-time=14194 local-vips=[10.3.0.1] child-sas {home-1 {name=home uniqueid=1 reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP spi-in=c9bc0195 spi-out=ca7ab435 encr-alg=AES_GCM_16 encr-keysize=128 bytes-in=0 packets-in=0 bytes-out=0 packets-out=0 rekey-time=3344 life-time=3959 install-time=1 local-ts=[10.3.0.1/32] remote-ts=[10.1.0.0/16]}}}}

dave# swanctl --list-sas --raw 2> /dev/null | grep 'home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=192.168.0.200 remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*local-vips=\[10.3.0.2] child-sas.*home.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.3.0.2/32] remote-ts=\[10.1.0.0/16]' [YES]
list-sa event {home {uniqueid=1 version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=192.168.0.200 remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes initiator-spi=7dbe741fc42ee167 responder-spi=293c1dc455b0feb1 encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 established=1 rekey-time=13273 local-vips=[10.3.0.2] child-sas {home-1 {name=home uniqueid=1 reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP spi-in=cf72db83 spi-out=cfc69a4e encr-alg=AES_GCM_16 encr-keysize=128 bytes-in=0 packets-in=0 bytes-out=0 packets-out=0 rekey-time=3351 life-time=3960 install-time=1 local-ts=[10.3.0.2/32] remote-ts=[10.1.0.0/16]}}}}

moon# swanctl --list-sas --ike-id 1 --raw 2> /dev/null | grep 'rw-eap.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=192.168.0.100.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.3.0.1] child-sas.*net.*reqid=1 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.1/32]' [YES]
list-sa event {rw-eap {uniqueid=1 version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=192.168.0.100 remote-eap-id=carol initiator-spi=9752d3ca1a9940d4 responder-spi=3ddad966bacd980c encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 established=1 rekey-time=13295 remote-vips=[10.3.0.1] child-sas {net-1 {name=net uniqueid=1 reqid=1 state=INSTALLED mode=TUNNEL protocol=ESP spi-in=ca7ab435 spi-out=c9bc0195 encr-alg=AES_GCM_16 encr-keysize=128 bytes-in=0 packets-in=0 bytes-out=0 packets-out=0 rekey-time=3279 life-time=3959 install-time=1 local-ts=[10.1.0.0/16] remote-ts=[10.3.0.1/32]}}}}

moon# swanctl --list-sas --ike-id 2 --raw 2> /dev/null | grep 'rw-eap.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=192.168.0.200.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*remote-vips=\[10.3.0.2] child-sas.*net.*reqid=2 state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.3.0.2/32]' [YES]
list-sa event {rw-eap {uniqueid=2 version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=192.168.0.200 remote-eap-id=dave initiator-spi=7dbe741fc42ee167 responder-spi=293c1dc455b0feb1 encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519 established=1 rekey-time=13984 remote-vips=[10.3.0.2] child-sas {net-2 {name=net uniqueid=2 reqid=2 state=INSTALLED mode=TUNNEL protocol=ESP spi-in=cfc69a4e spi-out=cf72db83 encr-alg=AES_GCM_16 encr-keysize=128 bytes-in=0 packets-in=0 bytes-out=0 packets-out=0 rekey-time=3322 life-time=3959 install-time=1 local-ts=[10.1.0.0/16] remote-ts=[10.3.0.2/32]}}}}

carol# cat /var/log/daemon.log | grep 'authentication of .*moon.strongswan.org.* with RSA.* successful' [YES]
Mar 10 19:24:43 carol charon-systemd: 01[IKE] authentication of 'moon.strongswan.org' with RSA_EMSA_PKCS1_SHA2_256 successful

moon # cat /var/log/daemon.log | grep 'received EAP identity .*carol' [YES]
Mar 10 19:24:42 moon charon-systemd: 09[IKE] received EAP identity 'carol'

carol# cat /var/log/daemon.log | grep 'server requested EAP_MD5 authentication' [YES]
Mar 10 19:24:43 carol charon-systemd: 03[IKE] server requested EAP_MD5 authentication (id 0x01)

carol# cat /var/log/daemon.log | grep 'authentication of .*moon.strongswan.org.* with EAP successful' [YES]
Mar 10 19:24:43 carol charon-systemd: 14[IKE] authentication of 'moon.strongswan.org' with EAP successful

moon # cat /var/log/daemon.log | grep 'authentication of .*192.168.0.100.* with EAP successful' [YES]
Mar 10 19:24:42 moon charon-systemd: 05[IKE] authentication of '192.168.0.100' with EAP successful

carol# cat /var/log/daemon.log | grep 'installing new virtual IP 10.3.0.1' [YES]
Mar 10 19:24:43 carol charon-systemd: 14[IKE] installing new virtual IP 10.3.0.1

dave # cat /var/log/daemon.log | grep 'authentication of .*moon.strongswan.org.* with RSA.* successful' [YES]
Mar 10 19:24:43 dave charon-systemd: 15[IKE] authentication of 'moon.strongswan.org' with RSA_EMSA_PKCS1_SHA2_256 successful

moon # cat /var/log/daemon.log | grep 'received EAP identity .*dave' [YES]
Mar 10 19:24:43 moon charon-systemd: 06[IKE] received EAP identity 'dave'

dave # cat /var/log/daemon.log | grep 'server requested EAP_MD5 authentication' [YES]
Mar 10 19:24:43 dave charon-systemd: 04[IKE] server requested EAP_MD5 authentication (id 0x01)

dave # cat /var/log/daemon.log | grep 'authentication of .*moon.strongswan.org.* with EAP successful' [YES]
Mar 10 19:24:43 dave charon-systemd: 07[IKE] authentication of 'moon.strongswan.org' with EAP successful

moon # cat /var/log/daemon.log | grep 'authentication of .*192.168.0.200.* with EAP successful' [YES]
Mar 10 19:24:43 moon charon-systemd: 03[IKE] authentication of '192.168.0.200' with EAP successful

dave # cat /var/log/daemon.log | grep 'installing new virtual IP 10.3.0.2' [YES]
Mar 10 19:24:43 dave charon-systemd: 07[IKE] installing new virtual IP 10.3.0.2

carol# ping -c 1 10.1.0.10 | grep '64 bytes from 10.1.0.10: icmp_.eq=1' [YES]
64 bytes from 10.1.0.10: icmp_seq=1 ttl=63 time=1.08 ms

dave# ping -c 1 10.1.0.10 | grep '64 bytes from 10.1.0.10: icmp_.eq=1' [YES]
64 bytes from 10.1.0.10: icmp_seq=1 ttl=63 time=1.03 ms

moon# killall tcpdump

moon# cat /tmp/tcpdump.log | grep 'IP carol.strongswan.org > moon.strongswan.org: ESP' [YES]
19:24:44.783080 IP carol.strongswan.org > moon.strongswan.org: ESP(spi=0xca7ab435,seq=0x1), length 120

moon# cat /tmp/tcpdump.log | grep 'IP moon.strongswan.org > carol.strongswan.org: ESP' [YES]
19:24:44.783680 IP moon.strongswan.org > carol.strongswan.org: ESP(spi=0xc9bc0195,seq=0x1), length 120

moon# cat /tmp/tcpdump.log | grep 'IP dave.strongswan.org > moon.strongswan.org: ESP' [YES]
19:24:44.812575 IP dave.strongswan.org > moon.strongswan.org: ESP(spi=0xcfc69a4e,seq=0x1), length 120

moon# cat /tmp/tcpdump.log | grep 'IP moon.strongswan.org > dave.strongswan.org: ESP' [YES]
19:24:44.813124 IP moon.strongswan.org > dave.strongswan.org: ESP(spi=0xcf72db83,seq=0x1), length 120


POST-TEST

carol# systemctl stop strongswan

dave# systemctl stop strongswan

moon# systemctl stop strongswan

alice# killall freeradius

moon# iptables-restore < /etc/iptables.flush

carol# iptables-restore < /etc/iptables.flush

dave# iptables-restore < /etc/iptables.flush